CWE-1100, Insufficient Isolation of System-Dependent Functions, applies when a product or code does not isolate system dependent functionality into separate standalone modules.
MITRE allows this entry for mapping real vulnerabilities, with careful reading of its description.
How it happens
Code that touches the operating system, such as file paths, process launching, permissions or networking calls, ends up inline across the code base. Platform checks show up everywhere.
/* Smell: platform branches mixed into business logic */
void save_report(const char* name) {
#ifdef _WIN32
char path[260];
sprintf(path, "C:\\reports\\%s", name);
#else
char path[256];
sprintf(path, "/var/reports/%s", name);
#endif
write_file(path);
}
Different buffer sizes, different separators and different permission rules are now tangled with the report logic. Any fix has to be repeated for every platform, in every place.
A cleaner design puts the platform differences behind one small interface.
/* platform.h: one place that knows about the operating system */
int platform_report_path(const char* name, char* out, size_t out_len);
Callers use the interface. Each platform implements it once, with bounds checked formatting, and the report code never mentions the operating system.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability and portability, with the indirect effect of making vulnerabilities harder and slower to find and fix. The practical risk is a security fix applied on one platform branch and missed on the other.
How to find it
The record lists no detection methods. Search for platform macros and operating system calls outside a small set of files, and count them. A high number outside the platform layer is the signal.
How to fix it
- Create a thin platform layer for file system, process and network operations.
- Keep business logic free of platform checks.
- Test the platform layer on every supported platform.
- When you patch a security issue in it, you patch one place.
Quick check
Why does platform specific code scattered everywhere hurt security?
A fix must be applied in many places and on every platform. Missing one leaves a vulnerable path in the product.
