SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C++

C++ static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C++ code

  • All rules 674
  • Vulnerability13
  • Bug139
  • Security Hotspot19
  • Code Smell503

  • Quick Fix 91
Filtered: 74 rules found
clumsy
    Impact
      Clean code attribute
        1. "contains" should be used to test whether a substring is part of a string

           Code Smell
        2. "if consteval" should be used instead of "if (std::is_constant_evaluated())"

           Code Smell
        3. "static_assert" should be preferred to assert when the argument is a compile-time constant

           Code Smell
        4. "std::format" should be used instead of standard output manipulators

           Code Smell
        5. Use "std::format" rather than "std::vformat" when the format string is known at compile time

           Code Smell
        6. Concatenated "std::format" outputs should be replaced by a single invocation

           Code Smell
        7. Width, alignment, and padding format options should be used consistently

           Code Smell
        8. Explicit argument indexing in "std::format" should be used only for non-trivial ordering

           Code Smell
        9. "std::declval" should not be used within requires-expression

           Code Smell
        10. STL constrained algorithms with range parameter should be used when iterating over the entire range

           Code Smell
        11. "std::enable_if" should not be used

           Code Smell
        12. Function template parameters should be named if reused

           Code Smell
        13. "std::span" should be used for a uniform sequence of elements contiguous in memory

           Code Smell
        14. Operator spaceship "<=>" should be used to define comparable types

           Code Smell
        15. Redundant comparison operators should not be defined

           Code Smell
        16. "std::format" should be used instead of string concatenation and "std::to_string"

           Code Smell
        17. "contains" should be used to check if a key exists in a container

           Code Smell
        18. Elements in a container should be erased with "std::erase" or "std::erase_if"

           Code Smell
        19. Mathematical constants should not be hardcoded

           Code Smell
        20. Use discriminated unions or "std::variant"

           Code Smell
        21. Unnecessary expensive copy should be avoided when using auto as a placeholder type

           Code Smell
        22. The right template argument should be specified for std::forward

           Code Smell
        23. Exception specifications should be treated as part of the type

           Code Smell
        24. "auto" should be used for non-type template parameter

           Code Smell
        25. Use "std::variant" instead of unions with non-trivial types.

           Code Smell
        26. Free functions should be preferred to member functions when accessing a container in a generic context

           Code Smell
        27. "std::optional" member function "value_or" should be used

           Code Smell
        28. "std::byte" should be used when you need byte-oriented memory access

           Code Smell
        29. The "_t" and "_v" version of type traits should be used instead of "::type" and "::value"

           Code Smell
        30. Inline variables should be used to declare global variables in header files

           Code Smell
        31. "[*this]" should be used to capture the current object by copy

           Code Smell
        32. "static_assert" with no message should be used over "static_assert" with empty or redundant message

           Code Smell
        33. Redundant class template arguments should not be used

           Code Smell
        34. Objects should not be created solely to be passed as arguments to functions that perform delegated object creation

           Code Smell
        35. "std::filesystem::path" should be used to represent a file path

           Code Smell
        36. Fold expressions should be used instead of recursive template instantiations

           Code Smell
        37. "as_const" should be used to make a value constant

           Code Smell
        38. Structured binding should be used

           Code Smell
        39. "if" and "switch" initializer should be used to reduce scope of variables

           Code Smell
        40. Emplacement should be preferred when insertion creates a temporary with sequence containers

           Code Smell
        41. "std::visit" should be used to switch on the type of the current value in a "std::variant"

           Code Smell
        42. "std::scoped_lock" should be used instead of "std::lock_guard"

           Code Smell
        43. "bind" should not be used

           Code Smell
        44. Threads should not be detached

           Code Smell
        45. Loop variables should be declared in the minimal possible scope

           Code Smell
        46. "shared_ptr" should not be taken by rvalue reference

           Code Smell
        47. Inheriting constructors should be used

           Code Smell
        48. Return type of functions shouldn't be const qualified value

           Code Smell
        49. "std::endl" should not be used

           Code Smell
        50. C-style array should not be used

           Code Smell
        51. "auto" should be used to avoid repetition of types

           Code Smell
        52. Integer literals should not be cast to bool

           Code Smell
        53. STL algorithms and range-based for loops should be preferred to traditional for loops

           Code Smell
        54. Function pointers should not be used as function parameters

           Code Smell
        55. Macros should not be used to define constants

           Code Smell
        56. Function parameters should not be of type "std::unique_ptr<T> const &"

           Code Smell
        57. "const" and "volatile" should not be used in "enum" declarations

           Code Smell
        58. "static" should not be used in unnamed namespaces

           Code Smell
        59. "inline" should not be used redundantly

           Code Smell
        60. Declarations of functions defined outside of the class should not be marked as "inline"

           Code Smell
        61. Digit separators should be used

           Code Smell
        62. Base class access specifiers should not be redundant

           Code Smell
        63. Access specifiers should not be redundant

           Code Smell
        64. Special member function should not be defined unless a non standard behavior is required

           Code Smell
        65. Empty "case" clauses that fall through to the "default" should be omitted

           Code Smell
        66. "const" references to numbers should not be made

           Bug
        67. "catch" clauses should do more than rethrow

           Code Smell
        68. Exception specifications should not be used

           Code Smell
        69. Redundant casts should not be used

           Code Smell
        70. A "while" loop should be used instead of a "for" loop

           Code Smell
        71. Overriding member functions should do more than simply call the same member in the base class

           Code Smell
        72. "empty()" should be used to test for emptiness

           Code Smell
        73. Mergeable "if" statements should be combined

           Code Smell
        74. Variables of array type should not be declared

           Code Smell

        "static_assert" should be preferred to assert when the argument is a compile-time constant

        intentionality - efficient
        maintainability
        Code Smell
        Quick FixIDE quick fixes available with SonarQube for IDE
        • clumsy
        • since-c++11

        Why is this an issue?

        More Info

        Introduced in C++11, static_assert checks a precondition at compile-time and emits a diagnostic error message.

        For any condition that could be checked at compile-time, static_assert should be preferred to the C macro assert:

        • Because it is checked at compile-time, the maintainer changing the code is immediately warned when the condition breaks, as opposed to assert which will trigger only when the specific line is run, potentially by another person.
        • Because it is checked at compile-time, it is impossible to accidentally create a side-effect.
        • It cannot have a runtime performance cost.
        • Contrary to assert, it is not a macro and thus doesn’t have the same surprising behaviors like bad handling of commas or confusing error messages when it doesn’t compile.
        • It is designed to emit a customizable error message which will be useful to diagnose the error.
        template <class T>
        void testFunction(T t) {
          assert(sizeof(long) <= sizeof(long long) && "long long is smaller than long!"); // Noncompliant
          assert(std::is_integral_v<T> && "This template only works for integral types"); // Noncompliant
          assert(t > 0); // Compliant: only known at runtime
          // ...
        }
        
        template <class T>
        void testFunction(T t) {
          static_assert(sizeof(long) <= sizeof(long long), "long long is smaller than long!");
          static_assert(std::is_integral_v<T>, "This template only works for integral types");
          assert(t > 0); // Compliant: only known at runtime
          // ...
        }
        

        This rule doesn’t trigger for assertions that are false on purpose to stop the execution flow:

        [[noreturn]] void stop() {
          assert(false); // Compliant: Interrupting the runtime execution
          assert(!"We shouldn't reach this"); // Compliant: Interrupting the runtime execution
        }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          10.7

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use