SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
Java

Java static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your JAVA code

  • All rules 733
  • Vulnerability60
  • Bug175
  • Security Hotspot40
  • Code Smell458

  • Quick Fix 65
Filtered: 498 rules found
Tags
    Impact
      intentionality
        1. Functions should not be defined with a variable number of arguments

           Code Smell
        2. Return values should not be ignored when they contain the operation status code

           Bug
        3. Equality operators should not be used in "for" loop termination conditions

           Code Smell
        4. Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression

           Code Smell
        5. Limited dependence should be placed on operator precedence

           Code Smell
        6. WebViews should not be vulnerable to cross-app scripting attacks

           Vulnerability
        7. Privileged prompts should not be vulnerable to injection attacks

           Vulnerability
        8. Gatherer.ofSequential() should be used to build sequential gathers

           Code Smell
        9. "ClassBuilder.withMethodBody" should be preferred to "ClassBuilder.withMethod"

           Code Smell
        10. "transformClass" method should be used instead of "build" when transforming a class

           Code Smell
        11. Class name should be omitted when unchanged by class transform

           Code Smell
        12. Types of unused record components should be removed from pattern matching

           Code Smell
        13. Unused exception parameter should use the unnamed variable pattern

           Code Smell
        14. Unnamed variable declarations should use the "var" identifier

           Code Smell
        15. Methods annotated with "@BeforeTransaction" or "@AfterTransaction" must respect the contract

           Code Smell
        16. @EventListener methods should have one parameter at most

           Bug
        17. "@Scheduled" annotation should only be applied to no-arg methods

           Bug
        18. @InitBinder methods should have void return type

           Code Smell
        19. "@Cache*" annotations should only be applied on concrete classes

           Code Smell
        20. @Cacheable and @CachePut should not be combined

           Code Smell
        21. Injecting data into static fields is not supported by Spring

           Code Smell
        22. Use appropriate @DirtiesContext modes

           Code Smell
        23. "String.isEmpty()" should be used to test for emptiness

           Code Smell
        24. Server-side requests should not be vulnerable to traversing attacks

           Vulnerability
        25. Consumed Stream pipelines should not be reused

           Bug
        26. Bluetooth should be configured to use low power

           Code Smell
        27. "String.indexOf" should be used with correct ranges

           Bug
        28. Use Fused Location to optimize battery power

           Code Smell
        29. "Math.clamp" should be used with correct ranges

           Bug
        30. Use batch Processing in JDBC

           Code Smell
        31. Constant parameters in a "PreparedStatement" should not be set more than once

           Code Smell
        32. Virtual threads should not run tasks that include synchronized code

           Bug
        33. SQL queries should retrieve only necessary fields

           Code Smell
        34. Avoid using "FetchType.EAGER"

           Code Smell
        35. High frame rates should not be used

           Code Smell
        36. Exact alarms should not be abused

           Code Smell
        37. Proper Sensor Resource Management

           Code Smell
        38. Virtual threads should be used for tasks that include heavy blocking operations

           Bug
        39. Use switch instead of if-else chain to compare a variable against multiple cases

           Code Smell
        40. Use record pattern instead of explicit field access

           Code Smell
        41. Beans in "@Configuration" class should have different names

           Bug
        42. "@PathVariable" annotation should be present if a path variable is used

           Bug
        43. "@Bean" methods for Singleton should not be invoked in "@Configuration" when proxyBeanMethods is false

           Bug
        44. Superfluous "@ResponseBody" annotations should be removed

           Code Smell
        45. Non-singleton Spring beans should not be injected into singleton beans

           Code Smell
        46. "@Autowired" should be used when multiple constructors are provided

           Code Smell
        47. "@Autowired" should only be used on a single constructor

           Bug
        48. Use of the "@Async" annotation on methods declared within a "@Configuration" class in Spring Boot

           Bug
        49. Nullable injected fields and parameters should provide a default value

           Bug
        50. Model attributes should follow the Java identifier naming convention

           Bug
        51. Hash-based collections with known capacity should be initialized with the proper related static method.

