Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
Go
HTML
Java
JavaScript
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Python static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PYTHON code

Tags

Impact

Clean code attribute

HTTP response headers should not be vulnerable to response splitting attacks
Vulnerability
JWT secret keys should not be disclosed
Vulnerability
Flask secret keys should not be disclosed
Vulnerability
Credentials should not be hard-coded
Vulnerability
Server-side templates should not be vulnerable to injection attacks
Vulnerability
Dynamic code execution should not be vulnerable to injection attacks
Vulnerability
NoSQL operations should not be vulnerable to injection attacks
Vulnerability
HTTP request redirections should not be open to forging attacks
Vulnerability
Deserialization should not be vulnerable to injection attacks
Vulnerability
Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks
Vulnerability
Database queries should not be vulnerable to injection attacks
Vulnerability
XML parsers should not be vulnerable to XXE attacks
Vulnerability
A secure password should be used when connecting to a database
Vulnerability
XPath expressions should not be vulnerable to injection attacks
Vulnerability
I/O function calls should not be vulnerable to path injection attacks
Vulnerability
LDAP queries should not be vulnerable to injection attacks
Vulnerability
OS commands should not be vulnerable to command injection attacks
Vulnerability
Functions and methods should only return expected values
Bug
The number and name of arguments passed to a function should match its parameters
Bug
Equality checks should not be made against "numpy.nan"
Bug
Assert should not be called on a tuple literal
Bug
The "open" builtin function should be called with a valid mode
Bug
Only defined names should be listed in "__all__"
Bug
Calls should not be made to non-callable values
Bug
Property getter, setter and deleter methods should have the expected number of parameters
Bug
Special methods should have an expected number of parameters
Bug
Instance and class methods should have at least one positional parameter
Bug
Boolean expressions of exceptions should not be used in "except" statements
Bug
Caught Exceptions must derive from BaseException
Bug
Item operations should be done on objects supporting them
Bug
"in" and "not in" operators should be used on objects supporting them
Bug
Dictionary unpacking should only be done with "mapping" objects
Bug
Raised Exceptions must derive from BaseException
Bug
Operators should be used on compatible types
Bug
Function arguments should be passed only once
Bug
Iterable unpacking, "for-in" loops and "yield from" should use an Iterable object
Bug
Variables, classes and functions should be defined before being used
Bug
Identity operators should not be used with dissimilar types
Bug
"__iter__" should return an iterator
Bug
Only strings should be listed in "__all__"
Bug
"__init__" should not return a value
Bug
"yield" and "return" should not be used outside functions
Bug
String formatting should not lead to runtime errors
Bug
Recursion should not be infinite
Bug
Unnecessary equality checks should not be made
Bug
Hard-coded secrets are security-sensitive
Security Hotspot
Creating public APIs is security-sensitive
Security Hotspot
Allowing public network access to cloud resources is security-sensitive
Security Hotspot
Policies granting access to all resources of an account are security-sensitive
Security Hotspot
Policies granting all privileges are security-sensitive
Security Hotspot
Policies authorizing public access to resources are security-sensitive
Security Hotspot
Granting access to S3 buckets to all or authenticated users is security-sensitive
Security Hotspot
Hard-coded passwords are security-sensitive
Security Hotspot
Functions returns should not be invariant
Code Smell
The "exec" statement should not be used
Code Smell
Backticks should not be used
Code Smell
Methods and field names should not differ only by capitalization
Code Smell
GraphQL queries should not be vulnerable to Denial of Service attacks
Vulnerability
AWS IAM policies should limit the scope of permissions given
Vulnerability
JWT should be signed and verified
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Insecure temporary file creation methods should not be used
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
LDAP connections should be authenticated
Vulnerability
Cryptographic key generation should be based on strong parameters
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Cipher Block Chaining IVs should be unpredictable
Vulnerability
Regular expressions should not be vulnerable to Denial of Service attacks
Vulnerability
