Secure Coding Guidelines: The Top 25 CWE Weaknesses Every Developer Must Know

Top 25 CWE Weaknesses

The Common Weakness Enumeration (CWE) Top 25 represents the most dangerous software weaknesses. These are the coding mistakes that lead to the most serious vulnerabilities.

Critical Weaknesses and Prevention

CWE-787: Out-of-bounds Write

Buffer overflow allowing code execution.

// VULNERABLE
char buffer[10];
strcpy(buffer, user_input);  // No bounds checking

// SECURE
strncpy(buffer, user_input, sizeof(buffer) - 1);
buffer[sizeof(buffer) - 1] = '\0';

CWE-79: Cross-Site Scripting (XSS)

Output encoding prevents injection:

// VULNERABLE
element.innerHTML = userInput;

// SECURE
element.textContent = userInput;

CWE-89: SQL Injection

Use parameterized queries:

# VULNERABLE
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

# SECURE
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

CWE-862: Missing Authorization

Always verify permissions:

# VULNERABLE
@app.get("/api/documents/{doc_id}")
def get_document(doc_id):
    return db.find(doc_id)

# SECURE
@app.get("/api/documents/{doc_id}")
def get_document(doc_id, current_user):
    doc = db.find(doc_id)
    if doc.owner_id != current_user.id:
        raise HTTPException(403)
    return doc

CWE-434: Unrestricted Upload

Validate file uploads:

ALLOWED_EXTENSIONS = {'.jpg', '.png', '.pdf'}
MAX_SIZE = 10 * 1024 * 1024  # 10MB

def validate_upload(file):
    ext = os.path.splitext(file.filename)[1].lower()
    if ext not in ALLOWED_EXTENSIONS:
        raise ValueError("Invalid file type")
    if file.size > MAX_SIZE:
        raise ValueError("File too large")
    # Check magic bytes, not just extension
    validate_magic_bytes(file)

Secure Coding Principles

1. Input validation at every boundary
2. Output encoding based on context
3. Parameterized queries for all database interactions
4. Least privilege for all operations
5. Defense in depth: multiple layers of protection
6. Fail securely: errors should deny access, not grant it
7. Don't trust any external input

SuperClue Secure Coding Module

SuperClue finds many of these weaknesses through its SAST and DAST scans and its AI Code Security Analysis, which tags findings with CWE IDs. Its Academy's Web App Security course covers secure coding.