Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Apex
C
C++
CloudFormation
COBOL
C#
CSS
Docker
Flex
Go
HTML
Java
JavaScript
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Kotlin static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your KOTLIN code

Tags

"PreparedStatement" and "ResultSet" methods should be called with valid indices
Bug
Hard-coded credentials are security-sensitive
Security Hotspot
Counter Mode initialization vectors should not be reused
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Cryptographic keys should be robust
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
"SecureRandom" seeds should not be predictable
Vulnerability
Cipher Block Chaining IVs should be unpredictable
Vulnerability
Hashes should include an unpredictable salt
Vulnerability
Regular expressions should be syntactically valid
Bug
"runFinalizersOnExit" should not be called
Bug
"ScheduledThreadPoolExecutor" should not have 0 core threads
Bug
Jump statements should not occur in "finally" blocks
Bug
Using clear-text protocols is security-sensitive
Security Hotspot
Accessing Android external storage is security-sensitive
Security Hotspot
Receiving intents is security-sensitive
Security Hotspot
Broadcasting intents is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Empty lines should not be tested with regex MULTILINE flag
Code Smell
Cognitive Complexity of functions should not be too high
Code Smell
String literals should not be duplicated
Code Smell
Functions should not be empty
Code Smell
Mobile database encryption keys should not be disclosed
Vulnerability
"Map" values should be accessed safely
Bug
Flow intermediate operation results should not be left unused
Bug
Equals method should be overridden in data classes containing array fields
Bug
Unicode Grapheme Clusters should be avoided inside regex character classes
Bug
Alternatives in regular expressions should be grouped when used with anchors
Bug
Collection and array sizes comparisons should make sense
Bug
Intermediate Sequence and Stream functions should not be left unused
Bug
All branches in a conditional structure should not have exactly the same implementation
Bug
"=+" should not be used instead of "+="
Bug
Inappropriate collection calls should not be made
Bug
Values should not be uselessly incremented
Bug
"hashCode" and "toString" should not be called on array instances
Bug
Collections should not be passed as arguments to their own methods
Bug
Related "if/else if" statements should not have the same condition
Bug
Identical expressions should not be used on both sides of a binary operator
Bug
All code should be reachable
Bug
Variables should not be self-assigned
Bug
Useless "if(true) {...}" and "if(false){...}" blocks should be removed
Bug
Enabling file access for WebViews is security-sensitive
Security Hotspot
Enabling JavaScript support for WebViews is security-sensitive
Security Hotspot
Using unencrypted files in mobile applications is security-sensitive
Security Hotspot
Using biometric authentication without a cryptographic solution is security-sensitive
Security Hotspot
Using unencrypted databases in mobile applications is security-sensitive
Security Hotspot
Authorizing non-authenticated users to use keys in the Android KeyStore is security-sensitive
Security Hotspot
Variables assigned values should be read
Code Smell
"It" shouldn't be used as a lambda parameter name
Code Smell
Check for preconditions should be simplified
Code Smell
Redundant type casts and type checks should be removed
Code Smell
Type casts and type checks that can never succeed should be removed
Code Smell
Expression should be simplified with "isEmpty", "isNotEmpty" or "isNullOrEmpty"
Code Smell
Structural equality tests should use "==" or "!="
Code Smell
Element access should use indexed access operators
Code Smell
Single function interfaces should be functional interfaces
Code Smell
Functional interface implementations should use lambda expressions
Code Smell
Singleton pattern should use object declarations or expressions
Code Smell
Delegator pattern should use "by" clause
Code Smell
"when" statements should be used instead of chained "if" statements
Code Smell
"return" statements should be lifted before "if" or "when" statement
Code Smell
"Unit" should be used instead of "Void"
Code Smell
Kotlin coroutines API for timeouts should be used
Code Smell
The return value of functions returning "Deferred" should be used
Code Smell
ViewModel classes should create coroutines
Code Smell
Extension functions on CoroutineScopes should not be declared as "suspend"
Code Smell
Suspending functions should not be called on a different dispatcher
Code Smell
Dispatchers should be injectable
Code Smell
Functions returning Flow/Channel should not be suspending
Code Smell
Suspending functions should be main-safe
Code Smell
Coroutine usage should adhere to structured concurrency principles
Code Smell
"MutableStateFlow" and "MutableSharedFlow" should not be exposed
Code Smell
Redundant methods should be avoided in data classes
Code Smell
Operator "is" should be used instead of "isInstance()"
Code Smell
Character classes in regular expressions should not contain the same character twice
Code Smell
Regular expressions should not be too complicated
Code Smell
Native features should be preferred to Guava
Code Smell
Functions should not have identical implementations
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
"when" statements should not have too many clauses
Code Smell
Sections of code should not be commented out
Code Smell
Unused function parameters should be removed
Code Smell
Unused "private" methods should be removed
Code Smell
Track uses of "FIXME" tags
Code Smell
Redundant pairs of parentheses should be removed
Code Smell
Nested blocks of code should not be left empty
Code Smell
Functions should not have too many parameters
Code Smell
Collapsible "if" statements should be merged
Code Smell
Return values should not be ignored when they contain the operation status code
Bug
Repeated patterns in regular expressions should not match the empty string
Bug
"equals(other: Any?)" should test argument type
Bug
"equals(Any?)" and "hashCode()" should be overridden in pairs
Bug
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Using hardcoded IP addresses is security-sensitive
Security Hotspot
Getter and setter pattern should use property getters and setters
Code Smell
"suspend" modifier should not be redundant
Code Smell
Character classes should be preferred over reluctant quantifiers in regular expressions
Code Smell
Multi-line comments should not be empty
Code Smell
Boolean checks should not be inverted
Code Smell
Code annotated as deprecated should not be used
Code Smell
Unused local variables should be removed
Code Smell
Local variable and function parameter names should comply with a naming convention
Code Smell
Unnecessary imports should be removed
Code Smell
Boolean literals should not be redundant
Code Smell
Class names should comply with a naming convention
Code Smell
Method names should comply with a naming convention
Code Smell
Track uses of "TODO" tags
Code Smell
Deprecated code should be removed
Code Smell
Track lack of copyright and license headers
Code Smell
"when" statements should not be nested
Code Smell
Control flow statements "if", "for", "while", "when" and "try" should not be nested too deeply
Code Smell
"if ... else if" constructs should end with "else" clauses
Code Smell
Expressions should not be too complex
Code Smell
Lambdas should not have too many lines
Code Smell
Kotlin parser failure
Code Smell
Functions should not have too many lines of code
Code Smell
Statements should be on separate lines
Code Smell
"when" clauses should not have too many lines of code
Code Smell
Files should not have too many lines of code
Code Smell
Lines should not be too long
Code Smell
Unicode-aware versions of character classes should be preferred
Code Smell
Tabulation characters should not be used
Code Smell

Control flow statements "if", "for", "while", "when" and "try" should not be nested too deeply

Code Smell

CriticalSonarSource default severity
click to learn more

brain-overload

Why is this an issue?

Nested if, for, while, when, and try statements are key ingredients for making what’s known as "Spaghetti code".

Such code is hard to read, refactor and therefore maintain.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2023 SonarSource S.A., Switzerland. All content is copyright protected. SONAR, SONARSOURCE, SONARLINT, SONARQUBE, and SONARCLOUD are trademarks of SonarSource S.A. All other trademarks and copyrights are the property of their respective owners. All rights are expressly reserved.
Privacy Policy

In-IDE

SaaS

Self-Hosted