ENV00-A. Do not store the pointer to the string returned by getenv()
ENV01-A. Do not make assumptions about the size of an environment variable
ENV02-A. Beware of multiple environment variables with the same effective name
ENV03-A. Sanitize the environment when invoking external programs
ENV04-A. Do not call system() if you do not need a command processor
ENV30-C. Do not modify the string returned by getenv()
ENV31-C. Do not rely on an environment pointer following an operation that may invalidate it
ENV32-C. No atexit handler should terminate in any way other than by returning
Recommendation |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
ENV00-A |
low |
probable |
medium |
P4 |
L3 |
ENV01-A |
high |
likely |
medium |
P18 |
L1 |
ENV02-A |
low |
unlikely |
medium |
P2 |
L3 |
ENV03-A |
high |
likely |
high |
P9 |
L2 |
ENV04-A |
high |
probable |
medium |
P12 |
L1 |
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
|---|---|---|---|---|---|
ENV30-C |
low |
probable |
medium |
P4 |
L3 |
ENV31-C |
low |
probable |
medium |
P4 |
L3 |
ENV32-C |
medium |
likely |
medium |
P12 |
L1 |
ENV33-C |
medium |
likely |
medium |
P12 |
L1 |
09. Input Output (FIO) ENV00-A. Do not store the pointer to the string returned by getenv()