Scope minimization helps in capturing common programming errors, improves code readability by tying together the declaration and actual use of a variable and eases maintainability because unused variables are easily caught and removed.
Noncompliant Code Example
This noncompliant code example shows a variable that is declared outside the for
loop. This can harm reusability as the loop index i
will change after the for
statement. Consider for instance, the case when this code snippet is copy pasted with the intent of using a different index j
but the statement mistakenly still iterates over index i
. As i
is still in scope, this will lead to a unexpected behavior.
public class Scope { public static void main(String[] args) { int i = 0; for(i = 0; i < 10; i++) { //do operations } } }
Compliant Solution
To be compliant, minimize the scope of variables where possible, such as by declaring loop indexes within the for
statement.
public class Scope { public static void main(String[] args) { for(int i = 0; i < 10; i++) { //contains declaration //do operations } } }
Additionally, methods should be designed to perform only one operation if possible. This reduces the need for variables existing in overlapping scopes and consequently, helps prevent errors.
Risk Assessment
Using a larger scope than what is necessary results in less reliable code.
Rule |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
---|---|---|---|---|---|
SCP00- J |
low |
unlikely |
medium |
P2 |
L3 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
[[JLS 05]] Section 14.4.2, Scope of Local Variable Declarations
[[Bloch 01]] Item 29, Minimize the scope of local variables
05. Scope (SCP) 05. Scope (SCP) SCP01-J. Do not increase the accessibility of overridden or hidden methods