CWE-1117 covers a function or method whose signature or inline documentation does not sufficiently describe its inputs, outputs, side effects, assumptions or return codes.
MITRE classes it as a quality issue with no direct security implications and prohibits mapping real vulnerabilities to it.
How it happens
The name seemed obvious when it was written. process(data) explains nothing about whether it modifies the data, frees it, trusts it, or returns an error code that callers must check.
What an attacker gains
Nothing directly. MITRE says the issue makes the product harder to maintain, which indirectly affects security by making vulnerabilities more time-consuming to find and fix, and might make them easier to introduce. A caller that does not know a function frees its argument, or returns an error value instead of throwing, is a caller likely to misuse it.
How to find it
The record lists no detection methods. Sample public functions and ask whether a new caller could use them correctly from the signature and comment alone.
How to fix it
The record has no formal mitigations. Write a short summary for each callable that states what it expects, what it returns, what it changes, and how it signals failure. Use types, names and assertions to carry as much of this as possible, so the contract is checked rather than just described.
Quick check
What should a behavioral summary mention?
Inputs, outputs, side effects, assumptions and return codes, which is the list MITRE gives.
