SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C#

C# static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C# code

  • All rules 493
  • Vulnerability46
  • Bug88
  • Security Hotspot24
  • Code Smell335

  • Quick Fix 61
Filtered: 57 rules found
pitfall
    Impact
      Clean code attribute
        1. Literal suffixes should be upper case

           Code Smell
        2. Use a format provider when parsing date and time

           Code Smell
        3. Use UTC when recording DateTime instants

           Code Smell
        4. Always set the "DateTimeKind" when creating new "DateTime" instances

           Code Smell
        5. "PartCreationPolicyAttribute" should be used with "ExportAttribute"

           Bug
        6. Secure random number generators should not output predictable values

           Vulnerability
        7. "Shared" parts should not be created with "new"

           Bug
        8. Getters and setters should access the expected fields

           Bug
        9. Events should have proper arguments

           Code Smell
        10. Members should not have conflicting transparency annotations

           Vulnerability
        11. Windows Forms entry points should be marked with STAThread

           Bug
        12. Native methods should be wrapped

           Code Smell
        13. Classes should implement their "ExportAttribute" interfaces

           Bug
        14. Overloads with a "CultureInfo" or an "IFormatProvider" parameter should be used

           Code Smell
        15. Literals should not be passed as localized parameters

           Code Smell
        16. Operators should be overloaded consistently

           Code Smell
        17. Strings should be normalized to uppercase

           Code Smell
        18. Interface methods should be callable by derived types

           Code Smell
        19. Classes implementing "IEquatable<T>" should be sealed

           Code Smell
        20. Child class fields should not differ from parent class fields only by capitalization

           Code Smell
        21. Base class methods should not be hidden

           Code Smell
        22. Inherited member visibility should not be decreased

           Code Smell
        23. Threads should not lock on objects with weak identity

           Code Smell
        24. Objects should not be disposed more than once

           Code Smell
        25. "ISerializable" should be implemented correctly

           Code Smell
        26. Assemblies should have version information

           Code Smell
        27. "IDisposable" should be implemented correctly

           Code Smell
        28. Exceptions should not be thrown from unexpected methods

           Code Smell
        29. "operator==" should not be overloaded on reference types

           Code Smell
        30. Parameters with "[DefaultParameterValue]" attributes should also be marked "[Optional]"

           Code Smell
        31. "[Optional]" should not be used on "ref" or "out" parameters

           Code Smell
        32. Method overloads with default parameter values should not overlap

           Code Smell
        33. "value" contextual keyword should be used

           Code Smell
        34. Method calls should not resolve ambiguously to overloads with "params"

           Code Smell
        35. Inner class members should not shadow outer class "static" or type members

           Code Smell
        36. Methods named "Dispose" should implement "IDisposable.Dispose"

           Code Smell
        37. Conditionally executed code should be reachable

           Bug
        38. Whitespace and control characters in string literals should be explicit

           Code Smell
        39. Write-only properties should not be used

           Code Smell
        40. Public methods should not have multidimensional array parameters

           Code Smell
        41. Optional parameters should not be used

           Code Smell
        42. Fields should be private

           Code Smell
        43. Public constant members should not be used

           Code Smell
        44. Array covariance should not be used

           Code Smell
        45. Methods and properties that don't access instance data should be static

           Code Smell
        46. "async" and "await" should not be used as identifiers

           Code Smell
        47. Non-constant static fields should not be visible

           Code Smell
        48. Classes named like "Exception" should extend "Exception" or a subclass

           Code Smell
        49. Boolean checks should not be inverted

           Code Smell
        50. Related "if/else if" statements should not have the same condition

           Bug
        51. "switch" statements should not be nested

           Code Smell
        52. Constructors should only call non-overridable methods

           Code Smell
        53. Private fields only used as local variables in methods should become local variables

           Code Smell
        54. "for" loop stop conditions should be invariant

           Code Smell
        55. Control structures should use curly braces

           Code Smell
        56. Local variables should not shadow class fields or properties

           Code Smell
        57. Method overrides should not change parameter defaults

           Code Smell

        Public constant members should not be used

        intentionality - clear
        maintainability
        Code Smell
        • pitfall

        Why is this an issue?

        Constant members are copied at compile time to the call sites, instead of being fetched at runtime.

        As an example, say you have a library with a constant Version member set to 1.0, and a client application linked to it. This library is then updated and Version is set to 2.0. Unfortunately, even after the old DLL is replaced by the new one, Version will still be 1.0 for the client application. In order to see 2.0, the client application would need to be rebuilt against the new version of the library.

        This means that you should use constants to hold values that by definition will never change, such as Zero. In practice, those cases are uncommon, and therefore it is generally better to avoid constant members.

        This rule only reports issues on public constant fields, which can be reached from outside the defining assembly.

        Noncompliant code example

        public class Foo
        {
            public const double Version = 1.0;           // Noncompliant
        }
        

        Compliant solution

        public class Foo
        {
            public static double Version
            {
              get { return 1.0; }
            }
        }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Sonar helps developers write Clean Code.
        Privacy Policy | Cookie Policy | Terms of Use