373
Nature Type ID Name Page
MemberOf 857 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 14 - Input Output (FIO)
844 2368
MemberOf 884 CWE Cross-section 884 2567
MemberOf 974 SFP Secondary Cluster: Incorrect Buffer Length
Computation
888 2406
MemberOf 1408 Comprehensive Categorization: Incorrect Calculation 1400 2534
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Improper string length checking
The CERT Oracle Secure
Coding Standard for Java
(2011)
FIO10-J Ensure the array is filled when using
read() to fill an array
Software Fault Patterns SFP10 Incorrect Buffer Length Computation
References
[REF-7]Michael Howard and David LeBlanc. "Writing Secure Code". 2nd Edition. 2002
December 4. Microsoft Press. < https://www.microsoftpressstore.com/store/writing-securecode-
9780735617223 >.
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
CWE-138: Improper Neutralization of Special Elements
Weakness ID : 138
Structure : Simple
Abstraction : Class
Description
The product receives input from an upstream component, but it does not neutralize or incorrectly
neutralizes special elements that could be interpreted as control elements or syntactic markers
when they are sent to a downstream component.
Extended Description
Most languages and protocols have their own special elements such as characters and reserved
words. These special elements can carry control implications. If product does not prevent external
control or influence over the inclusion of such special elements, the control flow of the program may
be altered from what was intended. For example, both Unix and Windows interpret the symbol <
("less than") as meaning "read input from a file".
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 707 Improper Neutralization 1546
ParentOf 140 Improper Neutralization of Delimiters 376
ParentOf 147 Improper Neutralization of Input Terminators 389
ParentOf 148 Improper Neutralization of Input Leaders 391
ParentOf 149 Improper Neutralization of Quoting Syntax 392
CWE Version 4.14
CWE-138: Improper Neutralization of Special Elements
CWE-138: Improper Neutralization of Special Elements