SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C#

C# static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C# code

  • All rules 493
  • Vulnerability46
  • Bug88
  • Security Hotspot24
  • Code Smell335

  • Quick Fix 61
 
Tags
    Impact
      Clean code attribute
        1. Parameter names should match base declaration and other partial definitions

           Code Smell
        2. "goto" statement should not be used

           Code Smell
        3. Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression

           Code Smell
        4. Literal suffixes should be upper case

           Code Smell
        5. Locks should be released within the same method

           Bug
        6. A write lock should not be released when a read lock has been acquired and vice versa

           Bug
        7. First/Single should be used instead of FirstOrDefault/SingleOrDefault on collections that are known to be non-empty

           Code Smell
        8. Server-side requests should not be vulnerable to traversing attacks

           Vulnerability
        9. Content Security Policies should be restrictive

           Vulnerability
        10. Actions that return a value should be annotated with ProducesResponseTypeAttribute containing the return type

           Code Smell
        11. ModelState.IsValid should be called in controller actions

           Code Smell
        12. Awaitable method should be used

           Code Smell
        13. REST API actions should be annotated with an HTTP verb attribute

           Code Smell
        14. Value type property used as input in a controller action should be nullable, required or annotated with the JsonRequiredAttribute to avoid under-posting.

           Code Smell
        15. You should pool HTTP connections with HttpClientFactory

           Code Smell
        16. API Controllers should derive from ControllerBase instead of Controller

           Code Smell
        17. Controllers should not have mixed responsibilities

           Code Smell
        18. A Route attribute should be added to the controller when a route template is specified at the action level

           Code Smell
        19. Use model binding instead of reading raw request data

           Code Smell
        20. ASP.NET controller actions should not have a route template starting with "/"

           Code Smell
        21. Backslash should be avoided in route templates

           Bug
        22. Parameters with SupplyParameterFromQuery attribute should be used only in routable components

           Code Smell
        23. Using lambda expressions in loops should be avoided in Blazor markup section

           Code Smell
        24. Component parameter type should match the route parameter type constraint

           Bug
        25. [JSInvokable] attribute should only be used on public methods

           Bug
        26. Blazor query parameter type should be supported

           Bug
        27. JWT secret keys should not be disclosed

           Vulnerability
        28. Stack traces should not be disclosed

           Vulnerability
        29. Loop boundaries should not be vulnerable to injection attacks

           Vulnerability
        30. Use PascalCase for named placeholders

           Code Smell
        31. Message template placeholders should be unique

           Bug
        32. "Trace.WriteLineIf" should not be used with "TraceSwitch" levels

           Code Smell
        33. Log message template should be syntactically correct

           Bug
        34. Log message template placeholders should be in the right order

           Code Smell
        35. Generic logger injection should match enclosing type

           Code Smell
        36. "Trace.Write" and "Trace.WriteLine" should not be used

           Code Smell
        37. Logger field or property name should comply with a naming convention

           Code Smell
        38. Logging arguments should be passed to the correct parameter

           Code Smell
        39. Logging in a catch clause should pass the caught exception as a parameter.

           Code Smell
        40. The code block contains too many logging calls

           Code Smell
        41. Connection strings should not be vulnerable to injections attacks

           Vulnerability
        42. Using unsafe code blocks is security-sensitive

           Security Hotspot
        43. Memory allocations should not be vulnerable to Denial of Service attacks

           Vulnerability
        44. "string.Create" should be used instead of "FormattableString"

           Code Smell
        45. "Contains" should be used instead of "Any" for simple equality checks

           Code Smell
        46. "First" and "Last" properties of "LinkedList" should be used instead of the "First()" and "Last()" extension methods

           Code Smell
        47. The lambda parameter should be used instead of capturing arguments in "ConcurrentDictionary" methods

           Code Smell
        48. "StartsWith" and "EndsWith" overloads that take a "char" should be used instead of the ones that take a "string"

           Code Smell
        49. "Min/Max" properties of "Set" types should be used instead of the "Enumerable" extension methods

           Code Smell
        50. Prefer indexing instead of "Enumerable" methods on types implementing "IList"

           Code Smell
        51. The collection should be filtered before sorting by using "Where" before "OrderBy"

           Code Smell
        52. Collection-specific "Exists" method should be used instead of the "Any" extension

           Code Smell
        53. The collection-specific "TrueForAll" method should be used instead of the "All" extension