           Code Smell
        52. Accessing an array element should not trigger an ArrayIndexOutOfBoundsException

           Bug
        53. Counter Mode initialization vectors should not be reused

           Vulnerability
        54. Collections should not be modified while they are iterated

           Bug
        55. Calls to methods should not trigger an exception

           Bug
        56. Types used as keys in Maps should implement Comparable

           Code Smell
        57. XML operations should not be vulnerable to injection attacks

           Vulnerability
        58. JSON operations should not be vulnerable to injection attacks

           Vulnerability
        59. Character classes in regular expressions should not contain only one character

           Code Smell
        60. Superfluous curly brace quantifiers should be avoided

           Code Smell
        61. Non-capturing groups without quantifier should not be used

           Code Smell
        62. Thread suspensions should not be vulnerable to Denial of Service attacks

           Vulnerability
        63. Components should not be vulnerable to intent redirection

           Vulnerability
        64. XML parsers should not be vulnerable to Denial of Service attacks

           Vulnerability
        65. Regular expression quantifiers and character classes should be used concisely

           Code Smell
        66. Constructing arguments of system commands from user input is security-sensitive

           Security Hotspot
        67. Regular expressions should not contain empty groups

           Code Smell
        68. Regular expressions should not contain multiple spaces

           Code Smell
        69. Unsupported methods should not be called on some collection implementations

           Bug
        70. Cast operations should not trigger a ClassCastException

           Bug
        71. Applications should not create session cookies from untrusted input

           Vulnerability
        72. Using long-term access keys is security-sensitive

           Security Hotspot
        73. AWS region should not be set with a hardcoded String

           Code Smell
        74. Lambdas should not invoke other lambdas synchronously

           Code Smell
        75. Consumer Builders should be used

           Code Smell
        76. Reusable resources should be initialized at construction time of Lambda functions

           Code Smell
        77. Credentials Provider should be set explicitly when creating a new "AwsClient"

           Code Smell
        78. Region should be set explicitly when creating a new "AwsClient"

           Code Smell
        79. 'serialVersionUID' field should not be set to '0L' in records

           Code Smell
        80. Equals method should be overridden in records containing array fields

           Bug
        81. Permitted types of a sealed class should be omitted if they are declared in the same file

           Code Smell
        82. Reflection should not be used to increase accessibility of records' fields

           Bug
        83. Restricted Identifiers should not be used as Identifiers

           Code Smell
        84. Local-Variable Type Inference should be used

           Code Smell
        85. Custom getter method should not be used to override record's getter behavior

           Code Smell
        86. Members ignored during record serialization should not be used

           Bug
        87. Comma-separated labels should be used in Switch with colon case

           Code Smell
        88. Redundant constructors/methods should be avoided in records

           Code Smell
        89. Records should be used instead of ordinary classes when representing immutable data structure

           Code Smell
        90. Switch arrow labels should not use redundant keywords

           Code Smell
        91. "Stream.toList()" method should be used instead of "collectors" when unmodifiable list needed

           Code Smell
        92. Operator "instanceof" should be used instead of "A.class.isInstance()"

           Code Smell
        93. Pattern Matching for "instanceof" operator should be used instead of simple "instanceof" + cast

           Code Smell
        94. Reflection should not be vulnerable to injection attacks

           Vulnerability
        95. Map "computeIfAbsent()" and "computeIfPresent()" should not be used to add "null" values.

           Bug
        96. AssertJ assertions with "Consumer" arguments should contain assertion inside consumers

           Bug
        97. Extracting archives should not lead to zip slip vulnerabilities

           Vulnerability
        98. Mockito argument matchers should be used on all parameters

           Bug
        99. The regex escape sequence \cX should only be used with characters in the @-_ range

           Bug
        100. Call to Mockito method "verify", "when" or "given" should be simplified

           Code Smell
        101. Single-character alternations in regular expressions should be replaced with character classes

           Code Smell
        102. Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string

           Code Smell
        103. Regex lookahead assertions should not be contradictory

           Bug
        104. Back references in regular expressions should only refer to capturing groups that are matched before the reference

           Bug
        105. Regular expressions should not overflow the stack

           Bug
        106. Regex boundaries should not be used in a way that can never be matched

           Bug
        107. Regex patterns following a possessive quantifier should not always fail

           Bug
        108. Constructors of an "abstract" class should not be declared "public"

           Code Smell
        109. Annotated Mockito objects should be initialized

           Bug
        110. Tests should use fixed data instead of randomized data

           Code Smell
        111. Tests method should not be annotated with competing annotations

           Bug
        112. Assertions should not be used in production code

           Bug
        113. DateTimeFormatters should not use mismatched year and week numbers

           Bug
        114. OS commands should not be vulnerable to argument injection attacks

           Vulnerability
        115. Character classes in regular expressions should not contain the same character twice

           Code Smell
        116. Unicode Grapheme Clusters should be avoided inside regex character classes

           Bug
        117. Unicode-aware versions of character classes should be preferred

           Code Smell
        118. Case insensitive Unicode regular expressions should enable the "UNICODE_CASE" flag

           Bug
        119. Assertions should not compare an object to itself

           Bug
        120. Names of regular expressions named groups should be used

           Code Smell
        121. Character classes should be preferred over reluctant quantifiers in regular expressions

           Code Smell
        122. Regular expressions should be syntactically valid

           Bug
        123. Regex alternatives should not be redundant

           Bug
        124. Regexes containing characters subject to normalization should use the CANON_EQ flag

           Code Smell
        125. Consecutive AssertJ "assertThat" statements should be chained

           Code Smell
        126. Using slow regular expressions is security-sensitive

           Security Hotspot
        127. Alternatives in regular expressions should be grouped when used with anchors

           Bug
        128. Empty lines should not be tested with regex MULTILINE flag

           Code Smell
        129. Assertions comparing incompatible types should not be made

           Bug
        130. Regular expressions should not be too complicated

           Code Smell
        131. Repeated patterns in regular expressions should not match the empty string

           Bug
        132. AssertJ assertions "allMatch" and "doesNotContain" should also test for emptiness

           Bug
        133. Chained AssertJ assertions should be simplified to the corresponding dedicated assertion

           Code Smell
        134. AssertJ methods setting the assertion context should come before an assertion

           Bug
        135. AssertJ configuration should be applied

           Bug
        136. Allowing user enumeration is security-sensitive

           Security Hotspot
        137. JUnit5 test classes and methods should have default package visibility

           Code Smell
        138. JUnit assertTrue/assertFalse should be simplified to the corresponding dedicated assertion

           Code Smell
        139. Only one method invocation is expected when testing checked exceptions

           Bug
        140. Assertion methods should not be used within the try block of a try-catch catching an Error

           Bug
        141. Only one method invocation is expected when testing runtime exceptions

           Code Smell
        142. Exception testing via JUnit @Test annotation should be avoided

           Code Smell
        143. Exception testing via JUnit ExpectedException rule should not be mixed with other assertions

           Code Smell
        144. "@Deprecated" code marked for removal should never be used

           Code Smell
        145. Disclosing fingerprints from web application technologies is security-sensitive

           Security Hotspot
        146. Vararg method arguments should not be confusing

           Code Smell
        147. Escape sequences should not be used in text blocks

           Code Smell
        148. Simple string literal should be used for single line strings

           Code Smell
        149. Server hostnames should be verified during SSL/TLS connections

           Vulnerability
        150. Server-side templates should not be vulnerable to injection attacks

           Vulnerability
        151. Insecure temporary file creation methods should not be used

           Vulnerability
        152. Using publicly writable directories is security-sensitive

           Security Hotspot
        153. 'List.remove()' should not be used in ascending 'for' loops

           Code Smell
        154. Avoid using boxed "Boolean" types directly in boolean expressions

           Code Smell
        155. "String#replace" should be preferred to "String#replaceAll"

           Code Smell
        156. Dynamic code execution should not be vulnerable to injection attacks

           Vulnerability
        157. Using clear-text protocols is security-sensitive

           Security Hotspot
        158. Collection constructors should not be used as java.util.function.Function

           Code Smell
        159. Accessing Android external storage is security-sensitive

           Security Hotspot
        160. Receiving intents is security-sensitive

           Security Hotspot
        161. Broadcasting intents is security-sensitive

           Security Hotspot
        162. "ActiveMQConnectionFactory" should not be vulnerable to malicious code deserialization

           Vulnerability
        163. "else" statements should be clearly matched with an "if"

           Code Smell
        164. Disabling auto-escaping in template engines is security-sensitive

           Security Hotspot
        165. Use Java 14 "switch" expression

           Code Smell
        166. "ThreadLocal" variables should be cleaned up when no longer used

           Bug
        167. NoSQL operations should not be vulnerable to injection attacks

           Vulnerability
        168. HTTP request redirections should not be open to forging attacks

           Vulnerability
        169. Logging should not be vulnerable to injection attacks

           Vulnerability
        170. Server-side requests should not be vulnerable to forging attacks

           Vulnerability
        171. Deserialization should not be vulnerable to injection attacks

           Vulnerability
        172. Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks

           Vulnerability
        173. "Bean Validation" (JSR 380) should be properly configured

           Code Smell
        174. Having a permissive Cross-Origin Resource Sharing policy is security-sensitive

           Security Hotspot
        175. Expanding archive files without controlling resource consumption is security-sensitive

           Security Hotspot
        176. Type parameters should not shadow other type parameters

           Code Smell
        177. Strings and Boxed types should be compared using "equals()"

           Bug
        178. Derived exceptions should not hide their parents' catch blocks

           Code Smell
        179. The upper bound of type variables and wildcards should not be "final"

           Code Smell
        180. "read(byte[],int,int)" should be overridden

           Code Smell
        181. "serialVersionUID" should not be declared blindly

           Code Smell
        182. "Class.forName()" should not load JDBC 4.0+ drivers

           Code Smell
        183. An iteration on a Collection should be performed on the type handled by the Collection

           Code Smell
        184. "@CheckForNull" or "@Nullable" should not be used on primitive types

           Code Smell
        185. String offset-based methods should be preferred for finding substrings from offsets

           Code Smell
        186. Spring beans should be considered by "@ComponentScan"

           Code Smell
        187. "@SpringBootApplication" and "@ComponentScan" should not be used in the default package

           Bug
        188. Using unsafe Jackson deserialization configuration is security-sensitive

           Security Hotspot
        189. InputSteam.read() implementation should not return a signed byte

           Bug
        190. Composed "@RequestMapping" variants should be preferred

           Code Smell
        191. Nullness of parameters should be guaranteed

           Code Smell
        192. LDAP connections should be authenticated

           Vulnerability
        193. "Integer.toHexString" should not be used to build hexadecimal strings

           Code Smell
        194. "compareTo" should not be overloaded

           Bug
        195. "write(byte[],int,int)" should be overridden

           Code Smell
        196. "iterator" should not return "this"

           Bug
        197. Secure random number generators should not output predictable values

           Vulnerability
        198. Functional Interfaces should be as specialised as possible

           Code Smell
        199. Getters and setters should access the expected fields

           Bug
        200. Asserts should not be used to check the parameters of a public method

           Code Smell
        201. "Stream.collect()" calls should not be redundant

           Code Smell
        202. Regex patterns should not be created needlessly

           Code Smell
        203. Null checks should not be used with "instanceof"

           Code Smell
        204. Assignments should not be redundant

           Code Smell
        205. Map values should not be replaced unconditionally

           Bug
        206. "close()" calls should not be redundant

           Code Smell
        207. "ThreadLocal.withInitial" should be preferred

           Code Smell
        208. Searching OS commands in PATH is security-sensitive

           Security Hotspot
        209. "Stream" call chains should be simplified when possible

           Code Smell
        210. Packages containing only "package-info.java" should be removed

           Code Smell
        211. Collection contents should be used

           Code Smell
        212. Week Year ("YYYY") should not be used for date formatting

           Bug
        213. Unused "private" classes should be removed

           Code Smell
        214. Exceptions should not be created without being thrown

           Bug
        215. Collection sizes and array length comparisons should make sense

           Bug
        216. Consumed Stream pipelines should not be reused

           Bug
        217. Intermediate Stream methods should not be left unused

           Bug
        218. All branches in a conditional structure should not have exactly the same implementation

           Bug
        219. Arrays should not be created for varargs parameters

           Code Smell
        220. "Map.get" and value test should be replaced with single method call

           Code Smell
        221. "@Controller" classes that use "@SessionAttributes" must call "setComplete" on their "SessionStatus" objects

           Bug
        222. Allowing both safe and unsafe HTTP methods is security-sensitive

           Security Hotspot
        223. "@RequestMapping" methods should not be "private"

           Code Smell
        224. Spring "@Controller" classes should not use "@Scope"

           Bug
        225. Members of Spring components should be injected

           Code Smell
        226. Raw types should not be used

           Code Smell
        227. Java 8's "Files.exists" should not be used

           Code Smell
        228. Unit tests should throw exceptions

           Code Smell
        229. Optional value should only be accessed after calling isPresent()

           Bug
        230. Database queries should not be vulnerable to injection attacks

           Vulnerability
        231. "Arrays.stream" should be used for primitive arrays

           Code Smell
        232. Jump statements should not be redundant

           Code Smell
        233. Double Brace Initialization should not be used

           Bug
        234. "Optional" should not be used for parameters

           Code Smell
        235. Custom resources should be closed

           Bug
        236. Zero should not be a possible denominator

           Bug
        237. Methods returns should not be invariant

           Code Smell
        238. Format strings should be used correctly

           Code Smell
        239. Value-based objects should not be serialized

           Code Smell
        240. Value-based classes should not be used for locking

           Bug
        241. Assertion arguments should be passed in the correct order

           Code Smell
        242. Methods should not return constants

           Code Smell
        243. "private" methods called only by inner classes should be moved to those classes

           Code Smell
        244. "this" should not be exposed from constructors

           Code Smell
        245. Ternary operators should not be nested

           Code Smell
        246. Expressions used in "assert" should not produce side effects

           Bug
        247. Creating cookies without the "HttpOnly" flag is security-sensitive

