SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C++

C++ static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C++ code

  • All rules 674
  • Vulnerability13
  • Bug139
  • Security Hotspot19
  • Code Smell503

  • Quick Fix 91
Filtered: 6 rules found
since-c++23
    Impact
      Clean code attribute
        1. "std::views::as_const" should be used to prevent modifying range elements

           Code Smell
        2. Escape sequences should use the delimited form (\u{}, \o{}, \x{})

           Code Smell
        3. "std::stringstream" or "std::spanstream" should be used instead of "std::strstream"

           Code Smell
        4. The underlying value of an enum should be accessed through "to_underlying"

           Code Smell
        5. "contains" should be used to test whether a substring is part of a string

           Code Smell
        6. "if consteval" should be used instead of "if (std::is_constant_evaluated())"

           Code Smell

        "std::stringstream" or "std::spanstream" should be used instead of "std::strstream"

        intentionality - clear
        maintainability
        reliability
        security
        Code Smell
        • since-c++23
        • pitfall

        Uses of std::strstream and std::ostrstream should be replaced with:

        • std::stringstream and std::ostringstream to use dynamically allocated buffer
        • std::spanstream and std::ospanstream to use preallocated buffer.

        Uses of std::istrstream should be replaced with std::ispanstream.

        Why is this an issue?

        How can I fix it?

        More Info

        The input std::istrstream, output std::ostrstream, and combined std::iostream stream classes are deprecated since their introduction in the C++98 standard.

        Those stream classes support two use cases, and their behavior differs vastly depending on how the object is constructed:

        • When constructed without argument, the stream object manages a dynamically allocated buffer;
        • When constructed from char* buffer and size, the stream object uses only the provided buffer.

        The above behaviors make the strstream classes hard to use correctly. As illustration the str() member function:

        • returns a buffer that has unclear ownership;
        • does not return the size of readable characters nor guarantees null-termination of the buffer;
        • may leak unless freeze(false) is called afterwards.

        With the introduction of the std::spanstream, std::ispanstream and std::ospanstream C++23, all uses of the std::strstream, std::ostrstream and std::ispanstream classes may be replaced, with one of the following classes:

        • std::stringstream and std::ostringstream to use managed and growing buffer,
        • std::spanstream, std::ospanstream and std::ispanstream to use preallocated buffer with fixed size.

        This rule will raise an issue when the new object of strstream is created:

        std::string printData(std::string_view entry, int count) {
          std::ostrstream os; // Noncompliant
          os << "The entry '" << entry << "' was repeated " << count << " times." << std::ends;
          char const* content = os.str();
          os.freeze(false);
          return std::string(content);
        }
        
        int readInt(std::istrstream);
        
        void process() {
          readInt(std::istrstream("10")); // Noncompliant
        }
        

        Furthermore, the issue will be raised if a data member of the class is declared with one of strstream types:

        class Printer {
          /* .... */
        private:
          std::ostrstream os; // Noncompliant
        };
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          10.7

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use