Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarQube for IDE
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarQube Cloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube Server

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
GitHub Actions
Go
HTML
Java
JavaScript
JSON
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Rust
Scala
Shell
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML
YAML

COBOL static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your COBOL code

Tags

Impact

Clean code attribute

"PERFORM" calls should not be recursive
Code Smell
Limited dependence should be placed on operator precedence
Code Smell
Paragraphs used by a "PERFORM" statement should not contain "GO TO"
Bug
"GO TO DEPENDING ON" should not be used
Code Smell
"OCCURS DEPENDING ON" should be used with a minimum value
Code Smell
Unused condition names should be removed
Code Smell
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Queries that use "FETCH FIRST" should have an "ORDER BY"
Bug
"OCCURS DEPENDING ON" should not be used
Code Smell
Track uses of forbidden statements
Code Smell
All branches in a conditional structure should not have exactly the same implementation
Bug
Strings should only be moved to variables large enough to hold them without truncation
Bug
"COPY SUPPRESS" should not be used
Code Smell
"0 RECORDS" should be specified for "BLOCK CONTAINS"
Code Smell
"SQLCODE" or "SQLSTATE" should be tested after each SQL statement
Code Smell
SQL statements should not use "CAST(... AS CHAR/VARCHAR)"
Code Smell
Track uses of disallowed modules
Code Smell
"BINARY" variables should be used to declare variable-length table sizes
Code Smell
"LIKE" clauses should not be used without wildcards
Code Smell
"WHERE" clause conditions should not be contradictory
Bug
Binary variables should be used for table subscript access
Code Smell
Unused "TABLE" declarations should be removed
Code Smell
Selects should include null indicators for nullable columns
Bug
Default column values should not be set explicitly in inserts
Code Smell
Inserts should include values for non-null columns
Bug
Fetches should not select more columns than their cursors
Bug
Fetches should use all of the columns selected in their cursors
Code Smell
Programs should begin with titles
Code Smell
Binary search should be used for large tables
Code Smell
Condition names should be named for their conditional variables
Code Smell
Conditional variables should not be compared with literals
Code Smell
Variables of different numeric formats should not be compared
Code Smell
Math should only be performed on computational variables
Code Smell
"CALL" programs should be specified dynamically
Code Smell
SQL "UPDATE" statements should not impact columns included in partitioning indexes
Code Smell
"SELECT" statements should not lead to full table scans
Code Smell
"INSERT" statements should not set the values of identity columns
Bug
"UPDATE" and "DELETE" statements should not impact multiple rows
Code Smell
ACCEPT statements should be avoided
Vulnerability
SQL "UPDATE" statements should not change primary key values
Bug
Conditions should not use too many distinct data items
Code Smell
Boolean expressions should not be gratuitous
Code Smell
Conditionally executed code should be reachable
Bug
"NULL" should not be compared directly
Bug
Obsolete keywords should not be used
Code Smell
Track parsing failures
Code Smell
Section names should be unique within a program
Code Smell
Numbers should only be moved to variables large enough to hold them without truncation
Bug
Alphanumeric values should not be moved to numeric fields
Bug
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
Conditions in related "IF/ELSE IF" statements and "WHEN" clauses in "EVALUATE" statements should not have the same condition
Bug
Identical expressions should not be used on both sides of a binary operator
Bug
Files should not contain too many sections
Code Smell
Level 77 should not be used
Code Smell
"INSERT" statements should explicitly list the columns to be set
Code Smell
SQL "WHERE" clauses should use ANSI standard operators
Code Smell
SQL tables should be joined with the "JOIN" keyword
Code Smell
Arithmetic expressions and scalar functions should not be used in "WHERE" conditions
Code Smell
SQL "LIKE" clauses should not start with wildcard characters
Code Smell
SQL "OR" clauses testing equality on the same identifier should be replaced by an "IN" clause
Code Smell
A SQL "BETWEEN" clause should be used instead of "X>=Y AND X<=Z"
Code Smell
Column names should be used in a SQL "ORDER BY" clause
Code Smell
"FOR READ ONLY" or "FOR UPDATE" should be specified for DB2 cursors
Code Smell
"READ" statements should have an "AT END" or an "INVALID KEY" clause if "FILE-STATUS" is not defined
Code Smell
Data items should never be accessed using more than one "OF" clause
Code Smell
Data item declarations should be aligned
Code Smell
"TO" keywords should be aligned in a sequence of "MOVE" statements
Code Smell
Open files should be closed explicitly
Code Smell
Paragraphs should not be redefined
Bug
"PERFORM ... THRU ..." should not be used
Code Smell
The number of subprograms called in a program should be limited
Code Smell
Files should not contain too many paragraphs
Code Smell
The number of COPY directives in a program should be limited
Code Smell
When calling a subprogram, the data item containing the name of the subprogram to be called should not be programmatically updated
Vulnerability
"WITH DEBUGGING MODE" should not be used
Vulnerability
Copybooks should not contain keywords relating to the nature or structure of a program
Code Smell
"OCCURS 1" should not be used on data items
Code Smell
Variables should not be self-assigned
Bug
SQL statements should not join too many tables
Code Smell
Packed numeric fields should be defined with odd length
Code Smell
Either "RESP" or "NOHANDLE" should be used with CICS commands
Code Smell
