6.2.12.5. CWE¶
Checks for issues listed in the CWE - Common Weakness Enumeration
Excerpt from CWE [https://cwe.mitre.org], Copyright (C) 2006-2026, the MITRE Corporation. See section 9.4. "3rd-Party Licenses" in the documentation for full details.Nested Rules
Improper Input Validation. [Improper-Neutralization, Top25-2024-12] |
|
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’). [File-Handling-Issues, Improper-Control-Of-A-Resource-Through-Its-Lifetime, Top25-2024-5] |
|
Relative Path Traversal. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Absolute Path Traversal. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Improper Neutralization of Special Elements used in a Command (‘Command Injection’). [Improper-Neutralization, Top25-2024-13] |
|
Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’). [Data-Neutralization-Issues, Improper-Neutralization, Top25-2024-7] |
|
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’). [Data-Neutralization-Issues, Improper-Neutralization, Top25-2024-1] |
|
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’). [Data-Neutralization-Issues, Improper-Neutralization, Top25-2024-3] |
|
Improper Control of Generation of Code (‘Code Injection’). [Data-Neutralization-Issues, Improper-Neutralization, Top25-2024-11] |
|
Improper Restriction of Operations within the Bounds of a Memory Buffer. [Improper-Control-Of-A-Resource-Through-Its-Lifetime, Top25-2024-20] |
|
Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’). [Memory-Buffer-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Stack-based Buffer Overflow. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Write-what-where Condition. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Buffer Underwrite (‘Buffer Underflow’). [Memory-Buffer-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Out-of-bounds Read. [Memory-Buffer-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime, Top25-2024-6] |
|
Buffer Over-read. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Buffer Under-read. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Incorrect Calculation of Buffer Size. [Memory-Buffer-Errors, Incorrect-Calculation] |
|
Use of Externally-Controlled Format String. [String-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Incorrect Calculation of Multi-Byte String Length. [String-Errors, Incorrect-Calculation] |
|
Integer Overflow or Wraparound. [Numeric-Errors, Incorrect-Calculation, Top25-2024-23] |
|
Integer Underflow (Wrap or Wraparound). [Numeric-Errors, Incorrect-Calculation] |
|
Integer Coercion Error. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Unexpected Sign Extension. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Signed to Unsigned Conversion Error. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Numeric Truncation Error. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Exposure of Sensitive Information to an Unauthorized Actor. [Improper-Control-Of-A-Resource-Through-Its-Lifetime, Top25-2024-17] |
|
Use of Inherently Dangerous Function. [Api-Function-Errors, Improper-Adherence-To-Coding-Standards] |
|
Creation of chroot Jail Without Changing Working Directory. [Privilege-Issues, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Improper Clearing of Heap Memory Before Release (‘Heap Inspection’). [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Uncaught Exception. [Error-Conditions, Insufficient-Control-Flow-Management] |
|
Unchecked Return Value. [Error-Conditions, Improper-Check-Or-Handling-Of-Exceptional-Conditions] |
|
Incorrect Check of Function Return Value. [Error-Conditions, Improper-Adherence-To-Coding-Standards] |
|
Use of Hard-coded Password. [Improper-Access-Control, Improper-Adherence-To-Coding-Standards, Protection-Mechanism-Failure] |
|
Improper Privilege Management. [Improper-Access-Control, Top25-2024-15] |
|
Privilege Dropping / Lowering Errors. [Improper-Access-Control] |
|
Least Privilege Violation. [Privilege-Issues, Improper-Access-Control] |
|
Improper Check for Dropped Privileges. [Privilege-Issues, Improper-Check-Or-Handling-Of-Exceptional-Conditions] |
|
Improper Authentication. [Improper-Access-Control, Top25-2024-14] |
|
Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG). [Cryptographic-Issues, Random-Number-Issues, Protection-Mechanism-Failure] |
|
Same Seed in Pseudo-Random Number Generator (PRNG). [Protection-Mechanism-Failure] |
|
Predictable Seed in Pseudo-Random Number Generator (PRNG). [Protection-Mechanism-Failure] |
|
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). [Cryptographic-Issues, Random-Number-Issues, Protection-Mechanism-Failure] |
|
Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’). [Insufficient-Control-Flow-Management] |
