Invokable Control Element with Large Number of Outward Calls
This weakness occurs when a single function, method, or callable code block makes an excessively high number of calls to other objects or components outside its immediate scope. This creates a complex, tightly-coupled web of dependencies that is difficult to manage.
While the specific threshold for "excessively large" can vary by project, the CISQ standard recommends flagging any callable element that references more than five external objects. This high fan-out indicates a design where one component has too much responsibility and knowledge of the system's inner workings, violating principles of modularity and separation of concerns. This complexity directly undermines maintainability and indirectly harms security. It becomes harder to understand the code's impact, trace data flow, or modify one part without breaking others. This increased difficulty in auditing and updating the code slows down vulnerability fixes and raises the risk of introducing new security flaws during changes.
Impact: Reduce Maintainability
- OMG ASCMM