Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Apex
C
C++
CloudFormation
COBOL
C#
CSS
Docker
Flex
Go
HTML
Java
JavaScript
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Python static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PYTHON code

Tags

Server-side templates should not be vulnerable to injection attacks
Vulnerability
Dynamic code execution should not be vulnerable to injection attacks
Vulnerability
NoSQL operations should not be vulnerable to injection attacks
Vulnerability
HTTP request redirections should not be open to forging attacks
Vulnerability
Deserialization should not be vulnerable to injection attacks
Vulnerability
Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks
Vulnerability
Database queries should not be vulnerable to injection attacks
Vulnerability
XML parsers should not be vulnerable to XXE attacks
Vulnerability
A secure password should be used when connecting to a database
Vulnerability
XPath expressions should not be vulnerable to injection attacks
Vulnerability
I/O function calls should not be vulnerable to path injection attacks
Vulnerability
LDAP queries should not be vulnerable to injection attacks
Vulnerability
OS commands should not be vulnerable to command injection attacks
Vulnerability
The number and name of arguments passed to a function should match its parameters
Bug
Assert should not be called on a tuple literal
Bug
The "open" builtin function should be called with a valid mode
Bug
Only defined names should be listed in "__all__"
Bug
Calls should not be made to non-callable values
Bug
Property getter, setter and deleter methods should have the expected number of parameters
Bug
Special methods should have an expected number of parameters
Bug
Instance and class methods should have at least one positional parameter
Bug
Boolean expressions of exceptions should not be used in "except" statements
Bug
Caught Exceptions must derive from BaseException
Bug
Item operations should be done on objects supporting them
Bug
Dictionary unpacking should only be done with "mapping" objects
Bug
Raised Exceptions must derive from BaseException
Bug
Operators should be used on compatible types
Bug
Function arguments should be passed only once
Bug
Iterable unpacking, "for-in" loops and "yield from" should use an Iterable object
Bug
Variables, classes and functions should be defined before being used
Bug
Identity operators should not be used with dissimilar types
Bug
Only strings should be listed in "__all__"
Bug
"__init__" should not return a value
Bug
"yield" and "return" should not be used outside functions
Bug
String formatting should not lead to runtime errors
Bug
Recursion should not be infinite
Bug
Silly equality checks should not be made
Bug
Creating public APIs is security-sensitive
Security Hotspot
Allowing public network access to cloud resources is security-sensitive
Security Hotspot
Policies granting access to all resources of an account are security-sensitive
Security Hotspot
Policies granting all privileges are security-sensitive
Security Hotspot
Policies authorizing public access to resources are security-sensitive
Security Hotspot
Granting access to S3 buckets to all or authenticated users is security-sensitive
Security Hotspot
Hard-coded credentials are security-sensitive
Security Hotspot
Functions returns should not be invariant
Code Smell
The "exec" statement should not be used
Code Smell
Backticks should not be used
Code Smell
Methods and field names should not differ only by capitalization
Code Smell
AWS IAM policies should not allow privilege escalation
Vulnerability
JWT should be signed and verified
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Insecure temporary file creation methods should not be used
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
LDAP connections should be authenticated
Vulnerability
Cryptographic key generation should be based on strong parameters
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Cipher Block Chaining IVs should be unpredictable
Vulnerability
Regular expressions should not be vulnerable to Denial of Service attacks
Vulnerability
Hashes should include an unpredictable salt
Vulnerability
Regex lookahead assertions should not be contradictory
Bug
Back references in regular expressions should only refer to capturing groups that are matched before the reference
Bug
Regex boundaries should not be used in a way that can never be matched
Bug
Regex patterns following a possessive quantifier should not always fail
Bug
Assertions comparing incompatible types should not be made
Bug
