Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarQube for IDE
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarQube Cloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube Server

Secrets
ABAP
Ansible
Apex
AzureResourceManager
C
C#
C++
CloudFormation
COBOL
CSS
Dart
Docker
Flex
Go
HTML
Java
JavaScript
JCL
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Rust
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

VB.NET static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your VB.NET code

Tags

Impact

Clean code attribute

Parameter names should match base declaration
Code Smell
"GoTo" statements should not be used
Code Smell
Locks should be released within the same method
Bug
A write lock should not be released when a read lock has been acquired and vice versa
Bug
First/Single should be used instead of FirstOrDefault/SingleOrDefault on collections that are known to be non-empty
Code Smell
ASP.NET controller actions should not have a route template starting with "/"
Code Smell
Backslash should be avoided in route templates
Bug
"Contains" should be used instead of "Any" for simple equality checks
Code Smell
"First" and "Last" properties of "LinkedList" should be used instead of the "First()" and "Last()" extension methods
Code Smell
The lambda parameter should be used instead of capturing arguments in "ConcurrentDictionary" methods
Code Smell
"StartsWith" and "EndsWith" overloads that take a "char" should be used instead of the ones that take a "string"
Code Smell
"Min/Max" properties of "Set" types should be used instead of the "Enumerable" extension methods
Code Smell
Prefer indexing instead of "Enumerable" methods on types implementing "IList"
Code Smell
The collection should be filtered before sorting by using "Where" before "OrderBy"
Code Smell
Collection-specific "Exists" method should be used instead of the "Any" extension
Code Smell
The collection-specific "TrueForAll" method should be used instead of the "All" extension
Code Smell
"Find" method should be used instead of the "FirstOrDefault" extension
Code Smell
Use the "UnixEpoch" field instead of creating "DateTime" instances that point to the beginning of the Unix epoch
Code Smell
Don't hardcode the format when turning dates and times to strings
Code Smell
Use a format provider when parsing date and time
Code Smell
Use "TimeZoneInfo.FindSystemTimeZoneById" without converting the timezones with "TimezoneConverter"
Code Smell
Use "DateTimeOffset" instead of "DateTime"
Code Smell
Use UTC when recording DateTime instants
Code Smell
Always set the "DateTimeKind" when creating new "DateTime" instances
Code Smell
Avoid using "DateTime.Now" for benchmarking or timing operations
Code Smell
"ExcludeFromCodeCoverage" attributes should include a justification
Code Smell
Not specifying a timeout for regular expressions is security-sensitive
Security Hotspot
Use a testable date/time provider
Code Smell
"Option Explicit" should be enabled
Code Smell
"Option Strict" should be enabled
Code Smell
"Return" statements should be used instead of assigning values to function names
Code Smell
Regular expressions should be syntactically valid
Bug
Types allowed to be deserialized should be restricted
Vulnerability
Disabling ASP.NET "Request Validation" feature is security-sensitive
Security Hotspot
Allowing requests with excessive content length is security-sensitive
Security Hotspot
JWT should be signed and verified with strong cipher algorithms
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Insecure temporary file creation methods should not be used
Vulnerability
Using publicly writable directories is security-sensitive
Security Hotspot
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Server certificates should be verified during SSL/TLS connections
Vulnerability
Configuring loggers is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Comments should not be empty
Code Smell
Non-async "Task/Task<T>" methods should not return null
Bug
Calls to delegate's method "BeginInvoke" should be paired with calls to "EndInvoke"
Bug
"new Guid()" should not be used
Code Smell
"DebuggerDisplayAttribute" strings should reference existing members
Code Smell
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
"PartCreationPolicyAttribute" should be used with "ExportAttribute"
Bug
Weak SSL/TLS protocols should not be used
Vulnerability
"Shared" parts should not be created with "new"
Bug
Property procedures should access the expected fields
Bug
"ConstructorArgument" parameters should exist in constructors
Bug
Extension methods should not extend "Object"
Code Smell
Windows Forms entry points should be marked with STAThread
Bug
Null checks should not be combined with "TypeOf Is" operator checks
Code Smell
Classes should implement their "ExportAttribute" interfaces
Bug
Empty collections should not be accessed or iterated
Bug
Methods should not have identical implementations
Code Smell
Map values should not be replaced unconditionally
Bug
Method overloads should be grouped together
Code Smell
Non-abstract attributes should be sealed
Code Smell
Searching OS commands in PATH is security-sensitive
Security Hotspot
Child class fields should not differ from parent class fields only by capitalization
Code Smell
Threads should not lock on objects with weak identity
Code Smell
Assemblies should explicitly specify COM visibility
Code Smell
Assemblies should be marked as CLS compliant
Code Smell
Collection sizes and array length comparisons should make sense
Bug
Objects should not be disposed more than once
Code Smell
Calculations should not overflow
Bug
Serialization event handlers should be implemented correctly
Bug
Deserialization methods should be provided for "OptionalField" members
Bug
All branches in a conditional structure should not have exactly the same implementation
Bug
Assemblies should have version information
Code Smell
Types should be defined in named namespaces
Bug
Arguments of public methods should be validated against Nothing
Code Smell
Value types should implement "IEquatable<T>"
Code Smell
"Thread.Resume" and "Thread.Suspend" should not be used
Bug
"CoSetProxyBlanket" and "CoInitializeSecurity" should not be used
Vulnerability
Arrays should not be created for ParamArray parameters
Code Smell
Exception types should be "Public"
Code Smell
"SafeHandle.DangerousGetHandle" should not be called
Bug
"IIf" should not be used
Code Smell
"ByVal" should not be used
Code Smell
Cognitive Complexity of methods should not be too high
Code Smell
Empty nullable value should not be accessed
Bug
Methods with "Pure" attribute should return a value
Bug
One-way "OperationContract" methods should have "void" return type
Bug
Optional parameters should be passed to "base" calls
Bug
Type inheritance should not be recursive
Bug
Classes should not have only "private" constructors
Bug
Right operands of shift operators should be integers
Bug
"[ExpectedException]" should not be used
Code Smell
"Exit" statements should not be used
Code Smell
Date and time should not be used as a type for primary keys
Bug
If operators should not be nested
Code Smell
