Page History

Scope minimization helps developers avoid common programming errors, improves code readability by connecting the declaration and actual use of a variable, and improves maintainability because unused variables are more easily detected and removed. It may also allow objects to be recovered by the garbage collector more quickly, and it prevents violations of DCL51-J. Do not shadow or obscure identifiers in subscopes.

Noncompliant Code Example

This noncompliant code example shows a variable that is declared outside the for loop. Reusability is reduced because the value of the loop index, i, is modified by the for statement. Suppose, for example, this code snippet is copied and pasted with the intent to use a different index, j. If the index variable change were omitted, the new loop would then attempt to iterate over index i. Unexpected behavior can follow because i remains in scope. 

public class Scope {
  public static void main(String[] args) {
    int i = 0;
    for (i = 0; i < 10; i++) {
      // Do operations
    }
  }
}

This code is noncompliant because, even though variable i is not intentionally used outside the for loop. The , it is declared in method scope. One of the few scenarios where variable i would need to be declared local to the method if, for example, in method scope is when the loop contained contains a break statement and the value of i was inspected outside must be inspected after conclusion of the loop.

Compliant Solution

Minimize the scope of variables where possible, for . For example, by declaring declare loop indices within the for statement.:

public class Scope {
  public static void main(String[] args) {
    for (int i = 0; i < 10; i++) { //contains Contains declaration
      // Do operations
    }
  }
}

Noncompliant Code Example

This noncompliant code example shows a variable count that is declared outside the counter method, although the variable is not used outside the counter method. This reduces the reusability of the method because the count variable would need to be redefined in the new context.

public class Foo {
  private int count;
  private static private final int MAX_COUNT = 10;

  public void counter() {
    count = 0;
    while (condition()) {
      /* ... */
      if (count++ > MAX_COUNT) {
	    return;
      } 
    }
  }

  private boolean condition() {/* ... *}
  // No other method references count */
  /*/ but several other methods reference MAX_COUNT */
}

Compliant Solution

In this compliant solution, the count field is declared local to the counter() method.:

public class Foo {
  private static private final int MAX_COUNT = 10;

  public void counter() {
    int count = 0;
    while (condition()) {
      /* ... */
      if (count++ > MAX_COUNT) { 
	    return;
      }
    }
  }
  private boolean condition() {/* ... */}
  // No other method references count */
  /*/ but several other methods reference MAX_COUNT */
}

Risk Assessment

Do not use a larger scope than necessary because it will result in less reliable code.

...

Applicability

Detecting local variables that are declared in a larger scope than is required by the code as written is straightforward and can eliminate the possibility of false positives.

Detecting multiple for statements that use the same index variable is straightforward; it will produce produces false positives in the unusual case where this was intended by the programmer.

Related Guidelines

C Secure Coding Standard: DCL19-C. Minimize the scope of variables and functions
C++ Secure Coding Standard: DCL07-CPP. Minimize the scope of variables and methodsthe value of the index variable is intended to persist between loops.

Bibliography

 DCL61-J. Avoid cyclic dependencies between packages      01. Declarations and Initialization (DCL)      DCL51-JG. Do not shadow or obscure identifiers in subscopes

...

Image Added Image Added Image Added