           Code Smell
        54. "Find" method should be used instead of the "FirstOrDefault" extension

           Code Smell
        55. Use the "UnixEpoch" field instead of creating "DateTime" instances that point to the beginning of the Unix epoch

           Code Smell
        56. Don't hardcode the format when turning dates and times to strings

           Code Smell
        57. Use a format provider when parsing date and time

           Code Smell
        58. Use "TimeZoneInfo.FindSystemTimeZoneById" without converting the timezones with "TimezoneConverter"

           Code Smell
        59. Use "DateTimeOffset" instead of "DateTime"

           Code Smell
        60. Use UTC when recording DateTime instants

           Code Smell
        61. Always set the "DateTimeKind" when creating new "DateTime" instances

           Code Smell
        62. Avoid using "DateTime.Now" for benchmarking or timing operations

           Code Smell
        63. Accessing files should not lead to filesystem oracle attacks

           Vulnerability
        64. Environment variables should not be defined from untrusted input

           Vulnerability
        65. "ExcludeFromCodeCoverage" attributes should include a justification

           Code Smell
        66. Blocks should not be synchronized on local variables

           Bug
        67. Not specifying a timeout for regular expressions is security-sensitive

           Security Hotspot
        68. Interfaces for durable entities should satisfy the restrictions

           Code Smell
        69. Azure Functions should log all failures

           Code Smell
        70. Calls to "async" methods should not be blocking in Azure Functions

           Code Smell
        71. Azure Functions should use Structured Error Handling

           Code Smell
        72. Client instances should not be recreated on each Azure Function invocation

           Code Smell
        73. Azure Functions should be stateless

           Code Smell
        74. Hard-coded secrets are security-sensitive

           Security Hotspot
        75. XML operations should not be vulnerable to injection attacks

           Vulnerability
        76. XML signatures should be validated securely

           Vulnerability
        77. Use a testable date/time provider

           Code Smell
        78. Constructing arguments of system commands from user input is security-sensitive

           Security Hotspot
        79. Applications should not create session cookies from untrusted input

           Vulnerability
        80. Reflection should not be vulnerable to injection attacks

           Vulnerability
        81. Extracting archives should not lead to zip slip vulnerabilities

           Vulnerability
        82. OS commands should not be vulnerable to argument injection attacks

           Vulnerability
        83. Regular expressions should be syntactically valid

           Bug
        84. Types allowed to be deserialized should be restricted

           Vulnerability
        85. Deserializing objects without performing data validation is security-sensitive

           Security Hotspot
        86. Disabling ASP.NET "Request Validation" feature is security-sensitive

           Security Hotspot
        87. Allowing requests with excessive content length is security-sensitive

           Security Hotspot
        88. JWT should be signed and verified with strong cipher algorithms

           Vulnerability
        89. Cipher algorithms should be robust

           Vulnerability
        90. Encryption algorithms should be used with secure mode and padding scheme

           Vulnerability
        91. Insecure temporary file creation methods should not be used

           Vulnerability
        92. Using publicly writable directories is security-sensitive

           Security Hotspot
        93. Passwords should not be stored in plaintext or with a fast hashing algorithm

           Vulnerability
        94. Dynamic code execution should not be vulnerable to injection attacks

           Vulnerability
        95. Using clear-text protocols is security-sensitive

           Security Hotspot
        96. NoSQL operations should not be vulnerable to injection attacks

           Vulnerability
        97. HTTP request redirections should not be open to forging attacks

           Vulnerability
        98. Logging should not be vulnerable to injection attacks

           Vulnerability
        99. Server-side requests should not be vulnerable to forging attacks

           Vulnerability
        100. Deserialization should not be vulnerable to injection attacks

           Vulnerability
        101. Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks

           Vulnerability
        102. Having a permissive Cross-Origin Resource Sharing policy is security-sensitive

           Security Hotspot
        103. Expanding archive files without controlling resource consumption is security-sensitive

           Security Hotspot
        104. "ValueTask" should be consumed correctly

           Code Smell
        105. Server certificates should be verified during SSL/TLS connections

           Vulnerability
        106. Configuring loggers is security-sensitive

           Security Hotspot
        107. Using weak hashing algorithms is security-sensitive

           Security Hotspot
        108. Comments should not be empty

           Code Smell
        109. Start index should be used instead of calling Substring

           Code Smell
        110. Non-async "Task/Task<T>" methods should not return null

           Bug
        111. Calls to delegate's method "BeginInvoke" should be paired with calls to "EndInvoke"

