Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
Go
HTML
Java
JavaScript
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

Python static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your PYTHON code

Filtered: 87 rules found

cwe

Impact

Clean code attribute

JWT secret keys should not be disclosed
Vulnerability
Flask secret keys should not be disclosed
Vulnerability
Credentials should not be hard-coded
Vulnerability
Server-side templates should not be vulnerable to injection attacks
Vulnerability
Dynamic code execution should not be vulnerable to injection attacks
Vulnerability
NoSQL operations should not be vulnerable to injection attacks
Vulnerability
HTTP request redirections should not be open to forging attacks
Vulnerability
Deserialization should not be vulnerable to injection attacks
Vulnerability
Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks
Vulnerability
Database queries should not be vulnerable to injection attacks
Vulnerability
XML parsers should not be vulnerable to XXE attacks
Vulnerability
A secure password should be used when connecting to a database
Vulnerability
XPath expressions should not be vulnerable to injection attacks
Vulnerability
I/O function calls should not be vulnerable to path injection attacks
Vulnerability
LDAP queries should not be vulnerable to injection attacks
Vulnerability
OS commands should not be vulnerable to command injection attacks
Vulnerability
The number and name of arguments passed to a function should match its parameters
Bug
Hard-coded secrets are security-sensitive
Security Hotspot
Creating public APIs is security-sensitive
Security Hotspot
Allowing public network access to cloud resources is security-sensitive
Security Hotspot
Policies granting access to all resources of an account are security-sensitive
Security Hotspot
Policies granting all privileges are security-sensitive
Security Hotspot
Policies authorizing public access to resources are security-sensitive
Security Hotspot
Granting access to S3 buckets to all or authenticated users is security-sensitive
Security Hotspot
Hard-coded passwords are security-sensitive
Security Hotspot
AWS IAM policies should limit the scope of permissions given
Vulnerability
JWT should be signed and verified
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Insecure temporary file creation methods should not be used
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
LDAP connections should be authenticated
Vulnerability
Cryptographic key generation should be based on strong parameters
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Cipher Block Chaining IVs should be unpredictable
Vulnerability
Regular expressions should not be vulnerable to Denial of Service attacks
Vulnerability
Password hashing functions should use an unpredictable salt
Vulnerability
Zero should not be a possible denominator
Bug
Break, continue and return statements should not occur in "finally" blocks
Bug
Allowing public ACLs or policies on a S3 bucket is security-sensitive
Security Hotspot
Using slow regular expressions is security-sensitive
Security Hotspot
Using publicly writable directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Signaling processes is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Disabling CSRF protections is security-sensitive
Security Hotspot
Using non-standard cryptographic algorithms is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Unread "private" attributes should be removed
Code Smell
Server-side requests should not be vulnerable to traversing attacks
Vulnerability
GraphQL introspection should be disabled in production
Vulnerability
Loop boundaries should not be vulnerable to injection attacks
Vulnerability
Memory allocations should not be vulnerable to Denial of Service attacks
Vulnerability
Applications should not create session cookies from untrusted input
Vulnerability
Server-side requests should not be vulnerable to forging attacks
Vulnerability
Non-empty statements should change control flow or have at least one side-effect
Bug
Conditionally executed code should be reachable
Bug
Attributes should not be accessed on "None" values
Bug
All code should be reachable
Bug
Allowing unrestricted outbound communications is security-sensitive
Security Hotspot
Constructing arguments of system commands from user input is security-sensitive
Security Hotspot
Using unencrypted EFS file systems is security-sensitive
Security Hotspot
Using unencrypted SQS queues is security-sensitive
Security Hotspot
Using unencrypted SNS topics is security-sensitive
Security Hotspot
Using unencrypted SageMaker notebook instances is security-sensitive
Security Hotspot
Using unencrypted OpenSearch domains is security-sensitive
Security Hotspot
Using unencrypted RDS DB resources is security-sensitive
Security Hotspot
Using unencrypted EBS volumes is security-sensitive
Security Hotspot
Disabling auto-escaping in template engines is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Formatting SQL queries is security-sensitive
Security Hotspot
Boolean expressions should not be gratuitous
Code Smell
Unused assignments should be removed
Code Smell
Track uses of "FIXME" tags
Code Smell
"Exception" and "BaseException" should not be raised
Code Smell
Administration services access should be restricted to specific IP addresses
Vulnerability
Logging should not be vulnerable to injection attacks
Vulnerability
Having a permissive Cross-Origin Resource Sharing policy is security-sensitive
Security Hotspot
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Allowing both safe and unsafe HTTP methods is security-sensitive
Security Hotspot
Creating cookies without the "HttpOnly" flag is security-sensitive
Security Hotspot
Creating cookies without the "secure" flag is security-sensitive
Security Hotspot
Track uses of "TODO" tags
Code Smell
Dynamically executing code is security-sensitive
Security Hotspot
Using shell interpreter when executing OS commands is security-sensitive
Security Hotspot

Zero should not be a possible denominator

intentionality - logical

reliability

Bug

CriticalSonarSource default severity
click to learn more

cwe
denial-of-service

If the denominator to a division or modulo operation is zero, a ZeroDivisionError is raised.

This error will crash your program in most cases. To fix it, you need to ensure that the denominator value in all division operations is always non-zero, or check the value against zero before performing the division.

Why is this an issue?

How can I fix it?

More Info

A division (/) or modulo operation (%) by zero indicates a bug or logical error. This is because in Python, a division or modulo operation where the denominator is zero always results in a ZeroDivisionError being raised.

What is the potential impact?

Issues of this type interrupt the normal execution of a program, causing it to crash or putting it into an inconsistent state. Therefore, this issue might impact the availability and reliability of your application, or even result in data loss.

If the computation of the denominator is tied to user input data, this issue can potentially even be exploited by attackers to disrupt your application.

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

© 2008-2024 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.

Sonar helps developers write Clean Code.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted