DEV Community

Cover image for Code Smell 262 - Not Replaced Constants
Maxi Contieri
Maxi Contieri

Posted on • Originally published at maximilianocontieri.com

1

Code Smell 262 - Not Replaced Constants

Yet Another Security Code Smell Because Nobody Ever Reads the Documentation

TL;DR: Ignoring constant replacement leads to severe security risks.

Problems

  • Vulnerable endpoints

  • Lack of Testing

  • Documentation Nobody Reads

Solutions

  1. Enforce constant key replacement

  2. Audit upstream vendors

  3. Automate security checks

  4. Enforce your Documentation with tests

  5. Use invalid defaults to ensure they are always replaced

Context

A major security flaw, PKfail, persisted unnoticed for 12 years, compromising hundreds of devices.

The vulnerability stems from vendors failing to replace a "DO NOT TRUST" Secure Boot master key, a critical step that was neglected despite clear instructions.

This oversight left countless devices open to exploitation, allowing threat actors to bypass security measures and install malicious software.

Sample Code

Wrong

fn generate_pk() -> String {
    "DO NOT TRUST".to_string()
}

// Vendor forgets to replace PK
fn use_default_pk() -> String {
    let pk = generate_pk();
    pk // "DO NOT TRUST" PK used in production
}
Enter fullscreen mode Exit fullscreen mode

Right

fn generate_pk() -> String {
    "DO NOT TRUST".to_string()
    // The documentation tells vendors to replace this value
}

fn use_default_pk() -> String {
    let pk = generate_pk();

    if pk == "DO NOT TRUST" {
        panic!("Error: PK must be replaced before use.");
    }

    pk // Valid PK used in production
}
Enter fullscreen mode Exit fullscreen mode

Detection

[X] Automatic

You can detect this smell by checking for default values that must be replaced before deployment.

Tools like static analyzers and manual code reviews help you identify hardcoded or placeholder keys that should be updated.

Tags

  • Security

Level

[X] Intermediate

AI Generation

AI generators might create this smell unless instructed for context-specific security steps.

You must provide clear instructions to ensure proper key replacement.

AI Detection

AI tools can catch this smell with rules that flag placeholder values through testing and reviews.

Conclusion

Ignoring crucial steps in the security process, such as replacing default keys, can lead to severe vulnerabilities.

This long-lasting flaw emphasizes the need for diligent security practices.

Replace all your documentation with acceptance tests.

Relations

More Info

Tech Radar

Disclaimer

Code Smells are my opinion.

Credits

Photo by Jason Leung on Unsplash


It takes 20 years to build a reputation and a few minutes of cyber-incident to ruin it.

Stephane Nappo


This article is part of the CodeSmell Series.

Warp.dev image

The best coding agent. Backed by benchmarks.

Warp outperforms every other coding agent on the market, and gives you full control over which model you use. Get started now for free, or upgrade and unlock 2.5x AI credits on Warp's paid plans.

Download Warp

Top comments (0)

Scale globally with MongoDB Atlas. Try free.

Scale globally with MongoDB Atlas. Try free.

MongoDB Atlas is the global, multi-cloud database for modern apps trusted by developers and enterprises to build, scale, and run cutting-edge applications, with automated scaling, built-in security, and 125+ cloud regions.

Learn More

👋 Kindness is contagious

Discover more in this insightful article and become part of the thriving DEV Community. Developers at every level are welcome to share and enrich our collective expertise.

A simple “thank you” can brighten someone’s day. Please leave your appreciation in the comments!

On DEV, sharing skills lights our way and strengthens our connections. Loved the read? A quick note of thanks to the author makes a real difference.

Count me in