           Bug
        112. "new Guid()" should not be used

           Code Smell
        113. "DebuggerDisplayAttribute" strings should reference existing members

           Code Smell
        114. "default" clauses should be first or last

           Code Smell
        115. Delivering code in production with debug features activated is security-sensitive

           Security Hotspot
        116. Disabling CSRF protections is security-sensitive

           Security Hotspot
        117. Unread "private" fields should be removed

           Code Smell
        118. Calls to "async" methods should not be blocking

           Code Smell
        119. Parameter validation in "async"/"await" methods should be wrapped

           Code Smell
        120. Parameter validation in yielding methods should be wrapped

           Code Smell
        121. LDAP connections should be authenticated

           Vulnerability
        122. "PartCreationPolicyAttribute" should be used with "ExportAttribute"

           Bug
        123. Cryptographic keys should be robust

           Vulnerability
        124. Weak SSL/TLS protocols should not be used

           Vulnerability
        125. Secure random number generators should not output predictable values

           Vulnerability
        126. "Shared" parts should not be created with "new"

           Bug
        127. Getters and setters should access the expected fields

           Bug
        128. Methods should be named according to their synchronicities

           Code Smell
        129. "ConstructorArgument" parameters should exist in constructors

           Bug
        130. Extensions should be in separate namespaces

           Code Smell
        131. Extension methods should not extend "object"

           Code Smell
        132. Events should have proper arguments

           Code Smell
        133. "P/Invoke" methods should not be visible

           Code Smell
        134. Serialization constructors should be secured

           Vulnerability
        135. Members should not have conflicting transparency annotations

           Vulnerability
        136. Windows Forms entry points should be marked with STAThread

           Bug
        137. Null checks should not be combined with "is" operator checks

           Code Smell
        138. Native methods should be wrapped

           Code Smell
        139. Classes should implement their "ExportAttribute" interfaces

           Bug
        140. Empty collections should not be accessed or iterated

           Bug
        141. Methods should not have identical implementations

           Code Smell
        142. Collection elements should not be replaced unconditionally

           Bug
        143. Method overloads should be grouped together

           Code Smell
        144. Non-flags enums should not be marked with "FlagsAttribute"

           Code Smell
        145. Operator overloads should have named alternatives

           Code Smell
        146. "params" should be used instead of "varargs"

           Code Smell
        147. Non-abstract attributes should be sealed

           Code Smell
        148. Property names should not match get methods

           Code Smell
        149. Overloads with a "StringComparison" parameter should be used

           Code Smell
        150. Locales should be set for data types

           Code Smell
        151. Overloads with a "CultureInfo" or an "IFormatProvider" parameter should be used

           Code Smell
        152. Literals should not be passed as localized parameters

           Code Smell
        153. Types should not extend outdated base types

           Code Smell
        154. Operators should be overloaded consistently

           Code Smell
        155. Properties should be preferred

           Code Smell
        156. Generics should be used when appropriate

           Code Smell
        157. Type names should not match namespaces

           Code Smell
        158. Strings should be normalized to uppercase

           Code Smell
        159. Interface methods should be callable by derived types

           Code Smell
        160. Searching OS commands in PATH is security-sensitive

           Security Hotspot
        161. Classes implementing "IEquatable<T>" should be sealed

           Code Smell
        162. Exceptions should provide standard constructors

           Code Smell
        163. Assemblies should be marked with "NeutralResourcesLanguageAttribute"

           Code Smell
        164. Child class fields should not differ from parent class fields only by capitalization

           Code Smell
        165. Interfaces should not be empty

           Code Smell
        166. Enumerations should have "Int32" storage

           Code Smell
        167. Base class methods should not be hidden

           Code Smell
        168. All type parameters should be used in the parameter list to enable type inference

           Code Smell
        169. Method signatures should not contain nested generic types

           Code Smell
        170. Enumeration members should not be named "Reserved"

           Code Smell
        171. Inherited member visibility should not be decreased

           Code Smell
        172. "System.Uri" arguments should be used instead of strings

           Code Smell
        173. Collection properties should be readonly

           Code Smell
        174. Disposable types should declare finalizers

           Code Smell
        175. Pointers to unmanaged memory should not be visible

           Code Smell
        176. Threads should not lock on objects with weak identity

           Code Smell
        177. String URI overloads should call "System.Uri" overloads

           Code Smell
        178. URI properties should not be strings

           Code Smell
        179. URI return values should not be strings

           Code Smell
        180. URI Parameters should not be strings

           Code Smell
        181. Custom attributes should be marked with "System.AttributeUsageAttribute"

