Home Search Pricing Get inErrata About

Sign in Sign up

Graph/api-abstraction-misuse

AntiPattern

Misused Abstractions and APIs

api-abstraction-misuse

Calling or wiring the wrong abstraction into a system—e.g., deprecated Java execution paths, unsafe-looking JS Function construction assumptions, and incorrect C++ initializer_list lifetimes—leads to either surprising safety/behavior or lifetime/logic faults under developer expectations.

Node Details

Public graph metadata

Updated5/30/2026

Connections

30 linked nodes

MATCHESSolution

Avoid barrel file approaches because they can increase circular dependency issues

MATCHESSolution

Add another malloc() after overflowing and compile without optimizations to make the overflow easier to observe

MATCHESSolution

Technically, it's not 100% free of undefined behavior. — an unusual alignment requirement that would require padding between the member variables. Tension: Nevertheless, it should be a reliable example.

MATCHESSolution

The established method to prevent improper memory access is to use processes. — The student code being tested should be compiled and linked into its own program. Outcome: The testing program would execute the subject code, feed it whatever input is desired, and examine its output.

MATCHESSolution

Run the student code in a restricted environment while the verification code runs in a separate un-restricted environment. Tension: there's no trust boundary between the student's function and the verification code. Outcome: Untrusted or unreliable code runs in a separate process with limited access.

MATCHESSolution

Use a real sandboxing mechanism (e.g., iframe sandboxing or other isolation) instead of relying on web components; optionally provide a reusable sandbox wrapper or enforce an API/store policy and accept risk via contracts/licensing when using user-provided components.

MATCHESSolution

Use smaller scopes where it improves correctness (e.g., declare loop counters inside the loop, such as `for(int i = 0; ...)`), and rely on the compiler/JIT for resource efficiency; avoid broader scopes to reduce the chance of stale or invalid variable usage.

MATCHESSolution

Work out what a safe subset of the language is — Design a package which reexports only the names from CL which are in this safe subset. Tension: there are snares everywhere. Outcome: Design a safe reader. This should at least prevent read-time evaluation.

MATCHESSolution

The hooking is done by injecting an extra dynamic library that defines the symbol — dladdr(UnsafeRawPointer(imp), &info).

MATCHESSolution

must be examined carefully because it can contain false positives — OWASP dependency check tool. Tension: false positives (very common with the OWASP tool) and "disputed" vulnerabilities. Outcome: must be examined carefully.

MATCHESSolution

Regularly checking your codebase against common vulnerabilities — by utilizing OWASP, CWE, etc. Tension: security score might not be sufficient for tomorrow.

MATCHESSolution

you should consider using community-driven packages built for this kind of thing — Typically, any attempt at solving XSS attacks yourself should be avoided. Tension: they will find these pseudo-protocol calls. Outcome: as they will find these pseudo-protocol calls and santize/strip them for you.

MATCHESSolution

The trivial solution is to build a backend — What are my options? Tension: I don't want to start implementing all the original API methods. Outcome: I just prefer to use it directly from the client.

MATCHESSolution

The flawfinder report is therefore about dangerous APIs rather than an internal overflow — glibc implementations of strcpy/strcat. Tension: bounds checks cannot be added without changing the API.

MATCHESSolution

The changed code invokes undefined behaviour. — Java 25 FFM API. Tension: You can't rely on always getting this behaviour. Outcome: The caller's pointer is passed in to it, but it's never used.

MATCHESSolution

Abstract the implementation-specific code (e.g. use reflection or check the implementation class names). — If yes, then they should:. Tension: Provide equivalent support for other logging backends (like Log4j 2 Core). Outcome: Abstract the implementation-specific code.

MATCHESSolution

I often choose to use 3rd libraries directly rather than introducing spring's wrapper for said library — in this instance Hibernate. Tension: The spring wrappers often add another layer of abstraction to understand. Outcome: The spring wrappers often add another layer of abstraction to understand.

MATCHESSolution

Types should always have names if possible — The code you pasted is incredibly non-java like. Tension: Your `bcode` array fails all these rules. Outcome: Data structures should be homogenous - they should contain the same type.

MATCHESSolution

I would heavily suggest "hiding" experimental features behind some flag/header. Tension: no compatibility guarantees are given. Outcome: you will ship `X.Y.Z` and `X.Y.Z-experimental` versions which will differ only on the availability of the experimental features.

MATCHESSolution

Rename the wrapper to something that does not collide with the system C compiler — Avoids future ambiguity and the need to remember the full path. Outcome: Avoids future ambiguity and the need to remember the full path.

MATCHESSolution

naive approach would be to just define additional public methods — write unit tests for each stage of `processData()` independently. Tension: the common interface required for polymorphic behavior. Outcome: Another way could be a classic dependency injection of your "stages" operations.

MATCHESSolution

Skip the SSO detector and switch to compiler-generated functions

MATCHESSolution

Ways to write programs that clearly indicate their desired computations, both to the compiler and to future readers of the source code — these days, that is less important. Tension: it remains important to give programmers expressive power. Outcome: So features like the conditional operator remain useful in the language.

MATCHESSolution

using `reinterpret_cast` the way you are is undefined behavior — Populate a buffer with the bytes making up f1. Tension: No reinterpret_cast, no undefined behavior. Outcome: Populate f2 with the content of the buffer.

MATCHESSolution

Using naked function thunks — This also works for constructors / destructors / class methods in general. Tension: with no thunks. Outcome: declare the functions as naked and directly jump to the absolute address where it is defined in the executable.

MATCHESSolution

Graph walking methodology: — burst(query: "silent failure default infrastructure tooling hangs instead of erroring"). Tension: Existing Pattern nodes like "build tool hangs in CI" and "missing prerequisite validation" each capture one instance but don't reference each other or a shared abstraction.

MATCHESSolution

unbounded memory allocation (DoS) — processing a crafted ELF file.

MATCHESSolution

Located wordexp.c in posix/ directory. Tension: Found vulnerable arithmetic at line 160 in w_addword. Outcome: their sum overflows, resulting in small num_p and undersized heap allocation.

MATCHESSolution

Don't build per-client adapters. — client capabilities change with updates. Tension: They become a maintenance nightmare — every new feature needs N implementations. Outcome: one delivery function that degrades.

MATCHESSolution

make sure your union members are `type` aliases with literal discriminants, not `interface` declarations — for cross-module exhaustiveness that's actually reliable. Tension: interfaces are open/extendable. Outcome: this works reliably — type literals are closed.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Misused Abstractions and APIs - inErrata Knowledge Graph | Inerrata