Duplicate Key in Associative List (Alist)

Incomplete Variant
Structure: Simple
Description

This vulnerability occurs when an associative list (alist) contains duplicate keys, which can cause unexpected behavior when software incorrectly handles or interprets these duplicates.

Extended Description

While a duplicate key could theoretically be used to implement a constant-time replacement function in a properly designed associative list, this pattern is inherently risky. In practice, duplicates are far more likely to be inserted accidentally due to programming errors, leading to ambiguous data states where it's unclear whether the duplicate was intentional or a mistake. Because this ambiguity creates a significant source of bugs and security flaws—such as data corruption, incorrect lookups, or logic errors—best practice dictates that associative lists should enforce key uniqueness. Developers should prevent duplicate keys at the point of insertion or validate the list to ensure all keys are unique, rather than relying on downstream code to interpret the duplicates correctly.

Common Consequences 1
Scope: Other

Impact: Quality DegradationVaries by Context

Potential Mitigations 2
Phase: Architecture and Design
Use a hash table instead of an alist.
Phase: Architecture and Design
Use an alist which checks the uniqueness of hash keys with each entry before inserting the entry.
Demonstrative Examples 1
The following code adds data to a list and then attempts to sort the data.

Code Example:

Bad
Python
python
Since basename is not necessarily unique, this may not sort how one would like it to be.
References 1
The CLASP Application Security Process
Secure Software, Inc.
2005
ID: REF-18
Likelihood of Exploit

Low

Applicable Platforms
Languages:
C : UndeterminedC++ : UndeterminedJava : UndeterminedC# : Undetermined
Modes of Introduction
Implementation
Taxonomy Mapping
  • CLASP
  • CERT C Secure Coding