The last paragraph of a "PERFORM THRU" should only contain an "EXIT" statement
Code Smell
The return codes of CICS commands with "RESP" or "NOHANDLE" conditions should be tested
Code Smell
"ORDER BY" should be specified for cursors
Bug
"COMMAREA" length should be specified in "CICS Link" and "CICS Xctl" commands
Code Smell
"DELETE" and "UPDATE" statements should contain "WHERE" clauses
Bug
Paragraphs should follow a naming convention
Code Smell
"PROGRAM-ID"s should match their file names
Bug
Procedures used in "PERFORM ... THRU ..." should share a naming convention
Code Smell
Paragraphs should be documented
Code Smell
New types should be defined in copybooks
Code Smell
Logical files should follow a naming convention
Code Smell
"WHERE" clauses should not contain too many lines of code
Code Smell
First level data items should follow a naming convention
Code Smell
File-Codes should comply with a naming convention
Code Smell
File names should comply with a naming convention
Code Smell
"EXIT PROGRAM" should be the last statement of a sequence
Bug
"EVALUATE ... WHEN" statements should not contain conditional logic
Code Smell
Declared files should be used
Code Smell
Data items should be initialized with data of the correct type
Bug
Explicitly opened cursors should be closed
Bug
"FILE STATUS" should be checked after IO operations when it is available
Code Smell
"UNION" should not be used in "SELECT" statements
Code Smell
Data value clauses should not be used in linkage sections
Bug
"SORT" should not be used
Code Smell
"SECTION" should not be used in a "PROCEDURE DIVISION"
Code Smell
"REDEFINES" should not be used
Code Smell
"PERFORM SECTION" should not be used
Code Smell
"PERFORM PARAGRAPH" should not be used
Code Smell
Paragraphs should not be used
Code Smell
"OPEN" should not be used inside a loop
Code Smell
"NEXT SENTENCE" should not be used
Code Smell
"MERGE" should not be used
Code Smell
"INITIALIZE" should not be used
Code Smell
"GROUP BY" should not be used in SQL "SELECT" statements
Code Smell
"EXAMINE" should not be used
Code Smell
"DISTINCT" should not be used in SQL "SELECT" statements
Code Smell
The "COMPUTATIONAL" data value clause should not be used
Code Smell
"ALTER" should not be used
Code Smell
"LOCK TABLE" should not be used
Code Smell
Track uses of SQL
Code Smell
The OS/VS "TRANSFORM" statement should not be used
Code Smell
The OS/VS "ON" statement should not be used
Code Smell
Programs should not have too many lines of code
Code Smell
Program names should comply with a naming convention
Code Smell
Columns to be read with a "SELECT" statement should be clearly defined
Code Smell
The "LIKE" operator should be used very carefully in SQL "WHERE" condition
Code Smell
SQL statements should not contain dynamic clauses
Security Hotspot
Having SQL "SELECT" statements without "WHERE" conditions is security-sensitive
Security Hotspot
"GOBACK" should be used instead of "STOP RUN"
Bug
"STOP RUN" or "GOBACK" should be the last statement of a sequence
Bug
The number of "PERFORM" statements in a procedure, section, or paragraph should be limited
Code Smell
Sections and paragraphs should not perform more than one SQL operation
Code Smell
Disallowed characters should not be used in identifiers
Code Smell
Unused sections should be removed
Code Smell
Track lack of copyright and license headers
Code Smell
Data used in a "LINKAGE" should be defined in a COPYBOOK
Code Smell
Control flow statements should not be nested too deeply
Code Smell
Ending words should be aligned with what they close
Code Smell
"EVALUATE" structures should end with "WHEN OTHERS" clauses
Code Smell
"GO TO" should not be used
Code Smell
Sections should end with an empty paragraph
Code Smell
"PERFORM" calls should not be nested too deeply
Code Smell
Sections should be documented
Code Smell
Sections should not be empty
Code Smell
Cyclomatic Complexity of sections should not be too high
Code Smell
Sections should not have too many lines of code
Code Smell
The second procedure of a "PERFORM THRU" statement should be defined after the first procedure
Bug
The OS/VS "NOTE" statement should not be used
Code Smell
"OS/VS EXHIBIT" should not be used
Code Smell
Track uses of "NOSONAR" comments
Code Smell
Unused paragraphs should be removed
Code Smell
Unused data item blocks should be removed
Code Smell
Cyclomatic Complexity of paragraphs should not be too high
Code Smell
Paragraphs should not have too many lines of code
Code Smell
The cyclomatic complexity of a program should not be too high
Code Smell
Paragraphs should not be empty
Code Smell
Cursors should not be opened inside loops
Code Smell
Nested SQL "SELECT" statements should not be used
Code Smell
Modules should not have too many lines of code
Code Smell
Paragraphs and statements should be indented consistently
Code Smell
"DISPLAY" should not be used
Vulnerability
"CURSORs" should not be declared inside procedure divisions
Code Smell
Cursors should not be declared inside loops
Code Smell
"CORRESPONDING" should not be used in "ADD", "SUBTRACT", and "MOVE" statements
Bug
Cursors should not be closed inside loops
Code Smell
Closable statements with nested statements should be closed
Code Smell
File data items should not exceed 63,488 characters
Bug
Sections of code should not be commented out
Code Smell
Track comments matching a regular expression
Code Smell
Statements should be on separate lines
Code Smell
String literals should not be duplicated
Code Smell
Copybooks should be used to share data structures, not procedural logic
Code Smell
SQL EXISTS subqueries should not be used
Code Smell
"GO TO" statements should not transfer control outside their modules
Bug
Track uses of "TODO" tags
Code Smell
Track uses of "FIXME" tags
Code Smell
Redundant pairs of parentheses should be removed
Code Smell
Magic numbers should not be used
Code Smell
DDL statements should not be used
Code Smell
Collapsible "IF" statements should be merged
Code Smell
Tabulation characters should not be used
Code Smell

