Opening and closing braces for if, for, or while statements should always be used, even if the statement's body contains only a single statement.

Braces improve the uniformity and readability of code.

More importantly, when inserting an additional statement into a body containing only a single statement, it is easy to forget to add braces because the indentation gives strong (but misleading) guidance to the structure.

Noncompliant Code Example

This noncompliant code example uses an if statement without braces to authenticate the user.

int login;

if (invalid_login())
  login = 0;
else
  login = 1;

A maintainer might add a debug statement or other logic, but forget to add opening and closing braces.

int login;

if (invalid_login())
  login = 0;
else
  System.out.println("Login is valid\n");  // debugging line added here
  login = 1;                               // this line always gets executed, regardless of a valid login!

The code indentation disguises the functionality of the program, potentially leading to a security breach.

Compliant Solution

In this compliant solution, opening and closing braces are used even when the body is a single statement.

int login;

if (invalid_login()) {
  login = 0;
} else {
  login = 1;
}

Noncompliant Code Example

This noncompliant code example nests an if statement within another if statement without braces around if and else bodies.

int privileges;

if (invalid_login())
  if (allow_guests())
    privileges = GUEST;
else
  privileges = ADMINISTRATOR;

The indentation might lead the programmer to believe that a user is given administrator privileges only when the user's login is valid. However, the else statement actually attaches to the inner if statement:

int privileges;

if (invalid_login())
  if (allow_guests())
    privileges = GUEST;
  else
    privileges = ADMINISTRATOR;

This is a vulnerability, because unauthorized users can obtain administrator privileges.

Compliant Solution

In this compliant solution, adding braces removes the ambiguity and ensures that privileges are correctly assigned.

int privileges;

if (invalid_login()) {
  if (allow_guests()) {
    privileges = GUEST;
  } 
} else {
  privileges = ADMINISTRATOR;
}

Risk Assessment

Related Guidelines

CERT C Secure Coding Standard: EXP19-C. Use braces for the body of an if, for, or while statement

Bibliography

\[[GNU 2010|AA. Bibliography#GNU 10]\] [Coding Standards, Section 5.3, "Clean Use of C Constructs"|http://www.gnu.org/prep/standards/standards.html#Syntactic-Conventions]

INT10-J. Be aware of integer promotion behavior      Expressions (EXP)      EXP07-J. Understand the differences between bitwise and logical operators