CWE 546

R2026b

Suspicious Comment

Since R2026b

expand all in page

Description

Suspicious Comment

Polyspace Implementation

Polyspace® checks for the issue Suspicious Comments

Examples

expand all

Issue

The issue occurs when a comment in your code contains one of these suspicious words:

  • BUG

  • HACK

  • FIXME

  • LATER

  • TODO

The matching is case-insensitive. The checker also detects these words when they are prefixed by a symbol such as @, or when they are followed by numbers or a trailing special character. For instance, @TODO, FIXME21, and todo: all trigger a violation.

A function or variable name that contains one of these words does not trigger a violation. The rule checker only flags comments.

Risk

Comments containing these words suggest that the code has known problems or unfinished functionality that a developer intended to address later. Shipping code with these markers can indicate missing security checks, incomplete error handling, or unresolved defects. An attacker who gains access to the source code can use these markers to identify weak points.

Fix

Resolve the underlying issue described in the comment and remove the suspicious comments. If the comment describes work that is genuinely deferred, track it in an issue tracker and remove the comment from the code.

Example - Suspicious Comment Detected in Source Code

In this example, Polyspace detects comments that contain suspicious words indicating incomplete or problematic code.


#include <stdlib.h>

void process_data(int *data, int count) {
    /* HACK: skipping validation for now */ // Noncompliant
    for (int i = 0; i < count; i++) {
        data[i] = data[i] * 2;
    }
}

void initialize_buffer(char *buffer, int size) {
    // TODO: add bounds checking // Noncompliant
    for (int i = 0; i < size; i++) {
        buffer[i] = 0;
    }
}
Correction - Remove Suspicious Comments and Address the Issues

Resolve the issues described in the suspicious comments and remove the markers.


#include <stdlib.h>

void process_data(int *data, int count) {
    /* Input is validated by the caller per API contract */ // Compliant
    for (int i = 0; i < count; i++) {
        data[i] = data[i] * 2;
    }
}

void initialize_buffer(char *buffer, int size) {
    if (buffer == NULL || size <= 0) { // Compliant
        return;
    }
    for (int i = 0; i < size; i++) {
        buffer[i] = 0;
    }
}
Correction - Remove Suspicious Comments and track issues elsewhere

Track the issues in an issue tracker and remove the comments.


#include <stdlib.h>

void process_data(int *data, int count) {
    /*  JIRA 12345*/ 
    for (int i = 0; i < count; i++) {
        data[i] = data[i] * 2;
    }
}

void initialize_buffer(char *buffer, int size) {
    // Jira 78942 
    for (int i = 0; i < size; i++) {
        buffer[i] = 0;
    }
}

Check Information

Group: Bad Coding Practices
PQL Name: std.cwe_native.R546

Version History

Introduced in R2026b