VNX-483: Incorrect Block Delimitation

Field	Value
Rule ID	VNX-483
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++, Java
CWE	CWE-483
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	incorrect-block-delimitation misleading-indentation cwe-483
Source	internal/sast/rules/vnx-483.rego

Overview

VNX-483 maps to CWE-483: Incorrect Block Delimitation. Without braces only one statement belongs to an if, else, for or while. When a second statement is indented as if it belonged too, readers and reviewers see a guarded block where the compiler sees an unconditional statement. That is the shape of Apple’s 2014 “goto fail” TLS bug, where a duplicated goto fail; skipped signature verification. The rule reports:

1. Misleading indentation: a braceless if/else if/else/for/while header whose single guarded statement is immediately followed by another statement at exactly the same indentation. The finding is on the line that looks guarded but always runs.
2. Empty if body: if (condition); where the semicolon ends the if, so the block below runs unconditionally.

Not reported: braced bodies, a braceless body followed by a dedented line, a blank line or a closing brace, else/case/default labels, preprocessor and macro-continuation lines, conditions that span several lines, deliberate empty loops (while (*p++);, for (...);), the do { } while (x); terminator, and comments. A braceless if on its own is a style choice and is not reported.

What Gets Flagged

if ((err = hash_update(ctx, sig->server)) != 0)
    goto fail;
    goto fail;                   /* FLAGGED: always runs */

if (strcmp(pw, expected) != 0);  /* FLAGGED: empty body */
{
    return -1;
}

else
    audit.deny(user);
    user.lock();                 // FLAGGED: always runs

What Is Not Flagged

if (a < 0)
    b[0] = -1;
b[1] = 0;

Remediation

1. Always brace the bodies of if, else, for and while.
2. Remove the stray semicolon after an if condition.
3. Compile C/C++ with -Wmisleading-indentation and -Wempty-body (both in -Wall/-Wextra), and enforce braces with a formatter or linter.

References

• CWE-483: Incorrect Block Delimitation
• SEI CERT EXP19-C: Use braces for the body of an if, for, or while statement

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-483
// nosec vnx-483

Or record an ignore rule: vulnetix ignore add --rule vnx-483 --reason "...". See Suppressing findings.