CWE-1064 is a function, subroutine or method whose signature has an unnecessarily large number of parameters. Every language has this problem, and it tends to grow in long-lived code where one more flag is always easier than a redesign.
How it happens
A function starts with two arguments. Each new requirement adds one. Eventually callers pass nine values, several of the same type, and swapping two of them compiles fine.
MITRE notes that what counts as large varies by product, and that CISQ recommends a default maximum of 7 parameters.
# Pattern to avoid: easy to pass arguments in the wrong order
def create_user(name, email, role, active, admin, team, region, tier):
...
# Better: group related values into one typed object
from dataclasses import dataclass
@dataclass
class NewUser:
name: str
email: str
role: str
active: bool = True
admin: bool = False
team: str = ""
region: str = ""
tier: str = "standard"
def create_user(user: NewUser):
...
Notice the risk in the first version: admin and active are both booleans, and a swapped pair grants privileges silently.
What an attacker gains
MITRE lists reduced maintainability and increased analytical complexity. The issue "indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities" and "might make it easier to introduce vulnerabilities."
How to find it
MITRE says automated static analysis (SAST) can find some instances. Most linters have a maximum arguments rule you can set to 7.
How to fix it
- Group related parameters into a named object.
- Split the function if it does several jobs.
- Use named arguments so callers cannot confuse the order.
- Enable a linter rule so new long signatures fail review.
Quick check
What maximum does CISQ recommend by default?
7 parameters, though the right limit can vary by product.