|
Divide By Zero. [Numeric-Errors, Incorrect-Calculation] |
|
Creation of Temporary File With Insecure Permissions. [File-Handling-Issues, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Creation of Temporary File in Directory with Insecure Permissions. [File-Handling-Issues, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Declaration of Catch for Generic Exception. [Error-Conditions, Insufficient-Control-Flow-Management] |
|
Declaration of Throws for Generic Exception. [Error-Conditions, Insufficient-Control-Flow-Management] |
|
Uncontrolled Resource Consumption. [Improper-Control-Of-A-Resource-Through-Its-Lifetime, Top25-2024-24] |
|
Missing Release of Memory after Effective Lifetime. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Improper Resource Shutdown or Release. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Improper Resource Locking. [Resource-Locking-Problems, Improper-Control-Of-A-Resource-Through-Its-Lifetime, Insufficient-Control-Flow-Management] |
|
Double Free. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Use After Free. [Improper-Control-Of-A-Resource-Through-Its-Lifetime, Top25-2024-8] |
|
Untrusted Search Path. [File-Handling-Issues, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Use of Uninitialized Variable. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Addition of Data Structure Sentinel. [Data-Neutralization-Issues, Improper-Neutralization] |
|
Use of sizeof() on a Pointer Type. [Incorrect-Calculation] |
|
Incorrect Pointer Scaling. [Pointer-Issues, Incorrect-Calculation] |
|
Use of Pointer Subtraction to Determine Size. [Pointer-Issues, Incorrect-Calculation] |
|
NULL Pointer Dereference. [Pointer-Issues, Improper-Adherence-To-Coding-Standards, Top25-2024-21] |
|
Use of Obsolete Function. [Api-Function-Errors, Improper-Adherence-To-Coding-Standards] |
|
Missing Default Case in Multiple Condition Expression. [Bad-Coding-Practices, Incorrect-Comparison] |
|
Use of Incorrect Operator. [Behavioral-Problems, Expression-Issues, String-Errors, Insufficient-Control-Flow-Management] |
|
Assigning instead of Comparing. [Insufficient-Control-Flow-Management] |
|
Comparing instead of Assigning. [Insufficient-Control-Flow-Management] |
|
Incorrect Block Delimitation. [Behavioral-Problems, Insufficient-Control-Flow-Management] |
|
Omitted Break Statement in Switch. [Behavioral-Problems, Improper-Adherence-To-Coding-Standards] |
|
Active Debug Code. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Public Static Field Not Marked Final. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Deserialization of Untrusted Data. [Resource-Management-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime, Top25-2024-16] |
|
Use of Hard-coded, Security-relevant Constants. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Use of getlogin() in Multithreaded Application. [Improper-Control-Of-A-Resource-Through-Its-Lifetime, Insufficient-Control-Flow-Management] |
|
Dead Code. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Return of Stack Variable Address. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Assignment to Variable without Use. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Assignment of a Fixed Address to a Pointer. [Pointer-Issues, Improper-Adherence-To-Coding-Standards] |
|
Attempt to Access Child of a Non-structure Pointer. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Free of Memory not on the Heap. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Comparison of Object References Instead of Object Contents. [Incorrect-Comparison] |
|
Unchecked Input for Loop Condition. [Data-Validation-Issues, Improper-Neutralization] |
|
Reachable Assertion. [Error-Conditions, Insufficient-Control-Flow-Management] |
|
Improper Initialization. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Operation on a Resource after Expiration or Release. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Uncontrolled Recursion. [Insufficient-Control-Flow-Management] |
|
Multiple Operations on Resource in Single-Operation Context. [Improper-Adherence-To-Coding-Standards] |
|
Use of Potentially Dangerous Function. [Api-Function-Errors, Improper-Adherence-To-Coding-Standards] |
|
Function Call With Incorrect Order of Arguments. [Improper-Adherence-To-Coding-Standards] |
|
Function Call With Incorrect Number of Arguments. [Improper-Adherence-To-Coding-Standards] |
|
Function Call With Incorrect Argument Type. [Improper-Adherence-To-Coding-Standards] |
|
Unchecked Return Value to NULL Pointer Dereference. [Improper-Check-Or-Handling-Of-Exceptional-Conditions] |
|
Free of Pointer not at Start of Buffer. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Mismatched Memory Management Routines. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Release of Invalid Pointer or Reference. [Pointer-Issues, Resource-Management-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Critical Data Element Declared Public. [Permission-Issues, Improper-Access-Control, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Access to Critical Private Variable via Public Method. [Permission-Issues, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Missing Release of Resource after Effective Lifetime. [Resource-Management-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Missing Reference to Active File Descriptor or Handle. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Missing Release of File Descriptor or Handle after Effective Lifetime. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Operator Precedence Logic Error. [Behavioral-Problems, Expression-Issues, Insufficient-Control-Flow-Management] |
|
Out-of-bounds Write. [Memory-Buffer-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime, Top25-2024-2] |
|
Memory Allocation with Excessive Size Value. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Use of Hard-coded Credentials. [Credentials-Management-Errors, Key-Management-Errors, Improper-Access-Control, Top25-2024-22] |
|
Buffer Access Using Size of Source Buffer. [Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Access of Uninitialized Pointer. [Pointer-Issues, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Expired Pointer Dereference. [Pointer-Issues, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Signal Handler with Functionality that is not Asynchronous-Safe. [Insufficient-Control-Flow-Management] |
|
Signal Handler Function Associated with Multiple Signals. [Insufficient-Control-Flow-Management] |
|
Numeric Range Comparison Without Minimum Check. [Numeric-Errors, Incorrect-Comparison] |
|
Access of Resource Using Incompatible Type (‘Type Confusion’). [Type-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Use of Expired File Descriptor. [Resource-Management-Errors, Improper-Control-Of-A-Resource-Through-Its-Lifetime] |
|
Data Element Aggregating an Excessively Large Number of Non-Primitive Elements. [Bad-Coding-Practices, Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Multiple Inheritance from Concrete Classes. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Invocable Control Element with Variadic Parameters. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Invocable Control Element with Signature Containing an Excessive Number of Parameters. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Empty Exception Block. [Improper-Adherence-To-Coding-Standards] |
|
Empty Code Block. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Class with Excessively Deep Inheritance. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Unconditional Control Flow Transfer outside of Switch Block. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Floating Point Comparison with Incorrect Operator. [Incorrect-Comparison] |
|
Parent Class without Virtual Destructor Method. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Source Code File with Excessive Number of Lines of Code. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Class Instance Self Destruction Control Element. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Class with Excessive Number of Child Classes. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Class with Virtual Method without a Virtual Destructor. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Excessive Use of Unconditional Branching. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Excessive McCabe Cyclomatic Complexity. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Excessively Deep Nesting. [Complexity-Issues, Improper-Adherence-To-Coding-Standards] |
|
Declaration of Variable with Unnecessarily Wide Scope. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Compilation with Insufficient Warnings or Errors. [Bad-Coding-Practices, Improper-Adherence-To-Coding-Standards] |
|
Weak Authentication. [Improper-Access-Control] |
|
Use of Weak Credentials. [Improper-Access-Control] |
Options
Setting an option for this rule means setting the default for all nested rules.
This rule shares the following common options: exclude_in_macros, exclude_messages_in_system_headers, excludes, extend_exclude_to_macro_invocations, includes, justification_checker, languages, post_processing, provider, report_at, severity
The following places define options that affect this rule: Stylechecks, Analysis-GlobalOptions
This rule has no individual options.