Source
Use of absolute paths
Summary The system files must be referenced through absolute paths. Description An absolute path provides the complete and unambiguous location of a file or directory from the root of the file system. These paths eliminate ambiguity that may arise ...
Keep low McCabe cyclomatic complexity
Summary The source code must contain functions, methods or fragments of code with a cyclomatic complexity (McCabe) lower than 20. Description The use of McCabe cyclomatic complexity helps to measure how complex a source code is regardless of the ...
Associate type to variables
Summary All variables in the source code should have an associated type. Description The data type of a variable defines the kind of data it can hold, such as integers, floating-point numbers, characters, strings, or custom data structures. Explicit ...
Avoid using generic exceptions
Summary The system should use typified exceptions instead of generic exceptions. Description Catching generic exceptions obscures the problem that caused the error and promotes a generic way to handle different categories or sources of error. This ...
Establish protections against overflows
Summary The system must have protection mechanisms against the different types of overflow (stack, buffer, heap, integer, etc.). Description An overflow occurs when an application receives a value outside of the range that it is prepared to handle. ...
Avoid dynamic code execution
Summary The system should not use dynamic code execution features such as eval(). Description Dynamic code execution features, despite the flexibility they provide, should be used carefully and generally avoided. These features often open the door ...
Validate request parameters
Summary The system must validate the content and length of all request parameters (GET, POST, cookies, headers, etc.), as well as their amount. Description Proper data validation prevents a vast majority of injection attacks. Its implementation ...
Make critical logic flows thread safe
Summary Critical and high-value business logic flows must be thread safe and resistant to time-of-check and time-of-use (TOCTOU) race conditions. Description A race condition occurs when a code sequence requires exclusive access to a resource but ...
Exclude unverifiable files
Summary Binary and other types of files, which are often not audited for security purposes, should not be stored in the source code repository. Description Binary files usually have a file size greater than their source counterpart, which can ...
Declare dependencies explicitly
Summary All dependencies (third-party software/libraries) must be explicitly declared (name and specific version) in a file inside the source code repository. Their source code must not be directly included in the repository. Description The usage of ...
Protect pages from clickjacking
Summary Web pages must be protected from being embedded in malicious sites (clickjacking). Description Clickjacking is a malicious technique often used in phishing attacks. By using it, attackers may deceive users and make them perform actions other ...
Transactions without a distinguishable pattern
Summary Requests that execute transactions must not follow any distinguishable pattern. Description When they are implemented, distinguishable transaction patterns make it easier for malicious actors or unauthorized users to anticipate and exploit ...
Discard unsafe inputs
Summary The system must discard all potentially harmful information received via data inputs. Description Technological devices and, in particular, applications must be able to notice if the received information does not correspond to its operational ...
Encrypt connection strings
Summary The system should load encrypted database connection strings from a protected configuration file that resides separately from the source code. Description Database connection strings are very sensitive information because they contain ...
Remove commented-out code
Summary The source code must not contain commented-out code when it is deployed to the production environment. Description Commented-out code often represents pieces of logic or functionality that is incomplete or used for testing purposes. Leaving ...
Use parameterized queries
Summary The system must use parameterized queries or stored procedures to create dynamic sentences (e.g., java.sql.PreparedStatement). Description One of the main reasons for using parameterized queries or stored procedures is to prevent SQL ...
Initialize variables explicitly
Summary All the variables in the source code must be explicitly initialized. Description Uninitialized variables can lead to undefined behavior, unpredictable outcomes, and potential security vulnerabilities. Explicit initialization helps to mitigate ...
Close unused resources
Summary The source code must implement mechanisms to ensure the closure of any unused open resources. Description By closing unused resources the system ensures optimal resource utilization. Resources are finite, especially those with external ...
Use optimized structures
Summary The code must use optimized data containers or structures. Description Source code must have optimized data structures that can lead to use memory efficiently. By choosing the right data structures for specific tasks, developers can minimize ...
Avoid duplicate code
Summary The source code must not have repeated functions, methods or classes. Description The organization must avoid code duplication because it makes maintenance more difficult. If the same functionality is implemented in multiple places and a ...
Define secure default options
Summary The source code must have secure default options ensuring secure failures in the application (try, catch/except; default for switches). Description The organization must ensure that its own systems and those of third parties are safe and ...
Encode system outputs
Summary The system output must be encoded in the corresponding language (escaping). Description System components use structured messages to communicate with other components. When these messages include input from untrusted sources and this input is ...
Obfuscate code
Summary The source code must be obfuscated in production environments. Description Implementing obfuscation techniques makes it challenging for attackers to reverse engineer the source code. By transforming the code structure and renaming variables, ...
Use a secure programming language
Summary System source code must be implemented in a stable, updated, tested and free of known vulnerabilities version of the chosen programming language. Description Systems that use an updated and secure version of the programming language helps to ...
Use the strict mode
Summary The organization should set its parsers, linters, compilers and interpreters to run in strict mode. Description Systems must use strict mode because it is useful to prevent silent failures that might occur when certain actions, such as using ...
Source code without sensitive information
Summary The source code must not contain sensitive information. Description Sensitive data is often included in the source code during early development stages for practicality or due to a lack of early architecture. This data includes credentials, ...
Application free of malicious code
Summary The application code must be free of malicious code. Description There are several ways in which malicious code may be included in an application. It can be imported as part of third party libraries, which may be intentionally malicious or ...
Eliminate backdoors
Summary The source code of a system must not perform functions other than those specified in the functional requirements (backdoors). Description Sometimes, functionalities other than the ones for which a system was designed are included during ...
Reuse database connections
Summary The system must reuse the database connections. Description If a system reuses existing connections can be useful to improve performance by avoiding the overhead of establishing a new connection for each database interaction. This reduces the ...