Code Issues

When a system is expected to behave in a certain way and it fails to meet the result, the issue occurs. Similarly, any defect or bug found in the code leads to code issues. BrowserStack Code Quality helps to identify the code issues in your software and provide the solutions for the same. 
There are different languages in which these code checks are written.

The software vulnerability is basically an error or a weakness present in the software code. Those are product-related threats that can hamper your data and gain access to your products and data.

Once, a vulnerability is detected in a code, there is a high risk from a security perspective. External attackers can exploit and trigger the information systems. This may affect the performance of your product.

Vulnerabilities can be caused due to many reasons like design implementation, input validation errors, code injection, complexity in building large systems, and so on.

The most effective way to prevent these vulnerabilities is by enforcing standard security practices. Check here to know more about security standards supported by BrowserStack Code Quality.

Supported languages

Java: Vulnerabilities in Java can be found and BrowserStack Code Quality can help in detecting those.

To get more details about the vulnerability count, refer to this table.

Code checker configuration helps you to enable or disable code checkers and their corresponding rules for any repository.

Steps to navigate to code checker configuration

1. Select the Code checkers configuration option from the repository context menu of the desired repository.
2. On the Code checkers configuration page, on the left side navigation pane, by default, code issues are enabled except few.
3. Check or uncheck the radio button to enable or disable a specific rule. If you want the checkers to be disabled, you can disable the code checkers (for example GammaCXX or cppcheck).
4. For a specific selected checker, rules will be displayed.
5. Move the cursor on the desired rule to view the More info button. More info will display a detailed description and examples.
6. Users can search rules manually by typing in the search text box.
7. On the right side navigation pane, the Filter Rules section can be used to filter the displayed rules based on Criticality or by associated KPI.
8. To download the file, click Download JSON at the bottom right corner of the code configuration page. This file provides a customized configuration in JSON format and you can change it manually.
9. To upload the changed file, click Upload JSON Configuration at the top of the code configuration page.

Code issues are one of the important assets of BrowserStack Code Quality analysis. Issue suppression is a feature that lists the suppressed code issues within a file/project. Suppression means basically ignoring some parts or a whole parts of the code.

In a few cases, code analysis gives false-positive. Issue suppression is a feature that allows users to suppress these false-positive issue occurrences. This is important because disabling the issue type entirely will not be correct in many cases. If one issue is suppressed, it will be taken off from the code issues panel and will be moved to separate suppressed issues panel.

Steps for suppressing an issue:

1. Go to the Component Explorer present at the top navigation bar next to the duplication tab.
2. Click on the icon on the left side for the issue to be suppressed.
3. Click on “Suppress this occurrence” icon.
4. Add comment i.e. the reason for suppression.
5. Click on the Submit button.

Steps for unsuppressing an issue :

1. Go to the Component Explorer present at the top navigation bar next to the duplication tab.
2. From the Suppressed Issues tab, click on the unsuppress icon.

Suppression Review Workflow

This feature is only available for enterprise customers.

1. Select three dots on repository’s page and click on enable suppression approval work flow.

2. When a developer suppresses an issue,  project manager, project admins and super admins will see the list of suppressed issues on newly introduced Suppression Status page.

3. Project manager, project admins and super admins can review – Accept or Reject suppressions.

Suppression history

The suppression history feature allows users to view a comprehensive log of suppression actions taken on certain issues. This log includes details such as the name of the user who initiated the action, the reason for the suppression, the status of the suppression (whether it was pending, approved or rejected), any accompanying reasons for approval or rejection, and the date on which the action occurred. This feature provides transparency and accountability regarding the management of suppression issues within the system.

See screenshot below for reference

The generic module is used to import code issues from a file. Regardless of language or combination of languages, if you get your code issues data into the generic format as specified by this module, it will be imported and correctly applied.

Module Name:

gamma_generic

The supported format looks like:

File	Severity	Line	Description	Rule	Tag
src/main/java/com/mariten/kanatools/KanaConverter.java	Low	26	This issue is having low criticality.	Custom Rule	{"CWE":"146"};{"MISRA":"444"};{"CWE":"123"}
src/main/java/com/mariten/kanatools/KanaConverter.java	High	33	This issue is having High criticality.	Rule-01	Tag1
src/main/java/com/mariten/kanatools/KanaConverter.java	low	45	This issue is having low criticality.	custom Rule 3	{"CWE":"231"};{"CWE":"867"}
src/main/java/com/mariten/kanatools/KanaConverter.java	Medium	25	This issue is having medium criticality.	custom Rule-04	{"CWE":"453"}
src/main/java/com/mariten/kanatools/KanaConverter.java	Medium	39	This issue is having medium criticality.	custom Rule 5	NewTag;TagTest1
src/main/java/com/mariten/kanatools/KanaConverter.java	Critical	43	Critical	custome Rule 8	NewTag;TagTest1;Tag_123

Supported severity types :
Critical, High, Medium, Low and Info

Supported input tag formats :

only tag name=   tag1

multiple tag with only name = tag2;tag3

name and value =   “{“CWE”:”330″}”

multiple tag with name and value=  “{“CWE”:”330″};{“CWE”:”200″}”

Usage

There are two ways to run gamma-generic module:

Step 1: Through API

1. By specifying the path of the CSV file where it is located:
   To specify a path, use the following API:
   POST - api/v1/repositories/{repositoryUid}/config/{moduleType}/{moduleName}
   Refer to this link to get additional information.
2. By uploading a zip file: Here, the CSV file is zipped and send to API.
   To upload zip use following API:
   POST - api/v1/repositories/{repositoryUid}/upload/{moduleName}
   Refer to this link to get additional information.
3. Commit CSV files in the source code and then give the relative file path

Step 2: Run scan to get the generic code issues on UI.

1. Any CSV file name will work

2. By Providing CSV PATH relative to base directory

3. In a remote scan, multiple CSV files can be given with comma-separated paths

The section below briefs you about the bugs, vulnerabilities, and code issues in C/C++.

---

Embold comes with a state-of-the-art proprietary analyser. In addition to integrating and building upon great work from the open source space, we have created our own checks and rules to discover code issues that were not sufficiently covered by other tools.

---

Rule	Description	Example	KPI
core.DivideZero	Check for division by zero	void test(int z) { if (z == 0) int x = 1 / z; // warn }	Robustness
core.NonNullParamChecker	Check for null pointers passed as arguments to a function whose arguments are references or marked with the ‘nonnull’ attribute	int f(int *p) __attribute__((nonnull)); void test(int *p) { if (!p) f(p); // warn }	Robustness
core.NullDereference	Check for dereferences of null pointers	void test(int *p) { if (p) return; int x = p[0]; // warn }	Robustness
core.StackAddressEscape	Check that addresses to stack memory do not escape the function	char const *p; void test() { char const str[] = “string”; p = str; // warn }	Robustness
core.uninitialized.ArraySubscript	Check for uninitialized values used as array subscripts	void test() { int i, a[10]; int x = a[i]; // warn: array subscript is undefined }	Robustness
cplusplus.NewDelete	Check for double-free and use-after-free problems. Traces memory managed by new/delete.	void f(int *p); void testUseMiddleArgAfterDelete(int *p) { delete p; f(p); // warn: use after free }	Robustness
cplusplus.NewDeleteLeaks	Check for memory leaks. Traces memory managed by new/delete.	void test() { int *p = new int; } // warn	Resource Utilization
cplusplus.SelfAssignment	Checks C++ copy and move assignment operators for self assignment		Resource Utilization
optin.cplusplus.VirtualCall	Check virtual function calls during construction or destruction		Robustness
osx.coreFoundation.CFRetainRelease	Check for null arguments to CFRetain/CFRelease/CFMakeCollectable	void test(CFTypeRef p) { if (!p) CFRetain(p); // warn }	Robustness
osx.coreFoundation.containers.OutOfBounds	Checks for index out-of-bounds when using ‘CFArray’ API	void test() { CFArrayRef A = CFArrayCreate(0, 0, 0, &kCFTypeArrayCallBacks); CFArrayGetValueAtIndex(A, 0); // warn }	Robustness
osx.coreFoundation.containers.PointerSizedValues	Warns if ‘CFArray’, ‘CFDictionary’, ‘CFSet’ are created with non-pointer-size values	void test() { int x[] = { 1 }; CFArrayRef A = CFArrayCreate(0, (const void **)x, 1, &kCFTypeArrayCallBacks); // warn }	Robustness
osx.NumberObjectConversion	Check for erroneous conversions of objects representing numbers into numbers	NSNumber *photoCount = [albumDescriptor objectForKey:@”PhotoCount”]; // Warning: Comparing a pointer value of type ‘NSNumber *’ // to a scalar integer value if (photoCount > 0) { [self displayPhotos]; }	Robustness
security.FloatLoopCounter	Warn on using a floating point value as a loop counter (CERT: FLP30-C, FLP30-CPP)	void test() { for (float x = 0.1f; x <= 1.0f; x += 0.1f) {} // warn }	Robustness
security.insecureAPI.UncheckedReturn	Warn on uses of functions whose return values must be always checked	void test() { setuid(1); // warn }	Maintainability
unix.Malloc	Check for memory leaks, double free, and use-after-free problems. Traces memory managed by malloc()/free().	void test() { int *p = malloc(1); free(p); free(p); // warn: attempt to free released memory }	Robustness
unix.MismatchedDeallocator	Check for mismatched deallocators.	// C, C++ void test() { int *p = (int *)malloc(sizeof(int)); delete p; // warn }	Robustness
alpha.valist.Uninitialized	Experimental: Check for usages of uninitialized (or already released) va_lists.		Robustness
alpha.valist.Unterminated	Experimental: Check for va_lists which are not released by a va_end call.		Robustness

