1260
Scope Impact Likelihood
The existence of hardcoded constants could cause
unexpected behavior and the introduction of weaknesses
during code maintenance or when making changes to
the code if all occurrences are not modified. The use of
hardcoded constants is an indication of poor quality.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Avoid using hard-coded constants. Configuration files offer a more flexible solution.
Demonstrative Examples
Example 1:
The usage of symbolic names instead of hard-coded constants is preferred.
The following is an example of using a hard-coded constant instead of a symbolic name.
Example Language: C (Bad)
char buffer[1024];
...
fgets(buffer, 1024, stdin);
If the buffer value needs to be changed, then it has to be altered in more than one place. If the
developer forgets or does not find all occurrences, in this example it could lead to a buffer overflow.
Example Language: C (Good)
enum { MAX_BUFFER_SIZE = 1024 };
...
char buffer[MAX_BUFFER_SIZE];
...
fgets(buffer, MAX_BUFFER_SIZE, stdin);
In this example the developer will only need to change one value and all references to the buffer
size are updated, as a symbolic name is used instead of a hard-coded constant.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 736 CERT C Secure Coding Standard (2008) Chapter 3 -
Declarations and Initialization (DCL)
734 2341
MemberOf 884 CWE Cross-section 884 2567
MemberOf 950 SFP Secondary Cluster: Hardcoded Sensitive Data 888 2396
CWE Version 4.14
CWE-548: Exposure of Information Through Directory Listing
CWE-548: Exposure of Information Through Directory Listing