Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Apex
C
C++
CloudFormation
COBOL
C#
CSS
Docker
Flex
Go
HTML
Java
JavaScript
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Flex static code analysis

Unique rules to find Bugs, Security Hotspots, and Code Smells in your FLEX code

Tags

Security.allowDomain(...) should only be used in a tightly focused manner
Vulnerability
The flash.system.Security.exactSettings property should never be set to false
Vulnerability
Dynamic classes should not be used
Code Smell
"LocalConnection" should be configured to narrowly specify the domains with which local connections to other Flex application are allowed
Vulnerability
"default" clauses should be first or last
Code Smell
Event types should be defined in metadata tags
Code Smell
Event names should not be hardcoded in event listeners
Code Smell
The special "star" type should not be used
Code Smell
Variables of the "Object" type should not be used
Code Smell
Methods should not be empty
Code Smell
Constant names should comply with a naming convention
Code Smell
All branches in a conditional structure should not have exactly the same implementation
Bug
Classes that extend "Event" should override "Event.clone()"
Bug
Constructors should not dispatch events
Bug
"ManagedEvents" tags should have companion "Event" tags
Bug
Objects should not be instantiated inside a loop
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
Constructor bodies should be as lightweight as possible
Code Smell
Only "while", "do" and "for" statements should be labelled
Code Smell
Statements, operators and keywords specific to ActionScript 2 should not be used
Code Smell
"for" loop stop conditions should be invariant
Code Smell
Unused function parameters should be removed
Code Smell
Unused "private" functions should be removed
Code Smell
Local variables should not shadow class fields
Code Smell
Nested blocks of code should not be left empty
Code Smell
Functions should not have too many parameters
Code Smell
Unused "private" fields should be removed
Code Smell
Collapsible "if" statements should be merged
Code Smell
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Unused local variables should be removed
Code Smell
Package definition should be separate from Class definition
Code Smell
Constructors should not have a "void" return type
Code Smell
"public static" fields should be constant
Code Smell
"switch" statements should have at least 3 "case" clauses
Code Smell
Package names should comply with a naming convention
Code Smell
Overriding methods should do more than simply call the same method in the super class
Code Smell
Public constants and fields initialized at declaration should be "const static" rather than merely "const"
Code Smell
Local variable and function parameter names should comply with a naming convention
Code Smell
Field names should comply with a naming convention
Code Smell
Boolean literals should not be redundant
Code Smell
Empty statements should be removed
Code Smell
Class names should comply with a naming convention
Code Smell
Function names should comply with a naming convention
Code Smell
The element type of an array field should be specified
Code Smell
Track lack of copyright and license headers
Code Smell
Octal values should not be used
Code Smell
Switch cases should end with an unconditional "break" statement
Code Smell
"switch" statements should not be nested
Code Smell
Cyclomatic Complexity of functions should not be too high
Code Smell
Control flow statements "if", "for", "while" and "switch" should not be nested too deeply
Code Smell
Cyclomatic Complexity of classes should not be too high
Code Smell
"switch" statements should have "default" clauses
Code Smell
Multiple "++" or "--" unary operators should not be used in a single arithmetic expression
Bug
"with" statements should not be used
Bug
Useless "if(true) {...}" and "if(false){...}" blocks should be removed
Bug
Flex parser failure
Code Smell
Classes should not have too many fields
Code Smell
Classes should not have too many methods
Code Smell
"===" and "!==" should be used instead of "==" and "!="
Code Smell
Track breaches of an XPath rule
Code Smell
Functions should not have too many lines of code
Code Smell
Sections of code should not be commented out
Code Smell
Track comments matching a regular expression
Code Smell
Statements should be on separate lines
Code Smell
Public classes, methods, properties and metadata should be documented with ASDoc
Code Smell
"switch case" clauses should not have too many lines of code
Code Smell
Functions should not contain too many return statements
Code Smell
Lines should not be too long
Code Smell
The "trace" function should not be used
Vulnerability
"Alert.show(...)" should not be used
Vulnerability
Cases in a "switch" should not have the same condition
Bug
Method visibility should be explicitly declared
Bug
"MovieClip.onEnterFrame" event handler should not be used
Code Smell
Statements should end with semicolons
Code Smell
Loggers should be "private static const" and should share naming convention
Code Smell
A function should have a single point of exit at the end of the function
Code Smell

Security.allowDomain(...) should only be used in a tightly focused manner

Vulnerability

BlockerSonarSource default severity
click to learn more

Calling Security.allowDomain("*") lets any domain cross-script into the domain of this SWF and exercise its functionality.

Noncompliant Code Example

Security.allowDomain("*");

Compliant Solution

Security.allowDomain("www.myDomain.com");

Available In:

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2023 SonarSource S.A., Switzerland. All content is copyright protected. SONAR, SONARSOURCE, SONARLINT, SONARQUBE, and SONARCLOUD are trademarks of SonarSource S.A. All other trademarks and copyrights are the property of their respective owners. All rights are expressly reserved.
Privacy Policy

In-IDE

SaaS

Self-Hosted