SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
Java

Java static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your JAVA code

  • All rules 733
  • Vulnerability60
  • Bug175
  • Security Hotspot40
  • Code Smell458

  • Quick Fix 65
Filtered: 187 rules found
Tags
    reliability
      Clean code attribute
        1. Return values should not be ignored when they contain the operation status code

           Bug
        2. Methods annotated with "@BeforeTransaction" or "@AfterTransaction" must respect the contract

           Code Smell
        3. Methods returning "Page" or "Slice" must take "Pageable" as an input parameter

           Code Smell
        4. @EventListener methods should have one parameter at most

           Bug
        5. "@Scheduled" annotation should only be applied to no-arg methods

           Bug
        6. @InitBinder methods should have void return type

           Code Smell
        7. "@Cache*" annotations should only be applied on concrete classes

           Code Smell
        8. @Cacheable and @CachePut should not be combined

           Code Smell
        9. Injecting data into static fields is not supported by Spring

           Code Smell
        10. Use appropriate @DirtiesContext modes

           Code Smell
        11. Consumed Stream pipelines should not be reused

           Bug
        12. "String.indexOf" should be used with correct ranges

           Bug
        13. "Math.clamp" should be used with correct ranges

           Bug
        14. Virtual threads should not run tasks that include synchronized code

           Bug
        15. "setDaemon", "setPriority" and "getThreadGroup" should not be invoked on virtual threads

           Bug
        16. Virtual threads should be used for tasks that include heavy blocking operations

           Bug
        17. Set appropriate Status Codes on HTTP responses

           Bug
        18. Beans in "@Configuration" class should have different names

           Bug
        19. SpEL expression should have a valid syntax

           Bug
        20. "@PathVariable" annotation should be present if a path variable is used

           Bug
        21. "@Bean" methods for Singleton should not be invoked in "@Configuration" when proxyBeanMethods is false

           Bug
        22. Non-singleton Spring beans should not be injected into singleton beans

           Code Smell
        23. "@Qualifier" should not be used on "@Bean" methods

           Bug
        24. "@Autowired" should be used when multiple constructors are provided

           Code Smell
        25. "@Autowired" should only be used on a single constructor

           Bug
        26. Use of the "@Async" annotation on methods declared within a "@Configuration" class in Spring Boot

           Bug
        27. Nullable injected fields and parameters should provide a default value

           Bug
        28. Optional REST parameters should have an object type

           Code Smell
        29. Field dependency injection should be avoided

           Code Smell
        30. Async methods should return void or Future

           Bug
        31. Model attributes should follow the Java identifier naming convention

           Bug
        32. "@Value" annotation should inject property or SpEL expression

           Code Smell
        33. Accessing an array element should not trigger an ArrayIndexOutOfBoundsException

           Bug
        34. Collections should not be modified while they are iterated

           Bug
        35. Calls to methods should not trigger an exception

           Bug
        36. Unsupported methods should not be called on some collection implementations

           Bug
        37. Cast operations should not trigger a ClassCastException

           Bug
        38. Equals method should be overridden in records containing array fields

           Bug
        39. Reflection should not be used to increase accessibility of records' fields

           Bug
        40. Members ignored during record serialization should not be used

           Bug
        41. Map "computeIfAbsent()" and "computeIfPresent()" should not be used to add "null" values.

           Bug
        42. AssertJ assertions with "Consumer" arguments should contain assertion inside consumers

           Bug
        43. Mockito argument matchers should be used on all parameters

           Bug
        44. The regex escape sequence \cX should only be used with characters in the @-_ range

           Bug
        45. Regex lookahead assertions should not be contradictory

           Bug
        46. Back references in regular expressions should only refer to capturing groups that are matched before the reference

           Bug
        47. Regular expressions should not overflow the stack

           Bug
        48. Regex boundaries should not be used in a way that can never be matched

           Bug
        49. Regex patterns following a possessive quantifier should not always fail

           Bug
        50. Annotated Mockito objects should be initialized

           Bug
        51. Tests should be stable

           Code Smell
        52. Tests method should not be annotated with competing annotations

           Bug
        53. Assertions should not be used in production code

           Bug
        54. DateTimeFormatters should not use mismatched year and week numbers

           Bug
        55. Unicode Grapheme Clusters should be avoided inside regex character classes

           Bug
        56. Case insensitive Unicode regular expressions should enable the "UNICODE_CASE" flag

           Bug
        57. Assertions should not compare an object to itself

           Bug
        58. Regular expressions should be syntactically valid

           Bug
        59. Regex alternatives should not be redundant

           Bug
        60. Alternatives in regular expressions should be grouped when used with anchors

           Bug
        61. Assertions comparing incompatible types should not be made

           Bug
        62. Repeated patterns in regular expressions should not match the empty string

           Bug
        63. AssertJ assertions "allMatch" and "doesNotContain" should also test for emptiness

           Bug
        64. AssertJ methods setting the assertion context should come before an assertion

           Bug
        65. AssertJ configuration should be applied

           Bug
        66. JUnit5 test classes and methods should not be silently ignored

           Bug
        67. JUnit5 inner test classes should be annotated with @Nested

           Bug
        68. Only one method invocation is expected when testing checked exceptions

           Bug
        69. Assertion methods should not be used within the try block of a try-catch catching an Error

           Bug
        70. "ThreadLocal" variables should be cleaned up when no longer used

           Bug
        71. Strings and Boxed types should be compared using "equals()"

           Bug
        72. "@SpringBootApplication" and "@ComponentScan" should not be used in the default package

           Bug
        73. InputSteam.read() implementation should not return a signed byte

           Bug
        74. "compareTo" should not be overloaded

           Bug
        75. "iterator" should not return "this"

           Bug
        76. Getters and setters should access the expected fields

           Bug
        77. Map values should not be replaced unconditionally

           Bug
        78. Week Year ("YYYY") should not be used for date formatting

           Bug
        79. Exceptions should not be created without being thrown

           Bug
        80. Collection sizes and array length comparisons should make sense

           Bug
        81. Consumed Stream pipelines should not be reused

           Bug
        82. Intermediate Stream methods should not be left unused

           Bug
        83. All branches in a conditional structure should not have exactly the same implementation

           Bug
        84. "@Controller" classes that use "@SessionAttributes" must call "setComplete" on their "SessionStatus" objects

           Bug
        85. Spring "@Controller" classes should not use "@Scope"

           Bug
        86. Optional value should only be accessed after calling isPresent()

           Bug
        87. Double Brace Initialization should not be used

           Bug
        88. Overrides should match their parent class methods in synchronization

           Bug
        89. Custom resources should be closed

           Bug
        90. Zero should not be a possible denominator

           Bug
        91. Value-based classes should not be used for locking

           Bug
        92. Expressions used in "assert" should not produce side effects

           Bug
        93. Constructor injection should be used instead of field injection

           Bug
        94. "volatile" variables should not be used with compound operators

           Bug
        95. Non-primitive fields should not be "volatile"

           Bug
        96. "getClass" should not be used for synchronization

           Bug
        97. Min and max used in combination should not always return the same value

           Bug
        98. Assignment of lazy-initialized members should be the last step with double-checked locking

           Bug
        99. "wait" should not be called when multiple locks are held

           Bug
        100. Indexes to passed to "String" operations should be within the string's bounds

           Bug
        101. Raw byte values should not be used in bitwise operations in combination with shifts

           Bug
        102. JEE applications should not "getClassLoader"

           Bug
        103. "Collection.toArray()" should be passed an array of the proper type

           Bug
        104. Getters and setters should be synchronized in pairs

           Bug
        105. Non-thread-safe fields should not be static

           Bug
        106. "null" should not be used with "Optional"

           Bug
        107. Unary prefix operators should not be repeated

           Bug
        108. Non-existent operators like "=+" should not be used

           Bug
        109. "PreparedStatement" and "ResultSet" methods should be called with valid indices

           Bug
        110. Files opened in append mode should not be used with "ObjectOutputStream"

           Bug
        111. "read" and "readLine" return values should be used

           Bug
        112. "Math.abs" and negation should not be used on numbers that could be "MIN_VALUE"

           Bug
        113. The value returned from a stream read should be checked

           Bug
        114. Inappropriate regular expressions should not be used

           Bug
        115. "@NonNull" values should not be set to null

           Bug
        116. Conditionally executed code should be reachable

           Bug
        117. "notifyAll()" should be preferred over "notify()"

           Bug
        118. Blocks should be synchronized on "private final" fields

           Bug
        119. Non-serializable objects should not be stored in "javax.servlet.http.HttpSession" instances

           Bug
        120. Classes should not access their own subclasses during class initialization

           Bug
        121. "wait(...)" should be used instead of "Thread.sleep(...)" when a lock is held

           Bug
        122. Printf-style format strings should not lead to unexpected behavior at runtime

           Bug
        123. "Object.wait()", "Object.notify()" and "Object.notifyAll()" should only be called from synchronized code

           Bug
        124. "Iterator.next()" methods should throw "NoSuchElementException"

           Bug
        125. Null pointers should not be dereferenced

           Bug
        126. Loop conditions should be true at least once

           Bug
        127. A "for" loop update clause should move the counter in the right direction

           Bug
        128. Methods "wait(...)", "notify()" and "notifyAll()" should not be called on Thread instances

           Bug
        129. Methods with Spring proxying annotations should be public

           Bug
        130. Methods should not call same-class methods with incompatible "@Transactional" values

           Bug
        131. Servlets should not have mutable instance fields

           Bug
        132. "toString()" and "clone()" methods should not return null

           Bug
        133. Locks should be released on all paths

           Bug
        134. ".equals()" should not be used to test the values of "Atomic" classes

           Bug
        135. Return values from functions without side effects should not be ignored

           Bug
        136. "compareTo" results should not be checked for specific values

           Bug
        137. Recursion should not be infinite

           Bug
        138. Loops should not be infinite

           Bug
        139. Math operands should be cast before assignment

           Bug
        140. Ints and longs should not be shifted by zero or more than their number of bits-1

           Bug
        141. Child class methods named for parent class methods should be overrides

           Bug
        142. Inappropriate "Collection" calls should not be made

           Bug
        143. Double-checked locking should not be used

           Bug
        144. "compareTo" should not return "Integer.MIN_VALUE"

           Bug
        145. Math should not be performed on floats

           Bug
        146. "equals" methods should be symmetric and work for subclasses

           Bug
        147. Unnecessary equality checks should not be made

           Bug
        148. Dissimilar primitive wrappers should not be used with the ternary operator without explicit casting

           Bug
        149. Unnecessary boxing and unboxing should be avoided

           Bug
        150. "runFinalizersOnExit" should not be called

           Bug
        151. "InterruptedException" and "ThreadDeath" should not be ignored

           Bug
        152. Classes that don't define "hashCode()" should not be used in hashes

           Bug
        153. Classes extending java.lang.Thread should provide a specific "run" behavior

           Bug
        154. "Double.longBitsToDouble" should take "long" as argument

           Bug
        155. Values should not be uselessly incremented

           Bug
        156. "ScheduledThreadPoolExecutor" should not have 0 core threads

           Bug
        157. String operations with predictable outcomes should be avoided

           Bug
        158. "Random" objects should be reused

           Bug
        159. "writeObject" argument must implement "Serializable"

           Bug
        160. "hashCode" and "toString" should not be called on array instances

           Bug
        161. Collections should not be passed as arguments to their own methods

           Bug
        162. "BigDecimal(double)" should not be used

           Bug
        163. Invalid "Date" values should not be used

           Bug
        164. Reflection should not be used to check non-runtime annotations

           Bug
        165. "equals(Object obj)" should test the argument's type

           Bug
        166. Resources should be closed

           Bug
        167. "Serializable" inner classes of non-serializable outer classes should be "static"

           Bug
        168. Custom serialization methods should have required signatures

           Bug
        169. "Externalizable" classes should have no-arguments constructors

           Bug
        170. The non-serializable super class of a "Serializable" class should have a no-argument constructor

           Bug
        171. Classes should not be compared by name

           Bug
        172. Related "if/else if" statements should not have the same condition

           Bug
        173. Synchronization should not be done on instances of value-based classes

           Bug
        174. "Iterator.hasNext()" should not call "Iterator.next()"

           Bug
        175. Identical expressions should not be used on both sides of a binary operator

           Bug
        176. Loops with at most one iteration should be refactored

           Bug
        177. Variables should not be self-assigned

           Bug
        178. "StringBuilder" and "StringBuffer" should not be instantiated with a character

           Bug
        179. Floating point numbers should not be tested for equality

           Bug
        180. Method parameters, caught exceptions and foreach variables' initial values should not be ignored

           Bug
        181. Methods should not be named "tostring", "hashcode" or "equal"

           Bug
        182. "Thread.run()" should not be called directly

           Bug
        183. "equals(Object obj)" and "hashCode()" should be overridden in pairs

           Bug
        184. "equals" method overrides should accept "Object" parameters

           Bug
        185. The signature of "finalize()" should match that of "Object.finalize()"

           Bug
        186. Jump statements should not occur in "finally" blocks

           Bug
        187. The "Object.finalize()" method should not be called

           Bug

        The regex escape sequence \cX should only be used with characters in the @-_ range

        intentionality - complete
        reliability
        Bug
        • regex

        Why is this an issue?

        In regular expressions the escape sequence \cX, where the X stands for any character that’s either @, any capital ASCII letter, [, \, ], ^ or _, represents the control character that "corresponds" to the character following \c, meaning the control character that comes 64 bytes before the given character in the ASCII encoding.

        In some other regex engines (for example in that of Perl) this escape sequence is case insensitive and \cd produces the same control character as \cD. Further using \c with a character that’s neither @, any ASCII letter, [, \, ], ^ nor _, will produce a warning or error in those engines. Neither of these things is true in Java, where the value of the character is always XORed with 64 without checking that this operation makes sense. Since this won’t lead to a sensible result for characters that are outside of the @ to _ range, using \c with such characters is almost certainly a mistake.

        Noncompliant code example

        Pattern.compile("\\ca"); // Noncompliant, 'a' is not an upper case letter
        Pattern.compile("\\c!"); // Noncompliant, '!' is outside of the '@'-'_' range
        

        Compliant solution

        Pattern.compile("\\cA"); // Compliant, this will match the "start of heading" control character
        Pattern.compile("\\c^"); // Compliant, this will match the "record separator" control character
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use