Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Opening Use opening and closing braces for if, for, or and while statements should always be used, even if when the statement's body contains only a single statement. Braces improve the uniformity and readability of code.

More importantly, when inserting an additional statement important, it is easy to forget to add braces when inserting additional statements into a body containing only a single statement, it is easy to forget to add braces because the conventional indentation gives strong (but misleading) guidance to the structure.

Noncompliant Code Example

This noncompliant code example uses authenticates a user with an if statement without braces to authenticate the user.that lacks braces:

Code Block
bgColor#ffcccc

int login;

if (invalid_login())
  login = 0;
else
  login = 1;

A This program behaves as expected. However, a maintainer might subsequently add a debug statement or other logic but forget to add opening and closing braces.:

Code Block
bgColor#ffcccc

int login;

if (invalid_login())
  login = 0;
else
  // Debug line added below
  System.out.println("Login is valid\n");
  // debuggingThe next line addedis herealways executed 
login  login = 1; 
                             // this line always gets executed, regardless of a valid login!

The code's indentation disguises the functionality of the program, potentially leading to a security breach.

Compliant Solution

In this This compliant solution , uses opening and closing braces are used even when though the body is a single statement.of the if and else bodies of the if statement are single statements:

Code Block
bgColor#CCCCFF

int login;

if (invalid_login()) {
  login = 0;
} else {
  login = 1;
}

Noncompliant Code Example

This noncompliant code example nests an if statement within another if statement, without braces around the if and else bodies.:

Code Block
bgColor#ffcccc

int privileges;

if (invalid_login())
  if (allow_guests())
    privileges = GUEST;
else
  privileges = ADMINISTRATOR;

The indentation might lead the programmer to believe that a user is given users are granted administrator privileges only when the user's their login is valid. However, the else statement actually attaches binds to the inner if statement:

Code Block
bgColor#ffcccc

int privileges;

if (invalid_login())
  if (allow_guests())
    privileges = GUEST;
  else
    privileges = ADMINISTRATOR;

This is a vulnerability because Consequently, this defect allows unauthorized users can to obtain administrator privileges.

Compliant Solution

In this This compliant solution , adding uses braces removes to remove the ambiguity and ensures , consequently ensuring that privileges are correctly assigned.:

Code Block
bgColor#CCCCFF

int privileges;

if (invalid_login()) {
  if (allow_guests()) {
    privileges = GUEST;
  } 
} else {
  privileges = ADMINISTRATOR;
}

Risk Assessment

Recommendation

Severity

Likelihood

Remediation Cost

Priority

Level

EXP05-J

medium

probable

medium

P8

L2

Related Guidelines

CERT C Secure Coding Standard: "EXP19-C. Use braces for the body of an if, for, or while statement"

Bibliography

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="094e6786-69e8-42f9-93ca-5a963aa02202"><ac:plain-text-body><![CDATA[

...

[[GNU 2010

...

AA. References#GNU 10]]

...

Applicability

Failure to enclose the bodies of if, for, or while statements in braces makes code error prone and increases maintenance costs.

Automated Detection

ToolVersionCheckerDescription
SonarQube
Include Page
SonarQube_V
SonarQube_V

S2681
S00121

 

 

Bibliography

[GNU 2013]

§5.3, "Clean Use of C Constructs"

http://www.gnu.org/prep/standards/standards.html#Syntactic-Conventions]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4765006b-4752-48cc-9799-afa39bdf4ea5"><ac:plain-text-body><![CDATA[

[[Rogue 2000

AA. References#Rogue 2000]]

Rule 76: Use block statements instead of expression statements in control flow constructs

]]></ac:plain-text-body></ac:structured-macro>

EXP51-J. Do not perform assignments in conditional statements      02. Expressions (EXP)      Image Removed 

...

Image Added Image Added Image Added