1956
This issue makes it more difficult to maintain the product, which indirectly affects security by
making it more difficult or time-consuming to find and/or fix vulnerabilities. It also might make it
easier to introduce vulnerabilities.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1078 Inappropriate Source Code Style or Formatting 1918
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1006 Bad Coding Practices 2422
Weakness Ordinalities
Indirect :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Reduce Maintainability
Potential Mitigations
Phase: Implementation
Verify that each comment accurately reflects what is intended to happen during execution of the
code.
Demonstrative Examples
Example 1:
In the following Java example the code performs a calculation to determine how much medicine
to administer. A comment is provided to give insight into what the calculation shoud be doing.
Unfortunately the comment does not match the actual code and thus leaves the reader to wonder
which is correct.
Example Language: Java (Bad)
public class Main {
public static void main(String[] args) {
int pt_weight = 83;
int mg_per_kg = 3;
int daily_dose = 0;
// Add the patient weight and Mg/Kg to calculate the correct daily dose
daily_dose = pt_weight * mg_per_kg;
return dosage;
}
}
In the correction below, the code functionality has been verified, and the comment has been
corrected to reflect the proper calculation.
CWE Version 4.14
CWE-1117: Callable with Insufficient Behavioral Summary
CWE-1117: Callable with Insufficient Behavioral Summary