SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C++

C++ static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C++ code

  • All rules 674
  • Vulnerability13
  • Bug139
  • Security Hotspot19
  • Code Smell503

  • Quick Fix 91
Filtered: 52 rules found
confusing
    Impact
      Clean code attribute
        1. #include directives in a file should only be preceded by other preprocessor directives or comments

           Code Smell
        2. Loops should not have more than one "break" or "goto" statement

           Code Smell
        3. Switch labels should not be nested inside non-switch blocks

           Code Smell
        4. Appropriate char types should be used for character and integer values

           Code Smell
        5. Named methods should be used to avoid confusion between testing an optional or an expected and testing the wrapped value

           Code Smell
        6. The first element of an array should not be accessed implicitly

           Code Smell
        7. The condition of "assert" should not be trivially true

           Code Smell
        8. "std::declval" should not be used within requires-expression

           Code Smell
        9. Template should not be constrained with ad-hoc requires-expression

           Code Smell
        10. Coroutine should have co_return on each execution path or provide return_void

           Bug
        11. Thread local variables should not be used in coroutines

           Code Smell
        12. "std::chrono" components should be used to operate on time

           Code Smell
        13. "std::has_single_bit" should be used to test if an integer is a power of two

           Code Smell
        14. "std::to_address" should be used to convert iterators to raw pointers

           Code Smell
        15. "std::midpoint" and "std::lerp" should be used for midpoint computation and linear interpolation

           Code Smell
        16. Multicharacter literals should not be used

           Code Smell
        17. "std::initializer_list" constructor should not overlap with other constructors

           Code Smell
        18. "shared_ptr" should not be taken by rvalue reference

           Code Smell
        19. Member functions that don't mutate their objects should be declared "const"

           Code Smell
        20. Concise syntax should be used for concatenatable namespaces

           Code Smell
        21. "std::move" should only be used where moving can happen

           Code Smell
        22. GNU attributes should be used correctly

           Code Smell
        23. Functions which do not return should be declared as "noreturn"

           Code Smell
        24. Functions with "noreturn" attribute should not return

           Bug
        25. "else" statements should be clearly matched with an "if"

           Code Smell
        26. Lambdas that capture "this" should capture everything explicitly

           Code Smell
        27. "auto" should not be used to deduce raw pointers

           Code Smell
        28. Methods should not have identical implementations

           Code Smell
        29. A conditionally executed single line should be denoted by indentation

           Code Smell
        30. Macros should not be redefined

           Code Smell
        31. 'extern "C"' should not be used with namespaces

           Code Smell
        32. "#include_next" should not be used

           Code Smell
        33. String literals should not be concatenated implicitly

           Code Smell
        34. Types and variables should be declared in separate statements

           Code Smell
        35. "final" classes should not have "virtual" functions

           Code Smell
        36. Format strings should be used correctly

           Code Smell
        37. Conditional operators should not be nested

           Code Smell
        38. "static" base class members should not be accessed via derived types

           Code Smell
        39. Increment should not be used to set boolean variables to 'true'

           Code Smell
        40. Child class fields should not shadow parent class fields

           Code Smell
        41. "final" classes should not have "protected" members

           Code Smell
        42. Loops with at most one iteration should be refactored

           Bug
        43. Inherited functions should not be hidden

           Code Smell
        44. Try-catch blocks should not be nested

           Code Smell
        45. Redundant pairs of parentheses should be removed

           Code Smell
        46. "/*" and "//" should not be used within comments

           Code Smell
        47. "Global variables" shall not be used

           Code Smell
        48. A function declared with the "[[noreturn]]" attribute shall not return

           Bug
        49. Local variables shall not have static storage duration

           Code Smell
        50. "nullptr" shall be the only form of the "null-pointer-constant"

           Code Smell
        51. All identifiers used in the controlling expression of "#if" or "#elif" preprocessing directives shall be defined prior to evaluation

           Bug
        52. "#include" directives should only be preceded by preprocessor directives or comments

           Code Smell

        Template should not be constrained with ad-hoc requires-expression

        intentionality - clear
        maintainability
        Code Smell
        • bad-practice
        • confusing
        • since-c++20

        Why is this an issue?

