SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C++

C++ static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C++ code

  • All rules 674
  • Vulnerability13
  • Bug139
  • Security Hotspot19
  • Code Smell503

  • Quick Fix 91
Filtered: 12 rules found
error-handling
    Impact
      Clean code attribute
        1. Move and swap operations should be "noexcept"

           Code Smell
        2. Exceptions should not be thrown in "noexcept" functions

           Code Smell
        3. Non-exception types should not be caught

           Code Smell
        4. Non-exception types should not be thrown

           Code Smell
        5. Destructors should be "noexcept"

           Bug
        6. General "catch" clauses should not be used

           Code Smell
        7. "catch" clauses should do more than rethrow

           Code Smell
        8. Exceptions should not be ignored

           Code Smell
        9. Exception specifications should not be used

           Code Smell
        10. Generic exceptions should not be caught

           Code Smell
        11. Try-catch blocks should not be nested

           Code Smell
        12. Generic exceptions should never be thrown

           Code Smell

        Exceptions should not be thrown in "noexcept" functions

        intentionality - logical
        maintainability
        Code Smell
        • error-handling
        • bad-practice
        • pitfall

        Why is this an issue?

        noexcept is a specifier that can be applied to a function declaration to state whether or not this function might throw an exception.

        This specifier is a crucial information for the compiler as it enables it to perform automatic optimizations. It is also used by the noexcept operator, so that a developer can know whether an expression can throw, and adapt the code accordingly (for instance, to decide to move or copy an object).

        When a function is specified noexcept, the compiler does not generate any code to throw exceptions and any uncaught exception will result in a call to std::terminate. This means that writing a noexcept function is an implicit agreement to the statement : "my program will terminate if any exception is thrown inside this function".

        It is a very strong commitment as there are so many ways to get an exception including any dynamic allocation.

        This rule raises an issue when an exception is thrown, directly or indirectly, from a function declared noexcept.

        Noncompliant code example

        #include <exception>
        #include <memory>
        
        using namespace std;
        
        class SafetyException {};
        class Engine {};
        unique_ptr<Engine> engine;
        
        bool safety_check() noexcept;
        void other_checks();
        
        void critical_checks() {
          if (!safety_check()) {
            throw SafetyException{};
          }
        }
        
        void do_checks() {
          critical_checks(); // can throw
          other_checks(); // can throw
        }
        
        void init() noexcept(true) { // noncompliant because...
          do_checks(); // can throw
          engine = std::make_unique<Engine>(); // can throw
        }
        

        Compliant solution

        #include <exception>
        #include <memory>
        
        using namespace std;
        
        class SafetyException {};
        class Engine {};
        unique_ptr<Engine> engine;
        
        bool safety_check();
        void other_checks();
        
        void critical_checks() {
          if (!safety_check()) {
            throw SafetyException{};
          }
        }
        
        void do_checks() {
          critical_checks();
          other_checks();
        }
        
        void init() noexcept(true) { // compliant because ...
          try {
            do_checks(); // exception caught
            engine = std::make_unique<Engine>(); // exception caught
          } catch(std::exception e) {
            std::terminate();
          }
        }
        

        Exceptions

        Destructors are not handled by this rule because there is a specific rule about exceptions in destructors (see ExceptionInDestructor).

          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use