Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Apex
C
C++
CloudFormation
COBOL
C#
CSS
Docker
Flex
Go
HTML
Java
JavaScript
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

JavaScript static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your JAVASCRIPT code

Tags

DOM updates should not lead to open redirect vulnerabilities
Vulnerability
Extracting archives should not lead to zip slip vulnerabilities
Vulnerability
DOM updates should not lead to cross-site scripting (XSS) attacks
Vulnerability
Dynamic code execution should not be vulnerable to injection attacks
Vulnerability
NoSQL operations should not be vulnerable to injection attacks
Vulnerability
HTTP request redirections should not be open to forging attacks
Vulnerability
Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks
Vulnerability
Database queries should not be vulnerable to injection attacks
Vulnerability
XML parsers should not be vulnerable to XXE attacks
Vulnerability
I/O function calls should not be vulnerable to path injection attacks
Vulnerability
OS commands should not be vulnerable to command injection attacks
Vulnerability
Callbacks of array methods should have return statements
Bug
Loops should not be infinite
Bug
Creating public APIs is security-sensitive
Security Hotspot
Allowing public network access to cloud resources is security-sensitive
Security Hotspot
Policies granting all privileges are security-sensitive
Security Hotspot
Disabling Vue.js built-in escaping is security-sensitive
Security Hotspot
Policies authorizing public access to resources are security-sensitive
Security Hotspot
Disabling Angular built-in sanitization is security-sensitive
Security Hotspot
Granting access to S3 buckets to all or authenticated users is security-sensitive
Security Hotspot
Hard-coded credentials are security-sensitive
Security Hotspot
Function returns should not be invariant
Code Smell
Assertions should be complete
Code Smell
Variables should be declared explicitly
Code Smell
Tests should include assertions
Code Smell
"future reserved words" should not be used as identifiers
Code Smell
Octal values should not be used
Code Smell
Switch cases should end with an unconditional "break" statement
Code Smell
"switch" statements should not contain non-case labels
Code Smell
AWS IAM policies should not allow privilege escalation
Vulnerability
A new session should be created during user authentication
Vulnerability
JWT should be signed and verified with strong cipher algorithms
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Cryptographic keys should be robust
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Origins should be verified during cross-origin communications
Vulnerability
Regular expressions should not be vulnerable to Denial of Service attacks
Vulnerability
File uploads should be restricted
Vulnerability
Function calls should not pass extra arguments
Bug
Regular expressions should be syntactically valid
Bug
Getters and setters should access the expected fields
Bug
"typeof" expressions should only be compared to valid values
Bug
"super()" should be invoked appropriately
Bug
"Symbol" should not be used as a constructor
Bug
Results of "in" and "instanceof" should be negated rather than operands
Bug
"in" should not be used with primitive types
Bug
A compare function should be provided when using "Array.prototype.sort()"
Bug
Jump statements should not occur in "finally" blocks
Bug
Allowing public ACLs or policies on a S3 bucket is security-sensitive
Security Hotspot
Authorizing HTTP communications with S3 buckets is security-sensitive
Security Hotspot
Using slow regular expressions is security-sensitive
Security Hotspot
Using publicly writable directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Disabling CSRF protections is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Dynamically executing code is security-sensitive
Security Hotspot
Equality operators should not be used in "for" loop termination conditions
Code Smell
Tests should not execute any code after "done()" is called
Code Smell
"default" clauses should be last
Code Smell
"await" should only be used with promises
Code Smell
Conditionals should start on new lines
Code Smell
Cognitive Complexity of functions should not be too high
Code Smell
"void" should not be used
Code Smell
Variables should be declared with "let" or "const"
Code Smell
Loop counters should not be assigned to from within the loop body
Code Smell
"for" loop increment clauses should modify the loops' counters
Code Smell
Functions should not be empty
Code Smell
Applications should not create session cookies from untrusted input
Vulnerability
Server-side requests should not be vulnerable to forging attacks
Vulnerability
Non-empty statements should change control flow or have at least one side-effect
Bug
Promises should not be misused
Bug
Numbers should not lose precision
Bug
No optional chaining where undefined is forbidden
Bug
React state setter function should not be called with its matching state variable
Bug
React's useState hook should not be used directly in the render function or body of a component
Bug
React Hooks should be properly called
Bug
React components should not render non-boolean condition values
Bug
Comments inside JSX expressions should be enclosed in curly braces
Bug
React "render" function should return a value
Bug
Exclusive tests should not be commited to version control
Bug
Regular expressions with the global flag should be used with caution
Bug
Replacement strings should reference existing regular expression groups
Bug
Regular expressions should not contain control characters
Bug
Alternation in regular expressions should not contain empty alternatives
Bug
Mocha timeout should be disabled by setting it to "0".
Bug
Unicode Grapheme Clusters should be avoided inside regex character classes
Bug
Assertions should not be given twice the same argument
Bug
Alternatives in regular expressions should be grouped when used with anchors
Bug
Promise rejections should not be caught by 'try' block
Bug
Collection elements should not be replaced unconditionally
Bug
Errors should not be created without being thrown
Bug
Collection sizes and array length comparisons should make sense
Bug
All branches in a conditional structure should not have exactly the same implementation
Bug
Destructuring patterns should not be empty
Bug
The output of functions that don't return anything should not be used
Bug
Comma and logical OR operators should not be used in switch cases
Bug
Generators should "yield" something
Bug
Attempts should not be made to update "const" variables
Bug
Strict equality operators should not be used with dissimilar types
Bug
"new" operators should be used with functions
Bug
Non-existent operators '=+', '=-' and '=!' should not be used
Bug
"NaN" should not be used in comparisons
Bug
Empty character classes should not be used
Bug
Setters should not return values
Bug
Properties of variables with "null" or "undefined" values should not be accessed
Bug
A "for" loop update clause should move the counter in the right direction
Bug
Return values from functions without side effects should not be ignored
Bug
Special identifiers should not be bound or assigned
Bug
Values should not be uselessly incremented
Bug
Related "if/else if" statements should not have the same condition
Bug
Objects should not be created to be dropped immediately without being used
Bug
Identical expressions should not be used on both sides of a binary operator
Bug
All code should be reachable
Bug
Loops with at most one iteration should be refactored
Bug
Variables should not be self-assigned
Bug
Function argument names should be unique
Bug
Member names should not be duplicated within a class or object literal
Bug
Bitwise operators should not be used in boolean contexts
Bug
Constructing arguments of system commands from user input is security-sensitive
Security Hotspot
Using unencrypted EFS file systems is security-sensitive
Security Hotspot
Using unencrypted SQS queues is security-sensitive
Security Hotspot
Using unencrypted SNS topics is security-sensitive
Security Hotspot
Using unencrypted SageMaker notebook instances is security-sensitive
Security Hotspot
Using unencrypted Elasticsearch domains is security-sensitive
Security Hotspot
Using unencrypted RDS DB resources is security-sensitive
Security Hotspot
Using unencrypted EBS volumes is security-sensitive
Security Hotspot
Allowing requests with excessive content length is security-sensitive
Security Hotspot
Statically serving hidden files is security-sensitive
Security Hotspot
Using intrusive permissions is security-sensitive
Security Hotspot
Disabling auto-escaping in template engines is security-sensitive
Security Hotspot
Using shell interpreter when executing OS commands is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Formatting SQL queries is security-sensitive
Security Hotspot
Comma operator should not be used
Code Smell
Optional chaining should be preferred
Code Smell
Ends of strings should be checked with "startsWith()" and "endsWith()"
Code Smell
Unnecessary character escapes should be removed
Code Smell
No assigning values to variables used for imports
Code Smell
No uniq values as keys for JSX list components
Code Smell
React Context Provider values should not have non-stable identities
Code Smell
No array index for keys in JSX list components
Code Smell
React components should not be nested
Code Smell
Mandatory keys in JSX list components
Code Smell
Unused methods of React components should be removed
Code Smell
Character classes in regular expressions should not contain only one character
Code Smell
Regular expressions should not contain empty groups
Code Smell
Regular expressions should not contain multiple spaces
Code Smell
Chai assertions should have only one reason to succeed
Code Smell
Single-character alternations in regular expressions should be replaced with character classes
Code Smell
Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string
Code Smell
Tests should check which exception is thrown
Code Smell
Character classes in regular expressions should not contain the same character twice
Code Smell
Names of regular expressions named groups should be used
Code Smell
Regular expressions should not be too complicated
Code Smell
Shorthand promises should be used
Code Smell
Template literals should not be nested
Code Smell
"in" should not be used on arrays
Code Smell
Assignments should not be redundant
Code Smell
Functions should not have identical implementations
Code Smell
Sparse arrays should not be declared
Code Smell
Array-mutating methods should not be used misleadingly
Code Smell
Collection and array contents should be used
Code Smell
Functions should always return the same type
Code Smell
Arguments to built-in functions should match documented types
Code Smell
Literals should not be thrown
Code Smell
Functions should not be called both with and without "new"
Code Smell
Array indexes should be numeric
Code Smell
Assertion arguments should be passed in the correct order
Code Smell
Ternary operators should not be nested
Code Smell
"delete" should not be used on arrays
Code Smell
Variables and functions should not be redeclared
Code Smell
"indexOf" checks should not be for positive numbers
Code Smell
"arguments.caller" and "arguments.callee" should not be used
Code Smell
Multiline blocks should be enclosed in curly braces
Code Smell
Boolean expressions should not be gratuitous
Code Smell
Variables should be used in the blocks where they are declared
Code Smell
Parameters should be passed in the correct order
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
Unused assignments should be removed
Code Smell
Function parameters with default values should be last
Code Smell
Functions should not be defined inside loops
Code Smell
"switch" statements should not have too many "case" clauses
Code Smell
Only "while", "do", "for" and "switch" statements should be labelled
Code Smell
Sections of code should not be commented out
Code Smell
Track uses of "FIXME" tags
Code Smell
Assignments should not be made from within sub-expressions
Code Smell
Labels should not be used
Code Smell
Nested blocks of code should not be left empty
Code Smell
Functions should not have too many parameters
Code Smell
Administration services access should be restricted to specific IP addresses
Vulnerability
OS commands should not be vulnerable to argument injection attacks
Vulnerability
Repeated patterns in regular expressions should not match the empty string
Bug
Empty collections should not be accessed or iterated
Bug
"delete" should be used only with object properties
Bug
"with" statements should not be used
Bug
Function parameters, caught exceptions and foreach variables' initial values should not be ignored
Bug
Disabling versioning of S3 buckets is security-sensitive
Security Hotspot
Disabling server-side encryption of S3 buckets is security-sensitive
Security Hotspot
Forwarding client IP address is security-sensitive
Security Hotspot
Allowing confidential information to be logged is security-sensitive
Security Hotspot
Allowing browsers to perform DNS prefetching is security-sensitive
Security Hotspot
Disabling Certificate Transparency monitoring is security-sensitive
Security Hotspot
Disabling Strict-Transport-Security policy is security-sensitive
Security Hotspot
Disabling strict HTTP no-referrer policy is security-sensitive
Security Hotspot
Allowing browsers to sniff MIME types is security-sensitive
Security Hotspot
Disabling content security policy frame-ancestors directive is security-sensitive
Security Hotspot
Allowing mixed-content is security-sensitive
Security Hotspot
Disabling content security policy fetch directives is security-sensitive
Security Hotspot
Using remote artifacts without integrity checks is security-sensitive
Security Hotspot
Disclosing fingerprints from web application technologies is security-sensitive
Security Hotspot
Authorizing an opened window to access back to the originating window is security-sensitive
Security Hotspot
Having a permissive Cross-Origin Resource Sharing policy is security-sensitive
Security Hotspot
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Searching OS commands in PATH is security-sensitive
Security Hotspot
Creating cookies without the "HttpOnly" flag is security-sensitive
Security Hotspot
Creating cookies without the "secure" flag is security-sensitive
Security Hotspot
Using hardcoded IP addresses is security-sensitive
Security Hotspot
"RegExp.exec()" should be preferred over "String.match()"
Code Smell
Objects and classes converted or coerced to strings should define a "toString()" method
Code Smell
Extra boolean casts should be removed
Code Smell
Regular expression quantifiers and character classes should be used concisely
Code Smell
Regular expression literals should be used when possible
Code Smell
"for of" should be used with Iterables
Code Smell
Imports from the same modules should be merged
Code Smell
Jump statements should not be redundant
Code Smell
The global "this" object should not be used
Code Smell
"catch" clauses should do more than rethrow
Code Smell
Exceptions should not be ignored
Code Smell
Classes should not be empty
Code Smell
Boolean checks should not be inverted
Code Smell
Deprecated APIs should not be used
Code Smell
Wrapper objects should not be used for primitive types
Code Smell
Multiline string literals should not be used
Code Smell
Unused local variables and functions should be removed
Code Smell
Function call arguments should not start on new lines
Code Smell
"switch" statements should have at least 3 "case" clauses
Code Smell
A "while" loop should be used instead of a "for" loop
Code Smell
Unnecessary imports should be removed
Code Smell
Return of boolean expressions should not be wrapped into an "if-then-else" statement
Code Smell
Boolean literals should not be used in comparisons
Code Smell
Class names should comply with a naming convention
Code Smell
Track uses of "TODO" tags
Code Smell
Web SQL databases should not be used
Vulnerability
Variables should be defined before being used
Bug
Policies granting access to all resources of an account are security-sensitive
Security Hotspot
Variables declared with "var" should be declared before they are used
Code Smell
Track lack of copyright and license headers
Code Smell
Reading the Standard Input is security-sensitive
Security Hotspot
Using command line arguments is security-sensitive
Security Hotspot
Using Sockets is security-sensitive
Security Hotspot
Executing XPath expressions is security-sensitive
Security Hotspot
Encrypting data is security-sensitive
Security Hotspot
Using regular expressions is security-sensitive
