{"@ID": "741", "@Name": "CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).", "Relationships": {"Has_Member": [{"@CWE_ID": "119", "@View_ID": "734"}, {"@CWE_ID": "120", "@View_ID": "734"}, {"@CWE_ID": "135", "@View_ID": "734"}, {"@CWE_ID": "170", "@View_ID": "734"}, {"@CWE_ID": "193", "@View_ID": "734"}, {"@CWE_ID": "464", "@View_ID": "734"}, {"@CWE_ID": "686", "@View_ID": "734"}, {"@CWE_ID": "704", "@View_ID": "734"}, {"@CWE_ID": "78", "@View_ID": "734"}, {"@CWE_ID": "88", "@View_ID": "734"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-597"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Notes": {"Note": {"@Type": "Relationship", "xhtml:p": "In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:", "xhtml:ul": {"xhtml:li": ["CWE-78 STR02-C Sanitize data passed to complex subsystems", "CWE-88 STR02-C Sanitize data passed to complex subsystems", "CWE-119 STR31-C Guarantee that storage for strings has sufficient space for character data and the null terminator", "CWE-119 STR32-C Null-terminate byte strings as required", "CWE-119 STR33-C Size wide character strings correctly", "CWE-120 STR35-C Do not copy data from an unbounded source to a fixed-length array", "CWE-135 STR33-C Size wide character strings correctly", "CWE-170 STR03-C Do not inadvertently truncate a null-terminated byte string", "CWE-170 STR32-C Null-terminate byte strings as required", "CWE-193 STR31-C Guarantee that storage for strings has sufficient space for character data and the null terminator", "CWE-464 STR03-C Do not inadvertently truncate a null-terminated byte string", "CWE-464 STR06-C Do not assume that strtok() leaves the parse string unchanged", "CWE-686 STR37-C Arguments to character handling functions must be representable as an unsigned char", "CWE-704 STR34-C Cast characters to unsigned types before converting to larger integer sizes", "CWE-704 STR37-C Arguments to character handling functions must be representable as an unsigned char"]}, "#text_blocks": ["In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:", "CWE-78 STR02-C Sanitize data passed to complex subsystems", "CWE-88 STR02-C Sanitize data passed to complex subsystems", "CWE-119 STR31-C Guarantee that storage for strings has sufficient space for character data and the null terminator", "CWE-119 STR32-C Null-terminate byte strings as required", "CWE-119 STR33-C Size wide character strings correctly", "CWE-120 STR35-C Do not copy data from an unbounded source to a fixed-length array", "CWE-135 STR33-C Size wide character strings correctly", "CWE-170 STR03-C Do not inadvertently truncate a null-terminated byte string", "CWE-170 STR32-C Null-terminate byte strings as required", "CWE-193 STR31-C Guarantee that storage for strings has sufficient space for character data and the null terminator", "CWE-464 STR03-C Do not inadvertently truncate a null-terminated byte string", "CWE-464 STR06-C Do not assume that strtok() leaves the parse string unchanged", "CWE-686 STR37-C Arguments to character handling functions must be representable as an unsigned char", "CWE-704 STR34-C Cast characters to unsigned types before converting to larger integer sizes", "CWE-704 STR37-C Arguments to character handling functions must be representable as an unsigned char"]}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2008-11-24", "Submission_Version": "1.1", "Submission_ReleaseDate": "2008-11-24"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Description, Name, Relationship_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Description, Name, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}], "Previous_Entry_Name": [{"@Date": "2017-11-08", "#text": "CERT C Secure Coding Section 07 - Characters and Strings (STR)"}, {"@Date": "2019-01-03", "#text": "CERT C Secure Coding (2008 Version) Section 07 - Characters and Strings (STR)"}]}, "entry_type": "Grouping"}