CWE-476

[BartKaras1128]

No description provided.

[s19110]

I left a couple small cosmetic suggestions. The rule looks good. Remember to also add the README link to the table in the main readme of the Secure Coding project.

[s19110]

I think some backticks are unnecessary here:

Suggested change

	The `compliant solution` includes the same implementation as the previous `non-compliant example` but now checks if the string is `None`.
	The `compliant solution` includes the same implementation as the previous non-compliant example but now checks if the string is `None`.

Suggested change

	The `compliant solution` includes the same implementation as the previous `non-compliant example` but now checks if the string is `None`.
	The compliant solution includes the same implementation as the previous `non-compliant example` but now checks if the string is `None`.

[s19110]

This sentence sounds a bit odd. How about something like that?

Suggested change

	The code example attempts to directly calling `len()` on a non-array value, but rather on `None`, which will raise a `TypeError`. Such unchecked dereferencing of a `None` value could result in an application crash or denial of service, impacting system availability.
	The code example attempts to directly call `len()` on a non-array value, in this case on `None`, which will raise a `TypeError`. Such unchecked dereferencing of a `None` value could result in an application crash or denial of service, impacting system availability.

[andrew-costello]

The rule looks good to me, I agree with @s19110 's rewording suggestion, I was going to put it in myself. When it is reworded, I will review again and give +1.