Exceptions' "__cause__" should be either an Exception or None
Bug
Zero should not be a possible denominator
Bug
"break" and "continue" should not be used outside a loop
Bug
Break, continue and return statements should not occur in "finally" blocks
Bug
Allowing public ACLs or policies on a S3 bucket is security-sensitive
Security Hotspot
Using slow regular expressions is security-sensitive
Security Hotspot
Using publicly writable directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Signaling processes is security-sensitive
Security Hotspot
Configuring loggers is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Disabling CSRF protections is security-sensitive
Security Hotspot
Using non-standard cryptographic algorithms is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Constants should not be used as conditions
Code Smell
"SystemExit" should be re-raised
Code Smell
Bare "raise" statements should only be used in "except" blocks
Code Smell
Comparison to None should not be constant
Code Smell
"self" should be the first argument to instance methods
Code Smell
Function parameters' default values should not be modified or assigned
Code Smell
Some special methods should return "NotImplemented" instead of raising "NotImplementedError"
Code Smell
Custom Exception classes should inherit from "Exception" or one of its subclasses
Code Smell
Bare "raise" statements should not be used in "finally" blocks
Code Smell
Arguments given to functions should be of an expected type
Code Smell
`str.replace` should be preferred to `re.sub`
Code Smell
Unread "private" attributes should be removed
Code Smell
Cognitive Complexity of functions should not be too high
Code Smell
The first argument to class methods should follow the naming convention
Code Smell
Method overrides should not change contracts
Code Smell
Wildcard imports should not be used
Code Smell
String literals should not be duplicated
Code Smell
Functions and methods should not be empty
Code Smell
Applications should not create session cookies from untrusted input
Vulnerability
Server-side requests should not be vulnerable to forging attacks
Vulnerability
Non-empty statements should change control flow or have at least one side-effect
Bug
ExceptionGroup and BaseExceptionGroup should not be caught with except*
Bug
Accessing list elements should not trigger an IndexError
Bug
Unpacking should be done with the same number of elements of the iterable.
Bug
Non-existent dictionary keys should not be accessed
Bug
Collections should not be modified while they are iterated
Bug
Replacement strings should reference existing regular expression groups
Bug
Alternation in regular expressions should not contain empty alternatives
Bug
Unicode Grapheme Clusters should be avoided inside regex character classes
Bug
Regex alternatives should not be redundant
Bug
Alternatives in regular expressions should be grouped when used with anchors
Bug
New objects should not be created only to check their identity
Bug
Collection content should not be replaced unconditionally
Bug
Exceptions should not be created without being raised
Bug
Collection sizes and array length comparisons should make sense
Bug
All branches in a conditional structure should not have exactly the same implementation
Bug
The output of functions that don't return anything should not be used
Bug
"=+" should not be used instead of "+="
Bug
Conditionally executed code should be reachable
Bug
Increment and decrement operators should not be used
Bug
Attributes should not be accessed on "None" values
Bug
Return values from functions without side effects should not be ignored
Bug
Related "if/else if" statements should not have the same condition
Bug
Identical expressions should not be used on both sides of a binary operator
Bug
All code should be reachable
Bug
Loops with at most one iteration should be refactored
Bug
Variables should not be self-assigned
Bug
All "except" blocks should be able to catch exceptions
Bug
Allowing unrestricted outbound communications is security-sensitive
Security Hotspot
Constructing arguments of system commands from user input is security-sensitive
Security Hotspot
Using unencrypted EFS file systems is security-sensitive
Security Hotspot
Using unencrypted SQS queues is security-sensitive
Security Hotspot
Using unencrypted SNS topics is security-sensitive
Security Hotspot
Using unencrypted SageMaker notebook instances is security-sensitive
Security Hotspot
Using unencrypted OpenSearch domains is security-sensitive
Security Hotspot
Using unencrypted RDS DB resources is security-sensitive
Security Hotspot
