No-op / Unused Return Value Checks

[JonathanWilbur]

Search Terms

noop
no-op

Suggestion

Generate warnings when the return value of a function or method is not used.

Use Cases

To prevent security vulnerabilities like CVE-2009-0846:

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in
the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before 1.6.4
allows remote attackers to cause a denial of service (daemon crash) or
possibly execute arbitrary code via vectors involving an invalid DER encoding
that triggers a free of an uninitialized pointer.

This bug was only caused by nothing being done with the return value of
asn1buf_remove_charstring. So when the program encountered a problem
decoding the ASN.1 element, the code would continue even though the
output buffer, s, was never actually initialized. The second line
below was added in version 1.6.4, which fixed this bug.

retval = asn1buf_remove_charstring(buf,15,&s);
if (retval) return retval;

Giving developers warnings about unused return values would be a cheap way to mitigate these vulnerabilities.

Examples

This code:

const SUCCESS = 0;
const ENEGMON = -1;
function depositMoney (amount : number) {
    if (amount < 0) return ENEGMON;
    // Modify something else somewhere
    return SUCCESS;
}

depositMoney(-50);

Would display a compiler warning that could look like:

TS12345: file.ts (12,34): WARNING: The return value of `depositMoney` is unused. Ensure this is not a security vulnerability and/or compile with the `--no-noop-check` flag.

Checklist

My suggestion meets these guidelines:

• This wouldn't be a breaking change in existing TypeScript / JavaScript code
• This wouldn't change the runtime behavior of existing JavaScript code
• This could be implemented without emitting different JS based on the types of the expressions
• This isn't a runtime feature (e.g. new expression-level syntax)

[RyanCavanaugh]

See #8240, #8615, #8584, #7770, #17282

[typescript-bot]

This issue has been marked as a 'Duplicate' and has seen no recent activity. It has been automatically closed for house-keeping purposes.