CWE-1062 Parent Class with References to a Child Class

CWE-1062 is a parent class that contains references to a child class, its methods or its members. It matters to teams using class hierarchies, where the parent is supposed to know nothing about who extends it.

How it happens

Someone adds a shortcut in the base class: a type check for one particular subclass, or a call to a method that only a child defines.

// Pattern to avoid: the parent knows a child
abstract class Shape {
    double area() {
        if (this instanceof Circle) {
            return Math.PI * ((Circle) this).radius * ((Circle) this).radius;
        }
        return 0;
    }
}

// Better: let each child implement its own behavior
abstract class Shape {
    abstract double area();
}

Now adding a new child means editing the parent, and the parent breaks if the child changes.

What an attacker gains

MITRE lists reduced reliability. If an attacker can reach the code, the problem "might introduce a vulnerability."

How to find it

The record lists no detection methods. Search base classes for type checks and casts to subclasses.

How to fix it

Use polymorphism: declare an abstract or overridable method in the parent and implement it in each child. Move any child specific logic into the child.

Quick check

Sources

• MITRE CWE-1062