Mixing the use of traditional or block comments (starting with /* and ending with */) and end-of-line comments (from // to the end of the line) can lead to misleading and confusing code, which may result in errors.
...
In this example, the call to the security-critical method is not executed. It is possible that a A reviewer examining this page could incorrectly assume that the code is executed.
In cases where this is the result of an accidental omission, it is useful to use Using an editor that provides syntax highlighting or that formats the code to help identify issues like missing end comment delimitors can help detect accidental omissions.
Because missing end delimitors are error prone and often viewed as a mistake, this approach is not recommended for commenting out code.
...
This compliant solution takes advantage of the compiler's ability to remove unreachable (dead) code. The code inside the if block must remain acceptable to the compiler. If other parts of the program change later in a way that would cause syntax errors, the unexecuted code must be brought up to date to correct the problem. Then, if it is needed again in the future, all that the programmer must be done do is to remove the surrounding if statement and the NOTREACHED comment.
...
This is an instance of exception MSC59-EX2 to guideline MSC59-J. Detect and remove dead code.
...
Confusion over which instructions are executed and which are not can lead to serious programming errors and vulnerabilities, including denial of service, abnormal program termination, and data integrity violation. This problem is mitigated by the use of interactive development environments (IDEs) and editors that use fonts, colors, or other mechanisms to differentiate between comments and code. However, the problem can still manifest itself, for example, when reviewing source code printed on a black-and-white printer.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MSC64-J | medium | unlikely | medium | P4 | L3 |
...