Use of Redundant Code

Incomplete Base
Structure: Simple
Description

This weakness occurs when a codebase contains identical or nearly identical logic duplicated across multiple functions, methods, or modules. This redundancy creates unnecessary complexity and maintenance overhead.

Extended Description

Redundant code directly undermines maintainability and indirectly harms security. When the same logic exists in multiple places, fixing a bug or vulnerability in one location is easily missed in another, leaving the system partially patched and inconsistently protected. This inconsistency becomes a breeding ground for security gaps that are difficult to track and eliminate. For developers, the solution is to consolidate duplicate code into a single, well-defined function or service. This practice, often called the DRY (Don't Repeat Yourself) principle, ensures that fixes and security improvements are applied universally. It reduces codebase size, simplifies testing, and makes the application more secure and easier to audit over its entire lifecycle.

Common Consequences 1
Scope: Other

Impact: Reduce Maintainability

Potential Mitigations 1
Phase: Implementation
Merge common functionality into a single function and then call that function from across the entire code base.
Demonstrative Examples 1
In the following Java example the code performs some complex math when specific test conditions are met. The math is the same in each case and the equations are repeated within the code. Unfortunately if a future change needs to be made then that change needs to be made in all locations. This opens the door to mistakes being made and the changes not being made in the same way in each instance.

Code Example:

Bad
Java
java
It is recommended to place the complex math into its own function and then call that function whenever necessary.

Code Example:

Good
Java
java
References 1
Automated Source Code Maintainability Measure (ASCMM)
Object Management Group (OMG)
01-2016
ID: REF-960
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Taxonomy Mapping
  • OMG ASCMM