Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
Go
HTML
Java
JavaScript
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Kotlin static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your KOTLIN code

Tags

Impact

Clean code attribute

"PreparedStatement" and "ResultSet" methods should be called with valid indices
Bug
Hard-coded credentials are security-sensitive
Security Hotspot
Counter Mode initialization vectors should not be reused
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Cryptographic keys should be robust
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
"SecureRandom" seeds should not be predictable
Vulnerability
Cipher Block Chaining IVs should be unpredictable
Vulnerability
Hashes should include an unpredictable salt
Vulnerability
Regular expressions should be syntactically valid
Bug
"runFinalizersOnExit" should not be called
Bug
"ScheduledThreadPoolExecutor" should not have 0 core threads
Bug
Jump statements should not occur in "finally" blocks
Bug
Using clear-text protocols is security-sensitive
Security Hotspot
Accessing Android external storage is security-sensitive
Security Hotspot
Receiving intents is security-sensitive
Security Hotspot
Broadcasting intents is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Empty lines should not be tested with regex MULTILINE flag
Code Smell
Cognitive Complexity of functions should not be too high
Code Smell
String literals should not be duplicated
Code Smell
Functions should not be empty
Code Smell
Mobile database encryption keys should not be disclosed
Vulnerability
"Map" values should be accessed safely
Bug
Flow intermediate operation results should not be left unused
Bug
Equals method should be overridden in data classes containing array fields
Bug
Unicode Grapheme Clusters should be avoided inside regex character classes
Bug
Alternatives in regular expressions should be grouped when used with anchors
Bug
Collection and array sizes comparisons should make sense
Bug
Intermediate Sequence and Stream functions should not be left unused
Bug
All branches in a conditional structure should not have exactly the same implementation
Bug
Non-existent operators like "=+" should not be used
Bug
Inappropriate collection calls should not be made
Bug
Values should not be uselessly incremented
Bug
"hashCode" and "toString" should not be called on array instances
Bug
Collections should not be passed as arguments to their own methods
Bug
Related "if/else if" statements should not have the same condition
Bug
Identical expressions should not be used on both sides of a binary operator
Bug
All code should be reachable
Bug
Variables should not be self-assigned
Bug
Useless "if(true) {...}" and "if(false){...}" blocks should be removed
Bug
Enabling file access for WebViews is security-sensitive
Security Hotspot
Enabling JavaScript support for WebViews is security-sensitive
Security Hotspot
Using unencrypted files in mobile applications is security-sensitive
Security Hotspot
Using biometric authentication without a cryptographic solution is security-sensitive
Security Hotspot
Using unencrypted databases in mobile applications is security-sensitive
Security Hotspot
Authorizing non-authenticated users to use keys in the Android KeyStore is security-sensitive
Security Hotspot
Gradle settings file should always be present
Code Smell
Dependencies should be grouped by destination
Code Smell
Tasks should define "description" and "group"
Code Smell
"rootProject.name" should always be present in Gradle settings
Code Smell
Dependency versions shouldn't be hard-coded
Code Smell
"tasks.register()" should be preferred over "tasks.create()"
Code Smell
Null checks should be useful
Code Smell
Variables assigned values should be read
Code Smell
"It" shouldn't be used as a lambda parameter name
Code Smell
Check for preconditions should be simplified
Code Smell
Redundant type casts and type checks should be removed
Code Smell
Type casts and type checks that can never succeed should be removed
Code Smell
Expression should be simplified with "isEmpty", "isNotEmpty" or "isNullOrEmpty"
Code Smell
"find" should be replaced with "any", "none" or "contains"
Code Smell
Function chain using "filter" should be simplified
Code Smell
Abstract class should be interface
Code Smell
Structural equality tests should use "==" or "!="
Code Smell
Element access should use indexed access operators
Code Smell
Single function interfaces should be functional interfaces
Code Smell
Functional interface implementations should use lambda expressions
Code Smell
Singleton pattern should use object declarations or expressions
Code Smell
Delegator pattern should use "by" clause
Code Smell
"when" statements should be used instead of chained "if" statements
