CQE-134: Format String Improper Input Neutralization

 
Format String Improper Input Neutralization
[an error occurred while processing this directive] Definition in a New Window Definition in a New Window
Quality Issue ID: 134 Maturity: Preliminary
+ Description

Description Summary

This pattern identifies situations where an external value is entered into the application through the user interface ReadsUI action, transformed throughout the application along the sequence composed of ActionElements with DataRelations relations, some of which being part of named callable and method control elements, and ultimately used in the formatting statement; none of the callable or method control element of the transformation sequence being a vetted sanitization control element from the list of vetted sanitization control elements.
+ Relationships
NatureTypeIDNameView(s) this relationship pertains to
View
ChildOf
Ch
Characteristic
9115Security
Default Graph (primary)9001
ChildOf
Pr
Practice
9129Output Formatting Control
Quality Issues Organized by Practices (primary)9002
CanPrecede
Co
Consequence
9017Arbitrary Code Execution
Default Graph (primary)9001
CanPrecede
Co
Consequence
9189Information Disclosure
Default Graph (primary)9001

Related Taxonomy Entries

TaxonomyVersionRelated ID
ASCSM1ASCSM-CWE-134
CWE2.11134
+ References
"Automated Source Code Security Measure (ASCSM)". ASCSM-CWE-134. v1.0. Object Management Group (OMG). 2016-01-01. <http://www.omg.org/spec/ASCSM/1.0/>.
Page Last Updated or Reviewed: October 01, 2017