Copy and paste is fast. It is also how a bug gets fixed in one place and left alive in another.
CWE-1041 is the weakness where the product has multiple functions, methods, procedures or macros that contain the same code. MITRE lists it as a Base weakness in any language.
How it happens
Duplicates build up when a developer copies a working routine into a new module instead of sharing it, when two teams solve the same problem independently, or when a fork drifts from its source. Each copy then lives its own life.
The MITRE consequence is about maintainability, with an indirect security effect: the issue makes it more difficult and time consuming to find and fix vulnerabilities. For example, if there are two copies of the same code, the programmer might fix a weakness in one copy but forget the other.
A short illustration in Python:
# Two copies of the same check in different modules
def is_safe_path_a(base, p):
return p.startswith(base)
def is_safe_path_b(base, p):
return p.startswith(base)
If that check later turns out to be flawed, both places need the repair. A single shared function needs one.
How to find it
MITRE lists automated static analysis as a way to find some instances. Duplicate code detectors do this well. You can also search for distinctive lines of a known bad routine across the whole repository after you find a bug, which is a useful habit.
How to fix it
MITRE's mitigation: merge common functionality into a single function and call it from across the entire code base.
- Extract the shared logic into one well tested function.
- Replace every copy with a call to it.
- After a vulnerability fix, search for copies of the old pattern.
- Run a duplicate detector in CI and review the results.
The same logic applies to dependencies. If you vendor a copy of a library, it will not get upstream fixes. The free in-browser scan at gold.safeguard.sh/scan checks up to 100 dependencies with no login.
Quick check
How does duplication become a security problem?
A weakness may be fixed in one copy and forgotten in another, and the extra copies make fixes slower to find and apply.