           Code Smell
        182. Assemblies should explicitly specify COM visibility

           Code Smell
        183. Assemblies should be marked as CLS compliant

           Code Smell
        184. Exceptions should not be created without being thrown

           Bug
        185. Collection sizes and array length comparisons should make sense

           Bug
        186. A conditionally executed single line should be denoted by indentation

           Code Smell
        187. Conditionals should start on new lines

           Code Smell
        188. "GC.SuppressFinalize" should not be called

           Code Smell
        189. Multidimensional arrays should not be used

           Code Smell
        190. Objects should not be disposed more than once

           Code Smell
        191. "static" fields should be initialized inline

           Code Smell
        192. "static readonly" constants should be "const" instead

           Code Smell
        193. "Generic.List" instances should not be part of public APIs

           Code Smell
        194. Calculations should not overflow

           Bug
        195. Number patterns should be regular

           Code Smell
        196. Parameter names used into ArgumentException constructors should match an existing one

           Code Smell
        197. Serialization event handlers should be implemented correctly

           Bug
        198. Deserialization methods should be provided for "OptionalField" members

           Bug
        199. "ISerializable" should be implemented correctly

           Code Smell
        200. All branches in a conditional structure should not have exactly the same implementation

           Bug
        201. Collections should implement the generic interface

           Code Smell
        202. Generic event handlers should be used

           Code Smell
        203. Event Handlers should have the correct signature

           Code Smell
        204. Assemblies should have version information

           Code Smell
        205. Types should be defined in named namespaces

           Bug
        206. "Assembly.GetExecutingAssembly" should not be called

           Code Smell
        207. Arguments of public methods should be validated against null

           Code Smell
        208. Value types should implement "IEquatable<T>"

           Code Smell
        209. Classes that provide "Equals(<T>)" should implement "IEquatable<T>"

           Code Smell
        210. "Thread.Resume" and "Thread.Suspend" should not be used

           Bug
        211. Mutable, non-private fields should not be "readonly"

           Bug
        212. "Assembly.Load" should be used

           Code Smell
        213. "CoSetProxyBlanket" and "CoInitializeSecurity" should not be used

           Vulnerability
        214. "IDisposable" should be implemented correctly

           Code Smell
        215. Finalizers should not be empty

           Code Smell
        216. Arrays should not be created for params parameters

           Code Smell
        217. Exceptions should not be thrown from unexpected methods

           Code Smell
        218. Strings or integral types should be used for indexers

           Code Smell
        219. "operator==" should not be overloaded on reference types

           Code Smell
        220. "out" and "ref" parameters should not be used

           Code Smell
        221. Parameter names should not duplicate the names of their methods

           Code Smell
        222. Exception types should be "public"

           Code Smell
        223. "SafeHandle.DangerousGetHandle" should not be called

           Bug
        224. Cognitive Complexity of methods should not be too high

           Code Smell
        225. Track use of "NotImplementedException"

           Code Smell
        226. Empty nullable value should not be accessed

           Bug
        227. Database queries should not be vulnerable to injection attacks

           Vulnerability
        228. Jump statements should not be redundant

           Code Smell
        229. Nullable type comparison should not be redundant

           Bug
        230. Member initializer values should not be redundant

           Code Smell
        231. Methods with "Pure" attribute should return a value

           Bug
        232. "params" should not be introduced on overrides

           Code Smell
        233. One-way "OperationContract" methods should have "void" return type

           Bug
        234. "ServiceContract" and "OperationContract" attributes should be used together

           Code Smell
        235. Empty "default" clauses should be removed

           Code Smell
        236. Optional parameters should be passed to "base" calls

           Bug
        237. Type inheritance should not be recursive

           Bug
        238. Unassigned members should be removed

           Code Smell
        239. Empty "case" clauses that fall through to the "default" should be omitted

           Code Smell
        240. Composite format strings should be used correctly

           Code Smell
        241. "string.ToCharArray()" and "ReadOnlySpan<T>.ToArray()" should not be called redundantly

           Bug
        242. Classes should not have only "private" constructors

           Bug
        243. "[DefaultValue]" should not be used when "[DefaultParameterValue]" is meant

           Code Smell
        244. Parameters with "[DefaultParameterValue]" attributes should also be marked "[Optional]"

           Code Smell
        245. Right operands of shift operators should be integers

           Bug
        246. "[Optional]" should not be used on "ref" or "out" parameters

           Code Smell
        247. Exceptions should not be explicitly rethrown

           Code Smell
        248. Interfaces should not simply inherit from base interfaces with colliding members

           Code Smell
        249. Type should not be examined on "System.Type" instances

           Code Smell
        250. "abstract" classes should not have "public" constructors

           Code Smell
        251. Redundant property names should be omitted in anonymous classes

           Code Smell
        252. Variables should not be checked against the values they're about to be assigned

           Code Smell
        253. Test method signatures should be correct

           Code Smell
        254. "[ExpectedException]" should not be used

           Code Smell
        255. Method overloads with default parameter values should not overlap

           Code Smell
        256. Loggers should be named for their enclosing types

           Code Smell
        257. Assertion arguments should be passed in the correct order

           Code Smell
        258. Methods should not return constants

           Code Smell
        259. "private" methods called only by inner classes should be moved to those classes

           Code Smell
        260. "base.Equals" should not be used to check for reference equality in "Equals" if "base" is not "object"

           Bug
        261. Attribute, EventArgs, and Exception type names should end with the type being extended

           Code Smell
        262. "this" should not be exposed from constructors

           Code Smell
        263. Date and time should not be used as a type for primary keys

           Bug
        264. Ternary operators should not be nested

           Code Smell
        265. Unchanged variables should be marked as "const"

           Code Smell
        266. Expressions used in "Debug.Assert" should not produce side effects

           Bug
        267. Caller information parameters should come at the end of the parameter list

           Bug
        268. Creating cookies without the "HttpOnly" flag is security-sensitive

           Security Hotspot
        269. Cipher Block Chaining IVs should be unpredictable

           Vulnerability
        270. Loops should be simplified with "LINQ" expressions

           Code Smell
        271. Non-flags enums should not be used in bitwise operations

           Code Smell
        272. Events should be invoked

           Code Smell
        273. Static fields should appear in the order they must be initialized

           Bug
        274. "params" should be used on overrides

           Code Smell
        275. Namespaces should not be empty

           Code Smell
        276. Non-derived "private" classes and records should be "sealed"

           Code Smell
        277. Declarations and initializations should be as concise as possible

           Code Smell
        278. "string.IsNullOrEmpty" should be used

           Code Smell
        279. Default parameter values should not be passed as arguments

           Code Smell
        280. Constructor and destructor declarations should not be redundant

           Code Smell
        281. Implementations should be provided for "partial" methods

           Code Smell
        282. Classes directly extending "object" should not call "base" in "GetHashCode" or "Equals"

           Bug
        283. Duplicate casts should not be made

           Code Smell
        284. Generic type parameters should be co/contravariant when possible

           Code Smell
        285. Anonymous delegates should not be used to unsubscribe from Events

           Bug
        286. Method parameters should be declared with base types

           Code Smell
        287. Methods should not return values that are never used

           Code Smell
        288. The simplest possible condition syntax should be used

           Code Smell
        289. "value" contextual keyword should be used

           Code Smell
        290. Caller information arguments should not be provided explicitly

           Code Smell
        291. Redundant parentheses should not be used

           Code Smell
        292. "GC.SuppressFinalize" should not be invoked for types without destructors

           Code Smell
        293. Method calls should not resolve ambiguously to overloads with "params"

           Code Smell
        294. Inner class members should not shadow outer class "static" or type members

           Code Smell
        295. "Explicit" conversions of "foreach" loops should not be used

           Code Smell
        296. "ConfigureAwait(false)" should be used

           Code Smell
        297. "interface" instances should not be cast to concrete types

           Code Smell
        298. Delegates should not be subtracted

           Bug
        299. Multiple "OrderBy" calls should not be used

           Code Smell
        300. "async" methods should not return "void"

           Bug
        301. "StringBuilder" data should be used

           Code Smell
        302. "is" should not be used with "this"

           Code Smell
        303. Types should not have members with visibility set higher than the type's visibility

           Code Smell
        304. Members should not be initialized to default values

           Code Smell
        305. Reflection should not be used to increase accessibility of classes, methods, or fields

           Code Smell
        306. Static fields should not be updated in constructors

           Code Smell
        307. "ThreadStatic" should not be used on non-static fields

           Bug
        308. "IDisposables" created in a "using" statement should not be returned

           Bug
        309. "ThreadStatic" fields should not be initialized

           Bug
        310. "Object.ReferenceEquals" should not be used for value types

           Bug
        311. LINQ expressions should be simplified

           Code Smell
        312. Assertions should be complete

           Code Smell
        313. Generic parameters not constrained to reference types should not be compared to "null"

           Bug
        314. Methods named "Dispose" should implement "IDisposable.Dispose"

           Code Smell
        315. Classes should "Dispose" of members from the classes' own "Dispose" methods

           Bug
        316. Property assignments should not be made for "readonly" fields not constrained to reference types

           Bug
        317. Fields that are only assigned in the constructor should be "readonly"

           Code Smell
        318. Classes with "IDisposable" members should implement "IDisposable"

           Bug
        319. "IDisposables" should be disposed

           Bug
        320. "Thread.Sleep" should not be used in tests

           Code Smell
        321. SQL keywords should be delimited by whitespace

           Bug
        322. Doubled prefix operators "!!" and "~~" should not be used

           Bug
        323. Sequential tests should not check the same condition

           Code Smell
        324. Non-existent operators like "=+" should not be used

           Bug
        325. XML parsers should not be vulnerable to XXE attacks

           Vulnerability
        326. Static fields should not be used in generic types

           Code Smell
        327. "catch" clauses should do more than rethrow

           Code Smell
        328. Literal boolean values should not be used in assertions

           Code Smell
        329. Tests should include assertions

           Code Smell
        330. Instance members should not write to "static" fields

           Code Smell
        331. "IndexOf" checks should not be for positive numbers

           Code Smell
        332. "NaN" should not be used in comparisons

           Bug
        333. Multiline blocks should be enclosed in curly braces

           Code Smell
        334. The length returned from a stream read should be checked

           Bug
        335. Regular expressions should not be vulnerable to Denial of Service attacks

           Vulnerability
        336. Logging templates should be constant

           Code Smell
        337. Setting loose file permissions is security-sensitive

           Security Hotspot
        338. Boolean expressions should not be gratuitous

           Code Smell
        339. Conditionally executed code should be reachable

           Bug
        340. Shared resources should not be used for locking

           Bug
        341. Generic exceptions should not be ignored

           Code Smell
        342. Whitespace and control characters in string literals should be explicit

           Code Smell
        343. Blocks should be synchronized on read-only fields

           Bug
        344. Unnecessary bit operations should not be performed

           Code Smell
        345. Types and methods should not have too many generic parameters

           Code Smell
        346. Child class fields should not shadow parent class fields

           Code Smell
        347. Mutable fields should not be "public static"

           Code Smell
        348. Write-only properties should not be used

           Code Smell
        349. Exceptions should not be thrown from property getters

           Code Smell
        350. Public methods should not have multidimensional array parameters

           Code Smell
        351. Properties should not make collection or array copies

           Code Smell
        352. Optional parameters should not be used

           Code Smell
        353. Fields should be private

           Code Smell
        354. Flags enumerations zero-value members should be named "None"

           Code Smell
        355. Flags enumerations should explicitly initialize all their members

           Bug
        356. Enumeration type names should not have "Flags" or "Enum" suffixes

           Code Smell
        357. Enumeration types should comply with a naming convention

           Code Smell
        358. Public constant members should not be used

           Code Smell
        359. Redundant modifiers should not be used

           Code Smell
        360. Array covariance should not be used

           Code Smell
        361. "GetHashCode" should not reference mutable fields

           Bug
        362. "try" statements with identical "catch" and/or "finally" blocks should be merged

           Code Smell
        363. Unused type parameters should be removed

           Code Smell
        364. Methods and properties that don't access instance data should be static

           Code Smell
        365. "async" and "await" should not be used as identifiers

           Code Smell
        366. "nameof" should be used

           Code Smell
        367. Trivial properties should be auto-implemented

           Code Smell
        368. Overflow checking should not be disabled for "Enumerable.Sum"

           Code Smell
        369. Field-like events should not be virtual

           Code Smell
        370. Composite format strings should not lead to unexpected behavior at runtime

           Bug
        371. Null pointers should not be dereferenced

           Bug
        372. Using non-standard cryptographic algorithms is security-sensitive

           Security Hotspot
        373. For-loop conditions should be true at least once

           Bug
        374. A "for" loop update clause should move the counter in the right direction

           Bug
        375. Using pseudorandom number generators (PRNGs) is security-sensitive

           Security Hotspot
        376. Arguments should be passed in the same order as the method parameters

           Code Smell
        377. "ToString()" method should not return null

           Bug
        378. Non-constant static fields should not be visible

           Code Smell
        379. Locks should be released on all paths

           Bug
        380. "Exception" should not be caught

           Code Smell
        381. Runtime type checking should be simplified

           Code Smell
        382. Methods without side effects should not have their return values ignored

           Bug
        383. Unnecessary mathematical comparisons should not be made

           Code Smell
        384. Modulus results should not be checked for direct equality

           Code Smell
        385. Loops and recursions should not be infinite

           Bug
        386. Test classes should contain at least one test case

           Code Smell
        387. Results of integer division should not be assigned to floating point variables

           Bug
        388. Integral numbers should not be shifted by zero or more than their number of bits-1

           Bug
        389. Short-circuit logic should be used in boolean contexts

           Code Smell
        390. Classes named like "Exception" should extend "Exception" or a subclass

           Code Smell
        391. "sealed" classes should not have "protected" members

           Code Smell
        392. Underscores should be used to make large numbers readable

           Code Smell
        393. Exceptions should be either logged or rethrown but not both

           Code Smell
        394. Values should not be uselessly incremented

           Bug
        395. A secure password should be used when connecting to a database

           Vulnerability
        396. Collections should not be passed as arguments to their own methods

           Bug
        397. Classes should not be empty

           Code Smell
        398. Creating cookies without the "secure" flag is security-sensitive

           Security Hotspot
        399. XPath expressions should not be vulnerable to injection attacks

           Vulnerability
        400. I/O function calls should not be vulnerable to path injection attacks

           Vulnerability
        401. LDAP queries should not be vulnerable to injection attacks

           Vulnerability
        402. Formatting SQL queries is security-sensitive

           Security Hotspot
        403. OS commands should not be vulnerable to command injection attacks

           Vulnerability
        404. Hard-coded credentials are security-sensitive

           Security Hotspot
        405. Password hashing functions should use an unpredictable salt

           Vulnerability
        406. "for" loop increment clauses should modify the loops' counters

           Code Smell
        407. Invalid casts should be avoided

           Code Smell
        408. Boolean checks should not be inverted

           Code Smell
        409. Inheritance list should not be redundant

           Code Smell
        410. Redundant casts should not be used

           Code Smell
        411. Two branches in a conditional structure should not have exactly the same implementation

           Code Smell
        412. Related "if/else if" statements should not have the same condition

           Bug
        413. "ToString()" calls should not be redundant

           Code Smell
        414. Unused assignments should be removed

           Code Smell
        415. Objects should not be created to be dropped immediately without being used

           Bug
        416. "switch" statements should not be nested

           Code Smell
        417. Identical expressions should not be used on both sides of operators

           Bug
        418. Loops with at most one iteration should be refactored

           Bug
        419. Constructors should only call non-overridable methods

           Code Smell
        420. "==" should not be used when "Equals" is overridden

           Code Smell
        421. NullReferenceException should not be caught

           Code Smell
        422. An abstract class should have both abstract and concrete methods

           Code Smell
        423. Multiple variables should not be declared on the same line

           Code Smell
        424. Variables should not be self-assigned

           Bug
        425. Strings should not be concatenated using '+' in a loop

           Code Smell
        426. Tests should not be ignored

           Code Smell
        427. Methods and properties should not be too complex

           Code Smell
        428. Unused local variables should be removed

           Code Smell
        429. "switch" statements with many "case" clauses should have only one statement

           Code Smell
        430. Track lack of copyright and license headers

           Code Smell
        431. Private fields only used as local variables in methods should become local variables

           Code Smell
        432. Culture should be specified for "string" operations

           Code Smell
        433. Functions should not have too many lines of code

           Code Smell
        434. Control flow statements "if", "switch", "for", "foreach", "while", "do" and "try" should not be nested too deeply

           Code Smell
        435. Using hardcoded IP addresses is security-sensitive

           Security Hotspot
        436. Logger fields should be "private static readonly"

           Code Smell
        437. "switch/Select" statements should contain a "default/Case Else" clauses

           Code Smell
        438. Track uses of in-source issue suppressions

           Code Smell
        439. "switch" statements should have at least 3 "case" clauses

           Code Smell
        440. "for" loop stop conditions should be invariant

           Code Smell
        441. A "while" loop should be used instead of a "for" loop

           Code Smell
        442. "if ... else if" constructs should end with "else" clauses

           Code Smell
        443. Sections of code should not be commented out

           Code Smell
        444. Floating point numbers should not be tested for equality

           Bug
        445. break statements should not be used except for switch cases

           Code Smell
        446. Method parameters, caught exceptions and foreach variables' initial values should not be ignored

           Bug
        447. Statements should be on separate lines

           Code Smell
        448. "GC.Collect" should not be called

           Code Smell
        449. "Equals" and the comparison operators should be overridden when implementing "IComparable"

           Code Smell
        450. Control structures should use curly braces

           Code Smell
        451. "Equals(Object)" and "GetHashCode()" should be overridden in pairs

           Bug
        452. Classes should not be coupled to too many other classes

           Code Smell
        453. Nested code blocks should not be used

           Code Smell
        454. String literals should not be duplicated

           Code Smell
        455. Methods should not be empty

           Code Smell
        456. Overriding members should do more than simply call the same member in the base class

           Code Smell
        457. Unused method parameters should be removed

           Code Smell
        458. Empty arrays and collections should be returned instead of null

           Code Smell
        459. Exceptions should not be thrown in finally blocks

           Code Smell
        460. "Any()" should be used to test for emptiness

           Code Smell
        461. "switch case" clauses should not have too many lines of code

           Code Smell
        462. Exit methods should not be called

           Code Smell
        463. Unused private types or members should be removed

           Code Smell
        464. Track uses of "TODO" tags

           Code Smell
        465. Track uses of "FIXME" tags

           Code Smell
        466. Deprecated code should be removed

           Code Smell
        467. Files should end with a newline

           Code Smell
        468. Unnecessary "using" should be removed

           Code Smell
        469. Boolean literals should not be redundant

           Code Smell
        470. "Obsolete" attributes should include explanations

           Code Smell
        471. Assignments should not be made from within sub-expressions

           Code Smell
        472. General or reserved exceptions should never be thrown

           Code Smell
        473. Utility classes should not have public constructors

           Code Smell
        474. Local variables should not shadow class fields or properties

           Code Smell
        475. Empty statements should be removed

           Code Smell
        476. Redundant pairs of parentheses should be removed

           Code Smell
        477. A close curly brace should be located at the beginning of a line

           Code Smell
        478. Fields should not have public accessibility

           Code Smell
        479. Inheritance tree of classes should not be too deep

           Code Smell
        480. Magic numbers should not be used

           Code Smell
        481. Nested blocks of code should not be left empty

           Code Smell
        482. URIs should not be hardcoded

           Code Smell
        483. Methods should not have too many parameters

           Code Smell
        484. Expressions should not be too complex

           Code Smell
        485. Mergeable "if" statements should be combined

           Code Smell
        486. Standard outputs should not be used directly to log anything

           Code Smell
        487. Tabulation characters should not be used

           Code Smell
        488. Finalizers should not throw exceptions

           Bug
        489. Files should not have too many lines of code

           Code Smell
        490. Lines should not be too long

           Code Smell
        491. Types should be named in PascalCase

           Code Smell
        492. Method overrides should not change parameter defaults

           Code Smell
        493. Methods and properties should be named in PascalCase

           Code Smell

        "GC.SuppressFinalize" should not be invoked for types without destructors

        intentionality - logical
        maintainability
        Code Smell
        Quick FixIDE quick fixes available with SonarLint
        • unused
        • confusing

        Why is this an issue?

        GC.SuppressFinalize asks the Common Language Runtime not to call the finalizer of an object. This is useful when implementing the dispose pattern where object finalization is already handled in IDisposable.Dispose. However, it has no effect if there is no finalizer defined in the object’s type, so using it in such cases is just confusing.

        This rule raises an issue when GC.SuppressFinalize is called for objects of sealed types without a finalizer.

        Note: S3971 is a stricter version of this rule. Typically it makes sense to activate only one of these 2 rules.

        Noncompliant code example

        sealed class MyClass
        {
          public void Method()
          {
            ...
            GC.SuppressFinalize(this); //Noncompliant
          }
        }
        

        Compliant solution

        sealed class MyClass
        {
          public void Method()
          {
            ...
          }
        }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use