        Since C++20, it is possible to add a requires-clause to a template as a way to express requirements (constraints) on the template arguments. This construct is versatile and allows any expression that evaluates to either true or false at compile time to be used. One of these expressions is the requires-expression, which can be used to express required operations on types:

        template<typename M>
          requires requires(M a, M b) {
            { a + b };
            { a * b };
          }
        M fma(M a, M b, M c) {
          return a + (b * c);
        }
        

        While the use of an ad-hoc requires-expression provides a way to quickly constrain a template, it limits the readability of the code: While it conveys the required syntax requirements, it fails to express the semantics associated with the operations. For instance, the above template expects that + and * perform mathematical additions and multiplications, not a concatenation of strings.

        Using a concept with a well-chosen name solves this issue and meaningful concepts that are reused in different parts of the codebase increase the level of abstraction of the code: You don’t need to check individual operations, you just need to know that your type is integral.

        Moreover, one interesting feature of concepts is called subsumption. It means that when a function overload is constrained with a list of concepts, and another overload is constrained with the same concepts plus additional constraints, then the second function is considered as more constrained than the first one, and will be selected by overload resolution if the concepts are satisfied.

        This feature only works with concepts: a requires-expression is never considered to be more constrained than another one, even if both contain identical subexpressions. For instance, the following overloads of rotate are ambiguous for any iterator that is at least bidirectional, as constraints for both of them are satisfied:

        template<typename ForwardIt>
          requires requires(ForwardIt it) {
            /* dereference and others */
            ++it;
          }
        ForwardIt rotate(ForwardIt first, ForwardIt mid, ForwardIt last);
        
        template<typename BidirectionalIt>
          requires requires(BidirectionalIt it) {
            /* dereference and others */
            ++it;
            --it;
          }
        BidirectionalIt rotate(BidirectionalIt first, BidirectionalIt mid,  BidirectionalIt last);
        

        This rule raises an issue for any use of an ad-hoc requires-expression in the requirements of template functions, classes, or variables.

        Noncompliant code example

        template<typename M>
          requires requires(M a, M b) { // noncompliant
            { a + b };
            { a * b };
          }
        M fma(M a, M b, M c) {
          return a + (b * c);
        }
        
        template<typename ForwardIt>
          requires requires(ForwardIt it) { // noncompliant
            /* dereference and others */
            ++it;
          }
        ForwardIt rotate(ForwardIt first, ForwardIt mid, ForwardIt last);
        
        template<typename BidirectionalIt>
          requires requires(BidirectionalIt it) { // noncompliant
            /* dereference and others */
            ++it;
            --it;
          }
        BidirectionalIt rotate(BidirectionalIt first, BidirectionalIt mid, BidirectionalIt last);
        

        Compliant solution

        template<typename T>
        concept Multiplicative = requires(const T a, const T b) {
          { a + b };
          { a * b };
        }
        
        template<Multiplicative M>
        M fma(M a, M b, M c) {
          return a + (b * c);
        }
        
        template<class ForwardIt>
          requires std::forward_iterator<ForwardIt>
        ForwardIt rotate(ForwardIt first, ForwardIt mid, ForwardIt last);
        
        // std::bidirectional_iterator subsumes std::forward_iterator, as it is defined as:
        // template<class I>
        //   concept bidirectional_iterator = forward_iterator<I> && additional requirements;
        template<class BidirectionalIt>
          requires std::bidirectional_iterator<BidirectionalIt>
        BidirectionalIt rotate(BidirectionalIt first, BidirectionalIt mid, BidirectionalIt last);
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.8

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use