Excessive Code Complexity
Description
Excessive Code Complexity occurs when code is too complex as calculated using well-defined, quantitative measures such as cyclomatic complexity, cognitive complexity, nesting depth, lines of code, or other metrics. Complex code is harder to understand, test, maintain, and audit for security vulnerabilities. This weakness serves as a parent category for various specific complexity issues including excessive cyclomatic complexity, Halstead complexity, unconditional branching, and other measurable complexity problems.
Risk
Excessive code complexity has significant indirect security implications. Security vulnerabilities are harder to identify in complex code. Code reviewers may miss subtle security issues due to cognitive overload. Testing coverage becomes difficult to achieve, leaving untested edge cases. Maintenance changes are more likely to introduce new vulnerabilities. Complex code paths may have inconsistent security checks. Static analysis tools may produce unreliable results. Developer fatigue leads to shortcuts and errors. Emergency patches are riskier in complex codebases.
Solution
Set and enforce complexity thresholds (e.g., cyclomatic complexity < 10). Refactor complex functions into smaller, focused units. Reduce nesting depth through early returns and guard clauses. Use design patterns to manage complexity. Apply the Single Responsibility Principle. Extract complex conditions into well-named boolean methods. Eliminate code duplication that increases cognitive load. Use automated tools to measure and track complexity. Include complexity metrics in code review criteria. Prioritize refactoring of security-critical complex code.
Common Consequences
| Impact | Details |
|---|---|
| Other | Scope: Other Reduce Maintainability - Makes it more difficult to understand and maintain the product, indirectly affecting security by making vulnerabilities harder to find and fix. May facilitate introducing new vulnerabilities. |
| Other | Scope: Other Increase Analytical Complexity - Complex code is harder to audit and analyze for security issues. |
| Other | Scope: Other Reduce Performance - May degrade product performance. If reachable by an attacker, could introduce denial-of-service vulnerabilities. |
Example Code
Vulnerable Code
// Vulnerable: Excessively complex method
// Cyclomatic complexity > 30, deep nesting, multiple responsibilities
public class UserProcessor {
public ProcessResult processUserRequest(User user, Request request,
Context context, Options options) {
ProcessResult result = new ProcessResult();
// Deep nesting and complex conditions
if (user != null) {
if (user.isActive()) {
if (request != null) {
if (request.getType() != null) {
switch (request.getType()) {
case "CREATE":
if (user.hasPermission("create")) {
if (options.isValidated()) {
if (context.isSecure()) {
try {
if (validateRequest(request)) {
if (checkQuota(user)) {
if (!isDuplicate(request)) {
// Actually do something
result = createResource(request);
if (result.isSuccess()) {
if (options.shouldNotify()) {
notify(user, result);
}
if (options.shouldLog()) {
log(user, request, result);
}
}
} else {
result.setError("duplicate");
}
} else {
result.setError("quota_exceeded");
}
} else {
result.setError("invalid_request");
}
} catch (Exception e) {
result.setError("exception: " + e.getMessage());
}
} else {
result.setError("insecure_context");
}
} else {
result.setError("not_validated");
}
} else {
result.setError("no_permission");
}
break;
case "UPDATE":
// Another 50 lines of similar deeply nested code...
break;
case "DELETE":
// Another 50 lines of similar deeply nested code...
break;
// More cases...
}
} else {
result.setError("null_type");
}
} else {
result.setError("null_request");
}
} else {
result.setError("inactive_user");
}
} else {
result.setError("null_user");
}
return result;
}
}
# Vulnerable: Complex function with multiple code smells
def process_order(order, user, payment, shipping, discounts, inventory, config):
"""Excessively complex order processing."""
result = {"success": False, "errors": [], "warnings": []}
# Too many conditions and branches
if order and user and payment:
if user.is_verified and not user.is_banned:
if order.total > 0:
if payment.method in ["card", "paypal", "bank"]:
if payment.method == "card":
if payment.card_number and len(payment.card_number) == 16:
if payment.cvv and len(payment.cvv) in [3, 4]:
if payment.expiry:
if not is_expired(payment.expiry):
# Card validation logic...
if validate_luhn(payment.card_number):
# More nested processing...
pass
else:
result["errors"].append("invalid_card_number")
else:
result["errors"].append("card_expired")
else:
result["errors"].append("missing_expiry")
else:
result["errors"].append("invalid_cvv")
else:
result["errors"].append("invalid_card_number")
elif payment.method == "paypal":
# Another deeply nested block for PayPal...
if payment.paypal_email:
if validate_email(payment.paypal_email):
# More nesting...
pass
elif payment.method == "bank":
# Yet another deeply nested block...
pass
# Check inventory (more complexity)
for item in order.items:
if item.product_id in inventory:
if inventory[item.product_id] >= item.quantity:
if item.quantity > 0:
if item.quantity <= config.max_per_item:
# Reserve inventory...
pass
else:
result["warnings"].append(f"quantity_limited_{item.product_id}")
# Apply discounts (even more complexity)
total_discount = 0
for discount in discounts:
if discount.is_active:
if discount.min_order <= order.total:
if discount.type == "percentage":
total_discount += order.total * discount.value / 100
elif discount.type == "fixed":
