CWE-1071: Empty Code Block

How it's found

Empty Code Block is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.

Empty code blocks can occur in the bodies of conditionals, function or method definitions, exception handlers, etc. While an empty code block might be intentional, it might also indicate incomplete implementation, accidental code deletion, unexpected macro expansion, etc. For some programming languages and constructs, an empty block might be allowed by the syntax, but the lack of any behavior within the block might violate a convention or API in such a way that it is an error.

Vulnerable vs. safe

c = a / b;int a = 1;int b = 0;int c = 0;try {} catch(ArithmeticException ae) {}
public static void main(String[] args) {}public class Main {}

c = a / b;

log.error("Divided by zero detected, setting to -1.");c = -1;int a = 1;int b = 0;int c = 0;try {} catch(ArithmeticException ae) {}
public static void main(String[] args) {}public class Main {}

Consequences

• Reduce Reliability

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Class weakness
  CWE-1164: Irrelevant Code