BF Name Resolution (NRS) Bugs Class

Definition

Name Resolution (NRS) class – The name of an object, a function, or a type is resolved improperly or bound to an improper type or implementation.

Taxonomy

OperationsDefinition
ReferRefer operation – Use a name to access an entity in local or remote scopes of source code. The Type System resolves the name and binds a data type to it.
CallCall operation – Invoke a function implementation. The Type System binds a function implementation to the resolved function name. A polymorphic function implementation is first resolved and then bound.
OperandsDefinition
NameName operand – The identifier of an object, function, or data type entity used to reference it.
TypeType operand – The data type of an object – i.e., the set of allowed values (e.g., char is within [-128, 127]) and operations over them (e.g., +, *, mod).
CausesDefinition
Code BugCode Bug type – Defect in the implementation of the operation – proper operands over an improper operation. A first cause for the chain of weaknesses underlying a software security vulnerability. Must be fixed to resolve the vulnerability.
   Erroneous CodeErroneous Code bug - There is a coding error in the implementation of the operation.
Specification BugSpecification Bug type – Defect in the metadata or algorithm of the operation – proper operands over an improper operation. It is always the first cause for the chain of weaknesses underlying a software security vulnerability. It must be fixed to resolve the vulnerability.
   Missing QualifierA namespace include is absent; or a scope is not specified i na fully qualified name.
   Wrong QualifierA wrong namespace is included, or a wrong scope is specified in a fully qualified name.
Name FaultName Fault/Error type – The fully resolved name is wrong.
   Missing Overridden FunctionMissing Overridden Function fault/error – The function implementation in a particular subclass is absent.
   Missing Overloaded FunctionMissing Overloaded Function fault/error – Code for particular function parameters' data types is absent.
Type FaultType Fault/Error type – The set or range of allowed values is wrong or the operations allowed on them are wrong.
   Incomplete TypeIncomplete Type fault/error – A specific constructor, method, or overloaded function is missing.
   Wrong Generic TypeWrong Generic Type fault/error – A generic object is instantiated via wrong type argument.
   Downcasted PointerDowncasted Pointer fault/error – A pointer is cast to a subtype (base to subclass or subclass to subclass) that is incompatible with its object's data type. The object may invoke an overridden function is of a wrong subtype.
   Wrong Argument TypeWrong Argument Type fault/error – An argument to an overloaded function is of incorrect data type.
ConsequencesDefinition
Name ErrorName Fault/Error type – The fully resolved name is wrong.
   Wrong Object ResolvedWrong Object Resolved fault/error – The object is resolved from wrong scope.
   Wrong Function ResolvedWrong Function Resolved fault/error – The function is resolved from wrong scope.
   Wrong Generic Function BoundWrong Generic Function Bound fault/error – Code for a wrong data type is bound due to wrong generic type arguments.
   Wrong Overridden Function BoundWrong Overridden Function Bound fault/error – Code from wrong subtype is bound due to a wrong invoking subtype object.
   Wrong Overloaded Function BoundWrong Overloaded Function Bound fault/error – Wrong overloaded implementation is bound due to wrong function arguments.
Type ErrorType Fault/Error type – The set or range of allowed values is wrong or the operations allowed on them are wrong.
   Wrong Object Type ResolvedWrong Object Type Resolved fault/error – An object is resolved from a wrong scope, so its data type might be wrong (e.g., a parent vs a child data type).
   Wrong Type ResolvedWrong Type Resolved fault/error – A data type is resolved from a wrong scope.
Operations AttributesDefinition
MechanismMechanism operation attribute type – Shows how the operation is performed.
   ResolveResolve operation attribute – The operation is via looking up a name and if needed determining its data type (infer from value, through hierarchy, via generic type attribute).
   BindBind operation attribute – The operation connects object data type, function return type, parameter data type, or simple function implementation.
   Early BindEarly Bind operation attribute – The operation resolves a subtype and sets its a generic function implementation.
   Late BindLate Bind operation attribute – The operation resolves an overridden function via subtype object and sets its implementation.
   Ad-hoc BindAd-hoc Bind operation attribute – The operation resolves an overloaded function via signature and sets its implementation.
Source CodeSource Code operation attribute type – Shows where the operation code resides within the software, firmware, or circuit logic code.
   CodebaseCodebase operation attribute – The operation is in the programmer's code - in the application itself.
   Third-PartyThird-Party operation attribute – The operation code is in a third-party software.
   Standard LibraryStandard Library operation attribute – The operation code is in the standard library for a particular programming language.
   Compiler/InterpreterCompiler/Interpreter operation attribute – The operation code is in the language processor that allows execution or creates executables (interpreter, compiler, assembler).
Execution SpaceExecution Space operation attribute type – Shows where the operation is executed or the privilege level at which it runs.
   LocalLocal operation attribute – The bugged code runs in an environment with access control policy with limited (local user) permission.
   AdminAdmin operation attribute – The bugged code runs in an environment with access control policy with unlimited (admin user) permission.
   Bare-MetalBare-Metal operation attribute – The bugged code runs in an environment without privilege control. Usually, the program is the only software running and has total access to the hardware.
Operands AttributesDefinition
         Name KindName Kind operand attribute type – Shows the entity with this name.
            ObjectObject operand attribute – A memory region used to store data.
            FunctionFunction operand attribute – An organized block of code that when called takes in data, processes it, and produces a result(s).
            Data TypeData Type operand attribute – A set of allowed values and the operations allowed over them.
            NamespaceNamespace operand attribute – An organization of entities' names, utilized to avoid names collision.
         Type KindType Kind operand attribute type – Shows what the data type composition is.
            PrimitivePrimitive operand attribute – A scalar data type that mimics the hardware units - e.g., int (long, short, signed), float, double, string, Boolean. A primitive data type is only language defined and is not built from other data types.
            StructureStructure operand attribute – A composite data type - e.g., array, list, map, class. A structured data type is built from other data types and has primitive or structured members.