"FILE STATUS" should be checked after IO operations when it is available

Code Smell

error-handling

Why is this an issue?

When a FILE STATUS is declared on a file, it should be tested immediately after IO operations.

Noncompliant code example

       IDENTIFICATION DIVISION.
       PROGRAM-ID. foo.

       ENVIRONMENT DIVISION.
       INPUT-OUTPUT SECTION.
       FILE-CONTROL.
         SELECT TEST-FILE
           ASSIGN TO 'foobar.txt'
           ORGANIZATION IS SEQUENTIAL
           FILE STATUS WS-TEST-FILE-STATUS.

       DATA DIVISION.
       FILE SECTION.
       FD TEST-FILE
         LABEL RECORDS ARE STANDARD.
         01 TEST-RECORD.
         05 USERNAME PIC XX.

       WORKING-STORAGE SECTION.
         01 WS-TEST-FILE-STATUS PIC X(42).

       PROCEDURE DIVISION.

      * Non-Compliant, TEST-FILE has a FILE STATUS variable which must be used
        OPEN INPUT TEST-FILE.

       END PROGRAM foo.

Compliant solution

       IDENTIFICATION DIVISION.
       PROGRAM-ID. foo.

       ENVIRONMENT DIVISION.
       INPUT-OUTPUT SECTION.
       FILE-CONTROL.
         SELECT TEST-FILE
           ASSIGN TO 'foobar.txt'
           ORGANIZATION IS SEQUENTIAL
           FILE STATUS WS-TEST-FILE-STATUS.

       DATA DIVISION.
       FILE SECTION.
       FD TEST-FILE
         LABEL RECORDS ARE STANDARD.
         01 TEST-RECORD.
         05 USERNAME PIC XX.

       WORKING-STORAGE SECTION.
         01 WS-TEST-FILE-STATUS PIC X(42).

       PROCEDURE DIVISION.

      * Compliant, errors of the IO operation are propery handled
        OPEN INPUT TEST-FILE.
        IF WS-TEST-FILE-STATUS <> "00" THEN
          DISPLAY "Error while opening foobar.txt as input.".

       END PROGRAM foo.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

Enterprise
Edition
Available Since
9.1

In-IDE

SaaS

Self-Hosted