Cipher Block Chaining IVs should be unpredictable
Vulnerability
"StringBuilder" data should be used
Code Smell
Reflection should not be used to increase accessibility of classes, methods, or fields
Code Smell
"Exit Select" statements should not be used redundantly
Code Smell
"Thread.Sleep" should not be used in tests
Code Smell
'Not' boolean operator should not be repeated
Bug
Non-existent operators like "=+" should not be used
Bug
"catch" clauses should do more than rethrow
Code Smell
"IndexOf" checks should not be for positive numbers
Code Smell
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Boolean expressions should not be gratuitous
Code Smell
Conditionally executed code should be reachable
Bug
Shared resources should not be used for locking
Bug
Unnecessary bit operations should not be performed
Code Smell
Arrays should be initialized using the "... = {}" syntax
Code Smell
Child class fields should not shadow parent class fields
Code Smell
Write-only properties should not be used
Code Smell
"With" statements should be used for a series of calls to the same object
Code Smell
Signed types should be preferred to unsigned ones
Code Smell
Generic type parameter names should comply with a naming convention
Code Smell
Exceptions should not be thrown from property getters
Code Smell
Non-private "Shared ReadOnly" fields should comply with a naming convention
Code Smell
Non-private fields should comply with a naming convention
Code Smell
Public methods should not have multidimensional array parameters
Code Smell
Non-private constants should comply with a naming convention
Code Smell
Properties should comply with a naming convention
Code Smell
Properties should not make collection or array copies
Code Smell
"Private" fields should comply with a naming convention
Code Smell
"Private Shared ReadOnly" fields should comply with a naming convention
Code Smell
Private constants should comply with a naming convention
Code Smell
Optional parameters should not be used
Code Smell
"On Error" statements should not be used
Code Smell
"IsNot" should be used instead of "Not ... Is ..."
Code Smell
Fields should be private
Code Smell
Array literals should be used instead of array creation expressions
Code Smell
Line continuations should not be used
Code Smell
Indexed properties with more than one parameter should not be used
Code Smell
Event names should not have "Before" or "After" as a prefix or suffix
Code Smell
Events should comply with a naming convention
Code Smell
Event handlers should comply with a naming convention
Code Smell
Flags enumerations zero-value members should be named "None"
Code Smell
Flags enumerations should explicitly initialize all their members
Bug
Enumeration type names should not have "Flags" or "Enum" suffixes
Code Smell
Enumeration values should comply with a naming convention
Code Smell
Enumeration types should comply with a naming convention
Code Smell
"Do" loops should not be used without a "While" or "Until" condition
Code Smell
Public constant members should not be used
Code Smell
Namespace names should comply with a naming convention
Code Smell
"NameOf" should be used
Code Smell
Null pointers should not be dereferenced
Bug
Using non-standard cryptographic algorithms is security-sensitive
Security Hotspot
Arguments should be passed in the same order as the procedure parameters
Code Smell
"ToString()" method should not return Nothing
Bug
Locks should be released on all paths
Bug
Short-circuit logic should be used in boolean contexts
Code Smell
Classes named like "Exception" should extend "Exception" or a subclass
Code Smell
Classes should not be empty
Code Smell
Formatting SQL queries is security-sensitive
Security Hotspot
Hard-coded credentials are security-sensitive
Security Hotspot
Password hashing functions should use an unpredictable salt
Vulnerability
Invalid casts should be avoided
Code Smell
Boolean checks should not be inverted
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
Related "If/ElseIf" statements should not have the same condition
Bug
"Select Case" statements should not be nested
Code Smell
Identical expressions should not be used on both sides of a binary operator
Bug
Loops with at most one iteration should be refactored
Bug
Multiple variables should not be declared on the same line
Code Smell
Variables should not be self-assigned
Bug
Method parameters should follow a naming convention
Code Smell
The "&" operator should be used to concatenate strings
Code Smell
Strings should not be concatenated using "+" or "&" in a loop
Code Smell
Functions and procedures should comply with a naming convention
Code Smell
Functions, procedures and properties should not be too complex
Code Smell
Unused local variables should be removed
Code Smell
"Select Case" statement with many "Case" clauses should have only one statement
Code Smell
Track lack of copyright and license headers
Code Smell
Comments should not be located at the end of lines of code
Code Smell
Procedures should not have too many lines of code
Code Smell
Control flow statements "If", "For", "For Each", "Do", "While", "Select" and "Try" should not be nested too deeply
Code Smell
Using hardcoded IP addresses is security-sensitive
Security Hotspot
"Select" statements should end with a "Case Else" clause
Code Smell
"Select" statements should have at least 3 "Case" clauses
Code Smell
"If ... ElseIf" constructs should end with "Else" clauses
Code Smell
Method parameters and caught exceptions should not be reassigned
Bug
Statements should be on separate lines
Code Smell
Array designators "()" should be on the type, not the variable
Code Smell
String literals should not be duplicated
Code Smell
Generic type parameter names should comply with a naming convention
Code Smell
Methods should not be empty
Code Smell
Unused procedure parameters should be removed
Code Smell
Local variable names should comply with a naming convention
Code Smell
Exceptions should not be thrown in finally blocks
Code Smell
"Any()" should be used to test for emptiness
Code Smell
"Select...Case" clauses should not have too many lines of code
Code Smell
"End" statements should not be used
Code Smell
Interface names should comply with a naming convention
Code Smell
Track uses of "TODO" tags
Code Smell
Track uses of "FIXME" tags
Code Smell
Deprecated code should be removed
Code Smell
Boolean literals should not be redundant
Code Smell
"Obsolete" attributes should include explanations
Code Smell
General or reserved exceptions should never be thrown
Code Smell
Redundant pairs of parentheses should be removed
Code Smell
Nested blocks of code should not be left empty
Code Smell
URIs should not be hardcoded
Code Smell
Procedures should not have too many parameters
Code Smell
Expressions should not be too complex
Code Smell
Mergeable "if" statements should be combined
Code Smell
Tabulation characters should not be used
Code Smell
Finalize method should not throw exceptions
Bug
Files should not have too many lines of code
Code Smell
Lines should not be too long
Code Smell
Class names should comply with a naming convention
Code Smell

