Skip to content

CWE Rule Mapping: cpp/uninitialized-local should be mapped to CWE-457 only, and not CWE-665 (Discouraged) #22161

Description

@davewichers

Description of the issue

This rule is defined as follows:

              "name": "cpp/uninitialized-local",
              "shortDescription": { "text": "Potentially uninitialized local variable"  },
              "fullDescription": {
                "text": "Reading from a local variable that has not been assigned to will typically yield garbage."
              }, ..."properties": {
                "tags": [
                  "security",
                  "external/cwe/cwe-665",
                  "external/cwe/cwe-457"
                ],

CWE 457 (Use of Uninitialized Variable) is the proper mapping for this rule. But CWE 665 is marked DISCOURAGED,

Recommended Fix

I recommend dropping the mapping of this rule to CWE-665 as its use is DISCOURAGED, and 457 is exactly the correct mapping for this rule.

Metadata

Metadata

Assignees

No one assigned

    Labels

    questionFurther information is requested

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions