Common Weakness Enumeration (CWE)

The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element.

The product does not have documentation that represents how it is designed.

The code at one architectural layer invokes code that resides at a deeper layer than the adjacent layer, i.e., the invocation skips at least one layer, and the invoked code is not part of a vertical utility layer that can be referenced from any horizontal layer.

The product performs too many data queries without using efficient data processing functionality such as stored procedures.

The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.

The code has a parent class that contains references to a child class, its methods, or its members.

A static code block creates an instance of a class.

The product contains a function, subroutine, or method whose signature has an unnecessarily large number of parameters/arguments.

The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.

An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.

The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable.

The source code contains a block that does not contain any code, i.e., the block is empty.

The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.

A class has an inheritance level that is too high, i.e., it has a large number of parent classes.

The product performs unconditional control transfer (such as a "goto") in code outside of a branching structure such as a switch block.

A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

A source code file has too many lines of code.

The code contains a class instance that calls the method or function to delete or destroy itself.

A function or method contains too many operations that utilize a data manager or file resource.

A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body.

A class contains an unnecessarily large number of children.

A class contains a virtual method, but the method does not have an associated virtual destructor.

The product uses a large data table that contains an excessively large number of indices.

A method for a class performs an operation that directly accesses a member element from another class.

The product uses the same control element across multiple architectural layers.