CWE-1084, Invokable Control Element with Excessive File or Data Access Operations, describes a function or method that contains too many operations using a data manager or file resource.
MITRE notes that the right limit varies by team. The CISQ quality standard recommends a default maximum of 7 operations on the same data manager or file. The entry is a quality issue with no direct security implications, and MITRE prohibits using it to map real vulnerabilities.
How it happens
A function starts with one query. Then it needs a second lookup, a status update, an audit insert, a cleanup delete. Each addition feels small. Eventually one function opens a file, reads it, writes it, and runs a dozen statements against the same table.
# Smell: one function, many operations on the same table
def close_account(account_id):
db.execute("SELECT ...")
db.execute("UPDATE ...")
db.execute("INSERT ...")
db.execute("DELETE ...")
# and several more
What an attacker gains
Nothing directly. MITRE lists reduced maintainability and says the issue indirectly affects security by making it harder or slower to find and fix vulnerabilities. A function with many data operations also has many places where a missed check or a half applied change can hide.
How to find it
Static analysis and code metrics can count data and file operations per function. Without tooling, search for long functions that call the database driver repeatedly and review the worst few.
How to fix it
- Group related operations into smaller functions with one clear job.
- Move repeated access into the data layer so the function states intent, not mechanics.
- Use a single transaction or a single well formed query where several statements do one logical task.
- Cover the refactor with tests before you change behavior.
Quick check
What default threshold does MITRE cite for this weakness?
The CISQ recommendation of a maximum of 7 operations on the same data manager or file, though teams may choose differently.
