CWE-570: Expression is Always False

What is Expression is Always False?

• Overview: An "Expression is Always False" vulnerability occurs when a conditional expression in the code is logically flawed, resulting in the expression evaluating to false every time it is executed. This can lead to dead or unreachable code, affecting the intended logic and flow of the program.

• Exploitation Methods:

• Attackers might exploit this vulnerability by targeting areas where conditional checks should alter program behavior but fail to do so due to the faulty logic.
• Common attack patterns include bypassing security checks or conditions meant to trigger specific actions, leading to unexpected program states.

• Security Impact:

• Direct consequences include non-execution of critical code blocks, potentially missing important security checks or business logic.
• Potential cascading effects might involve the failure to trigger essential processes or alerts, leading to broader system vulnerabilities.
• Business impact could range from minor logic errors to significant security breaches, depending on the criticality of the affected code segments.

• Prevention Guidelines:

• Specific code-level fixes include thoroughly reviewing and testing conditional expressions to ensure they evaluate as intended under all expected inputs.
• Security best practices involve rigorous code review processes, unit testing, and using static analysis tools to detect and resolve such logical errors.
• Recommended tools and frameworks include using IDEs with integrated linting and debugging capabilities, as well as employing static code analysis tools like SonarQube or Coverity to identify and fix logical errors in expressions.

Corgea can automatically detect and fix Expression is Always False in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

function checkAdminPrivileges(role) {
    // Vulnerability: The role comparison is hardcoded to a non-existent role
    if (role === "adminuser") {  // This condition is always false if "adminuser" is not a valid role
        return true;
    }
    return false;
}

// The issue is that the role check is against a hardcoded string that may not match any actual role,
// leading to the condition always being false unless the role "adminuser" is specifically assigned.

How to fix Expression is Always False?

To address this issue, ensure that role checks are based on a valid set of roles fetched from a reliable source. This means retrieving roles from a database or a configuration file that accurately reflects the actual roles assigned to users.

1. Remove Incorrect Hardcoded Roles: Avoid hardcoding roles that do not exist.
2. Use Dynamic Role Checking: Implement role checking against a dynamic list of roles that is updated as needed.
3. Implement Proper Authorization Logic: Ensure your authorization checks are part of a broader security strategy.

Fixed Code Example

function getUserRoles(username) {
    // This function should retrieve the list of roles for the user from a secure database
    // For demonstration, assume it returns ["user", "admin"]
    return ["user", "admin"];
}

function checkAdminPrivileges(username) {
    const roles = getUserRoles(username);  // Fetch the user's roles dynamically
    if (roles.includes("admin")) {  // Check if the user has the "admin" role
        return true;
    }
    return false;
}

// The expression now checks against a dynamic list of roles, ensuring the condition is valid.
// This approach uses actual user data to determine privileges, improving security and correctness.

In both examples, the fixes involve removing hardcoded values and using dynamic, secure data sources for validations, which solves the expression is always false vulnerability by ensuring the conditions are meaningful and based on actual data.