Ejecuta análisis estático (SAST) sobre el código buscando el patrón inseguro en el flujo de datos.
CWE-1071 Base Incompleto
Empty Code Block
An empty code block occurs when a section of source code, such as a conditional statement or function body, contains no executable statements.
Definición
What is CWE-1071?
An empty code block occurs when a section of source code, such as a conditional statement or function body, contains no executable statements.
Empty blocks can appear in various places like if/else conditionals, loops, function definitions, or exception handlers. While sometimes intentionally used as a placeholder, they often signal problems like incomplete features, accidentally deleted logic, or unexpected behavior from macros or code generators.
For developers, these empty blocks are a red flag. Even if the language syntax allows them, they frequently violate API contracts or expected program behavior, leading to silent failures or security issues where an action is assumed but never executed. Code reviews should actively identify and justify any empty block to prevent unintentional gaps in application logic.
Impacto en el mundo real
Real-world CVEs caused by CWE-1071
Todavía no hay CVEs públicos enlazados a esta CWE en el catálogo de MITRE.
Cómo lo explotan los atacantes
Ruta del atacante paso a paso
- 1
In the following Java example, the code catches an ArithmeticException.
- 2
Since the exception block is empty, no action is taken.
- 3
In the code below the exception has been logged and the bad execution has been handled in the desired way allowing the program to continue in an expected way.
- 4
The following code attempts to synchronize on an object, but does not execute anything in the synchronized block. This does not actually accomplish anything and may be a sign that a programmer is wrestling with synchronization but has not yet achieved the result they intend.
- 5
Instead, in a correct usage, the synchronized statement should contain procedures that access or modify data that is exposed to multiple threads. For example, consider a scenario in which several threads are accessing student records at the same time. The method which sets the student ID to a new value will need to make sure that nobody else is accessing this data at the same time and will require synchronization.
Ejemplo de código vulnerable
Vulnerable Java
In the following Java example, the code catches an ArithmeticException.
public class Main {
public static void main(String[] args) {
int a = 1;
int b = 0;
int c = 0;
try {
c = a / b;
} catch(ArithmeticException ae) {
}
}
} Ejemplo de código seguro
Secure Java
In the code below the exception has been logged and the bad execution has been handled in the desired way allowing the program to continue in an expected way.
public class Main {
public static void main(String[] args) {
int a = 1;
int b = 0;
int c = 0;
try {
c = a / b;
} catch(ArithmeticException ae) {
log.error("Divided by zero detected, setting to -1.");
c = -1;
}
}
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención
How to prevent CWE-1071
- Architecture Use safe-by-default frameworks and APIs that prevent the unsafe pattern from being expressible.
- Implementation Validate input at trust boundaries; use allowlists, not denylists.
- Implementation Apply the principle of least privilege to credentials, file paths, and runtime permissions.
- Testing Cover this weakness in CI: SAST rules + targeted unit tests for the data flow.
- Operation Monitor logs for the runtime signals listed in the next section.
Señales de detección
How to detect CWE-1071
Ejecuta pruebas dinámicas de seguridad de aplicaciones (DAST) contra el endpoint en vivo.
Vigila los logs en tiempo de ejecución para detectar trazas de excepción inusuales, entradas malformadas o intentos de bypass de autorización.
Revisión de código: marca cualquier código nuevo que maneje entrada desde esta superficie sin usar los helpers validados del framework.
CWE-1071
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Preguntas frecuentes ¿Qué es CWE-1071?
¿Qué gravedad tiene CWE-1071?
¿Qué lenguajes o plataformas se ven afectados por CWE-1071?
¿Cómo puedo prevenir CWE-1071?
¿Cómo detecta y corrige Plexicus CWE-1071?
¿Dónde puedo aprender más sobre CWE-1071?
Frequently asked questions
¿Qué es CWE-1071?
An empty code block occurs when a section of source code, such as a conditional statement or function body, contains no executable statements.
¿Qué gravedad tiene CWE-1071?
MITRE no ha publicado una calificación de probabilidad de explotación para esta debilidad. Trátala como de impacto medio hasta que tu modelo de amenazas demuestre lo contrario.
¿Qué lenguajes o plataformas se ven afectados por CWE-1071?
MITRE no ha especificado plataformas afectadas para esta CWE — puede aplicar a la mayoría de los stacks de aplicaciones.
¿Cómo puedo prevenir CWE-1071?
Use safe-by-default frameworks, validate untrusted input at trust boundaries, and apply the principle of least privilege. Cover the data-flow signature in CI with SAST.
¿Cómo detecta y corrige Plexicus CWE-1071?
El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-1071 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.
¿Dónde puedo aprender más sobre CWE-1071?
MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/1071.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.
Debilidades relacionadas
Weaknesses related to CWE-1071
CWE-1164 Padre
Irrelevant Code
Irrelevant code refers to sections of a program that have no impact on its execution, data, or logic. Removing this code would not change…
CWE-107 Hermano
Struts: Unused Validation Form
This vulnerability occurs when a Struts application contains validation form definitions that are no longer linked to any active form or…
CWE-110 Hermano
Struts: Validator Without Form Field
This vulnerability occurs when a Struts application's validation configuration file references form fields that no longer exist in the…
CWE-561 Hermano
Dead Code
Dead code refers to sections of a program that can never run during normal execution, effectively making them inactive and unreachable.
CWE-563 Hermano
Assignment to Variable without Use
This vulnerability occurs when a value is stored in a variable, but that variable is never read or used in subsequent code, creating a…
CWE-1069 Hijo
Empty Exception Block
This weakness occurs when a try-catch or try-finally block is present but contains no code to handle the caught exception or perform…
CWE-585 Hijo
Empty Synchronized Block
An empty synchronized block is a Java code construct where a synchronized block exists but contains no executable statements inside it.
¿Listo para validar lo que importa?
Listo para validar lo que importa.
Plexicus es Proof-Driven AppSec: hallazgos validados, comprensión contextual y remediación revisada — anclada en evidencia, acotada contigo.