CWE-1076 is a product whose architecture, source code, design, documentation or other artifact does not follow required conventions. It is a broad quality weakness, and it hits any team that has coding standards and does not enforce them.
How it happens
Conventions exist because someone paid for the lesson. Use symbolic names, not magic numbers. Let the runtime call cleanup methods. Follow naming and layering rules. They get skipped when a deadline looms, one file at a time.
MITRE gives two examples. The first is hard-coded constants in place of symbolic names:
/* Pattern to avoid: the size appears in more than one place */
char buffer[1024];
fgets(buffer, 1024, stdin);
MITRE explains that if the buffer size needs to change, it has to be altered in more than one place. If the developer forgets one occurrence, it could lead to a buffer overflow. The preferred version defines the size once:
enum { MAX_BUFFER_SIZE = 1024 };
char buffer[MAX_BUFFER_SIZE];
fgets(buffer, MAX_BUFFER_SIZE, stdin);
Now one edit updates every reference.
The second example is a Java call to finalize() made explicitly:
// Pattern to avoid: calling finalize() by hand
widget.finalize();
Finalization is meant to be invoked by the runtime, not by application code. Use an explicit close or dispose method that your own class defines instead.
What an attacker gains
MITRE lists reduced maintainability. Breaking conventions makes the product harder to maintain, which "indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities." It also might make it easier to introduce vulnerabilities, as the buffer example shows: a stale size in one spot becomes an overflow.
How to find it
MITRE says automated static analysis (SAST) can find some instances by analyzing source code without running it. Practical checks:
- Run a linter configured with your written standards, and fail the build on violations.
- Search for numeric literals next to buffer and array operations.
- Search for explicit finalize calls in Java.
grep -rn "\.finalize()" --include=*.java .
Try it yourself
A static scan is the quickest way to find convention breaks across a whole repository. This demo shows one at work.
Click through it at your own pace, or open it full screen.
How to fix it
The record lists no mitigations, so these steps are general practice.
- Write the conventions down. Keep the list short enough that people read it.
- Encode them in lint and static analysis rules, so enforcement is automatic.
- Replace magic numbers with named constants, defined once.
- Do not call lifecycle methods meant for the runtime. Provide your own explicit close.
- Fix violations when you touch a file, rather than in one risky sweep.
Conventions apply to what you depend on too. Safeguard's free in-browser scan at gold.safeguard.sh/scan lists known issues in your dependencies from a manifest, needs no login, covers up to 100 dependencies and keeps the file on your machine.
Quick check
How can a hard-coded constant lead to a buffer overflow?
If the size appears in several places and one is missed during a change, a buffer and the read into it can disagree, which allows more data than the buffer holds.
Is this weakness a direct vulnerability?
Not usually. MITRE treats it as a maintainability problem that makes vulnerabilities easier to introduce and harder to fix.
