CWE-684 (特定函数功能的不正确供给) — Vulnerability Class 25

CWE-684 represents a design-level weakness where software fails to adhere to its published specifications, resulting in unintended behaviors that external callers may inadvertently exploit. This vulnerability typically arises when developers omit critical nuances in documentation or implementation, causing the system to process inputs or requests in ways that diverge from expected standards. Attackers leverage these discrepancies by crafting specific inputs that trigger the undocumented or incorrect logic paths, potentially leading to data corruption, privilege escalation, or denial of service. To mitigate this risk, developers must prioritize rigorous requirement analysis and comprehensive API documentation. Implementing strict input validation, thorough unit testing against defined specifications, and adopting contract-based design principles ensures that the software’s actual behavior aligns precisely with its intended functionality, thereby eliminating ambiguity and reducing the attack surface for exploitation.