           Security Hotspot
        248. Constructor injection should be used instead of field injection

           Bug
        249. Factory method injection should be used in "@Configuration" classes

           Code Smell
        250. Default annotation parameter values should not be passed as arguments

           Code Smell
        251. "static" base class members should not be accessed via derived types

           Code Smell
        252. Method parameters should be declared with base types

           Code Smell
        253. "volatile" variables should not be used with compound operators

           Bug
        254. Non-primitive fields should not be "volatile"

           Bug
        255. "getClass" should not be used for synchronization

           Bug
        256. Min and max used in combination should not always return the same value

           Bug
        257. Assignment of lazy-initialized members should be the last step with double-checked locking

           Bug
        258. "StringBuilder" data should be used

           Code Smell
        259. Fields should not be initialized to default values

           Code Smell
        260. Multiple loops over the same set should be combined

           Code Smell
        261. "wait" should not be called when multiple locks are held

           Bug
        262. "writeObject" should not be the only "synchronized" code in a class

           Code Smell
        263. Indexes to passed to "String" operations should be within the string's bounds

           Bug
        264. Abstract methods should not be redundant

           Code Smell
        265. Raw byte values should not be used in bitwise operations in combination with shifts

           Bug
        266. ".isEmpty" should be used to test for the emptiness of StringBuffers/Builders

           Code Smell
        267. JEE applications should not "getClassLoader"

           Bug
        268. Arguments to "append" should not be concatenated

           Code Smell
        269. "Collection.toArray()" should be passed an array of the proper type

           Bug
        270. Arrays and lists should not be copied using loops

           Code Smell
        271. Static fields should not be updated in constructors

           Code Smell
        272. Escaped Unicode characters should not be used

           Code Smell
        273. "Thread.sleep" should not be used in tests

           Code Smell
        274. JUnit rules should be used

           Code Smell
        275. Getters and setters should be synchronized in pairs

           Bug
        276. Non-thread-safe fields should not be static

           Bug
        277. "entrySet()" should be iterated when both the key and value are needed

           Code Smell
        278. "null" should not be used with "Optional"

           Bug
        279. Nested "enum"s should not be declared static

           Code Smell
        280. Unary prefix operators should not be repeated

           Bug
        281. Non-existent operators like "=+" should not be used

           Bug
        282. XML parsers should not be vulnerable to XXE attacks

           Vulnerability
        283. "catch" clauses should do more than rethrow

           Code Smell
        284. "DateUtils.truncate" from Apache Commons Lang library should not be used

           Code Smell
        285. Literal boolean values and nulls should not be used in assertions

           Code Smell
        286. Test assertions should include messages

           Code Smell
        287. Instance methods should not write to "static" fields

           Code Smell
        288. "PreparedStatement" and "ResultSet" methods should be called with valid indices

           Bug
        289. Inner classes which do not reference their owning classes should be "static"

           Code Smell
        290. "indexOf" checks should not be for positive numbers

           Code Smell
        291. Files opened in append mode should not be used with "ObjectOutputStream"

           Bug
        292. "read" and "readLine" return values should be used

           Bug
        293. "Math.abs" and negation should not be used on numbers that could be "MIN_VALUE"

           Bug
        294. "readObject" should not be "synchronized"

           Code Smell
        295. The value returned from a stream read should be checked

           Bug
        296. Inappropriate regular expressions should not be used

           Bug
        297. Method overrides should not change contracts

           Code Smell
        298. "@NonNull" values should not be set to null

           Bug
        299. Regular expressions should not be vulnerable to Denial of Service attacks

           Vulnerability
        300. "Preconditions" and logging arguments should not require evaluation

           Code Smell
        301. Boolean expressions should not be gratuitous

           Code Smell
        302. Conditionally executed code should be reachable

           Bug
        303. Whitespace and control characters in literals should be explicit

           Code Smell
        304. "null" should not be returned from a "Boolean" method

           Code Smell
        305. "notifyAll()" should be preferred over "notify()"

           Bug
        306. Blocks should be synchronized on "private final" fields

           Bug
        307. Lazy initialization of "static" fields should be "synchronized"

           Code Smell
        308. Synchronizing on a "Lock" object should be avoided

           Code Smell
        309. Non-serializable objects should not be stored in "javax.servlet.http.HttpSession" instances

           Bug
        310. Classes with only "static" methods should not be instantiated

           Code Smell
        311. Unnecessary bit operations should not be performed

           Code Smell
        312. Inner class calls to super class methods should be unambiguous

           Code Smell
        313. Child class fields should not shadow parent class fields

           Code Smell
        314. Private mutable members should not be stored or returned directly

           Code Smell
        315. Redundant modifiers should not be used

           Code Smell
        316. Unused type parameters should be removed

           Code Smell
        317. "private" and "final" methods that don't access instance data should be "static"

           Code Smell
        318. Files should not be empty

           Code Smell
        319. "deleteOnExit" should not be used

           Code Smell
        320. The diamond operator ("<>") should be used

           Code Smell
        321. "wait(...)" should be used instead of "Thread.sleep(...)" when a lock is held

           Bug
        322. Printf-style format strings should not lead to unexpected behavior at runtime

           Bug
        323. "Object.wait(...)" and "Condition.await(...)" should be called inside a "while" loop

           Code Smell
        324. "Object.wait()", "Object.notify()" and "Object.notifyAll()" should only be called from synchronized code

           Bug
        325. Null pointers should not be dereferenced

           Bug
        326. Loop conditions should be true at least once

           Bug
        327. A "for" loop update clause should move the counter in the right direction

           Bug
        328. Collection methods with O(n) performance should be used carefully

           Code Smell
        329. Methods "wait(...)", "notify()" and "notifyAll()" should not be called on Thread instances

           Bug
        330. "IllegalMonitorStateException" should not be caught

           Code Smell
        331. Parameters should be passed in the correct order

           Code Smell
        332. "ResultSet.isLast()" should not be used

           Code Smell
        333. Servlets should not have mutable instance fields

           Bug
        334. "toString()" and "clone()" methods should not return null

           Bug
        335. Locks should be released on all paths

           Bug
        336. "Exception" should not be caught when not required by called methods

           Code Smell
        337. Types should be used in lambdas

           Code Smell
        338. "static" members should be accessed statically

           Code Smell
        339. Wildcard imports should not be used

           Code Smell
        340. ".equals()" should not be used to test the values of "Atomic" classes

           Bug
        341. "collect" should be used with "Streams" instead of "list::add"

           Code Smell
        342. Return values from functions without side effects should not be ignored

           Bug
        343. "compareTo" results should not be checked for specific values

           Bug
        344. Modulus results should not be checked for direct equality

           Code Smell
        345. Switches should be used for sequences of simple "String" tests

           Code Smell
        346. Recursion should not be infinite

           Bug
        347. Loops should not be infinite

           Bug
        348. JUnit test cases should call super methods

           Code Smell
        349. JUnit assertions should not be used in "run" methods

           Code Smell
        350. Do not perform unnecessary mathematical operations

           Code Smell
        351. Math operands should be cast before assignment

           Bug
        352. Ints and longs should not be shifted by zero or more than their number of bits-1

           Bug
        353. Short-circuit logic should be used in boolean contexts

           Code Smell
        354. Child class methods named for parent class methods should be overrides

           Bug
        355. Class names should not shadow interfaces or superclasses

           Code Smell
        356. Inappropriate "Collection" calls should not be made

           Bug
        357. Double-checked locking should not be used

           Bug
        358. "compareTo" should not return "Integer.MIN_VALUE"

           Bug
        359. Math should not be performed on floats

           Bug
        360. "equals" methods should be symmetric and work for subclasses

           Bug
        361. Subclasses that add fields to classes that override "equals" should also override "equals"

           Code Smell
        362. Unnecessary equality checks should not be made

           Bug
        363. "Cloneables" should implement "clone"

           Code Smell
        364. "final" classes should not have "protected" members

           Code Smell
        365. Dissimilar primitive wrappers should not be used with the ternary operator without explicit casting

           Bug
        366. Unnecessary boxing and unboxing should be avoided

           Bug
        367. "InterruptedException" and "ThreadDeath" should not be ignored

           Bug
        368. Classes that don't define "hashCode()" should not be used in hashes

           Bug
        369. Methods of "Random" that return floating point values should not be used in random integer generation

           Code Smell
        370. Classes extending java.lang.Thread should provide a specific "run" behavior

           Bug
        371. Objects should not be created only to invoke "getClass"

           Code Smell
        372. "Double.longBitsToDouble" should take "long" as argument

           Bug
        373. Values should not be uselessly incremented

           Bug
        374. "ScheduledThreadPoolExecutor" should not have 0 core threads

           Bug
        375. String operations with predictable outcomes should be avoided

           Bug
        376. "Random" objects should be reused

           Bug
        377. "writeObject" argument must implement "Serializable"

           Bug
        378. "hashCode" and "toString" should not be called on array instances

           Bug
        379. Collections should not be passed as arguments to their own methods

           Bug
        380. "BigDecimal(double)" should not be used

           Bug
        381. Invalid "Date" values should not be used

           Bug
        382. Reflection should not be used to check non-runtime annotations

           Bug
        383. "equals(Object obj)" should test the argument's type

           Bug
        384. "main" should not "throw" anything

           Code Smell
        385. Resources should be closed

           Bug
        386. Classes should not be empty

           Code Smell
        387. Creating cookies without the "secure" flag is security-sensitive

           Security Hotspot
        388. XPath expressions should not be vulnerable to injection attacks

           Vulnerability
        389. I/O function calls should not be vulnerable to path injection attacks

           Vulnerability
        390. LDAP queries should not be vulnerable to injection attacks

           Vulnerability
        391. Formatting SQL queries is security-sensitive

           Security Hotspot
        392. OS commands should not be vulnerable to command injection attacks

           Vulnerability
        393. "Serializable" inner classes of non-serializable outer classes should be "static"

           Bug
        394. Fields in non-serializable classes should not be "transient"

           Code Smell
        395. "readResolve" methods should be inheritable

           Code Smell
        396. Custom serialization methods should have required signatures

           Bug
        397. "Externalizable" classes should have no-arguments constructors

           Bug
        398. "Serializable" inner classes of "Serializable" classes should be static

           Code Smell
        399. "Serializable" classes should have a "serialVersionUID"

           Code Smell
        400. The non-serializable super class of a "Serializable" class should have a no-argument constructor

           Bug
        401. Member variable visibility should be specified

           Code Smell
        402. "for" loop increment clauses should modify the loops' counters

           Code Smell
        403. Fields in a "Serializable" class should either be transient or serializable

           Code Smell
        404. Variables should not be declared before they are relevant

           Code Smell
        405. Extensions and implementations should not be redundant

           Code Smell
        406. Redundant casts should not be used

           Code Smell
        407. Classes should not be compared by name

           Bug
        408. Related "if/else if" statements should not have the same condition

           Bug
        409. Synchronization should not be done on instances of value-based classes

           Bug
        410. "toString()" should never be called on a String object

           Code Smell
        411. Unused assignments should be removed

           Code Smell
        412. "Iterator.hasNext()" should not call "Iterator.next()"

           Bug
        413. "Object.wait" should not be called on objects that implement "java.util.concurrent.locks.Condition"

           Code Smell
        414. Identical expressions should not be used on both sides of a binary operator

           Bug
        415. Loops with at most one iteration should be refactored

           Bug
        416. Standard functional interfaces should not be redefined

           Code Smell
        417. Annotation repetitions should not be wrapped

           Code Smell
        418. Constructors should only call non-overridable methods

           Code Smell
        419. "==" and "!=" should not be used when "equals" is overridden

           Code Smell
        420. Variables should not be self-assigned

           Bug
        421. Strings should not be concatenated using '+' in a loop

           Code Smell
        422. Sets with elements that are enum values should be replaced with EnumSet

           Code Smell
        423. Maps with keys that are enum values should use the EnumMap implementation

           Code Smell
        424. Lambdas should be replaced with method references

           Code Smell
        425. Parentheses should be removed from a single lambda parameter when its type is inferred

           Code Smell
        426. Anonymous inner classes containing only one method should become lambdas

           Code Smell
        427. Lambdas containing only one statement should not nest this statement in a block

           Code Smell
        428. Local variables should not be declared and then immediately returned or thrown

           Code Smell
        429. Unused local variables should be removed

           Code Smell
        430. Generic wildcard types should not be used in return types

           Code Smell
        431. Private fields only used as local variables in methods should become local variables

           Code Smell
        432. String operations should not rely on the default system locale

           Code Smell
        433. "StringBuilder" and "StringBuffer" should not be instantiated with a character

           Bug
        434. Octal values should not be used

           Code Smell
        435. Track uses of "NOPMD" suppression comments

           Code Smell
        436. "switch" statements should have "default" clauses

           Code Smell
        437. Track uses of "@SuppressWarnings" annotations

           Code Smell
        438. "switch" statements should have at least 3 "case" clauses

           Code Smell
        439. Switch cases should end with an unconditional "break" statement

           Code Smell
        440. "for" loop stop conditions should be invariant

           Code Smell
        441. A "while" loop should be used instead of a "for" loop

           Code Smell
        442. "if ... else if" constructs should end with "else" clauses

           Code Smell
        443. Classes and enums with private members should have a constructor

           Code Smell
        444. Sections of code should not be commented out

           Code Smell
        445. Floating point numbers should not be tested for equality

           Bug
        446. Method parameters, caught exceptions and foreach variables' initial values should not be ignored

