Baseline for Ed 2 of tr 24772

Annex B
(informative)
Language Specific Vulnerability Template

Each language-specific annex should have the following heading information and initial sections:

ISO IEC TR 24772-X (Informative) Vulnerability descriptions for language [language] Forward [ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. In exceptional circumstances, when the joint technical committee has collected data of a different kind from that which is normally published as an International Standard (“state of the art”, for example), it may decide to publish a Technical Report. A Technical Report is entirely informative in nature and shall be subject to review every five years in the same manner as an International Standard. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC TR 24772, was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 22, Programming languages, their environments and system software interfaces.] Introduction This Technical Report provides guidance for the programming language [language] so that application developers considering [language] or using [language] will be better able to avoid the programming constructs that lead to vulnerabilities in software written in the [language] language and their attendant consequences. This guidance can also be used by developers to select source code evaluation tools that can discover and eliminate some constructs that could lead to vulnerabilities in their software. This technical can also be used in comparison with companion technical reports and with the language-independent report, TR 24772-1, to select a programming language that provides the appropriate level of confidence that anticipated problems can be avoided. This technical report part is intended to be used with TR 24772-1, which discusses programming language vulnerabilities in a language independent fashion. It should be noted that this Technical Report is inherently incomplete. It is not possible to provide a complete list of programming language vulnerabilities because new weaknesses are discovered continually. Any such report can only describe those that have been found, characterized, and determined to have sufficient probability and consequence. 1 Scope This Technical Report specifies software programming language vulnerabilities to be avoided in the development of systems where assured behaviour is required for security, safety, mission-critical and business-critical software. In general, this guidance is applicable to the software developed, reviewed, or maintained for any application. Vulnerabilities described in this technical report document the way that the vulnerability described in the language-independent writeup (in TR 24772-1) are manifested in [language]. 2 Normative References The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. [This sub-clause should list the relevant language standards and other documents that describe the language treated in the annex. It need not be simply a list of standards. It should do whatever is required to describe the language that is the baseline.] 3 Terms and definitions, symbols and conventions (Check title) For the purposes of this document, the terms and definitions given in ISO/IEC 2382–1, in TR 24772-1 and the following apply. Other terms are defined where they appear in italic type. 4 Concepts [This sub-clause should provide an overview of general terminology and concepts that are utilized throughout the annex.]

Every vulnerability description of Clause 6 of the main document should be addressed in the annex in the same order even if there is simply a notation that it is not relevant to the language in question. Each vulnerability description should have the following format:

5 General Guidance for [language] [ See Template] [Thoughts welcomed as to what could be provided here. Possibly an opportunity for the language community to address issues that do not correlate to the guidance of section 6. For languages that provide non-mandatory tools, how those tools can be used to provide effective mitigation of vulnerabilities described in the following sections] 6 Language Vulnerabilies 6.x [<3 letter tag>] 6..0 Status, history, and bibliography [Revision history. This clause will eventually be removed.] 6..1 Applicability to language [This section describes what the language does or does not do in order to deal with the vulnerability.] 6..2 Guidance to language users [This section describes what the programmer or user should do regarding the vulnerability.]

In those cases where a vulnerability is simply not applicable to the language, the following format should be used instead:

6. [<3 letter tag>] This vulnerability is not applicable to .

Following the final vulnerability description, there should be a single sub-clause as follows:

7. Language specific Vulnerabilities for [language] [This section is where vulnerabilities not covered by TR 24772-1 will be placed]. It is possible that there are none for any given language. 8 Implications for standardization or future revision [This section provides the opportunity to discuss changes anticipated for future versions of the language specification. The section may be left empty]