Aside from Memory Management, there's another general category that always comes up in these lists, but is not talked about much: in-band signaling (i.e., "Strings are Evil"):<p>- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (#2)<p>- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (#3)<p>- Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (#4)<p>- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (#8)<p>- Improper Neutralization of Special Elements used in a Command ('Command Injection') (#16)<p>- Improper Control of Generation of Code ('Code Injection') (#23)<p><i>All</i> of these came from trying to avoid structured data, and instead using strings with "special characters". It's crazy how many times this mistake has been repeated: file paths, URLs, log files, CSV, HTML, HTTP (cookies, headers, query strings), domain names, SQL, shell commands, shell pipelines... One unescaped character, from anywhere in the stack, and it all blows up.<p>One could say "at least it's human-readable", but that's not reliable either. Take files names, for example. Two visually identical file names may map to different files (because confusables[1] or surrounding spaces), or two different names map to the same file (because normalization[2]), or the ".jpg" at the end may not actually be the extension (because right-to-left override[3]).<p>So the <i>computer interpretation</i> of a string might be wrong because a special character sneaked in. And even if everyone was perfectly careful, the <i>human interpretation</i> might still be wrong. For the sake of the next generations, I hope we leave strings for human text and nothing more.<p>[1] <a href="https://unicode.org/cldr/utility/confusables.jsp" rel="nofollow noreferrer">https://unicode.org/cldr/utility/confusables.jsp</a><p>[2] <a href="https://developer.apple.com/library/archive/qa/qa1173/_index.html" rel="nofollow noreferrer">https://developer.apple.com/library/archive/qa/qa1173/_index...</a><p>[3] <a href="https://krebsonsecurity.com/2011/09/right-to-left-override-aids-email-attacks/" rel="nofollow noreferrer">https://krebsonsecurity.com/2011/09/right-to-left-override-a...</a>