Some functions do everything. They call a dozen other components, branch on all the results and quietly become the part of the code nobody wants to touch.
CWE-1048 describes callable control elements that contain an excessively large number of references to other application objects external to the callable. In plain terms, the fan out value is too high. MITRE lists it as a Base weakness in any language.
How it happens
Fan out grows when a function becomes a coordinator for a whole workflow, such as a request handler that validates, loads, authorizes, calculates, saves, notifies and logs in one body.
MITRE notes the meaning of excessively large varies, and that CISQ recommends a default of 5 referenced objects.
def handle_checkout(req):
user = users.load(req)
cart = carts.load(user)
prices = pricing.compute(cart)
tax = taxes.compute(cart, user)
stock = inventory.reserve(cart)
pay = payments.charge(user, prices, tax)
mail.send_receipt(user, pay)
audit.write(user, pay)
The consequences MITRE records are reduced maintainability and increased analytical complexity. The issue makes the product harder to maintain, which indirectly affects security by making vulnerabilities harder and slower to find and fix, and it might make vulnerabilities easier to introduce. No CVEs are observed.
For reviewers, it means more to hold in mind at once. A missing authorization step is easy to overlook in a long body.
How to find it
MITRE lists no detection methods. Code metrics tools report fan out per function. Sort by the highest values and review those first, especially the ones near security decisions.
How to fix it
MITRE lists no formal mitigations. Reasonable steps:
- Split large functions into steps with clear names.
- Group related calls behind a single focused component.
- Make security checks a distinct, early and obvious step.
- Set a team threshold and check it in review.
Quick check
What is fan out?
The number of other application objects a callable references from outside its own context.
