DCL04-J. Do not declare more than one variable per declaration

Every declaration should be for a single variable, on its own line, with an explanatory comment about the role of the variable. Declaring multiple variables in a single declaration can cause confusion regarding the types of the variables and their initial values. If more than one variable is declared in a declaration, care must be taken that the type and initialized value of the variable is known.

Noncompliant Code Example

In this noncompliant code example, a programmer or code reviewer might mistakenly believe that the two variables src and c are declared as int. In fact, src has a type of int [], while c has a type of int.

int src[], c;

Compliant Solution

In this compliant solution, each variable is declared on a separate line.

int src[];   /* source array */
int c;       /* max value    */

Although this change has no effect on compilation, the programmer's intent is clearer.

Noncompliant Example

In this noncompliant example, a programmer or code reviewer might mistakenly believe that both i and j have been initialized to 1. In fact, only j has been initialized, while i remains uninitialized.

int i, j = 1;

Compliant Solution

In this compliant solution, it is readily apparent that both i and j have been initialized to 1.

int i = 1;
int j = 1;

Nomcompliant Example

In this noncompliant example, the original programmer declared multiple variables, including an array, on the same line. Since even arrays have access to all Object methods, mistakes of this form may not be immediately detected by the compiler or an IDE.

public class Example{
  private T a,b,c[],d;

  public Example(T in){
    a = in;
    b = in;
    c = (T[]) new Object[10];
    d = in;
  }

Thus, when it comes time to write something like the toString method, a programmer might accidentally write it without realizing c is an array. Since the mistake compiles cleanly, it may go undetected.

public String toString(){
  return a.toString() + b.toString() + c.toString() + d.toString();
}

However, the intended toString might have been to invoke toString for each T in c.

public String toString(){
  String s = a.toString() + b.toString();
  for(int i = 0; i < c.length; i++){
    s += c[i].toString();
  }
  s += d.toString();
  return s;
}

Compliant Solution

Move each declaration to a different line, so programmer error of thinking c is a T object, isn't as likely. Furthermore, declare arrays by putting the brackets adjacent to the type, as opposed to postfixed to the variable name.

public class Example{
  private T a;
  private T b;
  private T[] c;
  private T d;

  public Example(T in){
    a = in;
    b = in;
    c = (T[]) new Object[10];
    d = in;
  }

Exceptions

DCL04-01: Trivial declarations for loop counters, for example, can reasonably be included within a for statement:

for (int i = 0; i < mx; ++i ) {
  /* ... */
}

Risk Assessment

Declaring no more than one variable per declaration can make code easier to read and eliminate confusion.

Other Languages

This rule appears in the C Secure Coding Standard as DCL04-C. Do not declare more than one variable per declaration.

This rule appears in the C++ Secure Coding Standard as DCL04-CPP. Do not declare more than one variable per declaration.

References

[[JLS 06]] Section 6.1, "Declarations"
[[JLS 06]] Section 4.3.2, "The class Object"