Code Smell
"return" statements should be lifted before "if" or "when" statement
Code Smell
"Unit" should be used instead of "Void"
Code Smell
Kotlin coroutines API for timeouts should be used
Code Smell
The return value of functions returning "Deferred" should be used
Code Smell
ViewModel classes should create coroutines
Code Smell
Extension functions on CoroutineScopes should not be declared as "suspend"
Code Smell
Suspending functions should not be called on a different dispatcher
Code Smell
Dispatchers should be injectable
Code Smell
Functions returning Flow/Channel should not be suspending
Code Smell
Suspending functions should be main-safe
Code Smell
Coroutine usage should adhere to structured concurrency principles
Code Smell
"MutableStateFlow" and "MutableSharedFlow" should not be exposed
Code Smell
Redundant methods should be avoided in data classes
Code Smell
Operator "is" should be used instead of "isInstance()"
Code Smell
Character classes in regular expressions should not contain the same character twice
Code Smell
Regular expressions should not be too complicated
Code Smell
Native features should be preferred to Guava
Code Smell
Functions should not have identical implementations
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
"when" statements should not have too many clauses
Code Smell
Sections of code should not be commented out
Code Smell
Unused function parameters should be removed
Code Smell
Unused "private" methods should be removed
Code Smell
Track uses of "FIXME" tags
Code Smell
Redundant pairs of parentheses should be removed
Code Smell
Nested blocks of code should not be left empty
Code Smell
Functions should not have too many parameters
Code Smell
Mergeable "if" statements should be combined
Code Smell
Return values should not be ignored when they contain the operation status code
Bug
Repeated patterns in regular expressions should not match the empty string
Bug
"equals(other: Any?)" should test the argument's type
Bug
"equals(Any?)" and "hashCode()" should be overridden in pairs
Bug
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Using hardcoded IP addresses is security-sensitive
Security Hotspot
Core plugins IDs should be replaced by their shortcuts
Code Smell
Collection should be immutable if contents is not changed
Code Smell
Getter and setter pattern should use property getters and setters
Code Smell
"suspend" modifier should not be redundant
Code Smell
Character classes should be preferred over reluctant quantifiers in regular expressions
Code Smell
Multi-line comments should not be empty
Code Smell
Boolean checks should not be inverted
Code Smell
Code annotated as deprecated should not be used
Code Smell
Unused local variables should be removed
Code Smell
Local variable and function parameter names should comply with a naming convention
Code Smell
Unnecessary imports should be removed
Code Smell
Boolean literals should not be redundant
Code Smell
Class names should comply with a naming convention
Code Smell
Function names should comply with a naming convention
Code Smell
Track uses of "TODO" tags
Code Smell
Deprecated code should be removed
Code Smell
Track lack of copyright and license headers
Code Smell
"var" should be "val" if local variable is never re-assigned
Code Smell
"when" statements should not be nested
Code Smell
Control flow statements "if", "for", "while", "when" and "try" should not be nested too deeply
Code Smell
"if ... else if" constructs should end with "else" clauses
Code Smell
Expressions should not be too complex
Code Smell
Lambdas should not have too many lines
Code Smell
Kotlin parser failure
Code Smell
Functions should not have too many lines of code
Code Smell
Statements should be on separate lines
Code Smell
"when" clauses should not have too many lines of code
Code Smell
Files should not have too many lines of code
Code Smell
Lines should not be too long
Code Smell
Unicode-aware versions of character classes should be preferred
Code Smell
Tabulation characters should not be used
Code Smell

Dependencies should be grouped by destination

consistency - conventional

maintainability

Code Smell

MajorSonarSource default severity
click to learn more

gradle

Why is this an issue?

How can I fix it?

More Info

Dependencies should be grouped by their destination, otherwise, it becomes hard for the reader to see which destination has what dependencies.

What is the potential impact?

Readability

This change improves readability by making it easier to see which destination has what dependencies.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2024 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.

Sonar helps developers write Clean Code.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted