SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
Go

Go static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your GO code

  • All rules 92
  • Vulnerability21
  • Bug12
  • Security Hotspot14
  • Code Smell45
 
Tags
    Impact
      Clean code attribute
        1. File existence checks followed by file creation should use atomic operations

           Vulnerability
        2. Busy waiting loops should use proper synchronization

           Bug
        3. Context should not be stored in struct fields

           Code Smell
        4. Context parameters should be reused instead of creating new background contexts

           Code Smell
        5. Package imports should be consistent and avoid redundancy

           Code Smell
        6. Variables should be used

           Code Smell
        7. Consecutive function parameters with the same type should be grouped

           Code Smell
        8. HTTP response bodies should be closed to prevent resource leaks

           Bug
        9. Deprecated "InterfaceData" method should not be used

           Bug
        10. Named types should be used instead of anonymous structs for complex nested structures

           Code Smell
        11. Use "bytes.Equal" instead of "bytes.Compare" for equality checks

           Code Smell
        12. Single-method interface names should follow Go naming conventions

           Code Smell
        13. Variables in if short statements should be used beyond just the condition

           Code Smell
        14. Context cancellation functions should be deferred

           Code Smell
        15. Blank imports should be documented to explain their purpose

           Code Smell
        16. Semicolons should not be used unnecessarily

           Code Smell
        17. Database transactions should be properly handled with rollback mechanisms

           Bug
        18. Test functions should not call "t.Fatal" from separate goroutines

           Bug
        19. Import statements should be factored into a single block

           Code Smell
        20. Credentials should not be hard-coded

           Vulnerability
        21. Hard-coded secrets are security-sensitive

           Security Hotspot
        22. Constructing arguments of system commands from user input is security-sensitive

           Security Hotspot
        23. Extracting archives should not lead to zip slip vulnerabilities

           Vulnerability
        24. JWT should be signed and verified with strong cipher algorithms

           Vulnerability
        25. Cipher algorithms should be robust

           Vulnerability
        26. Encryption algorithms should be used with secure mode and padding scheme

           Vulnerability
        27. Server hostnames should be verified during SSL/TLS connections

           Vulnerability
        28. Insecure temporary file creation methods should not be used

           Vulnerability
        29. Using publicly writable directories is security-sensitive

           Security Hotspot
        30. Passwords should not be stored in plaintext or with a fast hashing algorithm

           Vulnerability
        31. Using clear-text protocols is security-sensitive

           Security Hotspot
        32. HTTP request redirections should not be open to forging attacks

           Vulnerability
        33. Logging should not be vulnerable to injection attacks

           Vulnerability
        34. Server-side requests should not be vulnerable to forging attacks

           Vulnerability
        35. Server certificates should be verified during SSL/TLS connections

           Vulnerability
        36. Using weak hashing algorithms is security-sensitive

           Security Hotspot
        37. Multi-line comments should not be empty

           Code Smell
        38. Delivering code in production with debug features activated is security-sensitive

           Security Hotspot
        39. Cryptographic keys should be robust

           Vulnerability
        40. Weak SSL/TLS protocols should not be used

           Vulnerability
        41. Functions should not have identical implementations

           Code Smell
        42. Searching OS commands in PATH is security-sensitive

           Security Hotspot
        43. All branches in a conditional structure should not have exactly the same implementation

           Bug
        44. Cognitive Complexity of functions should not be too high

           Code Smell
        45. Database queries should not be vulnerable to injection attacks

           Vulnerability
        46. Creating cookies without the "HttpOnly" flag is security-sensitive

           Security Hotspot
        47. Cipher Block Chaining IVs should be unpredictable

           Vulnerability
        48. Non-existent operators like "=+" should not be used

           Bug
        49. Setting loose POSIX file permissions is security-sensitive

           Security Hotspot
        50. Go parser failure

           Code Smell
        51. Go parser failure

           Code Smell
        52. Using pseudorandom number generators (PRNGs) is security-sensitive

           Security Hotspot
        53. Creating cookies without the "secure" flag is security-sensitive

           Security Hotspot
        54. XPath expressions should not be vulnerable to injection attacks

           Vulnerability
        55. I/O function calls should not be vulnerable to path injection attacks

           Vulnerability
        56. Formatting SQL queries is security-sensitive

           Security Hotspot
        57. OS commands should not be vulnerable to command injection attacks

           Vulnerability
        58. Hard-coded credentials are security-sensitive

           Security Hotspot
        59. Password hashing functions should use an unpredictable salt

           Vulnerability
        60. Boolean checks should not be inverted

           Code Smell
        61. Two branches in a conditional structure should not have exactly the same implementation

           Code Smell
        62. Related "if/else if" statements should not have the same condition

           Bug
        63. "switch" statements should not be nested

           Code Smell
        64. Identical expressions should not be used on both sides of a binary operator

           Bug
        65. All code should be reachable

           Bug
        66. Variables should not be self-assigned

           Bug
        67. "switch" statements should not have too many "case" clauses

           Code Smell
        68. Track lack of copyright and license headers

           Code Smell
        69. Functions and methods should not have too many lines

           Code Smell
        70. Control flow statements "if", "for" and "switch" should not be nested too deeply

           Code Smell
        71. Octal values should not be used

           Code Smell
        72. Using hardcoded IP addresses is security-sensitive

           Security Hotspot
        73. "switch" statements should have "default" clauses

           Code Smell
        74. "if ... else if" constructs should end with "else" clauses

           Code Smell
        75. Statements should be on separate lines

           Code Smell
        76. String literals should not be duplicated

           Code Smell
        77. Functions should not be empty

           Code Smell
        78. Unused function parameters should be removed

           Code Smell
        79. Local variable and function parameter names should comply with a naming convention

           Code Smell
        80. "switch case" clauses should not have too many lines

           Code Smell
        81. Useless "if(true) {...}" and "if(false){...}" blocks should be removed

           Bug
        82. Track uses of "TODO" tags

           Code Smell
        83. Track uses of "FIXME" tags

           Code Smell
        84. Boolean literals should not be redundant

           Code Smell
        85. Empty statements should be removed

           Code Smell
        86. Redundant pairs of parentheses should be removed

           Code Smell
        87. Nested blocks of code should not be left empty

           Code Smell
        88. Functions should not have too many parameters

           Code Smell
        89. Expressions should not be too complex

           Code Smell
        90. Files should not have too many lines of code

           Code Smell
        91. Lines should not be too long

           Code Smell
        92. Function names should comply with a naming convention

           Code Smell

        Redundant pairs of parentheses should be removed

        intentionality - clear
        maintainability
        Code Smell
        • confusing

        Why is this an issue?

        Parentheses can disambiguate the order of operations in complex expressions and make the code easier to understand.

        a = (b * c) + (d * e); // Compliant: the intent is clear.
        

        Redundant parentheses are parenthesis that do not change the behavior of the code, and do not clarify the intent. They can mislead and complexify the code. They should be removed.

        Noncompliant code example

        func foo(a bool, y int) int {
          x := ((y / 2 + 1)) // Noncompliant
        
          if a && ((x+y > 0)) {  // Noncompliant
            return ((x + 1))  // Noncompliant
          }
        }
        

        Compliant solution

        func foo(a bool, y int) int {
          x := (y / 2 + 1)
        
          if a && (x+y > 0) {
            return (x + 1)
          }
        }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2025 SonarSource Sàrl. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use