SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
Go

Go static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your GO code

  • All rules 70
  • Vulnerability20
  • Bug7
  • Security Hotspot14
  • Code Smell29
 
Tags
    Impact
      Clean code attribute
        1. Credentials should not be hard-coded

           Vulnerability
        2. Hard-coded secrets are security-sensitive

           Security Hotspot
        3. Constructing arguments of system commands from user input is security-sensitive

           Security Hotspot
        4. Extracting archives should not lead to zip slip vulnerabilities

           Vulnerability
        5. JWT should be signed and verified with strong cipher algorithms

           Vulnerability
        6. Cipher algorithms should be robust

           Vulnerability
        7. Encryption algorithms should be used with secure mode and padding scheme

           Vulnerability
        8. Server hostnames should be verified during SSL/TLS connections

           Vulnerability
        9. Insecure temporary file creation methods should not be used

           Vulnerability
        10. Using publicly writable directories is security-sensitive

           Security Hotspot
        11. Passwords should not be stored in plaintext or with a fast hashing algorithm

           Vulnerability
        12. Using clear-text protocols is security-sensitive

           Security Hotspot
        13. HTTP request redirections should not be open to forging attacks

           Vulnerability
        14. Logging should not be vulnerable to injection attacks

           Vulnerability
        15. Server-side requests should not be vulnerable to forging attacks

           Vulnerability
        16. Server certificates should be verified during SSL/TLS connections

           Vulnerability
        17. Using weak hashing algorithms is security-sensitive

           Security Hotspot
        18. Multi-line comments should not be empty

           Code Smell
        19. Delivering code in production with debug features activated is security-sensitive

           Security Hotspot
        20. Cryptographic keys should be robust

           Vulnerability
        21. Weak SSL/TLS protocols should not be used

           Vulnerability
        22. Functions should not have identical implementations

           Code Smell
        23. Searching OS commands in PATH is security-sensitive

           Security Hotspot
        24. All branches in a conditional structure should not have exactly the same implementation

           Bug
        25. Cognitive Complexity of functions should not be too high

           Code Smell
        26. Database queries should not be vulnerable to injection attacks

           Vulnerability
        27. Creating cookies without the "HttpOnly" flag is security-sensitive

           Security Hotspot
        28. Cipher Block Chaining IVs should be unpredictable

           Vulnerability
        29. Non-existent operators like "=+" should not be used

           Bug
        30. Setting loose POSIX file permissions is security-sensitive

           Security Hotspot
        31. Go parser failure

           Code Smell
        32. Using pseudorandom number generators (PRNGs) is security-sensitive

           Security Hotspot
        33. Creating cookies without the "secure" flag is security-sensitive

           Security Hotspot
        34. XPath expressions should not be vulnerable to injection attacks

           Vulnerability
        35. I/O function calls should not be vulnerable to path injection attacks

           Vulnerability
        36. Formatting SQL queries is security-sensitive

           Security Hotspot
        37. OS commands should not be vulnerable to command injection attacks

           Vulnerability
        38. Hard-coded credentials are security-sensitive

           Security Hotspot
        39. Password hashing functions should use an unpredictable salt

           Vulnerability
        40. Boolean checks should not be inverted

           Code Smell
        41. Two branches in a conditional structure should not have exactly the same implementation

           Code Smell
        42. Related "if/else if" statements should not have the same condition

           Bug
        43. "switch" statements should not be nested

           Code Smell
        44. Identical expressions should not be used on both sides of a binary operator

           Bug
        45. All code should be reachable

           Bug
        46. Variables should not be self-assigned

           Bug
        47. "switch" statements should not have too many "case" clauses

           Code Smell
        48. Track lack of copyright and license headers

           Code Smell
        49. Functions and methods should not have too many lines

           Code Smell
        50. Control flow statements "if", "for" and "switch" should not be nested too deeply

           Code Smell
        51. Octal values should not be used

           Code Smell
        52. Using hardcoded IP addresses is security-sensitive

           Security Hotspot
        53. "switch" statements should have "default" clauses

           Code Smell
        54. "if ... else if" constructs should end with "else" clauses

           Code Smell
        55. Statements should be on separate lines

           Code Smell
        56. String literals should not be duplicated

           Code Smell
        57. Functions should not be empty

           Code Smell
        58. Local variable and function parameter names should comply with a naming convention

           Code Smell
        59. "switch case" clauses should not have too many lines

           Code Smell
        60. Useless "if(true) {...}" and "if(false){...}" blocks should be removed

           Bug
        61. Track uses of "TODO" tags

           Code Smell
        62. Track uses of "FIXME" tags

           Code Smell
        63. Boolean literals should not be redundant

           Code Smell
        64. Redundant pairs of parentheses should be removed

           Code Smell
        65. Nested blocks of code should not be left empty

           Code Smell
        66. Functions should not have too many parameters

           Code Smell
        67. Expressions should not be too complex

           Code Smell
        68. Files should not have too many lines of code

           Code Smell
        69. Lines should not be too long

           Code Smell
        70. Function names should comply with a naming convention

           Code Smell

        Go parser failure

        Code Smell
        • suspicious

        Why is this an issue?

        When the Go parser fails, it is possible to record the failure as a violation on the file. This way, not only it is possible to track the number of files that do not parse but also to easily find out why they do not parse.

          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Sonar helps developers write Clean Code.
        Privacy Policy | Cookie Policy | Terms of Use