SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
Java

Java static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your JAVA code

  • All rules 733
  • Vulnerability60
  • Bug175
  • Security Hotspot40
  • Code Smell458

  • Quick Fix 65
 
Tags
    Impact
      Clean code attribute
        1. Use when instead of a single if inside a pattern match body

           Code Smell
        2. "Math.clamp" should be used with correct ranges

           Bug
        3. Use switch instead of if-else chain to compare a variable against multiple cases

           Code Smell
        4. "@Controller" should be replaced with "@RestController"

           Code Smell
        5. "@Qualifier" should not be used on "@Bean" methods

           Bug
        6. Use of the "@Async" annotation on methods declared within a "@Configuration" class in Spring Boot

           Bug
        7. Nullable injected fields and parameters should provide a default value

           Bug
        8. Hash-based collections with known capacity should be initialized with the proper related static method.

           Code Smell
        9. Permitted types of a sealed class should be omitted if they are declared in the same file

           Code Smell
        10. Chained AssertJ assertions should be simplified to the corresponding dedicated assertion

           Code Smell
        11. JUnit5 test classes and methods should not be silently ignored

           Bug
        12. JUnit5 test classes and methods should have default package visibility

           Code Smell
        13. Avoid using boxed "Boolean" types directly in boolean expressions

           Code Smell
        14. "ThreadLocal" variables should be cleaned up when no longer used

           Bug
        15. Strings and Boxed types should be compared using "equals()"

           Bug
        16. "StandardCharsets" constants should be preferred

           Code Smell
        17. "@CheckForNull" or "@Nullable" should not be used on primitive types

           Code Smell
        18. "equals" method parameters should not be marked "@Nonnull"

           Code Smell
        19. Week Year ("YYYY") should not be used for date formatting

           Bug
        20. Exceptions should not be created without being thrown

           Bug
        21. Assertion arguments should be passed in the correct order

           Code Smell
        22. "static" base class members should not be accessed via derived types

           Code Smell
        23. ".isEmpty" should be used to test for the emptiness of StringBuffers/Builders

           Code Smell
        24. Arguments to "append" should not be concatenated

           Code Smell
        25. "Collection.toArray()" should be passed an array of the proper type

           Bug
        26. "notifyAll()" should be preferred over "notify()"

           Bug
        27. "private" and "final" methods that don't access instance data should be "static"

           Code Smell
        28. The diamond operator ("<>") should be used

           Code Smell
        29. "toString()" and "clone()" methods should not return null

           Bug
        30. "static" members should be accessed statically

           Code Smell
        31. "compareTo" results should not be checked for specific values

           Bug
        32. Unnecessary boxing and unboxing should be avoided

           Bug
        33. Catches should be combined

           Code Smell
        34. Constructors should not be used to instantiate "String", "BigInteger", "BigDecimal" and primitive-wrapper classes

           Code Smell
        35. "hashCode" and "toString" should not be called on array instances

           Bug
        36. "BigDecimal(double)" should not be used

           Bug
        37. Redundant casts should not be used

           Code Smell
        38. "toString()" should never be called on a String object

           Code Smell
        39. Multiple variables should not be declared on the same line

           Code Smell
        40. Variables should not be self-assigned

           Bug
        41. Lambdas should be replaced with method references

           Code Smell
        42. Local variables should not be declared and then immediately returned or thrown

           Code Smell
        43. Unused local variables should be removed

           Code Smell
        44. Private fields only used as local variables in methods should become local variables

           Code Smell
        45. Declarations should use Java collection interfaces such as "List" rather than specific implementation classes such as "LinkedList"

           Code Smell
        46. "Thread.run()" should not be called directly

           Bug
        47. Array designators "[]" should be on the type, not the variable

           Code Smell
        48. Array designators "[]" should be located after the type in method signatures

           Code Smell
        49. Methods should not be empty

           Code Smell
        50. Unused method parameters should be removed

           Code Smell
        51. Empty arrays and collections should be returned instead of null

           Code Smell
        52. "@Override" should be used on overriding and implementing methods

           Code Smell
        53. Primitive wrappers should not be instantiated only for "toString" or "compareTo" calls

           Code Smell
        54. "Collection.isEmpty()" should be used to test for emptiness

           Code Smell
        55. "String.valueOf()" should not be appended to a "String"

           Code Smell
        56. Unused "private" methods should be removed

           Code Smell
        57. Strings literals should be placed on the left side when checking for equality

           Code Smell
        58. Exceptions in "throws" clauses should not be superfluous

           Code Smell
        59. Unnecessary imports should be removed

           Code Smell
        60. Boolean literals should not be redundant

           Code Smell
        61. Modifiers should be declared in the correct order

           Code Smell
        62. Empty statements should be removed

           Code Smell
        63. Close curly brace and the next "else", "catch" and "finally" keywords should be located on the same line

           Code Smell
        64. Unused "private" fields should be removed

           Code Smell
        65. Mergeable "if" statements should be combined

           Code Smell

        Avoid using boxed "Boolean" types directly in boolean expressions

        intentionality - complete
        maintainability
        Code Smell
        Quick FixIDE quick fixes available with SonarQube for IDE
        • pitfall

        Why is this an issue?

        More Info

        When boxed type java.lang.Boolean is used as an expression to determine the control flow (as described in Java Language Specification §4.2.5 The boolean Type and boolean Values) it will throw a NullPointerException if the value is null (as defined in Java Language Specification §5.1.8 Unboxing Conversion).

        It is safer to avoid such conversion altogether and handle the null value explicitly.

        Note, however, that no issues will be raised for Booleans that have already been null-checked or are marked @NonNull/@NotNull.

        Noncompliant code example

        Boolean b = getBoolean();
        if (b) {  // Noncompliant, it will throw NPE when b == null
          foo();
        } else {
          bar();
        }
        

        Compliant solution

        Boolean b = getBoolean();
        if (Boolean.TRUE.equals(b)) {
          foo();
        } else {
          bar();  // will be invoked for both b == false and b == null
        }
        
        
        Boolean b = getBoolean();
        if(b != null){
          String test = b ? "test" : "";
        }
        

        Exceptions

        The issue is not raised if the expression is annotated @NonNull / @NotNull. This is useful if a boxed type is an instantiation of a generic type parameter and cannot be avoided.

        List<Boolean> list = new ArrayList<>();
        list.add(true);
        list.add(false);
        list.forEach((@NonNull Boolean value) -> {
          // Compliant
          if(value) {
            System.out.println("yes");
          }
        });
        
        @NonNull Boolean someMethod() { /* ... */ }
        
        // Compliant
        if(someMethod()) { /* ... */ }
        
        @NonNull Boolean boxedNonNull = Boolean.TRUE;
        
        // Compliant
        if(boxedNonNull) { /* ... */ }
        
          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use