Bad Coding Practices

Opis

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Wpisy w tej grupie

• CWE-358 Improperly Implemented Security Check for Standard
• CWE-360 Trust of System Event Data
• CWE-478 Missing Default Case in Multiple Condition Expression
• CWE-487 Reliance on Package-level Scope
• CWE-489 Active Debug Code
• CWE-547 Use of Hard-coded, Security-relevant Constants
• CWE-561 Dead Code
• CWE-562 Return of Stack Variable Address
• CWE-563 Assignment to Variable without Use
• CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined
• CWE-586 Explicit Call to Finalize()
• CWE-605 Multiple Binds to the Same Port
• CWE-628 Function Call with Incorrectly Specified Arguments
• CWE-654 Reliance on a Single Factor in a Security Decision
• CWE-656 Reliance on Security Through Obscurity
• CWE-694 Use of Multiple Resources with Duplicate Identifier
• CWE-807 Reliance on Untrusted Inputs in a Security Decision
• CWE-1041 Use of Redundant Code
• CWE-1043 Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
• CWE-1044 Architecture with Number of Horizontal Layers Outside of Expected Range
• CWE-1045 Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
• CWE-1046 Creation of Immutable Text Using String Concatenation
• CWE-1048 Invokable Control Element with Large Number of Outward Calls
• CWE-1049 Excessive Data Query Operations in a Large Data Table
• CWE-1050 Excessive Platform Resource Consumption within a Loop
• CWE-1063 Creation of Class Instance within a Static Code Block
• CWE-1065 Runtime Resource Management Control Element in a Component Built to Run on Application Servers
• CWE-1066 Missing Serialization Control Element
• CWE-1067 Excessive Execution of Sequential Searches of Data Resource
• CWE-1070 Serializable Data Element Containing non-Serializable Item Elements
• CWE-1071 Empty Code Block
• CWE-1072 Data Resource Access without Use of Connection Pooling
• CWE-1073 Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
• CWE-1079 Parent Class without Virtual Destructor Method
• CWE-1082 Class Instance Self Destruction Control Element
• CWE-1084 Invokable Control Element with Excessive File or Data Access Operations
• CWE-1085 Invokable Control Element with Excessive Volume of Commented-out Code
• CWE-1087 Class with Virtual Method without a Virtual Destructor
• CWE-1089 Large Data Table with Excessive Number of Indices
• CWE-1092 Use of Same Invokable Control Element in Multiple Architectural Layers
• CWE-1094 Excessive Index Range Scan for a Data Resource
• CWE-1097 Persistent Storable Data Element without Associated Comparison Control Element
• CWE-1098 Data Element containing Pointer Item without Proper Copy Control Element
• CWE-1099 Inconsistent Naming Conventions for Identifiers
• CWE-1101 Reliance on Runtime Component in Generated Code
• CWE-1102 Reliance on Machine-Dependent Data Representation
• CWE-1103 Use of Platform-Dependent Third Party Components
• CWE-1104 Use of Unmaintained Third Party Components
• CWE-1106 Insufficient Use of Symbolic Constants
• CWE-1107 Insufficient Isolation of Symbolic Constant Definitions
• CWE-1108 Excessive Reliance on Global Variables
• CWE-1109 Use of Same Variable for Multiple Purposes
• CWE-1113 Inappropriate Comment Style
• CWE-1114 Inappropriate Whitespace Style
• CWE-1115 Source Code Element without Standard Prologue
• CWE-1116 Inaccurate Source Code Comments
• CWE-1117 Callable with Insufficient Behavioral Summary
• CWE-1126 Declaration of Variable with Unnecessarily Wide Scope
• CWE-1127 Compilation with Insufficient Warnings or Errors
• CWE-1235 Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations