When distinct identifiers are defined using the same name it is possible that when one of the definitions is deleted from the source the program will continue to compile without a diagnostic being issued.
CWE: Nothing applicable
See clause 5.2.
Many languages support the concept of scope. One of the ideas behind the concept of scope is to provide a mechanism for the independent definition of identifiers that may share the same name.
For instance, in the following code fragment:
int some_var;
{
int t_var;
int some_var; /* definition in nested scope */
t_var=3;
some_var=2;
}
an identifier called some_var
has been defined in
different scopes.
If the either the definition of some_var
or
t_var
that occurs in the nested scope is deleted (e.g.,
when the source is modified) it is necessary to delete all other
references to that identifier within the scope. If a developer
deletes the definition of t_var
but fails to delete the
statement that references it, then most languages require a
diagnostic to be issued (e.g., reference to undefined
variable
). However, if the nested definition of
some_var
is deleted but the reference to it in the
nested scope is not deleted, then no diagnostic will be issued
(because the reference resolves to the definition in the outer scope).
New identifiers should not be defined using a name that is already visible within which the scope of the new definition.
This vulnerability is intended to be applicable to languages with the following characteristics:
Software developers can avoid the vulnerability or mitigate its ill effects in the following ways: