CWE-546, Suspicious Comment, is a weakness about what your own code admits. MITRE says the code contains comments that suggest the presence of bugs, incomplete functionality or weaknesses.
It is a quality signal more than an exploit. But the signal is worth reading.
How it happens
Developers leave markers when they plan to come back. MITRE lists the usual suspects: BUG, HACK, FIXME, LATER, LATER2 and TODO. Many of them, MITRE notes, indicate missing security functionality and checking. Others point to code problems programmers should fix, such as hard-coded variables, error handling, not using stored procedures, and performance issues.
# TODO: check that the user owns this invoice
def get_invoice(invoice_id):
return db.fetch_invoice(invoice_id)
That comment describes a missing authorization check. It also advertises it to anyone who can read the source.
What an attacker gains
MITRE frames the consequence as quality degradation. Suspicious comments may indicate problems in the source code that need fixing, and a sign of poor quality can lead to further bugs and the introduction of weaknesses. If the comments are visible to outsiders, they work as a guide to where the gaps are.
How to find it
- Search the codebase for the markers above: BUG, HACK, FIXME, TODO, LATER.
- Read each result with security in mind. Does it mark a missing check, a hard-coded value, or skipped error handling?
- MITRE notes static analysis can find some instances of this weakness, and a simple grep gets most of them.
grep -rnE "FIXME|HACK|TODO|BUG|LATER" src/
How to fix it
MITRE's mitigation, under documentation, is to remove comments that suggest the presence of bugs, incomplete functionality or weaknesses before deploying the application. The better path is to resolve what they describe:
- Triage each marker. If it describes a security gap, fix it or open a tracked issue.
- Delete the comment only after the work is done or tracked elsewhere.
- Make the release pipeline list new markers so they get seen.
- Strip comments from anything shipped to a browser.
Quick check
Is deleting the comment the fix?
Removing it stops the advertisement but not the problem. Fix the gap or track it, then clear the comment.
