Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
Go
HTML
Java
JavaScript
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Flex static code analysis

Unique rules to find Bugs, Security Hotspots, and Code Smells in your FLEX code

Tags

Impact

Clean code attribute

Security.allowDomain(...) should only be used in a tightly focused manner
Vulnerability
The flash.system.Security.exactSettings property should never be set to false
Vulnerability
The element type of an array field should be specified
Code Smell
Track lack of copyright and license headers
Code Smell
Dynamic classes should not be used
Code Smell
Octal values should not be used
Code Smell
Switch cases should end with an unconditional "break" statement
Code Smell
"LocalConnection" should be configured to narrowly specify the domains with which local connections to other Flex application are allowed
Vulnerability
"default" clauses should be first or last
Code Smell
"switch" statements should not be nested
Code Smell
Cyclomatic Complexity of functions should not be too high
Code Smell
Event types should be defined in metadata tags
Code Smell
Event names should not be hardcoded in event listeners
Code Smell
The special "star" type should not be used
Code Smell
Variables of the "Object" type should not be used
Code Smell
Control flow statements "if", "for", "while" and "switch" should not be nested too deeply
Code Smell
Cyclomatic Complexity of classes should not be too high
Code Smell
"switch" statements should have "default" clauses
Code Smell
Methods should not be empty
Code Smell
Constant names should comply with a naming convention
Code Smell
All branches in a conditional structure should not have exactly the same implementation
Bug
Classes that extend "Event" should override "Event.clone()"
Bug
Constructors should not dispatch events
Bug
"ManagedEvents" tags should have companion "Event" tags
Bug
Multiple "++" or "--" unary operators should not be used in a single arithmetic expression
Bug
"with" statements should not be used
Bug
Useless "if(true) {...}" and "if(false){...}" blocks should be removed
Bug
Flex parser failure
Code Smell
Objects should not be instantiated inside a loop
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
Classes should not have too many fields
Code Smell
Classes should not have too many methods
Code Smell
Constructor bodies should be as lightweight as possible
Code Smell
"===" and "!==" should be used instead of "==" and "!="
Code Smell
Only "while", "do" and "for" statements should be labelled
Code Smell
Track breaches of an XPath rule
Code Smell
Functions should not have too many lines of code
Code Smell
Statements, operators and keywords specific to ActionScript 2 should not be used
Code Smell
"for" loop stop conditions should be invariant
Code Smell
Sections of code should not be commented out
Code Smell
Track comments matching a regular expression
Code Smell
Statements should be on separate lines
Code Smell
Public classes, methods, properties and metadata should be documented with ASDoc
Code Smell
Unused function parameters should be removed
Code Smell
"switch case" clauses should not have too many lines of code
Code Smell
Unused "private" functions should be removed
Code Smell
Functions should not contain too many return statements
Code Smell
Local variables should not shadow class fields
Code Smell
Nested blocks of code should not be left empty
Code Smell
Functions should not have too many parameters
Code Smell
Unused "private" fields should be removed
Code Smell
Mergeable "if" statements should be combined
Code Smell
Lines should not be too long
Code Smell
The "trace" function should not be used
Vulnerability
"Alert.show(...)" should not be used
Vulnerability
Cases in a "switch" should not have the same condition
Bug
Method visibility should be explicitly declared
Bug
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
"MovieClip.onEnterFrame" event handler should not be used
Code Smell
Unused local variables should be removed
Code Smell
Package definition should be separate from Class definition
Code Smell
Constructors should not have a "void" return type
Code Smell
"public static" fields should be constant
Code Smell
Statements should end with semicolons
Code Smell
Loggers should be "private static const" and should share naming convention
Code Smell
"switch" statements should have at least 3 "case" clauses
Code Smell
Package names should comply with a naming convention
Code Smell
Overriding methods should do more than simply call the same method in the super class
Code Smell
Public constants and fields initialized at declaration should be "const static" rather than merely "const"
Code Smell
Local variable and function parameter names should comply with a naming convention
Code Smell
Field names should comply with a naming convention
Code Smell
Boolean literals should not be redundant
Code Smell
Empty statements should be removed
Code Smell
Class names should comply with a naming convention
Code Smell
A function should have a single point of exit at the end of the function
Code Smell
Function names should comply with a naming convention
Code Smell

Security.allowDomain(...) should only be used in a tightly focused manner

intentionality - complete

security

Vulnerability

BlockerSonarSource default severity
click to learn more

This rule is deprecated, and will eventually be removed.

Why is this an issue?

Calling Security.allowDomain("*") lets any domain cross-script into the domain of this SWF and exercise its functionality.

Noncompliant code example

Security.allowDomain("*");

Compliant solution

Security.allowDomain("www.myDomain.com");

Available In:

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2024 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.

Sonar helps developers write Clean Code.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted