VNX-478: Missing Default Case in Multiple Condition Expression

Detects a switch with no default whose cases are the only thing that sets a variable (uninitialised or NULL in C/C++, null in Java) that is read after the switch, so an unhandled value leaves it uninitialised or null.

Field	Value
Rule ID	`VNX-478`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++, Java
CWE	CWE-478
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`missing-default` `cwe-478`
Source	`internal/sast/rules/vnx-478.rego`

Overview

VNX-478 maps to CWE-478: Missing Default Case in Multiple Condition Expression. A switch without a default is not a defect by itself. It becomes one when the cases are the only code that gives a variable its value and the code after the switch reads that variable: any value the cases do not list leaves the variable uninitialised (undefined behaviour in C and C++) or null (a crash in Java). The rule reports exactly that shape:

a switch statement with no default label,
a variable assigned inside its cases,
declared above the switch without an initializer, or as NULL/nullptr (C/C++) or null (Java),
and read within twenty lines after the switch, without first being tested against NULL/null.

Not reported: a switch with a default, a variable given a real value before the switch (the author’s own default: an initialiser, a later plain assignment, or its address passed to an initialising call such as init(&v)), a variable not read afterwards, a NULL default that is checked after the switch, switch (x % N) with a case for every residue, Java switch expressions (x = switch ..., return switch ..., checked for exhaustiveness by the compiler), Go (every variable has a defined zero value), and comments.

What Gets Flagged

const char *text;
switch (code) {            /* FLAGGED: any other code leaves text uninitialised */
case 200: text = "OK"; break;
case 503: text = "Service Unavailable"; break;
}
return text;

String role = null;
switch (level) {           // FLAGGED: role stays null for any other level
    case 1: role = "reader"; break;
    case 2: role = "writer"; break;
}
return role.toUpperCase();

What Is Not Flagged

String role = "guest";
switch (level) {
    case 1: role = "reader"; break;
}
return role;

Remediation

Add a default that assigns a safe value or fails explicitly (return an error, throw).
Or initialise the variable to a safe value before the switch.
In C/C++, compile with -Wswitch-default -Wmaybe-uninitialized.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-478
// nosec vnx-478

Or record an ignore rule: vulnetix ignore add --rule vnx-478 --reason "...". See Suppressing findings.