           Bug
        447. Non-constructor methods should not have the same name as the enclosing class

           Code Smell
        448. Methods should not be named "tostring", "hashcode" or "equal"

           Bug
        449. "switch" statements should not contain non-case labels

           Code Smell
        450. "Thread.run()" should not be called directly

           Bug
        451. Execution of the Garbage Collector should be triggered only by the JVM

           Code Smell
        452. "equals(Object obj)" should be overridden along with the "compareTo(T obj)" method

           Code Smell
        453. Control structures should use curly braces

           Code Smell
        454. "equals(Object obj)" and "hashCode()" should be overridden in pairs

           Bug
        455. "equals" method overrides should accept "Object" parameters

           Bug
        456. Nested code blocks should not be used

           Code Smell
        457. "java.lang.Error" should not be extended

           Code Smell
        458. Methods should not be empty

           Code Smell
        459. Overriding methods should do more than simply call the same method in the super class

           Code Smell
        460. Classes that override "clone" should be "Cloneable" and call "super.clone()"

           Code Smell
        461. Public types, methods and fields (API) should be documented with Javadoc

           Code Smell
        462. The signature of "finalize()" should match that of "Object.finalize()"

           Bug
        463. Unused method parameters should be removed

           Code Smell
        464. Only static class initializers should be used

           Code Smell
        465. Public constants and fields initialized at declaration should be "static final" rather than merely "final"

           Code Smell
        466. Empty arrays and collections should be returned instead of null

           Code Smell
        467. Exceptions should not be thrown in finally blocks

           Code Smell
        468. "@Override" should be used on overriding and implementing methods

           Code Smell
        469. Primitive wrappers should not be instantiated only for "toString" or "compareTo" calls

           Code Smell
        470. Case insensitive string comparisons should be made without intermediate upper or lower casing

           Code Smell
        471. "Collection.isEmpty()" should be used to test for emptiness

           Code Smell
        472. "String.valueOf()" should not be appended to a "String"

           Code Smell
        473. Unused "private" methods should be removed

           Code Smell
        474. Jump statements should not occur in "finally" blocks

           Bug
        475. Methods should not have too many return statements

           Code Smell
        476. Try-catch blocks should not be nested

           Code Smell
        477. Track uses of "TODO" tags

           Code Smell
        478. Track uses of "FIXME" tags

           Code Smell
        479. Deprecated code should be removed

           Code Smell
        480. Strings literals should be placed on the left side when checking for equality

           Code Smell
        481. Exceptions in "throws" clauses should not be superfluous

           Code Smell
        482. Unnecessary imports should be removed

           Code Smell
        483. Return of boolean expressions should not be wrapped into an "if-then-else" statement

           Code Smell
        484. Modifiers should be declared in the correct order

           Code Smell
        485. Deprecated elements should have both the annotation and the Javadoc tag

           Code Smell
        486. Assignments should not be made from within sub-expressions

           Code Smell
        487. Generic exceptions should never be thrown

           Code Smell
        488. Utility classes should not have public constructors

           Code Smell
        489. Local variables should not shadow class fields

           Code Smell
        490. Empty statements should be removed

           Code Smell
        491. The "Object.finalize()" method should not be overridden

           Code Smell
        492. The "Object.finalize()" method should not be called

           Bug
        493. Redundant pairs of parentheses should be removed

           Code Smell
        494. Magic numbers should not be used

           Code Smell
        495. Nested blocks of code should not be left empty

           Code Smell
        496. Unused "private" fields should be removed

           Code Smell
        497. Mergeable "if" statements should be combined

           Code Smell
        498. Unused labels should be removed

           Code Smell

        "@NonNull" values should not be set to null

        intentionality - logical
        reliability
        Bug
        • cwe
        • cert
        • symbolic-execution

        Why is this an issue?

        More Info

        Fields, parameters and return values marked @NotNull, @NonNull, or @Nonnull are assumed to have non-null values and are not typically null-checked before use. Therefore setting one of these values to null, or failing to set such a class field in a constructor, could cause NullPointerExceptions at runtime.

        Noncompliant code example

        public class MainClass {
        
          @Nonnull
          private String primary;
          private String secondary;
        
          public MainClass(String color) {
            if (color != null) {
              secondary = null;
            }
            primary = color;  // Noncompliant; "primary" is Nonnull but could be set to null here
          }
        
          public MainClass() { // Noncompliant; "primary" is Nonnull but is not initialized
          }
        
          @Nonnull
          public String indirectMix() {
            String mix = null;
            return mix;  // Noncompliant; return value is Nonnull, but null is returned.
          }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2025 SonarSource Sàrl. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use