Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Code Smell 295 - String Concatenation

Untangling the string mess in your code TL;DR: Avoid string concatenation for complex strings, use templates. Problems 😔 Readability Maintainability Error-prone code Security concerns Unexpected outputs Context fr…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

Untangling the string mess in your code




TL;DR: Avoid string concatenation for complex strings, use templates.







Problems 😔




  • Readability

  • Maintainability

  • Error-prone code


  • Security concerns

  • Unexpected outputs

  • Context fragmentation

  • Translation nightmares

  • Context loss

  • (You will not see "Performance Issues" in this list)






Solutions 😃




  1. Implement message templates

  2. Separate text and logic

  3. Maintain translation context

  4. Abstract string creation.

  5. Use sprintf() or equivalent in your programming language.






Context 💬



String concatenation often starts innocently but quickly becomes a mess.



When you build strings by joining multiple fragments, you create complex and hard-to-translate code.



Translation requires context, but concatenation splits natural sentences into disconnected fragments.



This creates a perfect storm of confusing code that breaks when languages with different word orders or grammatical structures are introduced.



Performance is rarely a concern and optimizing string concatenation is a Premature Optimization smell.



The clean code argument is always stronger than making premature optimizations thinking you are clever than the compiler.






Sample Code 📖






Wrong ❌






name <- 'Art Vandelay'
age <- 30
city <- 'New York'

message <- paste0('User ',
name,
' is ',
age,
' years old and lives in ',
city,
'.')

# Same problem
message <- "User
"
%<% name %>
" is " %<% age %>

" years old and lives in "
%<% city %>
"."

print(message)










name <- "Art Vandelay"
age <- 30
city <- "New York"

message <- sprintf(
"User %s is %d years old and lives in %s.",
name,
age,
city)
# Easier to understand and translate
# Some human languages might change the order
# of the subparts
glue("User {name} is {age} years old and lives in {city}.")

print(message)







Detection 🔍



[X] Semi-Automatic



You can detect this smell by looking for concatenation operation abuse.



Many linters can also look for multiple string literals mixed with variables inside these functions.



You can also watch for combined string fragments that would form natural sentences.



Code with many single-character string literals (like spaces or punctuation) concatenated to variables is a strong indicator.





Tags 🏷️




  • Declarative Code





Level 🔋



[x] Beginner





Why the Bijection Is Important 🗺️



In natural language, sentences represent complete thoughts with proper grammar and structure.



When you fragment these into concatenated pieces, you break the Bijection between human-readable text and your code representation.



This mismatch causes multiple problems: for translators who need complete sentences to maintain context, for developers trying to understand the final output, and for maintenance when requirements change.



The world has many cultures and languages and the string order might change.



Templates maintain this bijection by keeping sentence structures intact, making your code a closer representation of the real-world language it produces.





AI Generation 🤖



AI code generators often create this smell because they use the most direct approach to string manipulation.



When prompted to "create a message with a username," they frequently default to basic concatenation without considering the translation or maintenance implications.



AI generators may not understand the broader context unless you explicitly instruct them to use template systems.





AI Detection 🥃



Most AI tools can detect and fix this smell with specific instructions.





Try Them! 🛠



Remember: AI Assistants make lots of mistakes




Suggested Prompt: use string templates instead of concatenation








Conclusion 🏁



String concatenation creates fragile code that's hard to maintain and nearly impossible to translate correctly.



By switching to template-based approaches, you create more readable and maintainable code that preserves the natural structure of human language.



This approach makes translation far easier as translators work with complete sentences rather than fragments.



Your future self (and your translators) will thank you for using templates instead of cobbling strings together one piece at a time.





Relations 👩‍❤️‍💋‍👨



































Disclaimer 📘



Code Smells are my opinion.






Credits 🙏



Photo by Amador Loureiro on Unsplash







Programming is the art of telling another human what one wants the computer to do.




Donald Knuth










This article is part of the CodeSmell Series.




1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - Code Smell 295 - String Concatenation
id: 59584a07-ec28-4036-b0c9-c56ce6168d59
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Code Smell 295 - String Concat" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Code Smell 295 - String Concatenation")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Code Smell 295 - String Concatenation*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Code Smell 295 - String Concatenation"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Code Smell 295 - String Concatenation.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Code Smell 295 - String Concatenation

Thematisch verwandte Begriffe: Code, Smell, String, Concatenation · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-93647 | An unauthenticated calendar sender can place active markup in a COUNTER …
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag