A string or table written straight into initialization code is easy to write and hard to find later.
CWE-1052 is the weakness where the product initializes a data element using a hard-coded literal that is not a simple integer or static constant element. MITRE lists it as a Base weakness in any language.
How it happens
Long literals, such as a list of values, a message template or a block of settings, get pasted directly into the place they are first used.
# Literal buried in initialization
allowed = ["png", "jpg", "gif", "bmp", "tiff", "webp"]
# Named constant in one place
ALLOWED_IMAGE_TYPES = ("png", "jpg", "gif", "bmp", "tiff", "webp")
allowed = ALLOWED_IMAGE_TYPES
MITRE's recorded consequence is reduced maintainability. The issue makes the product harder to modify, which indirectly affects security by making vulnerabilities harder and slower to find and fix, and it might make vulnerabilities easier to introduce. No CVEs are observed.
The security angle is practical. If a rule such as an allow list lives in several unlabeled places, a fix applied to one place leaves the others unchanged.
How to find it
MITRE lists no detection methods. Static analysis and code search for long literals in initializers will find many cases. Pay attention to literals that encode security rules.
How to fix it
MITRE lists no formal mitigations. Reasonable steps:
- Give each literal a descriptive constant name and define it once.
- Move values that change between deployments to configuration.
- Keep security relevant lists in a single reviewed location.
- Add tests that reference the constant.
Quick check
How does this relate to the redundant code weakness?
Both make fixes harder to apply everywhere. See CWE-1041 for duplicated code.
