Timeline for Poor error handling source code review
Current License: CC BY-SA 4.0
25 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 21, 2020 at 3:01 | history | tweeted | twitter.com/StackSecurity/status/1219454823743008768 | ||
| Jan 20, 2020 at 6:32 | comment | added | hax | @Graham Typically developers may not have access to those tools. I don't disagree with the fact that it is lazy coding. But more seriously this is lazy auditing. | |
| Jan 19, 2020 at 18:56 | answer | added | sdenham | timeline score: 0 | |
| Jan 19, 2020 at 18:40 | comment | added | Graham | @hax If these warnings seem to have come from an automated tool, they're the hallmark of a coder who is too slipshod or lazy to run the same tool themselves. As such, their code absolutely should be pushed back to get them to get their act together. | |
| Jan 19, 2020 at 8:50 | comment | added | Mast | These are results that warrant a closer look, but aren't necessarily security issues. If this is what you get back from an audit, it was a lousy audit. They should've dug deeper or not mention it at all. | |
| Jan 17, 2020 at 23:34 | comment | added | Hot Licks | The empty catch block could be exploited by taking advantage of it to allow bogus data to be fed into the system. | |
| Jan 17, 2020 at 22:42 | answer | added | Script Kid | timeline score: 6 | |
| Jan 17, 2020 at 11:47 | comment | added | Criticizing Israel not allowed |
@Bass It depends on the specific case probably. If somefile.java line 33 is something like i = -1; try {i = Integer.parseInt(str);} catch(NumberFormatException ex) {} then it's probably acceptable (though you can put i = -1; in the catch block to slightly enhance readability). (And it shouldn't all be on one line of course :)
|
|
| Jan 17, 2020 at 5:47 | comment | added | PaulHK | I'd argue that in some cases faulty error handling leads to unexpected behaviour, which can then lead security issues. | |
| Jan 17, 2020 at 3:34 | comment | added | Christopher Schultz | Most security issues stem directly from code-quality issues. Sorry, no citation :/ | |
| Jan 17, 2020 at 1:49 | comment | added | Bass | These are not directly security issues. These are serious code quality issues that prevent stupid security issues from getting noticed in time. Stupid, as in "Yeah, we had guarded against that CSRF attack, and our code noticed that a token was missing, but the exception got caught and ignored, so the attack got through, and that's why the President is now registered as a sex offender." | |
| Jan 16, 2020 at 20:56 | answer | added | Rich Moss | timeline score: 6 | |
| Jan 16, 2020 at 20:50 | history | edited | Anders | CC BY-SA 4.0 |
deleted 23 characters in body; edited tags
|
| Jan 16, 2020 at 19:36 | history | became hot network question | |||
| Jan 16, 2020 at 15:48 | comment | added | hax | @useradmin1234 The justifications you are given are straight out of Fortify results. This sounds more like lazy code review job to me. What's the risk rating they have given for this. (Perhaps I am shooting my own foot with this advice) You should ask them to clarify the security impact of vulnerability in terms of Confidentiality, Integrity and Availability or any such security properties. | |
| Jan 16, 2020 at 15:33 | answer | added | Winnnn | timeline score: 2 | |
| Jan 16, 2020 at 14:15 | review | Close votes | |||
| Jan 18, 2020 at 23:51 | |||||
| Jan 16, 2020 at 14:11 | answer | added | Anders | timeline score: 49 | |
| Jan 16, 2020 at 13:04 | answer | added | hax | timeline score: 11 | |
| Jan 16, 2020 at 12:32 | comment | added | schroeder♦ | But, as you say, those aren't security concerns (else why are you asking here, right?) | |
| Jan 16, 2020 at 12:22 | comment | added | useradmin1234 | @schroeder, Given justification are already mentioned in my question. | |
| Jan 16, 2020 at 12:13 | comment | added | schroeder♦ | If this is from your security team, why not ask them? They are either running a tool they do not understand or they have specific goals and requirements that these findings relate to. Either way, it sounds like a misalignment in expectations somewhere. | |
| Jan 16, 2020 at 11:50 | history | edited | useradmin1234 | CC BY-SA 4.0 |
deleted 487 characters in body
|
| Jan 16, 2020 at 11:39 | history | edited | Anders | CC BY-SA 4.0 |
deleted 53 characters in body; edited tags; edited title
|
| Jan 16, 2020 at 11:35 | history | asked | useradmin1234 | CC BY-SA 4.0 |