Password hashing functions should use an unpredictable salt
Vulnerability
datetime.datetime objects should not be compared with datetime.date objects
Bug
offset-naive datetime.time and datetime.datetime objects should not be compared with offset-aware ones
Bug
Accessing sequence elements should not trigger an IndexError
Bug
Unpacking should be done with the same number of elements of the iterable.
Bug
Non-existent dictionary keys should not be accessed
Bug
Regex lookahead assertions should not be contradictory
Bug
Back references in regular expressions should only refer to capturing groups that are matched before the reference
Bug
Regex boundaries should not be used in a way that can never be matched
Bug
Regex patterns following a possessive quantifier should not always fail
Bug
Assertions should not be made at the end of blocks expecting an exception
Bug
Assertions comparing incompatible types should not be made
Bug
Exceptions' "__cause__" should be either an Exception or None
Bug
Zero should not be a possible denominator
Bug
"break" and "continue" should not be used outside a loop
Bug
Break, continue and return statements should not occur in "finally" blocks
Bug
Allowing public ACLs or policies on a S3 bucket is security-sensitive
Security Hotspot
Using slow regular expressions is security-sensitive
Security Hotspot
Using publicly writable directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Signaling processes is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Disabling CSRF protections is security-sensitive
Security Hotspot
Using non-standard cryptographic algorithms is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Constants should not be used as conditions
Code Smell
"SystemExit" should be re-raised
Code Smell
Bare "raise" statements should only be used in "except" blocks
Code Smell
Comparison to None should not be constant
Code Smell
"self" should be the first argument to instance methods
Code Smell
Function parameters' default values should not be modified or assigned
Code Smell
Some special methods should return "NotImplemented" instead of raising "NotImplementedError"
Code Smell
Custom Exception classes should inherit from "Exception" or one of its subclasses
Code Smell
Bare "raise" statements should not be used in "finally" blocks
Code Smell
Arguments given to functions should be of an expected type
Code Smell
`str.replace` should be preferred to `re.sub`
Code Smell
Unread "private" attributes should be removed
Code Smell
Cognitive Complexity of functions should not be too high
Code Smell
The first argument to class methods should follow the naming convention
Code Smell
Method overrides should not change contracts
Code Smell
Wildcard imports should not be used
Code Smell
String literals should not be duplicated
Code Smell
Functions and methods should not be empty
Code Smell
Server-side requests should not be vulnerable to traversing attacks
Vulnerability
GraphQL introspection should be disabled in production
Vulnerability
Stack traces should not be disclosed
Vulnerability
Loop boundaries should not be vulnerable to injection attacks
Vulnerability
Memory allocations should not be vulnerable to Denial of Service attacks
Vulnerability
Applications should not create session cookies from untrusted input
Vulnerability
Server-side requests should not be vulnerable to forging attacks
Vulnerability
Non-empty statements should change control flow or have at least one side-effect
Bug
Einops pattern should be valid
Bug
Subclasses of "torch.nn.Module" should call the initializer
Bug
Transformers should not be accessed directly when a Scikit-Learn Pipeline uses caching
Bug
The abs_tol parameter should be provided when using math.isclose to compare values to 0
Bug
Sequence indexes must have an __index__ method
Bug
Set members and dictionary keys should be hashable
Bug
The "safe" flag should be set to "False" when serializing non-dictionary objects in Django JSON-encoded responses.
Bug
Django signal handler functions should have the '@receiver' decorator on top of all other decorators
Bug
ExceptionGroup and BaseExceptionGroup should not be caught with except*
Bug
Collections should not be modified while they are iterated
Bug
Replacement strings should reference existing regular expression groups
Bug
Alternation in regular expressions should not contain empty alternatives
Bug
Unicode Grapheme Clusters should be avoided inside regex character classes
Bug
Regex alternatives should not be redundant
Bug
Alternatives in regular expressions should be grouped when used with anchors
Bug
New objects should not be created only to check their identity
Bug
Collection content should not be replaced unconditionally
Bug
Exceptions should not be created without being raised
