SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C++

C++ static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C++ code

  • All rules 798
  • Vulnerability14
  • Bug173
  • Security Hotspot19
  • Code Smell592

  • Quick Fix 99
Filtered: 74 rules found
confusing
    Impact
      Clean code attribute
        1. #include directives in a file should only be preceded by other preprocessor directives or comments

           Code Smell
        2. Loops should not have more than one "break" or "goto" statement

           Code Smell
        3. Switch labels should not be nested inside non-switch blocks

           Code Smell
        4. Appropriate char types should be used for character and integer values

           Code Smell
        5. Named methods should be used to avoid confusion between testing an optional or an expected and testing the wrapped value

           Code Smell
        6. The first element of an array should not be accessed implicitly

           Code Smell
        7. The condition of "assert" should not be trivially true

           Code Smell
        8. "std::declval" should not be used within requires-expression

           Code Smell
        9. Template should not be constrained with ad-hoc requires-expression

           Code Smell
        10. Coroutine should have co_return on each execution path or provide return_void

           Bug
        11. Thread local variables should not be used in coroutines

           Code Smell
        12. "std::chrono" components should be used to operate on time

           Code Smell
        13. "std::has_single_bit" should be used to test if an integer is a power of two

           Code Smell
        14. "std::to_address" should be used to convert iterators to raw pointers

           Code Smell
        15. "std::midpoint" and "std::lerp" should be used for midpoint computation and linear interpolation

           Code Smell
        16. Multicharacter literals should not be used

           Code Smell
        17. "std::initializer_list" constructor should not overlap with other constructors

           Code Smell
        18. "shared_ptr" should not be taken by rvalue reference

           Code Smell
        19. Member functions that don't mutate their objects should be declared "const"

           Code Smell
        20. Concise syntax should be used for concatenatable namespaces

           Code Smell
        21. "std::move" should only be used where moving can happen

           Code Smell
        22. GNU attributes should be used correctly

           Code Smell
        23. Functions which do not return should be declared as "noreturn"

           Code Smell
        24. Functions with "noreturn" attribute should not return

           Bug
        25. "else" statements should be clearly matched with an "if"

           Code Smell
        26. Lambdas that capture "this" should capture everything explicitly

           Code Smell
        27. "auto" should not be used to deduce raw pointers

           Code Smell
        28. Methods should not have identical implementations

           Code Smell
        29. A conditionally executed single line should be denoted by indentation

           Code Smell
        30. Macros should not be redefined

           Code Smell
        31. 'extern "C"' should not be used with namespaces

           Code Smell
        32. "#include_next" should not be used

           Code Smell
        33. String literals should not be concatenated implicitly

           Code Smell
        34. Types and variables should be declared in separate statements

           Code Smell
        35. "final" classes should not have "virtual" functions

           Code Smell
        36. Format strings should be used correctly

           Code Smell
        37. Conditional operators should not be nested

           Code Smell
        38. "static" base class members should not be accessed via derived types

           Code Smell
        39. Increment should not be used to set boolean variables to 'true'

           Code Smell
        40. Child class fields should not shadow parent class fields

           Code Smell
        41. "final" classes should not have "protected" members

           Code Smell
        42. Loops with at most one iteration should be refactored

           Bug
        43. Inherited functions should not be hidden

           Code Smell
        44. Try-catch blocks should not be nested

           Code Smell
        45. Redundant pairs of parentheses should be removed

           Code Smell
        46. "/*" and "//" should not be used within comments

           Code Smell
        47. "Predicates" shall not have "persistent side effects"

           Bug
        48. "Global variables" shall not be used

           Code Smell
        49. The built-in unary "+" operator should not be used

           Code Smell
        50. The numerical value of a character shall not be used

           Code Smell
        51. The argument to a "mixed-use macro parameter" shall not be subject to further expansion

           Code Smell
        52. A function declared with the "[[noreturn]]" attribute shall not return

           Bug
        53. "User-declared" member functions shall use the "virtual", "override" and "final" specifiers appropriately

           Code Smell
        54. Derived classes shall not "conceal" functions that are inherited from their bases

           Code Smell
        55. A class shall only define an "initializer-list constructor" when it is the only constructor

           Code Smell
        56. The argument to "std::move" shall be a non-const "lvalue"

           Code Smell
        57. Local variables shall not have static storage duration

           Code Smell
        58. All constructors of a class should explicitly initialize all of its virtual base classes and immediate base classes

           Code Smell
        59. An accessible base class shall not be both virtual and non-virtual in the same hierarchy

