Improper Adherence to Coding Standards

Opis

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Skutki

• Other

  Other

Zapobieganie

• Policy

  Select and require coding standards. Ensure that they include security concerns.

• Implementation

  Closely follow coding standards, possibly enforcing them upon checkin of the code into a source control system or with periodic analyses.

Słabości podrzędne

• CWE-476 NULL Pointer Dereference
• CWE-477 Use of Obsolete Function
• CWE-484 Omitted Break Statement in Switch
• CWE-489 Active Debug Code
• CWE-570 Expression is Always False
• CWE-571 Expression is Always True
• CWE-573 Improper Following of Specification by Caller
• CWE-657 Violation of Secure Design Principles
• CWE-684 Incorrect Provision of Specified Functionality
• CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
• CWE-1041 Use of Redundant Code
• CWE-1044 Architecture with Number of Horizontal Layers Outside of Expected Range
• CWE-1048 Invokable Control Element with Large Number of Outward Calls
• CWE-1059 Insufficient Technical Documentation
• CWE-1061 Insufficient Encapsulation
• CWE-1065 Runtime Resource Management Control Element in a Component Built to Run on Application Servers
• CWE-1066 Missing Serialization Control Element
• CWE-1068 Inconsistency Between Implementation and Documented Design
• CWE-1076 Insufficient Adherence to Expected Conventions
• CWE-1092 Use of Same Invokable Control Element in Multiple Architectural Layers
• CWE-1093 Excessively Complex Data Representation
• CWE-1101 Reliance on Runtime Component in Generated Code
• CWE-1120 Excessive Code Complexity
• CWE-1126 Declaration of Variable with Unnecessarily Wide Scope
• CWE-1127 Compilation with Insufficient Warnings or Errors
• CWE-1164 Irrelevant Code
• CWE-1177 Use of Prohibited Code
• CWE-1209 Failure to Disable Reserved Bits
• CWE-1357 Reliance on Insufficiently Trustworthy Component

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific