# Unchecked Return Value (CWE-252)

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

- Prevalence: Medium 2 languages covered
- Impact: High 1 high-severity rules
- Prevention: Documented 2 fix examples

**OWASP:** Insecure Design (A04:2021-Insecure Design) - #4

## Description

When return values are not checked, the program may continue execution in an error state or with incorrect data, potentially leading to security vulnerabilities.

## Prevention

Prevention strategies for Unchecked Return Value based on 2 Shoulder detection rules.

### Go

Replace blank identifier _ with err and check error return values

### Node.js

Always check return values from critical operations like password comparison and database writes

## Warning Signs

- [HIGH] Return value from ... at ... is not checked
- [HIGH] critical operations (file system, database, authentication) whose
return values are not checked

## Consequences

- DoS
- Execute Unauthorized Code
- Modify Application Data

## Mitigations

- Always check return values from functions
- Use compiler warnings to detect unchecked return values
- Handle error conditions appropriately

## Detection

- Total rules: 2
- Languages: go, javascript, typescript

## Rules by Language

### Go (1 rules)

- **Unchecked Error Return Values** [MEDIUM]: Error return value ignored using blank identifier (_).
  - Remediation: Check all error return values and handle appropriately.

```go
data, err := ioutil.ReadFile(path)
if err != nil {
    return fmt.Errorf("failed to read file: %w", err)
}
```

Learn more: https://shoulder.dev/learn/go/cwe-252/unchecked-errors

### Javascript (1 rules)

- **Unchecked Return Value from Critical Operations** [HIGH]: Detects critical operations (file system, database, authentication) whose
return values are not checked. Ignoring return values can lead to silent
failures, data corruption, and security vulnerabilities.

Critical operations that must have their return values checked include:
- File system operations (write, delete, chmod)
- Database operations (insert, update, delete)
- Authentication/authorization checks
- Cryptographic operations
  - Remediation: Always check return values from critical operations:

```javascript
// ✅ SAFE - Check return value
const result = await fs.writeFile(path, data);
if (!result.success) {
  logger.error('Write failed');
  throw new Error('Failed to write file');
}
```

### Typescript (1 rules)

- **Unchecked Return Value from Critical Operations** [HIGH]: Detects critical operations (file system, database, authentication) whose
return values are not checked. Ignoring return values can lead to silent
failures, data corruption, and security vulnerabilities.

Critical operations that must have their return values checked include:
- File system operations (write, delete, chmod)
- Database operations (insert, update, delete)
- Authentication/authorization checks
- Cryptographic operations
  - Remediation: Always check return values from critical operations:

```javascript
// ✅ SAFE - Check return value
const result = await fs.writeFile(path, data);
if (!result.success) {
  logger.error('Write failed');
  throw new Error('Failed to write file');
}
```