...
Pages that need work have an incomplete tag.
Pages that need to be deleted have a deleteme tag.
Pages that need to be reviewed have an review tag.
I moved the Incomplete pages in C++ pages to have use their own incomplete-cpp tag since it looks to me like we are not focusing on them just yet. -alexv
Thanks, that will help. -rCs
Incomplete pages in Java use their own In the same vein, I changed the incomplete java pages to use 'incomplete-java' tag. There are now exactly 3 incomplete rules. -svoboda
...
Pages now have tags to indicate the status of their corresponding checker in Compass Rose.
Complete rules are tagged rose-complete.
...
As per Douglas's comment INT11-A. Do not make assumptions about the layout of bit-field structures has no business being in INT... should we move it to DCL? (Alternatively we need better examples that aren't solved by ARR37-C. Do not add or subtract an integer to a pointer to a non-array object)- alexv 5/14
I was delaying action on this because Dan Saks was going to work on it. -rCs
Forward/back links as well as the "CERT Website" link need to be constantly looked over
last checked 5/20 -alexv
...
References at the bottom of rules need a lot of work, here are some problem pages (based on broken/non-existent links)
- PRE07-A. Avoid using repeated question marks
- PRE10-A. Wrap multi-statement macros in a do-while loop
- FLP00-A. Consider avoiding floating point numbers when precise computation is needed
- FLP02-A. Understand the caveats of floating point exceptions
- ARR35-C. Do not allow loops to iterate beyond the end of an array
- STR06-A. Do not assume that strtok() leaves the parse string unchanged
- SIG00-A. Mask signals handled by non-interruptible signal handlers (openBSD link)
- SIG30-C. Call only asynchronous-safe functions within signal handlers (openBSD link)
- SIG31-C. Do not access or modify shared objects in signal handlers (openBSD link)
- SIG32-C. Do not call longjmp() from inside a signal handler
- SIG33-C. Do not recursively invoke the raise() function
- ERR30-C. Set errno to zero before calling a function, and use it only after the function returns a value indicating failure
- MSC08-A. Library functions should validate their parameters
- POS36-C. Observe correct revocation order while relinquishing privileges
The Risk Assessment Summary tables for each section need to be updated (they are out of date with the actual rules).
...
...
...