{"@ID": "1071", "@Name": "Empty Code Block", "@Abstraction": "Base", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The source code contains a block that does not contain any code, i.e., the block is empty.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "1164", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Indirect"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}}, "Background_Details": {"Background_Detail": "Empty code blocks can occur in the bodies of conditionals, function or method definitions, exception handlers, etc."}, "Modes_Of_Introduction": {"Introduction": {"Phase": "Implementation", "Note": "For some programming languages and constructs, an empty block might be allowed by the syntax. While an empty code block might be intentional, it could accidentally occur when the developer did not finish implementation, accidental code deletion, unexpected macro expansion, etc."}}, "Common_Consequences": {"Consequence": {"Scope": "Other", "Impact": ["Reduce Reliability", "Varies by Context"], "Note": "The lack of any behavior within the block might violate a convention or API in such a way that it is an error. It could indicate a situation in which some kind of action should be taken."}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Demonstrative_Examples": {"Demonstrative_Example": [{"@Demonstrative_Example_ID": "DX-213", "Intro_Text": "In the following Java example, the code catches an ArithmeticException.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "c = a / b;"}, "#text": "int a = 1;\n                        int b = 0;\n                        int c = 0;\n                        try {\n                           \n                        } catch(ArithmeticException ae) {\n                        }"}, "xhtml:br": null, "#text": "public static void main(String[] args) {\n                        \n                     }"}, "#text": "public class Main {\n                     \n                  }"}, "#text_blocks": ["public class Main {", "public static void main(String[] args) {", "int a = 1;", "int b = 0;", "int c = 0;", "try {", "c = a / b;", "} catch(ArithmeticException ae) {", "}", "}", "}"]}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null], "xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null, null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "c = a / b;"}, {"@style": "margin-left:1em;", "xhtml:br": null, "#text": "log.error(\"Divided by zero detected, setting to -1.\");\n                           c = -1;"}], "#text": "int a = 1;\n                        int b = 0;\n                        int c = 0;\n                        try {\n                           \n                        } catch(ArithmeticException ae) {\n                           \n                        }"}, "xhtml:br": null, "#text": "public static void main(String[] args) {\n                        \n                     }"}, "#text": "public class Main {\n                     \n                  }"}, "#text_blocks": ["public class Main {", "public static void main(String[] args) {", "int a = 1;", "int b = 0;", "int c = 0;", "try {", "c = a / b;", "} catch(ArithmeticException ae) {", "log.error(\"Divided by zero detected, setting to -1.\");", "c = -1;", "}", "}", "}"]}], "Body_Text": ["Since the exception block is empty, no action is taken.", "In the code below the exception has been logged and the bad execution has been handled in the desired way allowing the program to continue in an expected way."]}, {"@Demonstrative_Example_ID": "DX-214", "Intro_Text": "The following code attempts to synchronize on an object, but does not execute anything in the synchronized block. This does not actually accomplish anything and may be a sign that a programmer is wrestling with synchronization but has not yet achieved the result they intend.", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": "synchronized(this) { }", "#text_blocks": ["synchronized(this) { }"]}, {"@Nature": "Good", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "#text": "this.ID = ID;"}, "#text": "synchronized(this){}"}, "#text": "public void setID(int ID){}"}, "#text_blocks": ["public void setID(int ID){", "synchronized(this){", "this.ID = ID;", "}", "}"]}], "Body_Text": "Instead, in a correct usage, the synchronized statement should contain procedures that access or modify data that is exposed to multiple threads. For example, consider a scenario in which several threads are accessing student records at the same time. The method which sets the student ID to a new value will need to make sure that nobody else is accessing this data at the same time and will require synchronization."}]}, "Mapping_Notes": {"Usage": "Allowed", "Rationale": "This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.", "Comments": "Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.", "Reasons": {"Reason": {"@Type": "Acceptable-Use"}}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2019-01-02", "Submission_Version": "3.2", "Submission_ReleaseDate": "2019-01-03"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2024-02-29", "Modification_Version": "4.14", "Modification_ReleaseDate": "2024-02-29", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Detection_Factors, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Background_Details, Common_Consequences, Description, Modes_of_Introduction"}]}, "entry_type": "Weakness"}