           Bug
        60. A function with non-"void" return type shall return a value on all paths

           Bug
        61. The parameters in all "declarations" or overrides of a function shall either be unnamed or have identical names

           Code Smell
        62. The comma operator should not be used

           Code Smell
        63. Parentheses should be used to make the meaning of an expression appropriately explicit

           Code Smell
        64. "nullptr" shall be the only form of the "null-pointer-constant"

           Code Smell
        65. The same type aliases shall be used in all "declarations" of the same "entity"

           Code Smell
        66. Internal linkage should be specified appropriately

           Code Smell
        67. Block scope "declarations" shall not be "visually ambiguous"

           Code Smell
        68. All identifiers used in the controlling expression of "#if" or "#elif" preprocessing directives shall be defined prior to evaluation

           Bug
        69. Parentheses shall be used to ensure macro arguments are expanded appropriately

           Code Smell
        70. "#undef" should only be used for macros defined previously in the same file

           Code Smell
        71. "#include" directives should only be preceded by preprocessor directives or comments

           Code Smell
        72. A variable declared in an "inner scope" shall not hide a variable declared in an "outer scope"

           Code Smell
        73. The character sequence "/*" shall not be used within a C-style comment

           Code Smell
        74. Controlling expressions should not be invariant

           Bug

        "User-declared" member functions shall use the "virtual", "override" and "final" specifiers appropriately

        intentionality - clear
        maintainability
        Code Smell
        • confusing
        • since-c++11
        • cppcoreguidelines
        • misra-c++2023
        • misra-required

        Why is this an issue?

        More Info

        This rule is part of MISRA C++:2023.

        Usage of this content is governed by Sonar’s terms and conditions. Redistribution is prohibited.

        Rule 13.3.1 - User-declared member functions shall use the virtual, override and final specifiers appropriately

        Category: Required

        Analysis: Decidable,Single Translation Unit

        Amplification

        The specifiers are used appropriately when a member function declaration:

        • Does not override a function in a base class, and has either no specifier or has the virtual specifier; or
        • Overrides a function in a base class, does not use the virtual specifier, and does use either the override or final specifier.

        Note: this rule also applies to destructors.

        Rationale

        When a function is declared that does not override a function in a base class (including the case where the owning class has no base classes), then it is either not intended to be virtual or it is a virtual function that is expected to be overridden in a derived class. The function declaration should therefore include either no specifier or the virtual specifier, as appropriate. The use of the override specifier in this case would render the program ill-formed, whilst use of the final specifier would mean that it is a virtual function that cannot be subsequently overridden (in which case making it virtual is redundant).

        When a function is declared that overrides a virtual function in a base class:

        • The override specifier explicitly documents that this declaration overrides a function in a base class;
        • The final specifier documents that no further overrides are permitted.

        Whilst they are permitted by the C++ Standard, the following redundant combinations of specifier shall be avoided:

        • Use of virtual with either override or final;
        • Use of final with override.

        The use of a single specifier makes the meaning clearer:

        • virtual — this is a new virtual function this is expected to be overridden;
        • override — this is an override that may or may not be overridden;
        • final — this is an override that cannot be overridden.

        Notes:

        • Declaring a class itself as final does not make its virtual member functions override or final; the compiler is not required to check that the declarations are overrides.
        • M23_342: MISRA C++ 2023 Rule 6.4.2 restricts the use of function declarations that hide non-virtual functions in base classes.

        Example

        class A
        {
        public:
          virtual ~A() = default;
          virtual void f1() noexcept = 0;               // Compliant
          virtual void f2() noexcept {}                 // Compliant
          virtual void f3() noexcept {}                 // Compliant
                  void f4() noexcept {}                 // Compliant
        
          // The following declarations are non-compliant
          virtual void f5() noexcept final = 0;         // 'virtual' and 'final'
          virtual void f6() noexcept final {}           // 'virtual' and 'final'
                  void f7() noexcept final {}           // Ill-formed - not virtual
        };
        
        class B : public A
        {
        public:
          // The following declarations are non-compliant
          ~B();                                         // No specifier given for override
          virtual void f1() noexcept override {}        // 'virtual' and 'override'
                  void f2() noexcept override final {}  // 'override' and 'final'
                  void f3() noexcept {}                 // No specifier given for override
                  void f4() noexcept override {}        // Ill-formed - A::f4() not virtual
        };
        

        Copyright The MISRA Consortium Limited © 2023

          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube ServerAnalyze code in your
          on-premise CI

        © 2025 SonarSource Sàrl. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use