1608
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Data should be private, static, and final whenever possible. This will assure that your code is
protected by instantiating early, preventing access, and preventing tampering.
Demonstrative Examples
Example 1:
The following example declares a critical variable public, making it accessible to anyone with
access to the object in which it is contained.
Example Language: C++ (Bad)
public: char* password;
Instead, the critical data should be declared private.
Example Language: C++ (Good)
private: char* password;
Even though this example declares the password to be private, there are other possible issues
with this implementation, such as the possibility of recovering the password from process memory
(CWE-257).
Example 2:
The following example shows a basic user account class that includes member variables for the
username and password as well as a public constructor for the class and a public method to
authorize access to the user account.
Example Language: C++ (Bad)
#define MAX_PASSWORD_LENGTH 15
#define MAX_USERNAME_LENGTH 15
class UserAccount
{
public:
UserAccount(char *username, char *password)
{
if ((strlen(username) > MAX_USERNAME_LENGTH) ||
(strlen(password) > MAX_PASSWORD_LENGTH)) {
ExitError("Invalid username or password");
}
strcpy(this->username, username);
strcpy(this->password, password);
}
int authorizeAccess(char *username, char *password)
{
if ((strlen(username) > MAX_USERNAME_LENGTH) ||
(strlen(password) > MAX_PASSWORD_LENGTH)) {
CWE Version 4.14
CWE-766: Critical Data Element Declared Public
CWE-766: Critical Data Element Declared Public