This rule was developed in part by Fatima Nadeem at the October 20-22, 2017 OurCS Workshop (http://www.cs.cmu.edu/ourcs/register.html). For more information about this statement, see the About the OurCS Workshop page. |
---|
This guideline is under construction. |
When having unreachable code it allows programs to be vulnerable to attacks and threat, as discovered by [Watanabe, Akiyama, Kanei, Shioji, Takata, Sun, Ishi, Shibahara, Yagi, Mori, 2017].
Thus when creating new libraries or functions...
This noncompliant code example shows an a line of code that is unreachable.
int x = 1; if (x == 1){ return x; x += 1; } |
The statement following the return statement will never get executed thus created errors and bugs in the program which rely on that statement.
In this compliant solution with reachable code.
int x = 1; if (x == 1){ x += 1; return x; } |
Summary of risk assessment.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
---|---|---|---|---|---|
TBD | Medium | Probable | Medium |
|
|
Tools are available online, such as ProGuard, that help clean up code by removing unused statements that may have been a result of unreachable code.
Tool | Version | Checker | Description |
---|---|---|---|
TBD |
|
Fill in the table below with at least one entry row, per these instructions, then remove this purple-font section.
DRD10-X. Do not release apps that are debuggable | Issues of bugs and discrepency within the code relates to this rule. |
[Chou, Chang, Kuo 2011] | Hong-Zu Chou, Kai-Hui Chang, Sy-Yen Kuo, Facilitating unreachable code diagnosis and debugging, IEEE Press Piscataway, NJ, USA, 2011 |
[Watanabe, Akiyama, Kanei, Shioji, Takata, Sun, Ishi, Shibahara, Yagi, Mori, 2017] | Taukya Watanabe, Mitsuaki Akiyama, Fumihiro Kanei, Eitaro Shioji, Yuta Takata, So Bun, Yuta Ishi, Toshiki Shibahara, Takeshi Yagi, Tatsuya Mori, Understanding the Origins of Mobile App Vulnerabilities: A Large-scale Measurement Study of Free and Paid Apps, IEEE Press Piscataway, NJ, USA, 2017 |
[Joyner 2013] | Ian Joyner, Simply Structured Programming, 2013 |
[Goel, Diaz-Agudo, Roth-Berghofer, 2016] | Ashok Goel, M Belen Diaz-Agudo, Thomas Roth-Berghofer, Case-Based Reasoning Research and Development: 24th International Conference, ICCBR 2016, Atlanta, GA, USA, 2016 |