CWE-393 (返回错误的状态编码) — Vulnerability Class 5

CWE-393 represents a logic error where a software component returns an inaccurate status code, misleading the calling entity about the true outcome of an operation. This weakness typically arises when developers fail to map specific error conditions to their corresponding standard codes, resulting in ambiguous or incorrect feedback. Attackers exploit this by manipulating inputs to trigger unexpected code paths, potentially bypassing security checks or causing denial of service if the system misinterprets a failure as success. To mitigate this risk, developers must rigorously validate return values and ensure strict adherence to established error-handling protocols. Implementing comprehensive unit tests that verify every possible exit path and status code combination is essential. Additionally, using static analysis tools can help identify discrepancies between expected and actual return values, ensuring that security-critical decisions rely on accurate execution results.