CWE-1124 is a function or other code grouping in which the nesting or branching is too deep. MITRE marks it as a quality issue with no direct security implications and prohibits mapping real vulnerabilities to it.
How it happens
Each new condition goes inside the previous one. The happy path ends up indented six levels, and the error handling is scattered across the closing braces.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability, noting it indirectly affects security by making vulnerabilities more difficult or time-consuming to find and fix, and might make them easier to introduce. In deep nesting, the case nobody thought about is easy to hide.
How to find it
The record lists no detection methods. Many linters report maximum nesting depth. Set a limit, such as three or four levels, and review functions that exceed it.
How to fix it
The record has no formal mitigations. The usual fix is guard clauses: handle the failure cases first and return early.
# Before
def handle(req):
if req.user:
if req.user.verified:
if req.body:
return process(req.body)
else:
return error("empty")
else:
return error("unverified")
else:
return error("anonymous")
# After
def handle(req):
if not req.user:
return error("anonymous")
if not req.user.verified:
return error("unverified")
if not req.body:
return error("empty")
return process(req.body)
Same behaviour, and each rejection is visible at a glance. Extract inner blocks into named functions when guard clauses are not enough.
Quick check
Why do guard clauses help review?
They put each failure case on its own line, so a reviewer can check that every one is handled.
