{"id":1088,"date":"2010-02-18T22:41:19","date_gmt":"2010-02-18T21:41:19","guid":{"rendered":"http:\/\/www.mitternachtshacking.de\/blog\/1088-top-25-most-dangerous-programming-errors-2010"},"modified":"2010-03-01T22:53:18","modified_gmt":"2010-03-01T21:53:18","slug":"top-25-most-dangerous-programming-errors-2010","status":"publish","type":"post","link":"https:\/\/www.mitternachtshacking.de\/blog\/1088-top-25-most-dangerous-programming-errors-2010","title":{"rendered":"Top 25 Most Dangerous Programming Errors 2010"},"content":{"rendered":"

Mir sind zuf\u00e4llig zwei Links sehr zeitnah in die H\u00e4nde gefallen: die Top 25 Programmierfehler<\/a> und die Top 25 Ausreden der Programmierer<\/a>. Da lag es irgendwie nahe, aus diesen beiden Tabellen eine gemeinsame zu machen \ud83d\ude09<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Rank<\/th>\nScore<\/th>\nID<\/th>\nName<\/th>\nExcuse<\/th>\n<\/tr>\n
[1]<\/td>\n346<\/td>\nCWE-79<\/td>\nFailure to Preserve Web Page Structure (‚Cross-site Scripting‘)<\/td>\nOf course, I just have to do these small fixes.<\/td>\n<\/tr>\n
[2]<\/td>\n330<\/td>\nCWE-89<\/td>\nImproper Sanitization of Special Elements used in an SQL Command (‚SQL Injection‘)<\/td>\nIt will be done in no time at all.<\/td>\n<\/tr>\n
[3]<\/td>\n273<\/td>\nCWE-120<\/td>\nBuffer Copy without Checking Size of Input (‚Classic Buffer Overflow‘)<\/td>\nDidn’t I fix it already?<\/td>\n<\/tr>\n
[4]<\/td>\n261<\/td>\nCWE-352<\/td>\nCross-Site Request Forgery (CSRF)<\/td>\nHow is this possible?<\/td>\n<\/tr>\n
[5]<\/td>\n219<\/td>\nCWE-285<\/td>\nImproper Access Control (Authorization)<\/td>\nWell, the program needs some fixing.<\/td>\n<\/tr>\n
[6]<\/td>\n202<\/td>\nCWE-807<\/td>\nReliance on Untrusted Inputs in a Security Decision<\/td>\nIt’s already there, but it has not been tested.<\/td>\n<\/tr>\n
[7]<\/td>\n197<\/td>\nCWE-22<\/td>\nImproper Limitation of a Pathname to a Restricted Directory (‚Path Traversal‘)<\/td>\nI’m almost ready.<\/td>\n<\/tr>\n
[8]<\/td>\n194<\/td>\nCWE-434<\/td>\nUnrestricted Upload of File with Dangerous Type<\/td>\nThe user has made an error again.<\/td>\n<\/tr>\n
[9]<\/td>\n188<\/td>\nCWE-78<\/td>\nImproper Sanitization of Special Elements used in an OS Command (‚OS Command Injection‘)<\/td>\nThere is something wrong in your test data.<\/td>\n<\/tr>\n
[10]<\/td>\n188<\/td>\nCWE-311<\/td>\nMissing Encryption of Sensitive Data<\/td>\nYes yes, it will be ready in time.<\/td>\n<\/tr>\n
[11]<\/td>\n176<\/td>\nCWE-798<\/td>\nUse of Hard-coded Credentials<\/td>\nYou must have the wrong executable.<\/td>\n<\/tr>\n
[12]<\/td>\n158<\/td>\nCWE-805<\/td>\nBuffer Access with Incorrect Length Value<\/td>\nI can’t test everything!<\/td>\n<\/tr>\n
[13]<\/td>\n157<\/td>\nCWE-98<\/td>\nImproper Control of Filename for Include\/Require Statement in PHP Program (‚PHP File Inclusion‘)<\/td>\nI have not touched that module!<\/td>\n<\/tr>\n
[14]<\/td>\n156<\/td>\nCWE-129<\/td>\nImproper Validation of Array Index<\/td>\nI’ve never heard about that.<\/td>\n<\/tr>\n
[15]<\/td>\n155<\/td>\nCWE-754<\/td>\nImproper Check for Unusual or Exceptional Conditions<\/td>\nIt did work yesterday.<\/td>\n<\/tr>\n
[16]<\/td>\n154<\/td>\nCWE-209<\/td>\nInformation Exposure Through an Error Message<\/td>\nStrange…<\/td>\n<\/tr>\n
[17]<\/td>\n154<\/td>\nCWE-190<\/td>\nInteger Overflow or Wraparound<\/td>\nThe machine seems to be broken.<\/td>\n<\/tr>\n
[18]<\/td>\n153<\/td>\nCWE-131<\/td>\nIncorrect Calculation of Buffer Size<\/td>\nSomebody must have changed my code.<\/td>\n<\/tr>\n
[19]<\/td>\n147<\/td>\nCWE-306<\/td>\nMissing Authentication for Critical Function<\/td>\nIt works, but it’s not been tested.<\/td>\n<\/tr>\n
[20]<\/td>\n146<\/td>\nCWE-494<\/td>\nDownload of Code Without Integrity Check<\/td>\nThere must be a virus in the application software.<\/td>\n<\/tr>\n
[21]<\/td>\n145<\/td>\nCWE-732<\/td>\nIncorrect Permission Assignment for Critical Resource<\/td>\nHas the operating system been updated?<\/td>\n<\/tr>\n
[22]<\/td>\n145<\/td>\nCWE-770<\/td>\nAllocation of Resources Without Limits or Throttling<\/td>\nEven though it does not work, how does it feel?<\/td>\n<\/tr>\n
[23]<\/td>\n142<\/td>\nCWE-601<\/td>\nURL Redirection to Untrusted Site (‚Open Redirect‘)<\/td>\nTHIS can’t do THAT.<\/td>\n<\/tr>\n
[24]<\/td>\n141<\/td>\nCWE-327<\/td>\nUse of a Broken or Risky Cryptographic Algorithm<\/td>\nOh, it’s just a feature.<\/td>\n<\/tr>\n
[25]<\/td>\n138<\/td>\nCWE-362<\/td>\nRace Condition<\/td>\nIt’s just some unlucky coincidense.<\/td>\n<\/tr>\n<\/table>\n

Und meine Vorhersage f\u00fcr 2010, 2011 und 2012: das wird sich nicht bessern!<\/p>\n","protected":false},"excerpt":{"rendered":"

Mir sind zuf\u00e4llig zwei Links sehr zeitnah in die H\u00e4nde gefallen: die Top 25 Programmierfehler und die Top 25 Ausreden der Programmierer. Da lag es irgendwie nahe, aus diesen beiden Tabellen eine gemeinsame zu machen \ud83d\ude09 Rank Score ID Name Excuse [1] 346 CWE-79 Failure to Preserve Web Page Structure (‚Cross-site Scripting‘) Of course, I […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,6],"tags":[],"_links":{"self":[{"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/posts\/1088"}],"collection":[{"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/comments?post=1088"}],"version-history":[{"count":0,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/posts\/1088\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/media?parent=1088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/categories?post=1088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mitternachtshacking.de\/blog\/wp-json\/wp\/v2\/tags?post=1088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}