GitHub
CERT Secure Coding

MSC01-PL. Detect and remove unused variables

The presence of unused variables may indicate significant logic errors. To prevent such errors, unused values should be identified and removed from code.

Noncompliant Code Example

This noncompliant code example contains a variable $new_name that is initialized but never subsequently read.

Non-compliant code
sub fix_name {
  my $name = shift;
  my $new_name = $name;

  $name =~ s/^([a-z])/\U$1\E/g;
  $name =~ s/ ([a-z])/ \U$1\E/g;
  return $name;
}

Compliant Solution

This compliant solution eliminates the unused variable

Compliant code
sub fix_name {
  my $name = shift;

  $name =~ s/^([a-z])/\U$1\E/g;
  $name =~ s/ ([a-z])/ \U$1\E/g;
  return $name;
}

Risk Assessment

The presence of unused variables may indicate logic errors that can lead to unintended program behavior. As a result, resolving unused variables can be an in-depth process requiring significant analysis.

RecommendationSeverityLikelihoodRemediation CostPriorityLevel
MSC01-PLLowUnlikelyHighP1L3

Automated Detection

ToolDiagnostic
Perl::CriticVariables::ProhibitUnusedVariables
SEI CERT C Coding StandardMSC13-C. Detect and remove unused values
SEI CERT C++ Coding StandardVOID MSC13-CPP. Detect and remove unused values

Bibliography

[ CPAN ]

Elliot Shank, Perl-Critic-1.116 Variables::ProhibitUnusedVariables