Bug
Collection sizes and array length comparisons should make sense
Bug
All branches in a conditional structure should not have exactly the same implementation
Bug
The output of functions that don't return anything should not be used
Bug
Non-existent operators like "=+" should not be used
Bug
Conditionally executed code should be reachable
Bug
Increment and decrement operators should not be used
Bug
Attributes should not be accessed on "None" values
Bug
Return values from functions without side effects should not be ignored
Bug
Related "if/else if" statements should not have the same condition
Bug
Identical expressions should not be used on both sides of a binary operator
Bug
All code should be reachable
Bug
Loops with at most one iteration should be refactored
Bug
Variables should not be self-assigned
Bug
Floating point numbers should not be tested for equality
Bug
All "except" blocks should be able to catch exceptions
Bug
Usage of "torch.load" can lead to untrusted code execution
Security Hotspot
Allowing unrestricted outbound communications is security-sensitive
Security Hotspot
Constructing arguments of system commands from user input is security-sensitive
Security Hotspot
Using unencrypted EFS file systems is security-sensitive
Security Hotspot
Using unencrypted SQS queues is security-sensitive
Security Hotspot
Using unencrypted SNS topics is security-sensitive
Security Hotspot
Using unencrypted SageMaker notebook instances is security-sensitive
Security Hotspot
Using unencrypted OpenSearch domains is security-sensitive
Security Hotspot
Using unencrypted RDS DB resources is security-sensitive
Security Hotspot
Using unencrypted EBS volumes is security-sensitive
Security Hotspot
Disabling auto-escaping in template engines is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Formatting SQL queries is security-sensitive
Security Hotspot
"model.eval()" or "model.train()" should be called after loading the state of a PyTorch model
Code Smell
"torch.tensor" should be used instead of "torch.autograd.Variable"
Code Smell
Subclasses of Scikit-Learn's "BaseEstimator" should not set attributes ending with "_" in the "__init__" method
Code Smell
Important hyperparameters should be specified for machine learning libraries' estimators and optimizers
Code Smell
Nested estimator parameters modification in a Pipeline should refer to valid parameters
Code Smell
"memory" parameter should be specified for Scikit-Learn Pipeline
Code Smell
The reduction axis/dimension should be specified when using reduction operations
Code Smell
Python side effects should not be used inside a "tf.function"
Code Smell
The "validate_indices" argument should not be set for "tf.gather" function call
Code Smell
The "input_shape" parameter should not be specified for "tf.keras.Model" subclasses
Code Smell
"tf.Variable" objects should be singletons when created inside of a "tf.function"
Code Smell
"tf.function" should not depend on global or free Python variables
Code Smell
"tensorflow.function" should not be recursive
Code Smell
Using timezone-aware "datetime" objects should be preferred over using "datetime.datetime.utcnow" and "datetime.datetime.utcfromtimestamp"
Code Smell
Numpy weekmask should have a valid value
Code Smell
Dates should be formatted correctly when using "pandas.to_datetime" with "dayfirst" or "yearfirst" arguments
Code Smell
"zoneinfo" should be preferred to "pytz" when using Python 3.9 and later
Code Smell
"pytz.timezone" should not be passed to the "datetime.datetime" constructor
Code Smell
The 12-hour format should be used with the AM/PM marker, otherwise the 24-hour format should be used
Code Smell
Constructor attributes of date and time objects should be in the range of possible values
Code Smell
"f-strings" should not be nested too deeply
Code Smell
Generic functions should be defined using the type parameter syntax
Code Smell
Generic type statements should not use "TypeVars"
Code Smell
Type aliases should be declared with a "type" statement
Code Smell
Generic classes should be defined using the type parameter syntax
Code Smell
pandas.pipe method should be preferred over long chains of instructions
Code Smell
The "pandas.DataFrame.to_numpy()" method should be preferred to the "pandas.DataFrame.values" attribute
Code Smell
When using pandas.merge or pandas.join, the parameters on, how and validate should be provided
Code Smell
inplace=True should not be used when modifying a Pandas DataFrame
Code Smell
Deprecated NumPy aliases of built-in types should not be used
Code Smell
np.nonzero should be preferred over np.where when only the condition parameter is set
Code Smell
Passing a list to np.array should be preferred over passing a generator
Code Smell
