Code should be stripped out of suspicious comments

[vc_row][vc_column width=”1/1″ animate=”false” effect=”fade” margin_b=”true” text_align=”left” pl=”40″ pr=”40″ pt=”0″ pb=”0″][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

Code should be stripped out of suspicious comments (e.g. todo, tbd, tbc, etc.)

[/vc_column_text][nz_btn text=”Software Agility” link=”http://casthighlight.wpengine.com/category/product/indicators-methodology/code-insights/software-agility/” target=”_self” animate=”false” animation_type=”ghost” color=”pink” size=”small” shape=”rounded” type=”normal” hover_normal=”fill” hover_ghost=”fill”][nz_btn text=”Embedded Documentation” link=”http://casthighlight.wpengine.com/category/product/indicators-methodology/code-insights/software-agility/embedded-documentation/” target=”_self” animate=”false” animation_type=”ghost” color=”black” size=”small” shape=”rounded” type=”ghost” hover_normal=”fill” hover_ghost=”fill”][vc_empty_space height=”32px”][vc_separator color=”grey” align=”align_center”][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″] This code insight counts the number of occurences where suspicious keywords are found in comments. Based on the number of cases and associated with specific thresholds CAST has defined, Highlight counts penalty points to the scanned file.

Keywords that are taken into account by this code insight:
– two or more successive ! and/or ? (e.g. what is this code doing???!!!)
– todo, fixme, tdc (to be confirmed), tbd (to be defined), attention[/vc_column_text][vc_separator color=”grey” align=”align_center”][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

Why you should care

Sometimes, comments that are left by developers translate their doubts, questions or emotions about the code they’re working on. Having some suspicious comments, especially in production code, could indicate a component is not totally finalized, not really mature yet or -more worrying – that may contain a bug. There’s nothing worse than a bug that pops up in production and when the team investigates it they find a comment saying “todo”.

References:
https://cwe.mitre.org/data/definitions/546.html [/vc_column_text][vc_separator color=”grey” align=”align_center” style=”” border_width=”” el_width=””][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

CAST recommendations

As recommended by MITRE (CWE-546), a potential mitigation would be to remove comments that suggest the presence of bugs, incomplete functionality, or weaknesses, before deploying the application.[/vc_column_text][vc_separator color=”grey” align=”align_center” style=”” border_width=”” el_width=””][vc_column_text pl=”0″ pr=”0″ pt=”0″ pb=”0″]

About CAST and Highlight’s Code Insights

Over the last 25 years, CAST has leveraged unique knowledge on software quality measurement by analyzing thousands of applications and billions of lines of code. Based on this experience and community standards on programming best practices, Highlight implements hundreds of code insights across 15+ technologies to calculate health factors of a software.[/vc_column_text][nz_btn text=”How it works” link=”http://casthighlight.wpengine.com/how-it-works/” target=”_self” animate=”true” animation_type=”ghost” color=”black” size=”small” shape=”rounded” type=”normal” hover_normal=”fill” hover_ghost=”fill” icon=”icon-cog”][nz_btn text=”Features & Analytics” link=”http://casthighlight.wpengine.com/outputs-analytics/” target=”_self” animate=”true” animation_type=”ghost” color=”pink” size=”small” shape=”rounded” type=”ghost” hover_normal=”fill” hover_ghost=”fill” icon=”icon-stats”][/vc_column][/vc_row]