CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)

Opis

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

Wpisy w tej grupie

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-426 Untrusted Search Path
• CWE-462 Duplicate Key in Associative List (Alist)
• CWE-705 Incorrect Control Flow Scoping
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Uwagi

<xhtml:p>In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:</xhtml:p> <xhtml:ul> <xhtml:li>CWE-78 ENV03-C Sanitize the environment when invoking external programs</xhtml:li> <xhtml:li>CWE-78 ENV04-C Do not call system() if you do not need a command processor</xhtml:li> <xhtml:li>CWE-88 ENV03-C Sanitize the environment when invoking external programs</xhtml:li> <xhtml:li>CWE-88 ENV04-C Do not call system() if you do not need a command processor</xhtml:li> <xhtml:li>CWE-119 ENV01-C Do not make assumptions about the size of an environment variable</xhtml:li> <xhtml:li>CWE-426 ENV03-C Sanitize the environment when invoking external programs</xhtml:li> <xhtml:li>CWE-462 ENV02-C Beware of multiple environment variables with the same effective name</xhtml:li> <xhtml:li>CWE-705 ENV32-C All atexit handlers must return normally</xhtml:li> </xhtml:ul>

Źródła