numpy.random.Generator should be preferred to numpy.random.RandomState
Code Smell
Results that depend on random number generation should be reproducible
Code Smell
Fields of a Django ModelFom should be defined explicitly
Code Smell
"locals()" should not be passed to a Django "render()" function
Code Smell
'null=True' should not be used on string-based fields in Django models
Code Smell
Union type expressions should be preferred over "typing.Union" in type hints
Code Smell
Octal escape sequences should not be used in regular expressions
Code Smell
Character classes in regular expressions should not contain only one character
Code Smell
Superfluous curly brace quantifiers should be avoided
Code Smell
Non-capturing groups without quantifier should not be used
Code Smell
Regular expressions should not contain empty groups
Code Smell
Regular expressions should not contain multiple spaces
Code Smell
Single-character alternations in regular expressions should be replaced with character classes
Code Smell
Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string
Code Smell
Assertions should not fail or succeed unconditionally
Code Smell
Test methods should be discoverable
Code Smell
Values assigned to variables should match their type annotations
Code Smell
Function return types should be consistent with their type hint
Code Smell
Character classes in regular expressions should not contain the same character twice
Code Smell
Type checks shouldn't be confusing
Code Smell
Names of regular expressions named groups should be used
Code Smell
Regular expressions should not be too complicated
Code Smell
Builtins should not be shadowed by local variables
Code Smell
Implicit string and byte concatenations should not be confusing
Code Smell
Identity comparisons should not be used with cached types
Code Smell
Expressions creating sets should not have duplicate values
Code Smell
Expressions creating dictionaries should not have duplicate keys
Code Smell
Special method "__exit__" should not re-raise the provided exception
Code Smell
Unused scope-limited definitions should be removed
Code Smell
Functions and methods should not have identical implementations
Code Smell
Unused private nested classes should be removed
Code Smell
String formatting should be used correctly
Code Smell
Conditional expressions should not be nested
Code Smell
Loops without "break" should not have "else" clauses
Code Smell
Doubled prefix operators "not" and "~" should not be used
Code Smell
Boolean expressions should not be gratuitous
Code Smell
The "print" statement should not be used
Code Smell
"<>" should not be used to test inequality
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
Unused assignments should be removed
Code Smell
A field should not duplicate the name of its containing class
Code Smell
A reason should be provided when skipping a test
Code Smell
Function names should comply with a naming convention
Code Smell
Functions and lambdas should not reference variables defined in enclosing loops
Code Smell
Sections of code should not be commented out
Code Smell
Unused function parameters should be removed
Code Smell
Unused class-private methods should be removed
Code Smell
Track uses of "FIXME" tags
Code Smell
"Exception" and "BaseException" should not be raised
Code Smell
Redundant pairs of parentheses should be removed
Code Smell
Nested blocks of code should not be left empty
Code Smell
Functions, methods and lambdas should not have too many parameters
Code Smell
Mergeable "if" statements should be combined
Code Smell
Administration services access should be restricted to specific IP addresses
Vulnerability
Logging should not be vulnerable to injection attacks
Vulnerability
Repeated patterns in regular expressions should not match the empty string
Bug
Function parameters initial values should not be ignored
Bug
Disabling versioning of S3 buckets is security-sensitive
Security Hotspot
Having a permissive Cross-Origin Resource Sharing policy is security-sensitive
Security Hotspot
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Allowing both safe and unsafe HTTP methods is security-sensitive
Security Hotspot
Creating cookies without the "HttpOnly" flag is security-sensitive
Security Hotspot
Creating cookies without the "secure" flag is security-sensitive
Security Hotspot
Using hardcoded IP addresses is security-sensitive
Security Hotspot
The "num_workers" parameter should be specified for "torch.utils.data.DataLoader"
Code Smell
"isinstance()" should be preferred to direct type comparisons
Code Smell
'startswith' or 'endswith' methods should be used instead of string slicing in condition expressions
Code Smell
Regular expression quantifiers and character classes should be used concisely
Code Smell
