CWE-705: Incorrect Control Flow Scoping

Description

The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

Potential Impact

Demonstrative Examples

protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {String ip = req.getRemoteAddr();InetAddress addr = InetAddress.getByName(ip);...out.println("hello " + addr.getHostName());}

$requestingIP = $_SERVER['REMOTE_ADDR'];if(!in_array($requestingIP,$ipAllowList)){echo "You are not authorized to view this page";http_redirect($errorPageURL);}$status = getServerStatus();echo $status;
                     ...

Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {try {...} catch (ApplicationSpecificException ase) {logger.error("Caught: " + ase.toString());System.exit(1);}}

Detection Methods

• Automated Static Analysis — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Related Weaknesses

Taxonomy Mappings

• CERT C Secure Coding: ENV32-C — All exit handlers must return normally
• CERT C Secure Coding: ERR04-C — Choose an appropriate termination strategy
• The CERT Oracle Secure Coding Standard for Java (2011): THI05-J — Do not use Thread.stop() to terminate threads
• The CERT Oracle Secure Coding Standard for Java (2011): ERR04-J — Do not complete abruptly from a finally block
• The CERT Oracle Secure Coding Standard for Java (2011): ERR05-J — Do not let checked exceptions escape from a finally block
• SEI CERT Perl Coding Standard: EXP31-PL — Do not suppress or ignore exceptions