Inaccurate Source Code Comments
CWE-1116
The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
We track 3 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
How this weakness is prevented
- Implementation: Verify that each comment accurately reflects what is intended to happen during execution of the code.
Latest Inaccurate Source Code Comments vulnerabilities
- 8.6 High severity
refitter: Improper Control of Generation of Code
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verbatim into Refit route attributes such as `[Get("<path>")]` without escaping quotation marks or restricting characters. A
- 7.5 High severity
Pdfzorro: Improper Encoding or Escaping of Output
PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does not properly sanitize this information in all cases, causing redacted information, including images
- 7.8 High severity
Emacs: Improper Encoding or Escaping of Output
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or dir