Tests should be skipped explicitly
Code Smell
The most specific "unittest" assertion should be used
Code Smell
Character classes should be preferred over reluctant quantifiers in regular expressions
Code Smell
A subclass should not be in the same "except" statement as a parent class
Code Smell
Walrus operator should not make code confusing
Code Smell
Jump statements should not be redundant
Code Smell
"pass" should not be used needlessly
Code Smell
"except" clauses should do more than raise the same issue
Code Smell
Boolean checks should not be inverted
Code Smell
Unused local variables should be removed
Code Smell
Local variable and function parameter names should comply with a naming convention
Code Smell
Field names should comply with a naming convention
Code Smell
Class names should comply with a naming convention
Code Smell
Method names should comply with a naming convention
Code Smell
Track uses of "TODO" tags
Code Smell
HTML autoescape mechanism should not be globally disabled
Vulnerability
Variables, classes and functions should be either defined or imported
Bug
"__exit__" should accept type, value, and traceback arguments
Bug
"return" and "yield" should not be used in the same function
Bug
Track lack of copyright and license headers
Code Smell
Regular expressions should be syntactically valid
Bug
Sending emails is security-sensitive
Security Hotspot
Reading the Standard Input is security-sensitive
Security Hotspot
Using command line arguments is security-sensitive
Security Hotspot
Configuring loggers is security-sensitive
Security Hotspot
Encrypting data is security-sensitive
Security Hotspot
Using regular expressions is security-sensitive
Security Hotspot
Dynamically executing code is security-sensitive
Security Hotspot
Cyclomatic Complexity of functions should not be too high
Code Smell
Control flow statements "if", "for", "while", "try" and "with" should not be nested too deeply
Code Smell
Cyclomatic Complexity of classes should not be too high
Code Smell
"\" should only be used as an escape character outside of raw strings
Bug
Using shell interpreter when executing OS commands is security-sensitive
Security Hotspot
'dtype' parameter should be provided when using 'pandas.read_csv' or 'pandas.read_table'
Code Smell
Django models should define a "__str__" method
Code Smell
Type hints of generic types should specify their type parameters
Code Smell
Any should not be used as a type hint
Code Smell
Function parameters should have type hints
Code Smell
Function returns should have type hints
Code Smell
Functions should use "return" consistently
Code Smell
Python parser failure
Code Smell
Files should not be too complex
Code Smell
Docstrings should be defined
Code Smell
Functions should not have too many lines of code
Code Smell
Track uses of "NOSONAR" comments
Code Smell
Track comments matching a regular expression
Code Smell
Statements should be on separate lines
Code Smell
Functions should not contain too many return statements
Code Smell
Files should not have too many lines of code
Code Smell
Lines should not be too long
Code Smell
Disabling server-side encryption of S3 buckets is security-sensitive
Security Hotspot
Assignments of lambdas to variables should be replaced by function definitions
Code Smell
Built-in generic types should be preferred over the typing module in type hints
Code Smell
Methods and properties that don't access instance data should be static
Code Smell
New-style classes should be used
Code Smell
Parentheses should not be used after certain keywords
Code Smell
Track "TODO" and "FIXME" comments that do not contain a reference to a person
Code Smell
Module names should comply with a naming convention
Code Smell
Comments should not be located at the end of lines of code
Code Smell
Lines should not end with trailing whitespaces
Code Smell
Files should end with a newline
Code Smell
Long suffix "L" should be upper case
Code Smell
Unnecessary imports should be removed
Code Smell

"torch.tensor" should be used instead of "torch.autograd.Variable"

consistency - conventional

maintainability

Code Smell

MajorSonarSource default severity
click to learn more

This rule raises when a torch.autograd.Variable is instantiated.

Why is this an issue?

How can I fix it?

More Info

The Pytorch Variable API has been deprecated. The behavior of Variables is now provided by the Pytorch tensors and can be controlled with the requires_grad parameter.

The Variable API now returns tensors anyway, so there should not be any breaking changes.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2024 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.

Sonar helps developers write Clean Code.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted