Unchecked Error Condition (CWE-391) - Security Vulnerability

Unchecked Error Condition

The product does not properly check when a function or operation returns a value that is associated with an error condition.

When error conditions are not checked, the application may continue with invalid or unexpected state, potentially leading to crashes, data corruption, or security vulnerabilities.

普及度

中

3 言語をカバー

影響度

ハイ

1 件の重大度ハイのルール

予防

文書化済み

3 件の修正例

2 予防

この脆弱性の修正方法

3 件の Shoulder 検出ルールに基づく Unchecked Error Condition の予防策。

🐹 Go すべて表示 Go 詳細 →

Empty Error Handling LOW

Log or return errors instead of silently swallowing them

+2 -0 go

  _, err := db.Exec("DELETE FROM sessions WHERE expired = true")
  if err != nil {
+     log.Printf("session cleanup failed: %v", err)
+     return err
  }

🟨 JavaScript すべて表示 JavaScript 詳細 →

Unhandled Promise Rejection HIGH

Always handle promise rejections with .catch() or try/catch in async functions

+7 -2 javascript

  app.post('/create', async (req, res) => {
-   const user = await User.create(req.body);
-   res.json(user);
+   try {
+     const user = await User.create(req.body);
+     res.json(user);
+   } catch (error) {
+     logger.error('User creation failed:', error);
+     res.status(500).json({ error: 'Could not create user' });
+   }
  });

🐍 Python すべて表示 Python 詳細 →

Empty Exception Handler MEDIUM

Log exceptions or handle them explicitly instead of silently swallowing with pass

+11 -6 python

- def get_data():
-     try:
-         data = fetch_sensitive_data()
-         return {'data': data}
-     except:
-         pass
+ import logging
+ 
+ logger = logging.getLogger(__name__)
+ 
+ def get_data():
+     try:
+         data = fetch_sensitive_data()
+         return {'data': data}
+     except Exception as e:
+         logger.error(f"Failed to fetch data: {e}", exc_info=True)
+         return {'error': 'Data unavailable'}, 500

3 検出

コードの脆弱性を見つける

Shoulderを使用してコードのUnchecked Error Conditionパターンをスキャンしましょう。 3 ルール.

ターミナル

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=391

# Or scan entire project
npx @shoulderdev/cli trust .

検出ルール (3)

🐹 Go 1 rules

Empty Error Handling LOW

Error check block is empty, silently swallowing errors.

🟨 Javascript 1 rules

Unhandled Promise Rejection HIGH

Detects promises that are created or called without proper rejection handlers. Unhandled promise rejections can cause application crashes, expose sensitive error information, and lead to inconsistent application state. In Node.js, unhandled promise rejections will terminate the process in future versions, making this a critical reliability and security issue.

🔷 Typescript 1 rules

Unhandled Promise Rejection HIGH

🐍 Python 1 rules

Empty Exception Handler MEDIUM

Detects empty except blocks that silently swallow exceptions. This can hide security-critical errors, authentication failures, or data validation issues.

4 警告サイン

コードレビューで注目すべき点

これらのパターンはUnchecked Error Conditionの潜在的な脆弱性を示しています。コードレビューとセキュリティ監査中に探してください。

🟠

Promise at ... lacks rejection handler (.catch or try-catch) javascript-unhandled-promise-rejection

🟠

promises that are created or called without proper rejection handlers javascript-unhandled-promise-rejection

🟡

empty except blocks that silently swallow exceptions python-empty-except-block

🔍

コードベースをスキャン: Unchecked Error Condition

Shoulder CLI はコードベース全体から脆弱なパターンを見つけます。

npx shoulder trust すべてのルールを表示