CWE 546

The issue occurs when a comment in your code contains one of these suspicious words:

The matching is case-insensitive. The checker also detects these words when they are prefixed by a symbol such as @, or when they are followed by numbers or a trailing special character. For instance, @TODO, FIXME21, and todo: all trigger a violation.

A function or variable name that contains one of these words does not trigger a violation. The rule checker only flags comments.

Comments containing these words suggest that the code has known problems or unfinished functionality that a developer intended to address later. Shipping code with these markers can indicate missing security checks, incomplete error handling, or unresolved defects. An attacker who gains access to the source code can use these markers to identify weak points.

Resolve the underlying issue described in the comment and remove the suspicious comments. If the comment describes work that is genuinely deferred, track it in an issue tracker and remove the comment from the code.

In this example, Polyspace detects comments that contain suspicious words indicating incomplete or problematic code.

#include <stdlib.h>

void process_data(int *data, int count) {
    /* HACK: skipping validation for now */ // Noncompliant
    for (int i = 0; i < count; i++) {
        data[i] = data[i] * 2;
    }
}

void initialize_buffer(char *buffer, int size) {
    // TODO: add bounds checking // Noncompliant
    for (int i = 0; i < size; i++) {
        buffer[i] = 0;
    }
}

Resolve the issues described in the suspicious comments and remove the markers.

#include <stdlib.h>

void process_data(int *data, int count) {
    /* Input is validated by the caller per API contract */ // Compliant
    for (int i = 0; i < count; i++) {
        data[i] = data[i] * 2;
    }
}

void initialize_buffer(char *buffer, int size) {
    if (buffer == NULL || size <= 0) { // Compliant
        return;
    }
    for (int i = 0; i < size; i++) {
        buffer[i] = 0;
    }
}

Track the issues in an issue tracker and remove the comments.

#include <stdlib.h>

void process_data(int *data, int count) {
    /*  JIRA 12345*/ 
    for (int i = 0; i < count; i++) {
        data[i] = data[i] * 2;
    }
}

void initialize_buffer(char *buffer, int size) {
    // Jira 78942 
    for (int i = 0; i < size; i++) {
        buffer[i] = 0;
    }
}