Security Hotspot
A conditionally executed single line should be denoted by indentation
Code Smell
Class methods should be used instead of "prototype" assignments
Code Smell
Function constructors should not be used
Code Smell
Unchanged variables should be marked "const"
Code Smell
Wildcard imports should not be used
Code Smell
"switch" statements should not be nested
Code Smell
Cyclomatic Complexity of functions should not be too high
Code Smell
"strict" mode should be used with caution
Code Smell
Control flow statements "if", "for", "while", "switch" and "try" should not be nested too deeply
Code Smell
"switch" statements should have "default" clauses
Code Smell
"if ... else if" constructs should end with "else" clauses
Code Smell
Control structures should use curly braces
Code Smell
String literals should not be duplicated
Code Smell
Expressions should not be too complex
Code Smell
Local storage should not be used
Vulnerability
Template literal placeholder syntax should not be used in regular strings
Bug
Built-in objects should not be overridden
Bug
"for...in" loops should filter properties before acting on them
Bug
Results of operations on strings should not be ignored
Bug
Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression
Code Smell
Disallow `.bind()` and arrow functions in JSX props
Code Smell
"for in" should not be used with iterables
Code Smell
Functions should use "return" consistently
Code Smell
Variables and functions should not be declared in the global scope
Code Smell
Arithmetic operators should only have numbers as operands
Code Smell
Values not convertible to numbers should not be used in numeric comparisons
Code Smell
Arithmetic operations should not result in "NaN"
Code Smell
"arguments" should not be accessed directly
Code Smell
Comparison operators should not be used with strings
Code Smell
Property getters and setters should come in pairs
Code Smell
JavaScript parser failure
Code Smell
The ternary operator should not be used
Code Smell
"===" and "!==" should be used instead of "==" and "!="
Code Smell
Functions should not have too many lines of code
Code Smell
Track comments matching a regular expression
Code Smell
Statements should be on separate lines
Code Smell
Unused function parameters should be removed
Code Smell
Variables should not be shadowed
Code Smell
Redundant pairs of parentheses should be removed
Code Smell
Magic numbers should not be used
Code Smell
Collapsible "if" statements should be merged
Code Smell
Standard outputs should not be used directly to log anything
Code Smell
Files should not have too many lines of code
Code Smell
Lines should not be too long
Code Smell
Debugger statements should not be used
Vulnerability
"alert(...)" should not be used
Vulnerability
Regular expressions using Unicode character classes or property escapes should enable the unicode flag
Bug
The base should be provided to "parseInt"
Bug
Function declarations should not be made within blocks
Bug
Writing cookies is security-sensitive
Security Hotspot
"continue" should not be used
Code Smell
"await" should not be used redundantly
Code Smell
Trailing commas should be used
Code Smell
"import" should be used to include external code
Code Smell
Braces and parentheses should be used consistently with arrow functions
Code Smell
Destructuring syntax should be used for assignments
Code Smell
Template strings should be used instead of concatenation
Code Smell
Shorthand object properties should be grouped at the beginning or end of an object declaration
Code Smell
Object literal shorthand syntax should be used
Code Smell
Strings and non-strings should not be added
Code Smell
Default export names and file names should match
Code Smell
Object literal syntax should be used
Code Smell
"undefined" should not be assigned
Code Smell
Trailing commas should not be used
Code Smell
Array constructors should not be used
Code Smell
Local variables should not be declared and then immediately returned or thrown
Code Smell
Quotes for string literals should be used consistently
Code Smell
Statements should end with semicolons
Code Smell
Comments should not be located at the end of lines of code
Code Smell
Loops should not contain more than a single "break" or "continue" statement
Code Smell
Variable, property and parameter names should comply with a naming convention
Code Smell
Lines should not end with trailing whitespaces
Code Smell
Files should contain an empty newline at the end
Code Smell
Extra semicolons should be removed
Code Smell
An open curly brace should be located at the end of a line
Code Smell
Tabulation characters should not be used
Code Smell
Function and method names should comply with a naming convention
Code Smell

Results of operations on strings should not be ignored

Bug

MajorSonarSource default severity
click to learn more

Doing an operation on a string without using the result of the operation is useless and is certainly due to a misunderstanding.

Noncompliant Code Example

var str = "..."
str.toUpperCase(); // Noncompliant

Compliant Solution

var str = "..."
str = str.toUpperCase();

Deprecated

This rule is deprecated; use {rule:javascript:S2201} instead.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Developer
Edition

© 2008-2023 SonarSource S.A., Switzerland. All content is copyright protected. SONAR, SONARSOURCE, SONARLINT, SONARQUBE, and SONARCLOUD are trademarks of SonarSource S.A. All other trademarks and copyrights are the property of their respective owners. All rights are expressly reserved.
Privacy Policy

In-IDE

SaaS

Self-Hosted