Unchecked Return Value (CWE-252) - Security Vulnerability

2 预防

如何修复此漏洞

基于 2 条 Shoulder 检测规则的 Unchecked Return Value 预防策略。

🐹 Go 查看全部 Go 详情 →

Unchecked Error Return Values MEDIUM

Replace blank identifier _ with err and check error return values

+4 -1 go

- data, _ := ioutil.ReadFile(path)
+ data, err := ioutil.ReadFile(path)
+ if err != nil {
+     return fmt.Errorf("failed to read %s: %w", path, err)
+ }
  process(data)

🟨 JavaScript 查看全部 JavaScript 详情 →

Unchecked Return Value from Critical Operations HIGH

Always check return values from critical operations like password comparison and database writes

+4 -2 javascript

- bcrypt.compare(req.body.password, user.passwordHash);
- // Proceeds without checking the result
+ const isValid = await bcrypt.compare(req.body.password, user.passwordHash);
+ if (!isValid) {
+   return res.status(401).json({ error: 'Invalid credentials' });
+ }
  const token = generateToken(user);

3 检测

查找代码中的漏洞

使用Shoulder扫描代码中的Unchecked Return Value模式。 2 规则.

终端

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=252

# Or scan entire project
npx @shoulderdev/cli trust .

检测规则 (2)

🐹 Go 1 rules

Unchecked Error Return Values MEDIUM

Error return value ignored using blank identifier (_).

🟨 Javascript 1 rules

Unchecked Return Value from Critical Operations HIGH

Detects critical operations (file system, database, authentication) whose return values are not checked. Ignoring return values can lead to silent failures, data corruption, and security vulnerabilities. Critical operations that must have their return values checked include: - File system operations (write, delete, chmod) - Database operations (insert, update, delete) - Authentication/authorization checks - Cryptographic operations

🔷 Typescript 1 rules

Unchecked Return Value from Critical Operations HIGH

Detects critical operations (file system, database, authentication) whose return values are not checked. Ignoring return values can lead to silent failures, data corruption, and security vulnerabilities. Critical operations that must have their return values checked include: - File system operations (write, delete, chmod) - Database operations (insert, update, delete) - Authentication/authorization checks - Cryptographic operations

4 警告信号

代码审查中需要关注的内容

这些模式表明潜在的Unchecked Return Value漏洞。在代码审查和安全审计中注意查找。

🟠

Return value from ... at ... is not checked javascript-unchecked-return-value

🟠

critical operations (file system, database, authentication) whose return values are not checked javascript-unchecked-return-value

Unchecked Return Value