"IndexOf" checks should not be for positive numbers

intentionality - complete

maintainability

Code Smell

suspicious

Why is this an issue?

How can I fix it?

More Info

Most checks against an IndexOf value compare it with -1 because 0 is a valid index.

strings.IndexOf(someString) = -1  ' Test for "index not found"
strings.IndexOf(someString) < 0   ' Test for "index not found"
strings.IndexOf(someString) >= 0  ' Test for "index found"

Any checks which look for values > 0 ignore the first element, which is likely a bug. If the intent is merely to check the inclusion of a value in a String, List, or array, consider using the Contains method instead.

strings.Contains(someString) ' Boolean result

This rule raises an issue when the output value of any of the following methods is tested against > 0:

IndexOf, applied to String, list or array
IndexOfAny, applied to a String
LastIndexOf, applied to a String, list or array
LastIndexOfAny, applied to a String

someArray.IndexOf(someItem) > 0        ' Noncompliant: index 0 missing
someString.IndexOfAny(charsArray) > 0  ' Noncompliant: index 0 missing
someList.LastIndexOf(someItem) > 0     ' Noncompliant: index 0 missing
someString.LastIndexOf(charsArray) > 0 ' Noncompliant: index 0 missing

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Analyze code in your
on-premise CI

Available Since
9.1

Analyze code in your
on-premise CI

Developer Edition
Available Since
9.1

© 2008-2025 SonarSource SA. All rights reserved. SONAR, SONARSOURCE, SONARQUBE, and CLEAN AS YOU CODE are trademarks of SonarSource SA.

Sonar helps developers write Clean Code.
Privacy Policy | Cookie Policy | Terms of Use

In-IDE

SaaS

Self-Hosted