Bad Coding Practices

A category in the Common Weakness Enumeration published by The MITRE Corporation.


Summary

Categories in the Common Weakness Enumeration (CWE) group entries based on some common characteristic or attribute.

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Weaknesses

Active Debug Code

The application is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

Architecture with Number of Horizontal Layers Outside of Expected Range

The software's architecture contains too many - or too few - horizontal layers.

Assignment to Variable without Use

The variable's value is assigned but never used, making it a dead store.

Callable with Insufficient Behavioral Summary

The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, ...

Class Instance Self Destruction Control Element

The code contains a class instance that calls the method or function to delete or destroy itself.

Class with Virtual Method without a Virtual Destructor

A class contains a virtual method, but the method does not have an associated virtual destructor.

Compilation with Insufficient Warnings or Errors

The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues.

Creation of Class Instance within a Static Code Block

A static code block creates an instance of a class.

Creation of Immutable Text Using String Concatenation

The software creates an immutable text string using string concatenation operations.

Data Element Aggregating an Excessively Large Number of Non-Primitive Elements

The software uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects.

Data Element containing Pointer Item without Proper Copy Control Element

The code contains a data element with a pointer that does not have an associated copy or constructor method.

Data Resource Access without Use of Connection Pooling

The software accesses a data resource through a database without using a connection pooling capability.

Dead Code

The software contains dead code, which can never be executed.

Declaration of Variable with Unnecessarily Wide Scope

The source code declares a variable in one scope, but the variable is only used within a narrower scope.

Dynamic Variable Evaluation

In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary vari...

Empty Code Block

The source code contains a block that does not contain any code, i.e., the block is empty.

Excessive Data Query Operations in a Large Data Table

The software performs a data query with a large number of joins and sub-queries on a large data table.

Excessive Execution of Sequential Searches of Data Resource

The software contains a data query against an SQL table or view that is configured in a way that does not utilize an index and may cause sequential searches ...

Excessive Index Range Scan for a Data Resource

The software contains an index range scan for a large data table, but the scan can cover a large number of rows.

Excessive Platform Resource Consumption within a Loop

The software has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, ...

Excessive Reliance on Global Variables

The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the as...

Explicit Call to Finalize()

The software makes an explicit call to the finalize() method from outside the finalizer.

Function Call with Incorrectly Specified Arguments

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

Inaccurate Comments

The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.

Inappropriate Comment Style

The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.

Inappropriate Whitespace Style

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

Inconsistent Naming Conventions for Identifiers

The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callabl...

Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations

The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.

Insufficient Isolation of Symbolic Constant Definitions

The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.

Insufficient Use of Symbolic Constants

The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.

Invokable Control Element with Excessive File or Data Access Operations

A function or method contains too many operations that utilize a data manager or file resource.

Invokable Control Element with Excessive Volume of Commented-out Code

A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body.

Invokable Control Element with Large Number of Outward Calls

The code contains callable control elements that contain an excessively large number of references to other application objects external to the conte...

Large Data Table with Excessive Number of Indices

The software uses a large data table that contains an excessively large number of indices.

Missing Default Case in Switch Statement

The code does not have a default case in a switch statement, which might lead to complex logical errors and resultant weaknesses.

Missing Serialization Control Element

The software contains a serializable data element that does not have an associated serialization method.

Multiple Binds to the Same Port

When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.

Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses

The software contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use...

Object Model Violation: Just One of Equals and Hashcode Defined

The software does not maintain equal hashcodes for equal objects.

Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor

A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.

Parent Class without Virtual Destructor Method

A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

Persistent Storable Data Element without Associated Comparison Control Element

The software uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison.

Reliance on Machine-Dependent Data Representation

The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, physical machines, ...

Reliance on Package-level Scope

Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.

Reliance on Runtime Component in Generated Code

The product uses automatically-generated code that cannot be executed without a specific runtime support component.

Return of Stack Variable Address

A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.

Runtime Resource Management Control Element in a Component Built to Run on Application Servers

The application uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provide...

Serializable Data Element Containing non-Serializable Item Elements

The software contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable.

Source Code Element without Standard Prologue

The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.

Suspicious Comment

The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.

Use of Hard-coded, Security-relevant Constants

The program uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or sec...

Use of Multiple Resources with Duplicate Identifier

The software uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Use of Object without Invoking Destructor Method

The software contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method.

Use of Platform-Dependent Third Party Components

The product relies on third-party software components that do not provide equivalent functionality across all desirable platforms.

Use of Redundant Code

The software has multiple functions, methods, procedures, macros, etc. that contain the same code.

Use of Same Invokable Control Element in Multiple Architectural Layers

The software uses the same control element across multiple architectural layers.

Use of Same Variable for Multiple Purposes

The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one ins...

Use of Unmaintained Third Party Components

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original deve...

Variable Extraction Error

The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables ar...

Concepts

Software Development

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development l...


Common Weakness Enumeration content on this website is copyright of The MITRE Corporation unless otherwise specified. Use of the Common Weakness Enumeration and the associated references on this website are subject to the Terms of Use as specified by The MITRE Corporation.