total_discount += discount.value
# More discount logic...
# ... hundreds more lines of complex nested logic ...
return result
Fixed Code
// Fixed: Refactored into smaller, focused methods with clear responsibilities
public class UserProcessor {
public ProcessResult processUserRequest(User user, Request request,
Context context, Options options) {
// Early validation with clear error handling
ValidationResult validation = validateInputs(user, request, context, options);
if (!validation.isValid()) {
return ProcessResult.error(validation.getError());
}
// Delegate to specific handler based on request type
RequestHandler handler = getHandler(request.getType());
if (handler == null) {
return ProcessResult.error("unknown_request_type");
}
// Process with the appropriate handler
ProcessResult result = handler.handle(user, request, context);
// Post-processing (notifications, logging)
if (result.isSuccess()) {
performPostProcessing(user, request, result, options);
}
return result;
}
private ValidationResult validateInputs(User user, Request request,
Context context, Options options) {
if (user == null) {
return ValidationResult.invalid("null_user");
}
if (!user.isActive()) {
return ValidationResult.invalid("inactive_user");
}
if (request == null || request.getType() == null) {
return ValidationResult.invalid("invalid_request");
}
if (!context.isSecure()) {
return ValidationResult.invalid("insecure_context");
}
if (!options.isValidated()) {
return ValidationResult.invalid("not_validated");
}
return ValidationResult.valid();
}
private RequestHandler getHandler(String requestType) {
return switch (requestType) {
case "CREATE" -> new CreateHandler();
case "UPDATE" -> new UpdateHandler();
case "DELETE" -> new DeleteHandler();
default -> null;
};
}
private void performPostProcessing(User user, Request request,
ProcessResult result, Options options) {
if (options.shouldNotify()) {
notificationService.notify(user, result);
}
if (options.shouldLog()) {
auditService.log(user, request, result);
}
}
}
// Separate handler with single responsibility
class CreateHandler implements RequestHandler {
@Override
public ProcessResult handle(User user, Request request, Context context) {
// Guard clause for permission
if (!user.hasPermission("create")) {
return ProcessResult.error("no_permission");
}
// Validation chain
if (!requestValidator.validate(request)) {
return ProcessResult.error("invalid_request");
}
if (!quotaService.checkQuota(user)) {
return ProcessResult.error("quota_exceeded");
}
if (duplicateChecker.isDuplicate(request)) {
return ProcessResult.error("duplicate");
}
// Core logic
return resourceService.createResource(request);
}
}
# Fixed: Refactored into smaller, focused functions
def process_order(order: Order, user: User, payment: Payment,
shipping: Shipping, discounts: list[Discount],
inventory: Inventory, config: Config) -> OrderResult:
"""Process an order with clear, manageable steps."""
# Step 1: Validate inputs
validation_error = validate_order_inputs(order, user, payment)
if validation_error:
return OrderResult.error(validation_error)
# Step 2: Validate payment method
payment_validation = validate_payment(payment)
if not payment_validation.is_valid:
return OrderResult.error(payment_validation.errors)
# Step 3: Check and reserve inventory
inventory_result = process_inventory(order.items, inventory, config)
if not inventory_result.success:
return OrderResult.error(inventory_result.errors)
# Step 4: Calculate discounts
discount_amount = calculate_discounts(order, discounts)
# Step 5: Process payment
final_amount = order.total - discount_amount
payment_result = process_payment(payment, final_amount)
if not payment_result.success:
inventory_result.rollback()
return OrderResult.error(payment_result.error)
# Step 6: Create order record
return OrderResult.success(
order_id=create_order_record(order, user, payment_result),
total=final_amount,
discount=discount_amount
)
def validate_order_inputs(order: Order, user: User, payment: Payment) -> str | None:
"""Validate basic order inputs. Returns error message or None."""
if not order or not user or not payment:
return "missing_required_fields"
if not user.is_verified:
return "user_not_verified"
if user.is_banned:
return "user_banned"
if order.total <= 0:
return "invalid_order_total"
return None
def validate_payment(payment: Payment) -> ValidationResult:
"""Validate payment details based on payment method."""
validators = {
"card": validate_card_payment,
"paypal": validate_paypal_payment,
"bank": validate_bank_payment,
}
validator = validators.get(payment.method)
if not validator:
return ValidationResult.invalid(["unsupported_payment_method"])
return validator(payment)
def validate_card_payment(payment: Payment) -> ValidationResult:
"""Validate credit card payment details."""
errors = []
if not payment.card_number or len(payment.card_number) != 16:
errors.append("invalid_card_number")
elif not validate_luhn(payment.card_number):
errors.append("card_number_failed_luhn")
if not payment.cvv or len(payment.cvv) not in [3, 4]:
errors.append("invalid_cvv")
if not payment.expiry:
errors.append("missing_expiry")
elif is_expired(payment.expiry):
errors.append("card_expired")
return ValidationResult(is_valid=len(errors) == 0, errors=errors)
def process_inventory(items: list[OrderItem], inventory: Inventory,
config: Config) -> InventoryResult:
"""Check and reserve inventory for all items."""
reservations = []
errors = []
warnings = []
for item in items:
result = check_and_reserve_item(item, inventory, config)
if result.error:
errors.append(result.error)
elif result.warning:
warnings.append(result.warning)
else:
reservations.append(result.reservation)
if errors:
# Rollback any successful reservations
for reservation in reservations:
reservation.cancel()
return InventoryResult.failure(errors)
return InventoryResult.success(reservations, warnings)
CVE Examples
This CWE is marked as PROHIBITED for direct CVE mapping as it represents a code quality concern rather than a direct security vulnerability.
Related CWEs
- CWE-710: Improper Adherence to Coding Standards (parent)
- CWE-1121: Excessive McCabe Cyclomatic Complexity (child)
- CWE-1122: Excessive Halstead Complexity (child)
- CWE-1119: Excessive Use of Unconditional Branching (child)
- CWE-1226: Complexity Issues (category member)
References
- MITRE Corporation. "CWE-1120: Excessive Code Complexity." https://cwe.mitre.org/data/definitions/1120.html
- McCabe, T.J. "A Complexity Measure" IEEE Transactions on Software Engineering
- Halstead, M.H. "Elements of Software Science"
- CISQ Quality Measures - Maintainability