Using unencrypted EBS volumes is security-sensitive
Security Hotspot
Disabling auto-escaping in template engines is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Formatting SQL queries is security-sensitive
Security Hotspot
Union type expressions should be preferred over "typing.Union" in type hints
Code Smell
Octal escape sequences should not be used in regular expressions
Code Smell
Character classes in regular expressions should not contain only one character
Code Smell
Superfluous curly brace quantifiers should be avoided
Code Smell
Non-capturing groups without quantifier should not be used
Code Smell
Regular expressions should not contain empty groups
Code Smell
Regular expressions should not contain multiple spaces
Code Smell
Single-character alternations in regular expressions should be replaced with character classes
Code Smell
Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string
Code Smell
Assertions should not fail or succeed unconditionally
Code Smell
Values assigned to variables should match their type annotations
Code Smell
Function return types should be consistent with their type hint
Code Smell
Character classes in regular expressions should not contain the same character twice
Code Smell
Type checks shouldn't be confusing
Code Smell
Names of regular expressions named groups should be used
Code Smell
Regular expressions should not be too complicated
Code Smell
Builtins should not be shadowed by local variables
Code Smell
Implicit string and byte concatenations should not be confusing
Code Smell
Identity comparisons should not be used with cached typed
Code Smell
Expressions creating sets should not have duplicate values
Code Smell
Expressions creating dictionaries should not have duplicate keys
Code Smell
Special method "__exit__" should not re-raise the provided exception
Code Smell
Unused scope-limited definitions should be removed
Code Smell
Functions and methods should not have identical implementations
Code Smell
Unused private nested classes should be removed
Code Smell
String formatting should be used correctly
Code Smell
Conditional expressions should not be nested
Code Smell
Loops without "break" should not have "else" clauses
Code Smell
Doubled prefix operators "not" and "~" should not be used
Code Smell
Boolean expressions should not be gratuitous
Code Smell
The "print" statement should not be used
Code Smell
"<>" should not be used to test inequality
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
Unused assignments should be removed
Code Smell
A field should not duplicate the name of its containing class
Code Smell
A reason should be provided when skipping a test
Code Smell
Function names should comply with a naming convention
Code Smell
Functions and lambdas should not reference variables defined in enclosing loops
Code Smell
Sections of code should not be commented out
Code Smell
Unused function parameters should be removed
Code Smell
Unused class-private methods should be removed
Code Smell
Track uses of "FIXME" tags
Code Smell
"Exception" and "BaseException" should not be raised
Code Smell
Redundant pairs of parentheses should be removed
Code Smell
Nested blocks of code should not be left empty
Code Smell
Functions, methods and lambdas should not have too many parameters
Code Smell
Collapsible "if" statements should be merged
Code Smell
Administration services access should be restricted to specific IP addresses
Vulnerability
Logging should not be vulnerable to injection attacks
Vulnerability
Repeated patterns in regular expressions should not match the empty string
Bug
Function parameters initial values should not be ignored
Bug
Disabling versioning of S3 buckets is security-sensitive
Security Hotspot
Disabling server-side encryption of S3 buckets is security-sensitive
Security Hotspot
Having a permissive Cross-Origin Resource Sharing policy is security-sensitive
Security Hotspot
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Allowing both safe and unsafe HTTP methods is security-sensitive
Security Hotspot
Creating cookies without the "HttpOnly" flag is security-sensitive
Security Hotspot
Creating cookies without the "secure" flag is security-sensitive
Security Hotspot
Using hardcoded IP addresses is security-sensitive
Security Hotspot
Regular expression quantifiers and character classes should be used concisely
Code Smell
Character classes should be preferred over reluctant quantifiers in regular expressions
Code Smell
A subclass should not be in the same "except" statement as a parent class
Code Smell
Walrus operator should not make code confusing
Code Smell
Jump statements should not be redundant
Code Smell
"pass" should not be used needlessly
Code Smell
"except" clauses should do more than raise the same issue
Code Smell
Boolean checks should not be inverted
Code Smell
Unused local variables should be removed
Code Smell
Local variable and function parameter names should comply with a naming convention
Code Smell
Field names should comply with a naming convention
Code Smell
Class names should comply with a naming convention
Code Smell
Method names should comply with a naming convention
Code Smell
Track uses of "TODO" tags
Code Smell
HTML autoescape mechanism should not be globally disabled
Vulnerability
Variables, classes and functions should be either defined or imported
Bug
"__exit__" should accept type, value, and traceback arguments
Bug
"return" and "yield" should not be used in the same function
Bug
Track lack of copyright and license headers
Code Smell
HTTP response headers should not be vulnerable to injection attacks
Vulnerability
Assertions should not be made at the end of blocks expecting an exception
Bug
Regular expressions should be syntactically valid
Bug
Sending emails is security-sensitive
Security Hotspot
Reading the Standard Input is security-sensitive
Security Hotspot
Using command line arguments is security-sensitive
Security Hotspot
Encrypting data is security-sensitive
Security Hotspot
Using regular expressions is security-sensitive
Security Hotspot
Dynamically executing code is security-sensitive
Security Hotspot
Cyclomatic Complexity of functions should not be too high
Code Smell
Control flow statements "if", "for", "while", "try" and "with" should not be nested too deeply
Code Smell
Cyclomatic Complexity of classes should not be too high
Code Smell
"\" should only be used as an escape character outside of raw strings
Bug
Using shell interpreter when executing OS commands is security-sensitive
Security Hotspot
Type hints of generic types should specify their type parameters
Code Smell
Any should not be used as a type hint
Code Smell
Function parameters should have type hints
Code Smell
Function returns should have type hints
Code Smell
Test methods should be discoverable
Code Smell
Functions should use "return" consistently
Code Smell
Python parser failure
Code Smell
Files should not be too complex
Code Smell
Docstrings should be defined
Code Smell
Functions should not have too many lines of code
Code Smell
Track uses of "NOSONAR" comments
Code Smell
Track comments matching a regular expression
Code Smell
Statements should be on separate lines
Code Smell
Functions should not contain too many return statements
Code Smell
Files should not have too many lines of code
Code Smell
Lines should not be too long
Code Smell
Built-in generic types should be preferred over the typing module in type hints
Code Smell
Tests should be skipped explicitly
Code Smell
The most specific "unittest" assertion should be used
Code Smell
Methods and properties that don't access instance data should be static
Code Smell
New-style classes should be used
Code Smell
Parentheses should not be used after certain keywords
Code Smell
Track "TODO" and "FIXME" comments that do not contain a reference to a person
Code Smell
Module names should comply with a naming convention
Code Smell
Comments should not be located at the end of lines of code
Code Smell
Lines should not end with trailing whitespaces
Code Smell
Files should contain an empty newline at the end
Code Smell
Long suffix "L" should be upper case
Code Smell

"\" should only be used as an escape character outside of raw strings

Bug

MajorSonarSource default severity
click to learn more

Typically, backslashes are seen only as part of escape sequences. Therefore, the use of a backslash outside of a raw string or escape sequence looks suspiciously like a broken escape sequence.

Characters recognized as escape-able are: abfnrtvox\'"

Noncompliant Code Example

s = "Hello \world."
t = "Nice to \ meet you"
u = "Let's have \ lunch"

Compliant Solution

s = "Hello world."
t = "Nice to \\ meet you"
u = r"Let's have \ lunch"  // raw string

Deprecated

This rule is deprecated, and will eventually be removed.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Developer
Edition

© 2008-2023 SonarSource S.A., Switzerland. All content is copyright protected. SONAR, SONARSOURCE, SONARLINT, SONARQUBE, and SONARCLOUD are trademarks of SonarSource S.A. All other trademarks and copyrights are the property of their respective owners. All rights are expressly reserved.
Privacy Policy

In-IDE

SaaS

Self-Hosted