---

Rule	Description	Example	KPI
alpha.clone.CloneChecker	Experimental: Reports similar pieces of code.	void log(); int max(int a, int b) { // warn log(); if (a > b) return a; return b; } int maxClone(int x, int y) { // similar code here log(); if (x > y) return x; return y; }	Maintainability
alpha.core.CallAndMessageUnInitRefArg	Experimental: Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers, and pointer to undefined variables)	void test(void) { int t; int &p = t; int &s = p; int &q = s; foo(q); // warn }	Accuracy
alpha.core.CastSize	Experimental: Check when casting a malloc’ed type T, whether the size is a multiple of the size of T	void test() { int *x = (int *)malloc(11); // warn }	Accuracy
alpha.core.CastToStruct	Experimental: Check for cast from non-struct pointer to struct pointer	struct s {}; void test(int *p) { struct s *ps = (struct s *) p; // warn }	Accuracy
alpha.core.Conversion	Experimental: Loss of sign/precision in implicit conversions	void test(unsigned U, signed S) { if (S > 10) { if (U < S) { } } if (S < -10) { if (U < S) { // warn (loss of sign) } } }	Accuracy
alpha.core.FixedAddr	Experimental: Check for assignment of a fixed address to a pointer	void test() { int *p; p = (int *) 0x10000; // warn }	Maintainability
alpha.core.IdenticalExpr	Experimental: Warn about unintended use of identical expressions in operators	// C void test() { int a = 5; int b = a | 4 | a; // warn: identical expr on both sides }	Accuracy
alpha.core.PointerArithm	Experimental: Check for pointer arithmetic on locations other than array elements	void test() { int x; int *p; p = &x + 1; // warn }	Maintainability
alpha.core.PointerSub	Experimental: Check for pointer subtractions on two pointers pointing to different memory chunks	void test() { int x, y; int d = &y – &x; // warn }	Accuracy
alpha.core.SizeofPtr	Experimental: Warn about unintended use of sizeof() on pointer expressions	struct s {}; int test(struct s *p) { return sizeof(p); // warn: sizeof(ptr) can produce an unexpected result }	Accuracy
alpha.core.TestAfterDivZero	Experimental: Check for division by variable that is later compared against 0. Either the comparison is useless or there is division by zero.	void test(int x) { var = 77 / x; if (x == 0) { } // warn }	Robustness
alpha.cplusplus.IteratorPastEnd	Experimental: Check iterators used past end	class A { public: A() { f(); // warn } virtual void f(); }	Robustness
alpha.deadcode.UnreachableCode	Experimental: Check unreachable code	int test() { int x = 1; while(x); return x; // warn }	Maintainability
alpha.security.ArrayBound	Experimental: Warn about buffer overflows (older checker)	void test() { char *s = “”; char c = s[1]; // warn }	Robustness
alpha.security.ArrayBoundV2	Experimental: Warn about buffer overflows	void test() { int buf[100]; int *p = buf; p = p + 99; p[1] = 1; // warn }	Robustness
alpha.security.MallocOverflow	Experimental: Check for overflows in the arguments to malloc()	void test(int n) { void *p = malloc(n * sizeof(int)); // warn }	Robustness
alpha.security.ReturnPtrRange	Experimental: Check for an out-of-bound pointer being returned to callers	static int A[10]; int *test() { int *p = A + 10; return p; // warn }	Robustness
alpha.security.taint.TaintPropagation	Experimental: Generate taint information used by other checkers	void test() { char x = getchar(); // ‘x’ marked as tainted system(&x); // warn: untrusted data is passed to a system call }	Robustness
alpha.unix.BlockInCriticalSection	Experimental: Check for calls to blocking functions inside a critical section		Robustness
alpha.unix.Chroot	Experimental: Check improper use of chroot	void f(); void test() { chroot(“/usr/local”); f(); // warn: no call of chdir(“/”) immediately after chroot }	Robustness
alpha.unix.cstring.BufferOverlap	Experimental: Checks for overlap in two buffer arguments	void test() { int a[4] = {0}; memcpy(a + 2, a + 1, 8); // warn }	Maintainability
alpha.unix.cstring.NotNullTerminated	Experimental: Check for arguments which are not null-terminating strings	void test() { int y = strlen((char *)&test); // warn }	Accuracy
alpha.unix.cstring.OutOfBounds	Experimental: Check for out-of-bounds access in string functions	void test(char *y) { char x[4]; if (strlen(y) == 4) strncpy(x, y, 5); // warn }	Robustness
alpha.unix.PthreadLock	Experimental: Simple lock -> unlock checker	pthread_mutex_t mtx; void test() { pthread_mutex_lock(&mtx); pthread_mutex_lock(&mtx); // warn: this lock has already been acquired }	Robustness
alpha.unix.SimpleStream	Experimental: Check for misuses of stream APIs	void test() { FILE *F = fopen(“myfile.txt”, “w”); } // warn: opened file is never closed	Resource Utilization
alpha.unix.Stream	Experimental: Check stream handling functions	void test() { FILE *p = fopen(“foo”, “r”); } // warn: opened file is never closed	Resource Utilization
core.CallAndMessage	Check for logical errors for function calls and Objective-C message expressions (e.g., uninitialized arguments, null function pointers)	struct S { int x; }; void f(struct S s); void test() { struct S s; f(s); // warn: passed-by-value arg contain uninitialized data }	Accuracy
core.UndefinedBinaryOperatorResult	Check for undefined results of binary operators	void test() { int x; int y = x + 1; // warn: left operand is garbage }	Accuracy
core.uninitialized.Assign	Check for assigning uninitialized values	void test() { int x; x |= 1; // warn: left expression is unitialized }	Accuracy
core.uninitialized.Branch	Check for uninitialized values used as branch conditions	void test() { int x; if (x) // warn return; }	Accuracy
core.uninitialized.CapturedBlockVariable	Check for blocks that capture uninitialized values	void test() { int x; ^{ int y = x; }(); // warn }	Accuracy
core.uninitialized.UndefReturn	Check for uninitialized values being returned to the caller	int test() { int x; return x; // warn }	Accuracy
core.VLASize	Check for declarations of variable length arrays of undefined or zero size	void test() { int x; int vla1[x]; // warn: garbage as size }	Accuracy
osx.coreFoundation.CFError	Check usage of CFErrorRef* parameters	void test(CFErrorRef *error) { // warn: function accepting CFErrorRef* should have a // non-void return }	Understandability
osx.coreFoundation.CFNumber	Check for proper uses of CFNumber APIs	CFNumberRef test(unsigned char x) { return CFNumberCreate(0, kCFNumberSInt16Type, &x); // warn: 8 bit integer is used to initialize a 16 bit integer }	Understandability
osx.SecKeychainAPI	Check for proper uses of Secure Keychain APIs	void test() { unsigned int *ptr = 0; UInt32 length; SecKeychainItemFreeContent(ptr, &length); // warn: trying to free data which has not been allocated }	Robustness
security.insecureAPI.getpw	Warn on uses of the ‘getpw’ function	void test() { char buff[1024]; getpw(2, buff); // warn }	Maintainability
security.insecureAPI.gets	Warn on uses of the ‘gets’ function	void test() { char buff[1024]; gets(buff); // warn }	Maintainability
security.insecureAPI.mkstemp	Warn when ‘mkstemp’ is passed fewer than 6 X’s in the format string	void test() { mkstemp(“XX”); // warn }	Maintainability
security.insecureAPI.mktemp	Warn on uses of the ‘mktemp’ function	void test() { char *x = mktemp(“/tmp/zxcv”); // warn: insecure, use mkstemp }	Maintainability
security.insecureAPI.rand	Warn on uses of the ‘rand’, ‘random’, and related functions	void test() { random(); // warn }	Maintainability
security.insecureAPI.strcpy	Warn on uses of the ‘strcpy’ and ‘strcat’ functions – can lead to buffer overflow.	void test() { char x[4]; char *y = “abcd”; strcpy(x, y); // warn }	Robustness
security.insecureAPI.vfork	Warn on uses of the ‘vfork’ function	void test() { vfork(); // warn }	Maintainability
unix.API	Check calls to various UNIX/Posix functions	// Currently the check is performed for apple targets only. void test(const char *path) { int fd = open(path, O_CREAT); // warn: call to ‘open’ requires a third argument when the // ‘O_CREAT’ flag is set }	Maintainability
unix.cstring.BadSizeArg	Check the size argument passed into C string functions for common erroneous patterns	void test() { char dest[3]; strncat(dest, “***”, sizeof(dest)); // warn: potential buffer overflow }	Robustness
unix.cstring.NullArg	Check for null pointers being passed as arguments to C string functions	int test() { return strlen(0); // warn }	Robustness
unix.MallocSizeof	Check for dubious malloc arguments involving sizeof	void test() { long *p = malloc(sizeof(short)); // warn: result is converted to ‘long *’, which is // incompatible with operand type ‘short’ free(p); }	Accuracy
unix.Vfork	Check for proper usage of vfork	int test(int x) { pid_t pid = vfork(); // warn if (pid != 0) return 0; switch (x) { case 0: pid = 1; execl(“”, “”, 0); _exit(1); break; case 1: x = 0; // warn: this assignment is prohibited break; case 2: foo(); // warn: this function call is prohibited break; default: return 0; // warn: return is prohibited } while(1); }	Maintainability
Returning Local Address	Function should not return address of local variable because once function exits, all local variables are destroyed. This will affect robustness of code. The solution would be to dynamically allocate memory to a variable to hold the address and pass it to the function as a parameter	int* foo(int a,int b) { int sum = a + b; return ∑ /* Non-complaint */ } int* foo(int a, int b, int* sum) { *sum = a + b; return sum; /* Complaint */ }	Robustness

---

Rule	Description	Example	KPI
alpha.valist.CopyToSelf	Experimental: Check for va_lists which are copied onto itself.		Maintainability
apiModeling.google.GTest	Model gtest assertion APIs		Maintainability
core.builtin.BuiltinFunctions	Evaluate compiler builtin functions (e.g., alloca())		Maintainability
core.builtin.NoReturnFunctions	Evaluate “panic” functions that are known to not return to the caller		Maintainability
core.DynamicTypePropagation	Generate dynamic type information		Maintainability
deadcode.DeadStores	Check for values stored to variables that are never read afterwards	void test() { int x; x = 1; // warn }	Resource Utilization
optin.mpi.MPI-Checker	Checks MPI code	void test() { double buf = 0; MPI_Request sendReq1; MPI_Ireduce(MPI_IN_PLACE, &buf, 1, MPI_DOUBLE, MPI_SUM, 0, MPI_COMM_WORLD, &sendReq1); } // warn: request ‘sendReq1’ has no matching wait.	Maintainability
osx.API	Check for proper uses of various Apple APIs	void test() { dispatch_once_t pred = 0; dispatch_once(&pred, ^(){}); // warn: dispatch_once uses local }	Maintainability
unix.StdCLibraryFunctions	Improve modeling of the C standard library functions		Maintainability
dynamic-cast	Implementations of dynamic_cast mechanism are unsuitable for use with real-timesystems where low memory usage and determined performance are essential. Dynamic_cast can be replaced with polymorphism, i.e. virtual functions.	Compliant code: struct Base { virtual ~Base() {} }; struct Derived: Base { void name() {} }; Non-Compliant code: Base* b1 = new Base; Derived* d = dynamic_cast(b1);	Robustness
shallow copy assignment	Shallow copy assignment and default assignment operator must be avoided when dynamically allocated resources are involved.	class Shape { //default assignment operator char *ptr; //Non-Compliant }; class Node { char *str; public: Node& operator=(const Node& pOther){ (*this).str = pOther.str; //Non-Compliant return *this; } }; class Foo { char *bar; public: Foo& operator=(const Foo& pOther) { bar = nullptr; //Compliant return *this; } }; class Point { int* xPtr; int* yPtr; public: Point& operator=(const Point& pOther) { xPtr = pOther.xPtr; //Non-Compliant yPtr = new int(); //Compliant return *this; } };	Robustness
shallow copy construct	Shallow copy and default copy constructor must be avoided when dynamically allocated resources are involved.	class Shape { //default copy constructor char *ptr; //Non-Compliant }; class Node { char *str; public: Node(const Node& pOther) { (*this).str = pOther.str; //Non-Compliant } }; class Foo { char *bar; public: Foo(const Foo& pOther) { bar = nullptr; //Compliant } }; class Point { int* xPtr; int* yPtr; public: Point(const Point& pOther) { xPtr = pOther.xPtr; //Non-Compliant yPtr = new int(); //Compliant } };	Robustness

---

Rule	Description	Example	KPI
debug.AnalysisOrder	Print callbacks that are called during analysis in order		Maintainability
debug.ConfigDumper	Dump config table		Maintainability
debug.DumpBugHash	Dump the bug hash for all statements.		Maintainability
debug.DumpCallGraph	Display Call Graph		Maintainability
debug.DumpCalls	Print calls as they are traversed by the engine		Maintainability
debug.DumpCFG	Display Control-Flow Graphs		Maintainability
debug.DumpDominators	Print the dominance tree for a given CFG		Maintainability
debug.DumpLiveVars	Print results of live variable analysis		Maintainability
debug.DumpTraversal	Print branch conditions as they are traversed by the engine		Maintainability
debug.ExprInspection	Check the analyzer’s understanding of expressions		Maintainability
debug.Stats	Emit warnings with analyzer statistics		Maintainability
debug.TaintTest	Mark tainted symbols as such.		Maintainability
debug.ViewCallGraph	View Call Graph using GraphViz		Maintainability
debug.ViewCFG	View Control-Flow Graphs using GraphViz		Maintainability
debug.ViewExplodedGraph	View Exploded Graphs using GraphViz		Maintainability
llvm.Conventions	Check code for LLVM codebase conventions		Maintainability
llvm.Conventions	Check code for LLVM codebase conventions		Maintainability
empty-catch	The catch block should not be vacant. If you catch an exception, ensure you process it and avoid an unexpected behavior in the system.	Complaint Code: int x = -1; try { if (x < 0) { throw x; } } catch (int x ) { cout<<"Exception caught"; } Non-Complaint Code: int x = -1; try { if (x < 0) { throw x; } } catch (int x ) { }	Maintainability
char signedness	Specify the signess of char explicitly. Else, the compiler which is not portable can cause subtle errors if a char is unexpectedly "signed" instead of unsigned.	Complaint Code: unsigned char abc; signed char xyz; Non-Complaint Code: char abc; char xyz;	Maintainability
fixed size memory operation	Memory operations should not be called with a hard-coded value instead of using a macro or sizeof() or constant. This can be quickly forgotten while changing the size.	Complaint Code: char str1[] = "abc"; char str2[] = "xyz"; memcpy (str1, str2, sizeof(str2)); Non-Complaint Code: char str1[] = "abc"; char str2[] = "xyz"; memcpy (str1, str2, 4);	Maintainability
hidden parameter	A function declares a variable with the same name as a parameter, which is then "hidden".	Complaint Code: int add(int a, int b) { int a1; int x = 1; if(x == 1) { int b1; } return 0; } Non-Complaint Code: int add(int a, int b) { int a; /* reuse of 'a' */ int x = 1; if(x == 1) { int b; /* reuse of 'b' */ } return 0; }	Maintainability
hidden parameter	A function declares a variable with the same name as a parameter, which is then "hidden".	Complaint Code: int add(int a, int b) { int a1; int x = 1; if(x == 1) { int b1; } return 0; } Non-Complaint Code: int add(int a, int b) { int a; /* reuse of 'a' */ int x = 1; if(x == 1) { int b; /* reuse of 'b' */ } return 0; }	Maintainability
deactivated code	Code segments that are permanently disabled by the preprocessor. Indication of inactive code. Only cases with condition would be OK.	Non-complaint code: #if 0 /* Non-Complaint */ #if 1 /* Non-Complaint */ Complaint Code: #if 0 == xyz /* Complaint */	Maintainability
Assignment Operator Non-Const Arg	Assignment operator must not have non-const argument.	Non-complaint code: class Alpha { const Alpha& operator=(Alpha& pOther) /* Non-Compliant - Argument must be of type "const Alpha&" */ { //assignment operation } }; Complaint Code: struct Beta { const Beta& operator=(Beta& pOther) /* Non-Compliant - Argument must be of type "const Beta&" */ { //assignment operation } };	Robustness
Assignment Operator Returns Void	Assignment operator must return a valid object. Return type should not be void.	Non-Complaint code: class Alpha { void operator=(const Alpha& pOther) /* Non-Compliant - Return type must not be "void" */ { //assignment operation } }; Complaint Code: struct Beta { void operator=(const Beta& pOther) /* Non-Compliant - Return type must not be "void" */ { //assignment operation } };	Robustness
Assignment Operator Non-Const Return	Assignment operator must return const qualified valid object.	Non-Complaint code: class Alpha { Alpha& operator=(const Alpha& pOther) /* Non-Compliant - Return type must be "const Alpha&" */ { //assignment operation return *this; } }; Complaint Code: struct Beta { Beta& operator=(const Beta& pOther) /* Non-Compliant - Return type must be "const Beta&" */ { //assignment operation return *this; } };	Robustness

---

Cppcheck is a static analysis tool for C/C++ code providing unique code analysis to detect bugs and focusing on detecting undefined behaviour and dangerous coding constructs. Visit their website site for more information.

---

Rule	Description	KPI
arrayIndexOutOfBounds	Array ‘array[2]’ index array[1][1] out of bounds.	Robustness
assignBoolToPointer	Boolean value assigned to pointer.	Robustness
autoVariables	Dangerous assignment – the function parameter is assigned the address of a local auto-variable. Local auto-variables are reserved from the stack which is freed when the function ends. So the pointer to a local variable is invalid after the function ends.	Robustness
autovarInvalidDeallocation	The deallocation of an auto-variable results in undefined behaviour. You should only free memory that has been allocated dynamically.	Robustness
boostForeachError	BOOST_FOREACH caches the end() iterator. It’s undefined behavior if you modify the container inside.	Robustness
bufferAccessOutOfBounds	Buffer is accessed out of bounds: buffer	Resource Utilization
coutCerrMisusage	Invalid usage of output stream: ‘<< std::cout'.	Robustness
deadpointer	Dead pointer usage. Pointer ‘pointer’ is dead if it has been assigned ‘&x’ at line 0.	Robustness
deallocDealloc	Deallocating a deallocated pointer: varname	Robustness
deallocret	Returning/dereferencing ‘p’ after it is deallocated / released	Robustness
deallocuse	Dereferencing ‘varname’ after it is deallocated / released	Robustness
doubleFree	Memory pointed to by ‘varname’ is freed twice.	Resource Utilization
eraseDereference	The iterator ‘iter’ is invalid before being assigned. Dereferencing or comparing it with another iterator is invalid operation.	Robustness
floatConversionOverflow	Undefined behaviour: float (1e+100) conversion overflow.	Resource Utilization
insecureCmdLineArgs	Buffer overrun possible for long command line arguments.	Resource Utilization
integerOverflow	Signed integer overflow for expression ”.	Resource Utilization
invalidFunctionArg	Invalid func_name() argument nr 1	Understandability
invalidFunctionArgBool	Invalid func_name() argument nr 1. A non-boolean value is required.	Understandability
invalidIterator1	Invalid iterator: iterator	Understandability
invalidIterator2	After push_back|push_front|insert() the iterator ‘iterator’ may be invalid.	Understandability
invalidPointer	Invalid pointer ‘pointer’ after push_back().	Understandability
invalidScanfFormatWidth	Width 5 given in format string (no. 10) is larger than destination buffer ‘[0]’ use %-1s to prevent overflowing it.	Resource Utilization
IOWithoutPositioning	Read and write operations without a call to a positioning function (fseek fsetpos or rewind) or fflush in between result in undefined behaviour.	Resource Utilization
iterators	Same iterator is used with different containers ‘container1’ and ‘container2’.	Resource Utilization
leakNoVarFunctionCall	Allocation with funcName funcName doesn’t release it.	Resource Utilization
leakReturnValNotUsed	Return value of allocation function ‘funcName’ is not stored.	Maintainability
mallocOnClassError	Memory for class instance allocated with malloc() but class a std::string. This is unsafe since no constructor is called and class members remain uninitialized. Consider using ‘new’ instead.	Resource Utilization
memleak	Memory leak: varname	Resource Utilization
memleakOnRealloc	Common realloc mistake: ‘varname’ nulled but not freed upon failure	Resource Utilization
memsetClass	Using ‘memfunc’ on class that contains a classname is unsafe because constructor destructor and copy operator calls are omitted. These are necessary for this non-POD type to ensure that a valid object is created.	Resource Utilization
memsetClassReference	Using ‘memfunc’ on class that contains a reference.	Resource Utilization
mismatchAllocDealloc	Mismatching allocation and deallocation: varname	Resource Utilization
mismatchingContainers	Iterators of different containers are used together.	Robustness
mismatchSize	The allocated size sz is not a multiple of the underlying type’s size.	Resource Utilization
negativeArraySize	Declaration of array ” with negative size is undefined behaviour	Maintainability
negativeIndex	Array index -1 is out of bounds.	Maintainability
negativeMemoryAllocationSize	Memory allocation size is negative.Negative allocation size has no specified behaviour.	Resource Utilization
nullPointer	Null pointer dereference	Robustness
nullPointerArithmetic	Overflow in pointer arithmetic NULL pointer is subtracted.	Robustness
operatorEqMissingReturnStatement	No ‘return’ statement in non-void function causes undefined behavior.	Robustness
outOfBounds	index is out of bounds: Supplied size 2 is larger than actual size 1.	Robustness
pointerArithBool	Converting pointer arithmetic result to bool. The boolean result is always true unless there is pointer arithmetic overflow and overflow is undefined behaviour. Probably a dereference is forgotten.	Maintainability
preprocessorErrorDirective	#error message	Understandability
raceAfterInterlockedDecrement	Race condition: non-interlocked access after InterlockedDecrement(). Use InterlockedDecrement() return value instead.	Robustness
readWriteOnlyFile	Read operation on a file that was opened only for writing.	Maintainability
resourceLeak	Resource leak: varname	Resource Utilization
returnAddressOfAutoVariable	Address of an auto-variable returned.	Robustness
returnAddressOfFunctionParameter	Address of the function parameter ‘parameter’ becomes invalid after the function exits because function parameters are stored on the stack which is freed when the function exits. Thus the returned value is invalid.	Robustness
returnLocalVariable	Pointer to local array variable returned.	Robustness
returnReference	Reference to auto variable returned.	Robustness
returnTempReference	Reference to temporary returned.	Robustness
selfInitialization	Member variable ‘var’ is initialized by itself.	Robustness
shiftNegative	Shifting by a negative value is undefined behaviour	Robustness
shiftTooManyBits	Shifting 32-bit value by 64 bits is undefined behaviour	Robustness
shiftTooManyBitsSigned	Shifting signed 32-bit value by 31 bits is undefined behaviour	Robustness
sprintfOverlappingData	The variable ‘varname’ is used both as a parameter and as destination in s[n]printf(). The origin and destination buffers overlap. Quote from glibc (C-library) documentation (http://www.gnu.org/software/libc/manual/html_mono/libc.html#Formatted-Output-Functions): If copying takes place between objects that overlap as a result of a call to sprintf() or snprintf() the results are undefined.””	Robustness
stlBoundaries	Iterator compared with operator<. This is dangerous since the order of items in the container is not guaranteed. One should use operator!= instead to compare iterators.	Robustness
stlcstr	Dangerous usage of c_str(). The c_str() return value is only valid until its string is deleted.	Robustness
stlOutOfBounds	When i==foo.size() foo[i] is out of bounds.	Robustness
stringLiteralWrite	Modifying string literal directly or indirectly is undefined behaviour.	Robustness
strPlusChar	Unusual pointer arithmetic. A value of type ‘char’ is added to a string literal.	Robustness
throwInNoexceptFunction	Exception thrown in function declared not to throw exceptions.	Understandability
uninitdata	Memory is allocated but not initialized: varname	Resource Utilization
uninitstring	Dangerous usage of ‘varname’ (strncpy doesn’t always null-terminate it).	Robustness
uninitStructMember	Uninitialized struct member: a.b	Robustness
uninitvar	Uninitialized variable: varname	Robustness
unknownEvaluationOrder	Expression ‘x = x++;’ depends on order of evaluation of side effects	Robustness
useAutoPointerArray	Object pointed by an ‘auto_ptr’ is destroyed using operator ‘delete’. This means that you should only use ‘auto_ptr’ for pointers obtained with operator ‘new’. This excludes arrays which are allocated by operator ‘new[]’ and must be deallocated by operator ‘delete[]’.	Robustness
useAutoPointerContainer	An element of container must be able to be copied but ‘auto_ptr’ does not fulfill this requirement. You should consider to use ‘shared_ptr’ or ‘unique_ptr’. It is suitable for use in containers because they no longer copy their values they move them.	Robustness
useAutoPointerMalloc	Object pointed by an ‘auto_ptr’ is destroyed using operator ‘delete’. You should not use ‘auto_ptr’ for pointers obtained with function ‘malloc’. This means that you should only use ‘auto_ptr’ for pointers obtained with operator ‘new’. This excludes use C library allocation functions (for example ‘malloc’) which must be deallocated by the appropriate C library function.	Robustness
useClosedFile	Used file that is not opened.	Robustness
va_end_missing	va_list ‘vl’ was opened but not closed by va_end().	Resource Utilization
va_list_usedBeforeStarted	va_list ‘vl’ used before va_start() was called.	Maintainability
va_start_referencePassed	Using reference ‘arg1’ as parameter for va_start() results in undefined behaviour.	Robustness
va_start_subsequentCalls	va_start() or va_copy() called subsequently on ‘vl’ without va_end() in between.	Maintainability
virtualDestructor	Class ‘Base’ which is inherited by class ‘Derived’ does not have a virtual destructor. If you destroy instances of the derived class by deleting a pointer that points to the base class only the destructor of the base class is executed. Thus dynamic memory that is managed by the derived class could leak. This can be avoided by adding a virtual destructor to the base class.	Resource Utilization
writeReadOnlyFile	Write operation on a file that was opened only for reading.	Robustness
wrongPipeParameterSize	The pipe()/pipe2() system command takes an argument which is an array of exactly two integers.12The variable ‘varname’ is an array of size dimension which does not match.	Maintainability
wrongPrintfScanfArgNum	printf format string requires 3 parameters but only 2 are given.	Maintainability
zerodiv	Division by zero.	Robustness

---

Rule	Description	KPI
accessForwarded	Access of forwarded variable v.	Robustness
accessMoved	Access of moved variable v.	Robustness
argumentSize	The array ‘array’ is too small the function ‘function’ expects a bigger one.	Maintainability
arrayIndexOutOfBoundsCond	Array ‘x[10]’ accessed at index 20 which is out of bounds. Otherwise condition ‘y==20’ is redundant.	Robustness
assertWithSideEffect	Non-pure function: ‘function’ is called inside assert statement. Assert statements are removed from release builds so the code inside assert statement is not executed. If the code is needed also in release builds this is a bug.	Robustness
assignmentInAssert	Variable ‘var’ is modified insert assert statement. Assert statements are removed from release builds so the code inside assert statement is not executed. If the code is needed also in release builds this is a bug.	Robustness
badBitmaskCheck	Result of operator ‘|’ is always true if one operand is non-zero. Did you intend to use ‘&’?	Accuracy
bufferNotZeroTerminated	The buffer ‘buffer’ is not null-terminated after the call to strncpy(). This will cause bugs later in the code if the code assumes the buffer is null-terminated.	Robustness
charBitOp	When using ‘char’ variables in bit operations sign extension can generate unexpected results. For example:12 char c = 0x80;12 int i = 0 | c;12 if (i & 0x8000)12 printf(not expected”)	Robustness
charLiteralWithCharPtrCompare	Char literal compared with pointer ‘foo’. Did you intend to dereference it?	Accuracy
checkCastIntToCharAndBack	When saving func_name() return value in char variable there is loss of precision. When func_name() returns EOF this value is truncated. Comparing the char variable with EOF can have unexpected results. For instance a loop while (EOF != (c = func_name())	Robustness
clarifyStatement	A statement like ‘*A++;’ might not do what you intended. Postfix ‘operator++’ is executed before ‘operator*’. Thus the dereference is meaningless. Did you intend to write ‘(*A)++;’?	Robustness
compareBoolExpressionWithInt	Comparison of a boolean expression with an integer other than 0 or 1.	Accuracy
comparisonFunctionIsAlwaysTrueOrFalse	The function isless is designed to compare two variables. Calling this function with one variable (varName) for both parameters leads to a statement which is always false.	Accuracy
constStatement	Redundant code: Found a statement that begins with type constant.	Maintainability
copyCtorAndEqOperator	The class ‘class’ has ‘operator=’ but lack of ‘copy constructor’.	Maintainability
derefInvalidIterator	Make sure to check that the iterator is valid before dereferencing it – not after.	Maintainability
divideSizeof	Division of result of sizeof() on pointer type. sizeof() returns the size of the pointer not the size of the memory area it points to.	Robustness
duplInheritedMember	The class ‘class’ defines member variable with name ‘variable’ also defined in its parent class ‘class’.	Understandability
exceptDeallocThrow	Exception thrown in invalid state ‘p’ points at deallocated memory.	Robustness
exceptThrowInDestructor	The class Class is not safe because its destructor throws an exception. If Class is used and an exception is thrown that is caught in an outer scope the program will terminate.	Robustness
funcArgOrderDifferent	Function ‘function’ argument order different: declaration ” definition ”	Accuracy
ignoredReturnValue	Return value of function malloc() is not used.	Maintainability
incompleteArrayFill	The array ‘buffer’ is filled incompletely. The function ‘memset()’ needs the size given in bytes but an element of the given array is larger than one byte. Did you forget to multiply the size with ‘sizeof(*buffer)’?	Resource Utilization
incorrectLogicOperator	Logical disjunction always evaluates to true: foo > 3 && foo < 4. Are these conditions necessary? Did you intend to use && instead? Are the numbers correct? Are you comparing the correct variables?	Understandability
incorrectStringBooleanError	Conversion of string literal Hello World” to bool always evaluates to true.”	Understandability
incorrectStringCompare	String literal Hello World” doesn’t match length argument for substr().”	Understandability
invalidLengthModifierError	‘I’ in format string (no. 1) is a length modifier and cannot be used without a conversion specifier.	Understandability
invalidPrintfArgType_float	%f in format string (no. 1) requires ‘double’ but the argument type is Unknown.	Maintainability
invalidPrintfArgType_int	%X in format string (no. 1) requires ‘unsigned int’ but the argument type is Unknown.	Maintainability
invalidPrintfArgType_n	%n in format string (no. 1) requires ‘int *’ but the argument type is Unknown.	Maintainability
invalidPrintfArgType_p	%p in format string (no. 1) requires an address but the argument type is Unknown.	Maintainability
invalidPrintfArgType_s	%s in format string (no. 1) requires ‘char *’ but the argument type is Unknown.	Maintainability
invalidPrintfArgType_sint	%i in format string (no. 1) requires ‘int’ but the argument type is Unknown.	Maintainability
invalidPrintfArgType_uint	%u in format string (no. 1) requires ‘unsigned int’ but the argument type is Unknown.	Maintainability
invalidscanf	scanf() without field width limits can crash with huge input data. Add a field width specifier to fix this problem.1212Sample program that can crash:1212#include 12int main()12{12 char c[5];12 scanf(%s” c)	Robustness
invalidScanfArgType_float	%f in format string (no. 1) requires ‘float *’ but the argument type is Unknown.	Maintainability
invalidScanfArgType_int	%d in format string (no. 1) requires ‘int *’ but the argument type is Unknown.	Maintainability
invalidScanfArgType_s	%s in format string (no. 1) requires a ‘char *’ but the argument type is Unknown.	Maintainability
invalidTestForOverflow	Invalid test for overflow ‘x + u < x'. Condition is always false unless there is overflow and overflow is UB.	Accuracy
leakUnsafeArgAlloc	Unsafe allocation. If funcName() throws memory could be leaked. Use make_shared() instead.	Resource Utilization
literalWithCharPtrCompare	String literal compared with variable ‘foo’. Did you intend to use strcmp() instead?	Robustness
mallocOnClassWarning	Memory for class instance allocated with malloc() but class provides constructors. This is unsafe since no constructor is called and class members remain uninitialized. Consider using ‘new’ instead.	Resource Utilization
memsetValueOutOfRange	The 2nd memset() argument ‘varname’ doesn’t fit into an ‘unsigned char’. The 2nd parameter is passed as an ‘int’ but the function fills the block of memory using the ‘unsigned char’ conversion of this value.	Resource Utilization
memsetZeroBytes	memset() called to fill 0 bytes. The second and third arguments might be inverted. The function memset ( void * ptr int value size_t num ) sets the first num bytes of the block of memory pointed by ptr to the specified value.	Resource Utilization
moduloAlwaysTrueFalse	Comparison of modulo result is predetermined because it is always less than 1.	Understandability
multiplySizeof	Multiplying sizeof() with sizeof() indicates a logic error.	Understandability
nullPointerDefaultArg	Possible null pointer dereference if the default parameter value is used: pointer	Robustness
nullPointerRedundantCheck	Either the condition is redundant or there is possible null pointer dereference: pointer.	Robustness
operatorEqToSelf	operator=’ should check for assignment to self to ensure that each block of dynamically allocated memory is owned and managed by only one instance of the class.	Robustness
operatorEqVarError	Member variable ‘classname::’ is not assigned a value in ‘classname::operator=’.	Robustness
oppositeInnerCondition	Opposite conditions in nested ‘if’ blocks lead to a dead code block.	Maintainability
pointerSize	Size of pointer ‘varname’ used instead of size of its data. This is likely to lead to a buffer overflow. You probably intend to write ‘sizeof(*varname)’.	Robustness
possibleBufferAccessOutOfBounds	Possible buffer overflow if strlen(source) is larger than or equal to sizeof(destination). The source buffer is larger than the destination buffer so there is the potential for overflowing the destination buffer.	Robustness
publicAllocationError	Possible leak in public function. The pointer ‘varname’ is not deallocated before it is allocated.	Resource Utilization
redundantAssignInSwitch	Variable ‘var’ is reassigned a value before the old one has been used. ‘break;’ missing?	Maintainability
redundantCopyInSwitch	Buffer ‘var’ is being written before its old content has been used. ‘break;’ missing?	Maintainability
seekOnAppendedFile	Repositioning operation performed on a file opened in append mode has no effect.	Maintainability
selfAssignment	Redundant assignment of ‘varname’ to itself.	Maintainability
signConversion	Suspicious code: sign conversion of var in calculation even though var can have a negative value	Accuracy
signedCharArrayIndex	Signed ‘char’ type used as array index. If the value can be greater than 127 there will be a buffer underflow because of sign extension.	Robustness
sizeArgumentAsChar	The size argument is given as a char constant.	Maintainability
sizeofCalculation	Found calculation inside sizeof().	Understandability
sizeofDivisionMemfunc	Division by result of sizeof(). memset() expects a size in bytes did you intend to multiply instead?	Accuracy
sizeofsizeof	Calling sizeof for ‘sizeof looks like a suspicious code and most likely there should be just one ‘sizeof’. The current code is equivalent to ‘sizeof(size_t)’	Maintainability
sizeofwithnumericparameter	It is unusual to use a constant value with sizeof. For example ‘sizeof(10)’ returns 4 (in 32-bit systems) or 8 (in 64-bit systems) instead of 10. ‘sizeof(‘A’)’ and ‘sizeof(char)’ can return different results.	Robustness
sizeofwithsilentarraypointer	Using ‘sizeof’ for array given as function argument returns the size of a pointer. It does not return the size of the whole array in bytes as might be expected. For example this code:12 int f(char a[100]) {12 return sizeof(a);12 }12returns 4 (in 32-bit systems) or 8 (in 64-bit systems) instead of 100 (the size of the array in bytes).	Accuracy
staticStringCompare	The compared strings ‘str1’ and ‘str2’ are always unequal. Therefore the comparison is unnecessary and looks suspicious.	Understandability
stlIfFind	Suspicious condition. The result of find() is an iterator but it is not properly checked.	Robustness
StlMissingComparison	The iterator incrementing is suspicious – it is incremented at line and then at line . The loop might unintentionally skip an element in the container. There is no comparison between these increments to prevent that the iterator is incremented beyond the end.	Robustness
stringCompare	The compared strings ‘varname1’ and ‘varname2’ are identical. This could be a logic bug.	Maintainability
strncatUsage	At most strncat appends the 3rd parameter’s amount of characters and adds a terminating null byte.12The safe way to use strncat is to subtract one from the remaining space in the buffer and use it as 3rd parameter.Source: http://www.cplusplus.com/reference/cstring/strncat/12Source: http://www.opensource.apple.com/source/Libc/Libc-167/gen.subproj/i386.subproj/strncat.c	Robustness
suspiciousCase	Using an operator like ‘||’ in a case label is suspicious. Did you intend to use a bitwise operator multiple case labels or if/else instead?	Accuracy
suspiciousEqualityComparison	Found suspicious equality comparison. Did you intend to assign a value instead?	Accuracy
suspiciousSemicolon	Suspicious use of ; at the end of ” statement.	Accuracy
terminateStrncpy	If the source string’s size fits or exceeds the given size strncpy() does not add a zero at the end of the buffer. This causes bugs later in the code if the code assumes buffer is null-terminated.	Robustness
thisSubtraction	Suspicious pointer subtraction. Did you intend to write ‘->’?	Accuracy
uninitMemberVar	Member variable ‘classname::varname’ is not initialized in the constructor.	Robustness
unusedLabelSwitch	Label ” is not used. Should this be a ‘case’ of the enclosing switch()?	Understandability
useAutoPointerCopy	std::auto_ptr’ has semantics of strict ownership meaning that the ‘auto_ptr’ instance is the sole entity responsible for the object’s lifetime. If an ‘auto_ptr’ is copied the source looses the reference.	Robustness
uselessAssignmentPtrArg	Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?	Accuracy
uselessCallsCompare	std::string::find()’ returns zero when given itself as parameter (str.find(str)). As it is currently the code is inefficient. It is possible either the string searched (‘str’) or searched for (‘str’) is wrong.	Efficiency
uselessCallsEmpty	Ineffective call of function ’empty()’. Did you intend to call ‘clear()’ instead?	Resource Utilization
uselessCallsRemove	The return value of std::remove() is ignored. This function returns an iterator to the end of the range containing those elements that should be kept. Elements past new end remain valid but with unspecified values. Use the erase method of the container to delete them.	Resource Utilization
va_start_wrongParameter	‘arg1’ given to va_start() is not last named argument of the function. Did you intend to pass ‘arg2’?	Accuracy
wrongmathcall	Passing value ‘#’ to #() leads to implementation-defined result.	Understandability
wrongPrintfScanfParameterPositionError	printf: referencing parameter 2 while 1 arguments given	Understandability
zerodivcond	Either the condition is redundant or there is division by zero at line 0.	Robustness

---

Rule	Description	KPI
arithOperationsOnVoidPointer	varname’ is of type ‘vartype’. When using void pointers in calculations the behaviour is undefined. Arithmetic operations on ‘void *’ is a GNU C extension which defines the ‘sizeof(void)’ to be 1.	Robustness
AssignmentAddressToInteger	Assigning a pointer to an integer (int/long/etc) is not portable across different platforms and compilers. For example in 32-bit Windows and linux they are same width but in 64-bit Windows and linux they are of different width. In worst case you end up assigning 64-bit address to 32-bit integer. The safe way is to store addresses only in pointer types (or typedefs like uintptr_t).	Portability
AssignmentIntegerToAddress	Assigning an integer (int/long/etc) to a pointer is not portable across different platforms and compilers. For example in 32-bit Windows and linux they are same width but in 64-bit Windows and linux they are of different width. In worst case you end up assigning 64-bit integer to 32-bit pointer. The safe way is to store addresses only in pointer types (or typedefs like uintptr_t).	Portability
CastAddressToIntegerAtReturn	Returning an address value in a function with integer (int/long/etc) return type is not portable across different platforms and compilers. For example in 32-bit Windows and Linux they are same width but in 64-bit Windows and Linux they are of different width. In worst case you end up casting 64-bit address down to 32-bit integer. The safe way is to always return an integer.	Portability
CastIntegerToAddressAtReturn	Returning an integer (int/long/etc) in a function with pointer return type is not portable across different platforms and compilers. For example in 32-bit Windows and Linux they are same width but in 64-bit Windows and Linux they are of different width. In worst case you end up casting 64-bit integer down to 32-bit pointer. The safe way is to always return a pointer.	Portability
fflushOnInputStream	fflush() called on input stream ‘stdin’ may result in undefined behaviour on non-linux systems.	Portability
functionStatic	The member function ‘class::function’ can be made a static function. Making a function static can bring a performance benefit since no ‘this’ instance is passed to the function. This change should not cause compiler errors but it does not necessarily make sense conceptually. Think about your design and the task of the function first – is it a function that must not access members of class instances?	Efficiency
invalidPointerCast	Casting between float* and double* which have an incompatible binary data representation.	Portability
memsetClassFloat	Using memset() on class which contains a floating point number. This is not portable because memset() sets each byte of a block of memory to a specific value and the actual representation of a floating-point value is implementation defined. Note: In case of an IEEE754-1985 compatible implementation setting all bits to zero results in the value 0.0.	Portability
memsetFloat	The 2nd memset() argument ‘varname’ is a float its representation is implementation defined. memset() is used to set each byte of a block of memory to a specific value and the actual representation of a floating-point value is implementation defined.	Portability
passedByValue	Parameter ‘parametername’ is passed by value. It could be passed as a (const) reference which is usually faster and recommended in C++.	Efficiency
pointerOutOfBounds	Undefined behaviour pointer arithmetic ” is out of bounds. From chapter 6.5.6 in the C specification:12When an expression that has integer type is added to or subtracted from a pointer ..” and then “If both the pointer operand and the result point to elements of the same array object or one past the last element of the array object the evaluation shall not produce an overflow	Portability
postfixOperator	Prefix ++/– operators should be preferred for non-primitive types. Pre-increment/decrement can be more efficient than post-increment/decrement. Post-increment/decrement usually involves keeping a copy of the previous value around and adds a little extra code.	Efficiency
redundantCopy	Buffer ‘var’ is being written before its old content has been used.	Maintainability
redundantCopyLocalConst	The const variable ‘varname’ is assigned a copy of the data. You can avoid the unnecessary data copying by converting ‘varname’ to const reference.	Resource Utilization
shiftNegativeLHS	Shifting a negative value is technically undefined behaviour	Robustness
sizeofDereferencedVoidPointer	*varname’ is of type ‘void’ the behaviour of ‘sizeof(void)’ is not covered by the ISO C standard. A value for ‘sizeof(void)’ is defined only as part of a GNU C extension which defines ‘sizeof(void)’ to be 1.	Robustness
sizeofVoid	Behaviour of ‘sizeof(void)’ is not covered by the ISO C standard. A value for ‘sizeof(void)’ is defined only as part of a GNU C extension which defines ‘sizeof(void)’ to be 1.	Robustness
stlcstrParam	The conversion from const char* as returned by c_str() to std::string creates an unnecessary string copy. Solve that by directly passing the string.	Efficiency
stlcstrReturn	The conversion from const char* as returned by c_str() to std::string creates an unnecessary string copy. Solve that by directly returning the string.	Efficiency
stlIfStrFind	Either inefficient or wrong usage of string::find(). string::compare() will be faster if string::find’s result is compared with 0 because it will not scan the whole string. If your intention is to check that there are no findings in the string you should compare with std::string::npos.	Efficiency
stlSize	Checking for ‘list’ emptiness might be inefficient. Using list.empty() instead of list.size() can be faster. list.size() can take linear time but list.empty() is guaranteed to take constant time.	Efficiency
unknownSignCharArrayIndex	char’ type used as array index. Values greater that 127 will be treated depending on whether ‘char’ is signed or unsigned on target platform.	Robustness
useInitializationList	When an object of a class is created the constructors of all member variables are called consecutively in the order the variables are declared even if you don’t explicitly write them to the initialization list. You could avoid assigning ‘variable’ a value by passing the value to the constructor in the initialization list.	Efficiency
uselessCallsSubstr	Ineffective call of function ‘substr’ because it returns a copy of the object. Use operator= instead.	Accuracy
uselessCallsSwap	The ‘swap()’ function has no logical effect when given itself as parameter (str.swap(str)). As it is currently the code is inefficient. Is the object or the parameter wrong here?	Efficiency
varFuncNullUB	Passing NULL after the last typed argument to a variadic function leads to undefined behaviour.12The C99 standard in section 7.15.1.1 states that if the type used by va_arg() is not compatible with the type of the actual next argument (as promoted according to the default argument promotions) the behavior is undefined.12The value of the NULL macro is an implementation-defined null pointer constant (7.17) which can be any integer constant expression with the value 0 or such an expression casted to (void*) (6.3.2.3). This includes values like 0 0L or even 0LL.12In practice on common architectures this will cause real crashes if sizeof(int) != sizeof(void*) and NULL is defined to 0 or any other null pointer constant that promotes to int.12To reproduce you might be able to use this little code example on 64bit platforms. If the output includes ERROR” the sentinel had only 4 out of 8 bytes initialized to zero and was not detected as the final argument to stop argument processing via va_arg(). Changing the 0 to (void*)0 or 0L will make the “ERROR” output go away.12#include 12#include 1212void f(char *s …) {12 va_list ap	Robustness
misra-c2012-1.3	There shall be no occurrence of undefined or critical unspecified behavior	Robustness
misra-c2012-2.1	A project shall not contain unreachable code	Robustness
misra-c2012-2.2	There shall be no dead code	Robustness
misra-c2012-2.4	A project should not contain unused tag declarations	Robustness
misra-c2012-2.6	A function should not contain unused label declarations	Robustness
misra-c2012-3.1	The character sequences /* an // shall not be used within a comment	Robustness
misra-c2012-4.1	Octal and hexadecimal escape sequences shall be terminated	Robustness
misra-c2012-5.1	External identifiers shall be distinct	Robustness
misra-c2012-5.3	An identifier declared in an inner scope shall not hide an identifier declared in an outer scope	Robustness
misra-c2012-5.4	Macro identifiers shall be distinct	Robustness
misra-c2012-5.5	Identifiers shall be distinct from macro names	Robustness
misra-c2012-7.1	Octal constants shall not be used	Robustness
misra-c2012-7.3	The lowercase character ‘l’ shall not be used in a literal suffix	Robustness
misra-c2012-8.3	All declarations of an object or function shall use the same names and type qualifiers	Robustness
misra-c2012-8.11	When an array with external linkage is declared, its size should be explicitly specified	Robustness
misra-c2012-8.12	Within an enumerator list, the value of an implicitly-specified enumeration constant shall be unique	Robustness
misra-c2012-8.14	The restrict type qualifier shall not be used	Robustness
misra-c2012-9.1	The value of an object with automatic storage duration shall not be read before it has been set	Robustness
misra-c2012-9.5	Where designated initializers are used to initialize an array object the size of the array shall be specified explicitly	Robustness
misra-c2012-10.4	Both operands of an operator in which the usual arithmetic conversions are performed shall have the same essential type category	Robustness
misra-c2012-10.6	The value of a composite expression shall not be assigned to an object with wider essential type	Robustness
misra-c2012-10.8	The value of a composite expression shall not be cast to a different essential type category or a wider essential type	Robustness
misra-c2012-11.3	A cast shall not be performed between a pointer to object type and a pointer to a different object type	Robustness
misra-c2012-11.4	A conversion should not be performed between a pointer to object and an integer type	Robustness
misra-c2012-11.5	A conversion should not be performed from pointer to void into pointer to object	Robustness
misra-c2012-11.6	A cast shall not be performed between pointer to void and an arithmetic type	Robustness
misra-c2012-11.7	A cast shall not be performed between pointer to object and a noninteger arithmetic type	Robustness
misra-c2012-11.8	A cast shall not remove any const or volatile qualification from the type pointed to by a pointer	Robustness
misra-c2012-11.9	The macro NULL shall be the only per mitted form of integer null pointer constant	Robustness
misra-c2012-12.1	The precedence of operators within expressions should be made explicit	Robustness
misra-c2012-12.2	The right-hand operand of a shift operator shall lie in the range zero to one less than the width in bits of the essential type of the left-hand operand	Robustness
misra-c2012-12.3	The comma operator should not be used	Robustness
misra-c2012-12.4	Evaluation of constant expressions should not lead to unsigned integer wrap-around	Robustness
misra-c2012-13.1	Initializer lists shall not contain persistent side effects	Robustness
misra-c2012-13.2	The value of an expression and its persistent side effects shall be the same under all permitted evaluation orders	Robustness
misra-c2012-13.3	A full expression containing an increment (++) or decrement (–) operator should have no other potential side effects other than that caused by the increment or decrement operator	Robustness
misra-c2012-13.4	The result of an assignment operator should not be used	Robustness
misra-c2012-13.5	The right-hand operand of a logical && or || operator shall not contain persistent side effects	Robustness
misra-c2012-13.6	The operand of the sizeof operator shall not contain any expression which has potential side effects	Robustness
misra-c2012-14.1	A loop counter shall not have essentially floating type	Robustness
misra-c2012-14.2	A for loop shall be well-formed	Robustness
misra-c2012-14.4	The controlling expression of an if statement and the controlling expression of an iteration- statement shall have essentially Boolean type	Robustness
misra-c2012-15.1	The goto statement should not be used	Robustness
misra-c2012-15.2	The goto statement shall jump to a label declared later in the same function	Robustness
misra-c2012-15.3	Any label referenced by a goto statement shall be declared in the same block, or in any block enclosing the goto statement	Robustness
misra-c2012-15.5	A function should have a single point of exit at the end	Robustness
misra-c2012-15.6	The body of an iteration-statement or a selection-statement shall be a compound-statement	Robustness
misra-c2012-15.7	All if … else if constructs shall be terminated with an else statement	Robustness
misra-c2012-16.2	A switch label shall only be used when the most closely-enclosing compound statement is the body of a switch statement	Robustness
misra-c2012-16.3	An unconditional break statement shall terminate every switch-clause	Robustness
misra-c2012-16.4	Every switch statement shall have a default label	Robustness
misra-c2012-16.5	A default label shall appear as either the first or the last switch label of a switch statement	Robustness
misra-c2012-16.6	Every switch statement shall have at least two switch-clauses	Robustness
misra-c2012-16.7	A switch-expression shall not have essentially Boolean type	Robustness
misra-c2012-17.1	The features of shall not be used	Robustness
misra-c2012-17.5	The function argument corresponding to a parameter declared to have an array type shall have an appropriate number of elements	Robustness
misra-c2012-17.6	The declaration of an array parameter shall not contain the static keyword between the [ ]	Robustness
misra-c2012-17.8	A function parameter should not be modified	Robustness
misra-c2012-18.1	A pointer resulting from arithmetic on a pointer operand shall address an element of the same array as that pointer operand	Robustness
misra-c2012-18.5	Declarations should contain no more than two levels of pointer nesting	Robustness
misra-c2012-18.6	The address of an object with automatic storage shall not be copied to another object that persists after the first object has ceased to exist	Robustness
misra-c2012-18.8	Variable-length array types shall not be used	Robustness
misra-c2012-19.2	The union keyword should not be used	Robustness
misra-c2012-20.1	#include directives should only be preceded by preprocessor directives or comments	Robustness
misra-c2012-20.2	The ‘, ” or characters and the /* or // character sequences shall not occur in a header fi le name	Robustness
misra-c2012-20.3	The #include directive shall be followed by either a or “filename” sequence	Robustness
misra-c2012-20.4	A macro shall not be defined with the same name as a keyword	Robustness
misra-c2012-20.5	#undef should not be used	Robustness
misra-c2012-21.3	The memory allocation and deallocation functions of shall not be used	Robustness
misra-c2012-21.4	The standard header file shall not be used	Robustness
misra-c2012-21.5	The standard header file shall not be used	Robustness
misra-c2012-21.7	The atof, atoi, atol and atoll functions of shall not be used	Robustness
misra-c2012-21.8	The library functions abort, exit, getenv and system of shall not be used	Robustness
misra-c2012-21.9	The library functions bsearch and qsort of shall not be used	Robustness
misra-c2012-21.11	The standard header file shall not be used	Robustness
misra-c2012-22.1	All resources obtained dynamically by means of Standard Library functions shall be explicitly released	Robustness
misra-c2012-22.2	A block of memory shall only be freed if it was allocated by means of a Standard Library function	Robustness
misra-c2012-22.4	There shall be no attempt to write to a stream which has been opened as read-only	Robustness
misra-c2012-22.6	The value of a pointer to a FILE shall not be used after the associated stream has been closed	Robustness

---

Rule	Description	KPI
arrayIndexThenCheck	Defensive programming: The variable ‘index’ is used as an array index before it is checked that is within limits. This can mean that the array might be accessed out of bounds. Reorder conditions such as ‘(a[i] && i < 10)' to '(i < 10 && a[i])'. That way the array will not be accessed if the index is out of limits.	Maintainability
assignBoolToFloat	Boolean value assigned to floating point variable.	Maintainability
assignIfError	Mismatching assignment and comparison comparison ” is always false.	Maintainability
bitwiseOnBoolean	Boolean variable ‘varname’ is used in bitwise operation. Did you mean ‘&&’?	Maintainability
catchExceptionByValue	The exception is caught by value. It could be caught as a (const) reference which is usually recommended in C++.	Robustness
clarifyCalculation	Suspicious calculation. Please use parentheses to clarify the code. The code ”a+b?c:d” should be written as either ”(a+b)?c:d” or ”a+(b?c:d)”.	Maintainability
clarifyCondition	Suspicious condition (assignment + comparison); Clarify expression with parentheses.	Maintainability
commaSeparatedReturn	Comma is used in return statement. When comma is used in a return statement it can easily be misread as a semicolon. For example in the code below the value of ‘b’ is returned if the condition is true but it is easy to think that ‘a+1’ is returned:12 if (x)12 return a + 112 b++;12However it can be useful to use comma in macros. Cppcheck does not warn when such a macro is then used in a return statement it is less likely such code is misunderstood.	Maintainability
comparisonError	The expression ‘(X & 0x6) == 0x1’ is always false. Check carefully constants and operators used these errors might be hard to spot sometimes. In case of complex expression it might help to split it to separate expressions.	Maintainability
comparisonOfBoolWithBoolError	The variable ‘var_name’ is of type ‘bool’ and comparing ‘bool’ value using relational (< > <= or >=) operator could cause unexpected results.	Maintainability
comparisonOfFuncReturningBoolError	The return type of function ‘func_name’ is ‘bool’ and result is of type ‘bool’. Comparing ‘bool’ value using relational (< > <= or >=) operator could cause unexpected results.	Maintainability
comparisonOfTwoFuncsReturningBoolError	The return type of function ‘func_name1’ and function ‘func_name2’ is ‘bool’ and result is of type ‘bool’. Comparing ‘bool’ value using relational (< > <= or >=) operator could cause unexpected results.	Maintainability
copyCtorPointerCopying	Value of pointer ‘var’ which points to allocated memory is copied in copy constructor instead of allocating new memory.	Maintainability
cstyleCast	C-style pointer casting detected. C++ offers four different kinds of casts as replacements: static_cast const_cast dynamic_cast and reinterpret_cast. A C-style cast could evaluate to any of those automatically thus it is considered safer if the programmer explicitly states which kind of cast is expected. See also: https://www.securecoding.cert.org/confluence/display/cplusplus/EXP05-CPP.+Do+not+use+C-style+casts.	Maintainability
duplicateBranch	Finding the same code in an ‘if’ and related ‘else’ branch is suspicious and might indicate a cut and paste or logic error. Please examine this code carefully to determine if it is correct.	Maintainability
duplicateBreak	Consecutive return break continue goto or throw statements are unnecessary. The second statement can never be executed and so should be removed.	Maintainability
duplicateExpression	Finding the same expression on both sides of an operator is suspicious and might indicate a cut and paste or logic error. Please examine this code carefully to determine if it is correct.	Maintainability
duplicateExpressionTernary	Finding the same expression in both branches of ternary operator is suspicious as the same code is executed regardless of the condition.	Maintainability
exceptRethrowCopy	Rethrowing an exception with ‘throw varname;’ creates an unnecessary copy of ‘varname’. To rethrow the caught exception without unnecessary copying or slicing use a bare ‘throw;’.	Understandability
funcArgNamesDifferent	Function ‘function’ argument 2 names different: declaration ‘A’ definition ‘B’.	Understandability
functionConst	The member function ‘class::function’ can be made a const function. Making this function ‘const’ should not cause compiler errors. Even though the function can be made const function technically it may not make sense conceptually. Think about your design and the task of the function first – is it a function that must not change object internal state?	Maintainability
incrementboolean	The operand of a postfix increment operator may be of type bool but it is deprecated by C++ Standard (Annex D-1) and the operand is always set to true. You should assign it the value ‘true’ instead.	Maintainability
initializerList	Member variable ‘class::variable’ is in the wrong place in the initializer list. Members are initialized in the order they are declared not in the order they are in the initializer list. Keeping the initializer list in the same order that the members were declared prevents order dependent initialization errors.	Maintainability
knownConditionTrueFalse	Condition ‘x’ is always true	Understandability
mismatchingBitAnd	Mismatching bitmasks. Result is always 0 (X = Y & 0xf0; Z = X & 0x1; => Z=0).	Understandability
multiCondition	Expression is always false because ‘else if’ condition matches previous condition at line 1.	Understandability
nanInArithmeticExpression	Using NaN/Inf in a computation. Although nothing bad really happens it is suspicious.	Maintainability
noConstructor	The class ‘classname’ does not have a constructor although it has private member variables. Member variables of builtin types are left uninitialized when the class is instantiated. That may cause bugs or undefined behavior.	Maintainability
noCopyConstructor	class ‘class’ does not have a copy constructor which is recommended since the class contains a pointer to allocated memory.	Robustness
noExplicitConstructor	Class ‘classname’ has a constructor with 1 argument that is not explicit. Such constructors should in general be explicit for type safety reasons. Using the explicit keyword in the constructor means some mistakes when using the class can be avoided.	Maintainability
operatorEq	The class::operator= does not conform to standard C/C++ behaviour. To conform to standard C/C++ behaviour return a reference to self (such as: ‘class &class::operator=(..) { .. return *this; }’. For safety reasons it might be better to not fix this message. If you think that safety is always more important than conformance then please ignore/suppress this message. For more details about this topic see the book Effective C++” by Scott Meyers.”	Robustness
operatorEqRetRefThis	‘operator=’ should return reference to ‘this’ instance.	Accuracy
operatorEqShouldBeLeftUnimplemented	operator=’ should either return reference to ‘this’ instance or be declared private and left unimplemented.	Accuracy
pointerLessThanZero	A pointer cannot be negative so it is either pointless or an error to check if it is.	Maintainability
pointerPositive	A pointer cannot be negative so it is either pointless or an error to check if it is not.	Maintainability
reademptycontainer	Reading from empty STL container ‘var’	Understandability
redundantAssignment	Variable ‘var’ is reassigned a value before the old one has been used.	Maintainability
redundantCondition	Redundant condition: If x > 11 the condition x > 10 is always true.	Maintainability
redundantIfRemove	Redundant checking of STL container element existence before removing it. It is safe to call the remove method on a non-existing element.	Maintainability
redundantPointerOp	Redundant pointer operation on ‘varname’ – it’s already a pointer.	Maintainability
truncLongCastAssignment	int result is assigned to long variable. If the variable is long to avoid loss of information then there is loss of information. To avoid loss of information you must cast a calculation operand to long for example ‘l = a * b;’ => ‘l = (long)a * b;’.	Robustness
truncLongCastReturn	int result is returned as long value. If the return value is long to avoid loss of information then there is loss of information. To avoid loss of information you must cast a calculation operand to long for example ‘return a*b;’ => ‘return (long)a*b’.	Robustness
unassignedVariable	Variable ‘varname’ is not assigned a value.	Maintainability
unhandledExceptionSpecification	Unhandled exception specification when calling function foo(). Either use a try/catch around the function call or add a exception specification for funcname() also.	Maintainability
unpreciseMathCall	Expression ‘1 – erf(x)’ can be replaced by ‘erfc(x)’ to avoid loss of precision.	Maintainability
unreachableCode	Statements following return break continue goto or throw will never be executed.	Maintainability
unreadVariable	Variable ‘varname’ is assigned a value that is never used.	Understandability
unsafeClassCanLeak	The class ‘class’ is unsafe wrong usage can cause memory/resource leaks for ‘class::varname’. This can for instance be fixed by adding proper cleanup in the destructor.	Resource Utilization
unsignedLessThanZero	The unsigned variable ‘varname’ will never be negative so it is either pointless or an error to check if it is.	Maintainability
unsignedPositive	Unsigned variable ‘varname’ can’t be negative so it is unnecessary to test it.	Maintainability
unusedAllocatedMemory	Variable ‘varname’ is allocated memory that is never used.	Resource Utilization
unusedFunction	The function ‘funcName’ is never used.	Understandability
unusedLabel	Label ” is not used.	Understandability
unusedPrivateFunction	Unused private function: ‘classname::funcname’	Understandability
unusedScopedObject	Instance of ‘varname’ object is destroyed immediately.	Understandability
unusedStructMember	struct member ‘structname::variable’ is never used.	Understandability
unusedVariable	Unused variable: varname	Understandability
uselessAssignmentArg	Assignment of function parameter has no effect outside the function.	Understandability
variableScope	The scope of the variable ‘varname’ can be reduced. Warning: Be careful when fixing this message especially when there are inner loops. Here is an example where cppcheck will write that the scope for ‘i’ can be reduced:12void f(int x)12{12 int i = 0;12 if (x) {12 // it’s safe to move ‘int i = 0;’ here12 for (int n = 0; n < 10; ++n) {12 // it is possible but not safe to move 'int i = 0;' here12 do_something(&i);12 }12 }12}12When you see this message it is always safe to reduce the variable scope 1 level.	Maintainability

---

We have discovered some checks and rules for C#. Following section briefs, about the Embold CS code issues.

---

Embold comes with a proprietary and state-of-the-art analyser. In addition to integrating and building upon good work from the open source space, we have created our own checks and rules to discover code issues that were not sufficiently covered by other tools.

---

---

Rule	Description	Example	KPI
ArithmeticExpressionsMustDeclarePrecedence	This statement contains a complex arithmetic expression which omits parenthesis around operations	Non-complaint Code: int x = 5 + y * b / 6 % z – 2; Complaint Code: int x = 5 + (y * ((b / 6) % z)) – 2; This rule is intended to increase the readability and maintainability of this type of code, and to reduce the risk of introducing bugs later, by forcing the developer to insert parenthesis to explicitly declare the operator precedence.	Robustness
AvoidExceptionsInsideStaticConstructors	If any exception is thrown from within a static constructor, the type is unusable for the lifetime of the program	Cause: Static constructor are called before the first time a class is used but the caller doesn’t control when exactly. The exception is thrown in this context force callers to use ‘try’ block around any usage of the class and should be avoided. Non-complaint Code: public class MyClass { static MyClass() { throw new System.Exception(“error message”); } } Complaint Code: public class MyClass { static MyClass() { } }	Robustness
ConditionalExpressionsMustDeclarePrecedence	A C# statement contains a complex conditional expression which omits parenthesis around operations	Cause: This rule is intended to increase the readability and maintainability of this type of code, and to reduce the risk of introducing bugs later, by forcing the developer to insert parenthesis to explicitly declare the operator precedence. Non-Complaint Code: if (x || y && z && a || b) { } Complaint Code: if ((x || y) && z && (a || b)) { } //or if (x || (y && z && a) || b) { } Inserting parenthesis makes the code more obvious and easy to understand and removes the need for the reader to make assumptions about the code.	Robustness
EmptyCatchBlock	An empty catch block suppress all errors and shouldn’t be used		Analyzability
RegexExpressionIsIncorrect	The regular expression is invalid and will fail at run-time	Cause: The regular expression pattern is invalid and will fail at run-time. Non-complaint Code: string input = “/content/Somefile.cs”; Match match1 = Regex.Match(input, @”content/-z0-9-]+).a$”); Complaint code: string input = “/content/Somefile.cs”; Match match = Regex.Match(input, @”content/([A-Za-z0-9-]+).cs$”);	Robustness
VirtualMethodCalledOnConstructor	If you make a virtual method call in a constructor, and it is not the most derived type in its inheritance hierarchy, then it might be called on a class whose constructor has not been run	Non-complaint Code: public class VirtualMethodOnConstructorTests { public VirtualMethodOnConstructorTests(string foo) { DoFoo(foo); } public virtual void DoFoo(string foo) { } } Solution: There are 2 options: 1. This problem can be mitigated by marking the class as sealed to ensure that it is the most derived type in the inheritance hierarchy – in which case it is perfectly safe to call the virtual method. 2. Remove the call from the constructor.	Robustness
VulnerableEncryption	Secure the encryption mode by combining Cipher Block Chaining with an authenticity check (HMAC-SHA256 for example) on the cipher text.	Example For Issue Occurrence: AesManaged aes = new AesManaged { KeySize = 128, BlockSize = 128, Mode = CipherMode.ECB, // Noncompliant Padding = PaddingMode.PKCS7 };	Security
WeakEncryption	Weak encryption algorithms provide very less security and insufficient protection for sensitive data hence its recommended to use a more secure encryption algorithm, such as AES.	Non-complaint Code: using (var tripleDES = new TripleDESCryptoServiceProvider()) //Noncompliant { //... } Complaint Code: AesManaged aes = new AesManaged { KeySize = 128, BlockSize = 128, Padding = PaddingMode.PKCS7 };	Security

---

Rule	Description	Example	KPI
AllocationOfReferenceTypeEnumerator	Non-ValueType enumerator may result in an heap allocation.	Non-complaint Code: IList iListData = new[] { 123, 32, 4 }; foreach (var i in iListData) // Allocations (line 19) { Console.WriteLine(i); } Complaint Code: int[] intData = new[] { 123, 32, 4 }; foreach (var i in intData) { Console.WriteLine(i); }	Efficiency
ArrayAllocationForParamsParameter	Unnecessary array allocation will occur even if no parameter is passed in for the params parameter.	Non-complaint Code: class Test { void Method() { Params(1, 2); } public void Params(params int[] args) { } } Complaint Code: class Test { void Method() { Params(new[] { 1, 2 }); } public void Params(params int[] args) { } }	Efficiency
CodeAnalysisSuppressionMustHaveJustification	The SuppressMessage attribute does not include a justification. Justification increases the long term maintainability of the code.	Cause: A violation of this rule occurs when the code contains a Code Analysis SuppressMessage attribute, but a justification for the suppression has not been provided within the attribute.Whenever a Code Analysis rule is suppressed, a justification should be provided.This can increase the long-term maintainability of the code. Complaint Code: [SuppressMessage(“Microsoft.Performance”, “TestSuppressAttribute”, Justification = “Used for testing”)]public bool Method1() { } To fix an instance of this violation, add a Justification tag and justification text to the SuppressMessage attribute describing the reason for the suppression.	Robustness
DisposablesShouldCallSuppressFinalize	Classes implementing IDisposable should call the GC.SuppressFinalize method in their finalize method to avoid any finalizer from being called. This rule should be followed even if the class doesn’t have a finalizer as a derived class could have one.	Cause: Classes implementing IDisposable should call the GC.SuppressFinalize method in their finalize method to avoid any finalizer from being called. This rule should be followed even if the class doesn’t have a finalizer as a derived class could have one. Non-complaint code: public class MyClass : System.IDisposable { public void Dispose() { var x = 1; } } Compliant code: public class MyClass : System.IDisposable { public void Dispose() { var x = 1; GC.SuppressFinalize(this); } }	Robustness
DoNotChangeLoopVariables	Don’t change a loop variable inside a for loop.		Robustness
DontConcatenateStringsInLoops	Don’t concatenate strings in a loop. Using a StringBuilder will require less memory and time.	Cause: Do not concatenate a string on a loop. It will allocate a lot of memory. Use a StringBuilder instead. It will will require less allocation, less garbage collector work, less CPU cycles, and less overall time. Non-complaint code: var values = “”; foreach (var item in Enum.GetValues(typeof(LoaderOptimization))) { values += item.ToString(); } Complaint code: var values = “”; var builder = new StringBuilder(); builder.Append(values); foreach (var item in Enum.GetValues(typeof(LoaderOptimization))) { builder.Append(item.ToString()); } values = builder.ToString();	Efficiency
MakeFieldReadonly	A field that is only assigned in the constructor can be made readonly.	Cause: A field that is only assigned when declared or in the constructor can be made read-only. A read-only field cannot be assigned anywhere else after the object is created, making it immutable. Non-complaint code: class Class1 { private int x = 0; } Complaint code: class Class1 { private readonly int x = 0; }	Maintainability
NonOverriddenVirtualMethodCallOnValueType	Non-overridden virtual method is called on a value type.	Cause: An additional boxing or constrained instruction is needed for a non-overridden virtual method call on a value type because the CLR will automatically instantiate the corresponding class from a value type if you call some method on it. Complaint code: using System; var normal = new Normal().GetHashCode(); var overridden = new OverrideToHashCode().GetHashCode(); struct Normal { } struct OverrideToHashCode { public override int GetHashCode() { return -1; } }	Efficiency
RemoveEmptyFinalizers	An empty finalizer will stop your object from being collected immediately by the Garbage Collector when no longer used. It will instead be placed in the finalizer queue needlessly using resources.	Cause: Due to the finalize method, GC will not clear the entire memory associated with object in the first attempt. Memory used by managed resources is still in heap as inaccessible reference. Hence it is recommended that the Finalize method should not be used until it is extremely necessary. Non-complaint code: public class MyClass { //At runtime C# destructor is automatically Converted to Finalize method ~MyClass() { Dispose(false); } } Complaint code: public class MyClass { }	Resource Utilization
SwitchWithoutDefaultClause	Consider adding default case to the switch	Non-complaint code: switch (value) { case 1: Console.WriteLine(1); break; case 2: Console.WriteLine(2); break; } Complaint code: switch (value) { case 1: Console.WriteLine(1); break; case 2: Console.WriteLine(2); break; default: Console.WriteLine(0); break; }	Robustness
Invalid Logging Class Name	Consider creating the logger name in context to the current class name.	// Cause: //The log instace created should belong to the current class for logging consistency, consider changing the log class name to current class. //Example For Issue Occurrence: class ExampleClass { private static ILog logger = LogManager.GetLogger("otherClass"); static void Main(string[] args) { try { logger.Info(""); } catch (Exception e) { } } } //CODE FIX: class ExampleClass { private static ILog logger = LogManager.GetLogger("ExampleClass"); static void Main(string[] args) { try { logger.Info(""); } catch (Exception e) { } } }	Usage
Class Implements ICloneable	Consider defining your own Clone() or Copy() methods and document whether they perform deep or shallow copying instead of using ICloneable interface.	// Cause: //Implementing 'ICloneable' is discouraged due to its ambiguous effect on the code. //Example For Issue Occurrence: using System; public class Class1 : ICloneable { public int a; public int b; public Class1(int aa, int bb) { a = aa; b = bb; } public string ToString() { return "(" + a + "," + b + ")"; } public virtual object Cloning() { return new Class1(a, b); } object ICloneable.Clone() { return Cloning(); } }	Reliability

Rule	Description	Example	KPI
CatchBlocksShouldRethrow	Any catch block should rethrow or throw and not eat exceptions.	Cause: A Catch block that does don't throw any exception is not recommended. Non-complaint Code: try { // do something } catch { } Complaint Code: try { // do something } catch (Exception ex) { throw; }	Analyzability
CompilerWarningLevelIsSetTooLow	Build with the highest warning level	Cause: Warnings are potential problems with your code. Turning on the warnings at the highest level will highlight these problems, allowing you to fix them //early, rather than let them become potential bugs at a later date. Complaint Code: You can change the warning level for a project by right-clicking on it, going to its properties page and then setting warning level to highest ie.4 on its Build tab.	Understandability
DisposeFieldsProperly	This class has a disposable field and is not disposing it.	Non-Complaint Code: internal class D : System.IDisposable { } class Class1 { private D field = D.Open(); } Compliant code: class Class1 : System.IDisposable { private D field = D.Open(); public void Dispose() { field.Dispose(); } }	Maintainability
DoNotHideInheritedMembers	On hiding an inherited member, the derived version of the member replaces the base class version	Cause: Using a new keyword for a base class member in the derived class, hides the base class member. Ensure the required functionality and look out for compiler warnings. To simply put, if a method is not hiding the base method, it should be overriding it. Complaint code: public class B { public virtual void M(int i) { } } public class C : B { public new void M(int i) { } } Non-compliant code: public class B { public virtual void M(int i) { } } public class C : B { public override void M(int i) { } }	Understandability
DoNotPrefixLocalCallsWithThisKeyword	A call to an instance member of the local class or a base class is prefixed with ‘this’.	Non-compliant code: class Employee { public string FirstName; public string LastName; public string Salary; public void SetName( string newFirstName, string newLastName) { this.FirstName = newFirstName; this.LastName = newLastName; } } Compliant code: class Employee { public string FirstName; public string LastName; public string Salary; public void SetName( string newFirstName, string newLastName) { FirstName = newFirstName; LastName = newLastName; } }	Understandability
FieldsMustBePrivate	Make the field private and add a property to expose the field outside of the class	Cause: A violation of this rule occurs whenever a field in a class is given non-private access. For maintainability reasons, //properties should always be used as the mechanism for exposing fields outside of a class, and fields should always be //declared with private access. This allows the internal implementation of the property to change over time without changing //the interface of the class. Issue occurence: Fields located within C# structs are allowed to have any access level. Solution: To fix a violation of this rule, make the field private, and add a property to expose the field outside of the class.	Maintainability
HardCodedStringsAndMagicNumbers	Hard coded values should be moved to resources for better maintainability	Cause: For better maintainability of code it is recommended to have all strings in one place and you only need to change it there to update the whole program. Non-complaint code: public void MyMethod() { if (s != “some hard-coded value”) { } } Compliant code: public void MyMethod() { if (s.Equals(Resources.SomeValue)) { } }	Maintainability
MakeLocalVariableConstant	If a variable is assigned a constant value and never changed, it can be made ‘const’	Cause: The variable is assigned a constant value and never changed, it can be made a const Non-compliant code: class Class1 { int Method1() { int x = 30; return x; } } Compliant code: class Class1 { int Method1() { const int x = 30; return z; } }	Maintainability
RedundantFieldAssignment	Consider not assigning the default value to a field for performance optimisation	Cause: It’s recommended not to assign the default value to a field as a performance optimization. Non-complaint code: class SampleClass { private int number = 0; // … } Complaint code: class SampleClass { private int number; // … }	Efficiency
ThrowDoesNothing	If an exception is caught and then thrown again the original stack trace will be lost. It is best to throw an exception without using any parameters	Cause: Throwing the same exception as passed to the ‘catch’ block lose the original stack trace and will make debugging this exception a lot more difficult. The correct way to rethrow an exception without changing it is by using ‘throw’ without any parameter. Non-complaint code: try { } catch (System.Exception ex) { throw ex; } Complaint code: You will have two choices, you can rethrow the original exception as-is: try { } catch (System.Exception ex) { throw; } //Or you can rethrow the original exception as an inner exception, like so: try { } catch (System.Exception ex) { throw new Exception(“some reason to rethrow”, ex); }	Analyzability
UseConfigureAwaitFalseOnAwaitedTask	Consider using ConfigureAwait(false) on the awaited task	Non-complaint code: public async Task TestAsync() { await GetValueAsync(); // RCS1090 } Complaint code: public async Task TestAsync() { await GetValueAsync().ConfigureAwait(false); }	Robustness
UseOfRegexIsMatchMightBeImproved	Instantiating the Regex object multiple times might be bad for performance. Consider using the static IsMatch method from Regex class and/or compile the regex	Cause: When IsMatch() method is called multiple times, you should be using the static Regex.IsMatch method, as that can be cached and won’t be interpreted //every time you call the method, it will give you better performance. Non-complaint code: public static bool TestRegex(string parameterValue) { string pattern = @”p{Sc}+s*d+”; Regex test = new Regex(pattern); return test.IsMatch(parameterValue); } Complaint code: public static bool TestRegex(string parameterValue) { string pattern = @”p{Sc}+s*d+”; return Regex.IsMatch(parameterValue, pattern); }	Efficiency
UseStaticMethod	If the method is not referencing any instance variable and if you are not creating a virtual/abstract/new or partial method and if it is not an overridden method, your instance method can be changed to a static method.	Non-complaint code: public class Program { public int calculation(int x, int y) { int val = x * y; return val; } static void Main(string[] args) { Program obj = new Program(); int result = obj.calculation(18, 14); Console.WriteLine(result); Console.ReadKey(); } } Complaint code: public class Program { public static int calculation(int x, int y) { int val = x * y; return val; } static void Main(string[] args) { int result = calculation(18, 14); Console.WriteLine(result); Console.ReadKey(); } }	Robustness
UseSwitch	Multiple ‘if’ and ‘else if’ statements can be replaced with a ‘switch’	Cause In a switch statement, all elements get the same access time, compared to a list of if-else’s where the last element takes much more time to reach as //it has to evaluate every previous condition first. Thus the compiler is better in optimizing a switch-statement than an if-statement. Non-complaint code: public void DoThis(string s) { if (s == “A”) { // .. } else if (s == “B”) { // .. } else if (s == “C”) { // .. } else { // .. } } Complaint code: public void DoThis(string s) { switch (s) { case “A”: break; case “B”: break; case “C”: break; default: break; } }	Efficiency
LogErrorInCatch	The log level inside Catch block should be Error	Cause A log level less than an Error is not recommended within a Catch Block especially when there is an exception. Non-complaint code: try { var testVar = 10/0; } catch (Exception e) { log.Info("Divide by zero exception occured"); } Non-complaint code: try { var testVar = 10/0; } catch (Exception e) { log.Error("Divide by zero exception occured"); }	Maintainability

---

---

We have discovered some checks and rules for Objective C. Following section briefs, about the Embold CXX code issues.

---

Embold comes with a state-of-the-art proprietary analyser. In addition to integrating and building upon great work from the open source space, we have created our own checks and rules to discover code issues that were not sufficiently covered by other tools.

---

---

---

---

Rule	Description	Example	KPI
optin.osx.cocoa.localizability.EmptyLocalizationContextChecke	Check that NSLocalizedString macros include a comment for context	– (void)test { NSString *string = NSLocalizedString(@”LocalizedString”, nil); // warn NSString *string2 = NSLocalizedString(@”LocalizedString”, @” “); // warn NSString *string3 = NSLocalizedStringWithDefaultValue( @”LocalizedString”, nil, [[NSBundle alloc	Maintainability
osx.cocoa.Loops	Improved modeling of loops using Cocoa collection types		Maintainability
osx.cocoa.NonNilReturnValue	Model the APIs that are guaranteed to return a non-nil value		Maintainability
osx.cocoa.NSAutoreleasePool	Warn for suboptimal uses of NSAutoreleasePool in Objective-C GC mode	void test() { NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init]; [pool release]; // warn }	Maintainability
osx.cocoa.UnusedIvars	Warn about private ivars that are never used	@interface MyObj : NSObject { @private id x; // warn } @end @implementation MyObj @end	Maintainability

---

The section below covers the Embold Java code issues, PMD, and SpotBugs code issues.

---

Embold comes with a state-of-the-art proprietary analyser. In addition to integrating and building upon great work from the open source space, we have created our own checks and rules to discover code issues that were not sufficiently covered by other tools.

Rule	Description	Example	KPI	Tags
Compile Regex Once	Pattern object compiles the regular expressions which are passed to them and this compilation happens in the memory. If a regular expression is used many times, then this compilation should be performed only once.	Non-compliant code: Class Foo { // This method can call multiple times void findText(String inputText) { Pattern pattern = Pattern.compile("(.*)(\\d+)(.*)"); Matcher matcher = pattern.matcher(inputText); if(matcher.find()) { MatchResult result = matcher.toMatchResult(); } } } Compliant code: Class Foo { Pattern pattern = Pattern.compile("(.*)(\\d+)(.*)"); void findText(String inputText) { Matcher matcher = pattern.matcher(inputText); if(matcher.find()) { MatchResult result = matcher.toMatchResult(); } } }	Efficiency
Disabled Spring Securitys CSRF	CSRF protection is enabled by default in the Java configuration. Disabling CSRF protection can create a major security threat. Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. More Info - OWASP Top 10 A6:2017 - Security Misconfiguration CWE-352 - Cross-Site Request Forgery (CSRF)	Non-compliant code: @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable(); } } Compliant code: @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { // Do not disable CSRF // http.csrf().disable(); } }	Security
Resource Leak	Resource should be closed in finally block. Another way is to use try-with-resource. In case of either exception or no exception, close() should always be put in finally clause.	Non-compliant code: class Demo { public void process1() { try { PrintWriter out = new PrintWriter(new BufferedWriter(new FileWriter("out.txt", true))); out.println("the text"); out.close(); //close() is in try clause } catch (IOException e) { logger.error("resource is closed in try block",e); } } //Non-compliant code //resource is not closed anywhere public void process2() { try { PrintWriter out = new PrintWriter(new BufferedWriter(new FileWriter("out.txt", true))); out.println("the text"); } catch (IOException e) { logger.error("Resource is not closed anywhere.",e); } } } Compliant code: class Demo { public void process2() { printWriter out = null; try { out = new PrintWriter(new BufferedWriter(new FileWriter("out.txt", true))); out.println("the text"); } catch (IOException e) { logger.error("Resource is closed in finally block",e); } finally { if (out != null) { out.close(); //close() is in finally clause } } } //compliant code //try-with-resource statement public void process3() { try (PrintWriter out2 = new PrintWriter(new BufferedWriter(new FileWriter("out.txt", true)))) { out2.println("the text"); } catch (IOException e) { logger.error("try-with-resource",e); } } }	Resource Utilization
Weak Cipher Algorithm	Use strong cryptographic algorithms as they are less vulnerable to brute force attacks among others. For more information : : OWASP Top 10 2017 Category A3 - Sensitive Data Exposure MITRE, CWE-327 - Use of a Broken or Risky Cryptographic Algorithm	Non-compliant code: class CipherExample { public void foo() { try { Cipher c = Cipher.getInstance("DES"); // Or DESede, RC2, RC4 as these are known to be vulnerable } catch (NoSuchAlgorithmException | NoSuchPaddingException e) { logger.error("Invalid algorithm",e); } } } Compliant code: class CipherExample { public void foo() { try { Cipher c = Cipher.getInstance("AES/GCM/NoPadding"); // Compliant } catch(NoSuchAlgorithmException|NoSuchPaddingException e) { logger.error("Invalid algorithm",e); } } }	Security
Possible Thread Leak In Executor Service	Thread leak can be possible if ExecutorService is not getting shutdown.There is a queue of tasks between client threads and thread pool. When the normal thread finishes the "run" method (Runnable or Callable), it will be passed to garbage collector for collection. But with ExecuterService, threads will be simply put on hold and they will not be selected for garbage collection. Therefore, the shutdown is needed for ExecutorService.	Non-compliant code: class Demo { //ExecutorService is not closed anywhere public void process1() { ExecutorService executorService = Executors.newSingleThreadExecutor(); executorService.execute(new Runnable() { @Override public void run() { try { doTask(); } catch (Exception e) { logger.error("indexing failed", e); } } }); } } Compliant code: class Demo { public void process2() { ExecutorService executorService = Executors.newSingleThreadExecutor(); executorService.execute(new Runnable() { @Override public void run() { try { doTask(); } catch (Exception e) { logger.error("indexing failed", e); } } }); executorService.shutdown(); } }	Resource Utilization
Non Private Field In Synchronized Block	Non-private, non-final field accessed in synchronized block indicates possibly partial synchronization, and does not protect direct access to the field from other parts of the system without synchronization. Make the field private and/or final, and provide accessors which can enforce synchronization. More Info - CWE-820 - Missing synchronization	Non-compliant code: class NonPrivateFieldAccessInSynchronizedBlock { protected List statuses = new ArrayList<>(); // or public private Object lock = new Object(); void foo() { // Some processing synchronized(lock) { statuses.add("Running"); } } // Some more processing } Compliant code class NonPrivateFieldAccessInSynchronizedBlock { private List statuses = new ArrayList<>(); private Object lock = new Object(); void foo() { // Some processing synchronized(lock) { statuses.add("Running"); } // Some more processing } void updateStatus(String status) { synchronized(lock) { statuses.add(status); } } }	Robustness, Security
Database Should Be Password Protected	Database connection should always be password protected. Attacker can access the sensitive data from the database, in case it is not secured by password. More Info - [OWASP Top 10 2017 Category A3] - Sensitive Data Exposure - [MITRE, CWE-521] - Weak Password Requirements	Non-compliant code: class CipherExample { public void foo() { Connection conn1 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "AppLogin", ""); Connection conn2 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user&password="); Connection conn3 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user"); } } Compliant code class CipherExample { public void foo() { Connection conn4 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true", "AppLogin", "password"); Connection conn5 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true?user=user&password=text"); Connection conn6 = DriverManager.getConnection("jdbc:derby:memory:myDB;create=true&password=text", "AppLogin", ""); } }	Security
Should Not Use getRequestedSessionId API	This method returns the session ID specified by the client and may not be the same as the ID of the current valid session for this request. If the client does not mention a session ID, it returns null. The session ID returned is either transmitted in a cookie or a URL parameter, hence by definition nothing prevents the end-user from manually updating the value of this session ID in the HTTP request. More Info - [CWE-807] - Reliance on Untrusted Inputs in a Security Decision - [OWASP] - Broken Authentication	class Demo{ // Non-compliant code public void method(HttpServletRequest request) { if(isActiveSession(request.getRequestedSessionId()) ){ } } }	Security
Web Application Contains Main Method	This method returns the session ID specified by the client and may not be the same as the ID of the current valid session for this request. If the client does not mention a session ID, it returns null. The session ID returned is either transmitted in a cookie or a URL parameter, hence by definition nothing prevents the end-user from manually updating the value of this session ID in the HTTP request. More Info - [CWE-489] - Leftover Debug Code - [OWASP] - Sensitive Data Exposure	class Demo{ // Non-compliant code public void method(HttpServletRequest request) { if(isActiveSession(request.getRequestedSessionId()) ){ } } } ```	Security
Authenticate LDAP Connection	Anonymous binds and unauthenticated binds allow access to information in the LDAP directory without providing a password. Therefore using these binds is strongly discouraged. More Info - [OWASP Top 10 2017 Category A2]- Broken Authentication - [CWE-521] - Weak Password Requirements - [ldapwiki.com] - Simple Authentication	//Non-compliant code Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); // Use anonymous authentication env.put(Context.SECURITY_AUTHENTICATION, "none"); // Noncompliant // Compliant code Hashtable env = new Hashtable(); env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.SECURITY_AUTHENTICATION, "simple");	Security
Potential Command Injection	Avoid using unfiltered input to process executor APIs because that can lead to arbitrary command execution. More Info - [OWASP] - Command Injection - [OWASP: Top 10 2013 A1] -Injection - [CWE-78] - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	// Non-compliant code import java.lang.Runtime; class Demo{ Runtime r = Runtime.getRuntime(); r.exec("/bin/sh -c sometool" + input); }	Security
Potential Path Traversal	Path traversal is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating system files. More Info - [CWE-22] - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - [OWASP] - Path Traversal	// Non-compliant code class Demo{ @GET @Path("/images/{image}") @Produces("images/*") public Response getImage(@javax.ws.rs.PathParam("image") String image) { File file = new File("resources/images/", image); //Weak point if (!file.exists()) { return Response.status(Status.NOT_FOUND).build(); } return Response.ok().entity(new FileInputStream(file)).build(); } // Compliant code } import org.apache.commons.io.FilenameUtils; class Demo1{ @GET @Path("/images/{image}") @Produces("images/*") public Response getImage(@javax.ws.rs.PathParam("image") String image) { File file = new File("resources/images/", FilenameUtils.getName(image)); //Fix if (!file.exists()) { return Response.status(Status.NOT_FOUND).build(); } return Response.ok().entity(new FileInputStream(file)).build(); } }	Security
Accessing Android external storage is security-sensitive	Files or data stored in the android application should be security-sensitive. Files can be globally readable or writable as they are stored on external storage. Avoid storing sensitive information on the external storage as anyone can tamper with the data or remove the files by using any application. **More Info** - [OWASP Top 10 2017 Category A1](https://owasp.org/www-project-top-ten/2017/A1_2017-Injection.html) - Injection - [OWASP Top 10 2017 Category A3](https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure) - Sensitive Data Exposure - [CWE-312](https://cwe.mitre.org/data/definitions/312.html) - Cleartext Storage of Sensitive Information - [CWE-20](https://cwe.mitre.org/data/definitions/20.html) - Improper Input Validation accessing android external storage	```java //non-compliant import android.content.Context; import android.os.Environment; public class AccessExternalFiles { public void accessFiles(Context context) { Environment.getExternalStoragePublicDirectory(Environment.DIRECTORY_PICTURES); // non-compliant context.getExternalFilesDir(Environment.DIRECTORY_PICTURES); // non-compliant } }	Security
Using unsafe Jackson deserialization configuration is security-sensitive	JThe untrusted data could cause abuse to application logic. Jackson's deserialization should be configured securely. Implement @JsonTypeName and @JsonSubTypes to prevent serialized data from an untrusted source. It can help to safeguard the data from external attackers. **More Info** - [OWASP Top 10 2017 Category A8](https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization) - Insecure Deserialization - [CWE-502](https://cwe.mitre.org/data/definitions/502.html) - Deserialization of Untrusted Data	//non-compliant ObjectMapper mapper = new ObjectMapper(); mapper.enableDefaultTyping(); // non-compliant @JsonTypeInfo(use = Id.CLASS) // non-compliant abstract class PhoneNumber { }	Security
Setting JavaBean properties is security-sensitive	The JavaBean property uses a set or get functions that are exposed to other applications. An attacker can modify its properties, attack malicious code that can be risky. Avoid storing sensitive information under this JavaBean property as it may help the user to retain its software integrity. **More Info** - [OWASP Top 10 2017 Category A8](https://owasp.org/www-project-top-ten/2017/A8_2017-Insecure_Deserialization) - Insecure Deserialization - [CWE-502](https://cwe.mitre.org/data/definitions/502.html) - Deserialization of Untrusted Data	//non-compliant class Demo{ Company bean = new Company(); HashMap map = new HashMap(); Enumeration names = request.getParameterNames(); while (names.hasMoreElements()) { String name = (String) names.nextElement(); map.put(name, request.getParameterValues(name)); } BeanUtils.populate(bean, map); // "map" is populated with data coming from user input, here "request.getParameterNames()" }	Security
Run Should Not Be Called Directly	The program accidentally calls the Thread.run() method and causes the code to be executed in the current thread, just like any other method call. Instead, use Thread.start() to actually create a new thread so that the runnable's 'run()' method is executed in parallel. More Info [CWE-572] - Call to Thread run() instead of start()	Non-compliant code class Demo { Thread myThread = new Thread(runnable); myThread.run(); } Compliant code class Demo { Thread myThread = new Thread(runnable); myThread.start(); }	Functionality, Efficiency
Exclude SpringBootApplication And ComponentScan From The Default Package	Exclude "SpringBootApplication" and "@ComponentScan" from the default package.	Non-compliant code import org.springframework.boot.SpringApplication; @SpringBootApplication public class SpringBootApplicationAndComponentScanNotBeUsedInDefaultPackage { public static void main(String[] args) { SpringApplication.run(SpringBootApplicationAndComponentScanNotBeUsedInDefaultPackage.class, args); } } Compliant code package javacodechecker; import org.springframework.boot.SpringApplication; @SpringBootApplication public class SpringBootApplicationAndComponentScanNotBeUsedInDefaultPackage { public static void main(String[] args) { SpringApplication.run(SpringBootApplicationAndComponentScanNotBeUsedInDefaultPackage.class, args); } }	Efficiency	spring

Rule	Description	Example	KPI
Initialization Of Secure Random At Method Level	"SecureRandom" should not be initialized in method. Every SecureRandom generation is seeded from some entropy pool. Creating a new SecureRandom method on every call might slow down the application as it might block the creation of seed. Use a statically created instance instead.	Non-compliant code class Demo { public int generateSecureKey() { SecureRandom secureRandom = new SecureRandom(); return secureRandom.nextInt(); } } Compliant code class SecureRandomGenerator { static SecureRandom secureRandom = new SecureRandom(); public int generateSecureKey() { return secureRandom.nextInt(); } }	Security
Security Sensitive Regex	Regular expressions are security-sensitive. Evaluating regular expressions with input string can be an extremely CPU-intensive task. The regular expression naive algorithm builds a Nondeterministic Finite Automaton (NFA), the attacker might use the knowledge of states of finite state machine to look for applications that use regular expressions, containing an Evil Regex, and send a well-crafted input, that will hang the system. Alternatively, if a Regex itself is affected by a user input, the attacker can inject an Evil Regex, and make the system vulnerable.	Examples of Evil Patterns: Examples of Evil pattern : 1) (a+)+ 2) ([a-zA-Z]+)* 3) (a|aa)+ 4) (a|a?)+ 5) (.*a){2} for x > 10 E.g Pattern: /(a+)+b/; Input string:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab Instead use Pattern:(/a+b/) //fixed the hard-coded regex pattern to avoid possible captures, possessive quantifiers and back-references To avoid possible attacks, if the regex pattern is defined with an user-controlled input, it should be sanitized in order to escape characters which are part of the regular expression syntax. Non-compliant code class Demo { public boolean validate1(javax.servlet.http.HttpServletRequest request) { String regex = " /(a+)+b/"; String input = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab"; input.matches(regex); //Noncompliant } } Compliant code class Demo { public boolean { validate2(javax.servlet.http.HttpServletRequest request) { String regex = "/a+b/"; String input = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab"; input.matches(Pattern.quote(regex)); // Compliant } }	Efficiency, Security
Use Of System.err.println	1. System.err.println is an IO-operation and therefore is time consuming. 2. The better approach is to use a logging framework for a message queue. 3. Moreover, you can configure separate log files for different purposes.	Non-compliant code class Demo { public void process1() { System.err.println("Error while processing"); } } Compliant code class Demo { public void process2() { logger.error("Error while processing",e); } }	Analyzability
Invalid Logging Class Name	Avoid incorrect class names while creating logger. Ignoring this may create confusion while analysing logs.	Non-compliant code public class LoggingClass extends BaseChecker { private static Logger logger = LogManager.getLogger(InvalidLoggingClass.class.getName()); } Compliant code public class LoggingClass extends BaseChecker { private static Logger logger = LogManager.getLogger(LoggingClass.class.getName()); }	Analyzability
Use Of System.out.println	1.Sending messages to stdout is usually inappropriate in a production environment. E.g. If you are coding a GUI app, the information should be presented to the user and not to the stdout method anywhere. 2.System.out.println is an IO-operation and therefore is time consuming. The better approach is to use a logging framework for a message queue. 3.Moreover, you can configure separate log files for different purposes.	Non-compliant code class Demo { public void process1() { //some statements System.out.println("Some text"); } Compliant code public void process2() { //some statements logger.info("Some text"); } }	Analyzability
Complex Regex Pattern	Avoid usage of complex Regex pattern as it involves heavy processing.In some cases complex Regex performance test shows that regex is significantly inefficient.	//Non-compliant code class Demo { String regex = "(.*)(\\d+)(.*)"; Pattern p = Pattern.compile(regex); }	Efficiency
Empty Catch Block	Empty Catch Block finds instances where an exception is caught, but nothing is done. In most circumstances, this ignores an exception which should either be acted on or reported. Avoid keeping the catch block empty.	// Non-compliant code class Demo { public void process1() { try { FileInputStream fis = new FileInputStream("/tmp/bugger"); } catch (IOException ioe) { } } // compliant code public void process2() { try { FileInputStream fis = new FileInputStream("/tmp/bugger"); } catch (IOException ex) { logger.error("Inside catch block",ex); } } }	Analyzability
Empty Catch Block	Empty Catch Block finds instances where an exception is caught, but nothing is done. In most circumstances, this ignores an exception which should either be acted on or reported. Avoid keeping the catch block empty.	// Non-compliant code class Demo { public void process1() { try { FileInputStream fis = new FileInputStream("/tmp/bugger"); } catch (IOException ioe) { } } // compliant code public void process2() { try { FileInputStream fis = new FileInputStream("/tmp/bugger"); } catch (IOException ex) { logger.error("Inside catch block",ex); } } }	Analyzability
Sensitive Info Logged	Logger is used for recording application activity. Information displayed on the logs is visible to different stakeholders. Avoid logging sensitive information such as password, key, social security number etc. Not complying may compromise the system security.	Non-compliant code: class Demo { void process1(String password) { //Displaying sensitive information in logs logger.info("Password received "+ password); } } Compliant code class Demo { void process1(String password) { //doSomething logger.info("Password received"); } }	Security
Main Should Not Throw Anything	The main method should not throw any checked exception, instead, it needs to handle properly. If a non-checked exception is thrown (and not catch) in the main method, it will terminate.	Non-compliant code: public static void main(String args[]) throws Exception{ System.out.println("Hello"); } } Compliant code public static void main(String[] args) { try { int data=50/0; } catch(ArithmeticException e){ System.out.println(e); } }	Functionality
Avoid Synchronized At Method Level	Avoid synchronized at method level. When new code is added to the existing method then method-level synchronization can cause problems so to avoid these kind of problems use block-level synchronization. Block-level synchronization helps to ensure that only the code that needs synchronization gets it.	Non-compliant code: public class SynchronizedCounter { // Non-compliant code private int c = 0; public synchronized void increment() { c++; } } Compliant code public class SynchronizedCounter { // compliant code private int c = 0; public void increment() { synchronized(Test.class) { c++; } } }	Efficiency
Shortcircuit Logic Should Be Used In Boolean Contexts	Using non-short-curcuit logic is a mistake it can also cause serious problem error.	Non-compliant code: if(getTrue() | getFalse()) { ... } Compliant code if(getTrue() || getFalse()) { ... }	Efficiency

Rule	Description	Example	KPI
Return Empty Array Or Collection Instead Of Null	Returning null value instead of an empty array or collection can lead to denial-of-service vulnerabilities when the client code fails to explicitly handle the null return value. For methods that return a set of values using an array or collection, returning an empty array or collection is an excellent alternative to returning a null value. More Info MET55-J - Return an empty array or collection instead of a null value for methods that return an array or collection MSC19-C - For functions that return an array, prefer returning an empty array over a null value	Non-compliant code: class Demo { public static List getList() { return null; // Non-compliant code } public static void main(String[] args) { List results = getList(); for (Result result: results) { } // Need to add Nullity check to prevent NPE } } Compliant code: class Demo { public static List getList() { return Collections.emptyList(); // Compliant code } public static void main(String[] args) { List results = getList(); for (Result result: results) { } // No need to add Nullity check to prevent NPE } }	Robustness
Preserve Stack Trace In Logs	Preserve stack trace in logs. This will help to analyse the logs in case of any exception.	Non-compliant code: class Demo { public void process1() { try{ //some statements } catch(Exception e) { logger.error("Error while processing"); } } } Compliant code: class Demo { public void process2() { try { //some statements } catch(Exception e) { logger.error("Error while processing",e); } } }	Analyzability
Read Only Transaction	Spring components support database transactions using "@Transactional" annotation. If readOnly attribute is not explicitly set to true, we will have read/write transactions for select queries. Hence, it is always recommended to explicitly specify the readOnly attribute.	Non-Compliant Code: class Demo { public class UserRepository { @Query("select username from users") public List getAllUsers() { } } } Compliant Code: class Demo { @Transactional(readOnly=true) public class UserRepository { @Query("select username from users") public List getAllUsers() { } } //Compliant Code public class UserRepository { @Transactional(readOnly=true) @Query("select username from users") public List getAllUsers() { } } }	Robustness
Unusual REST Practice	The best practices while creating REST API's are : 1. URL should contain resources (E.g. nouns) only; not actions or verbs. 2. Singular and plural noun should not be mixed together. 3. Use plural noun only for all the resources. 4. Use GET method, instead of the POST method to fetch the data. 5. Use PUT, POST and DELETE methods to alter the state.	Non-compliant code class Demo { @RequestMapping("/users") public class UserController{ @RequestMapping(value="/getUser") public void getUser(){ } } } Compliant code class Demo { @RequestMapping("/users") public class UserController{ @RequestMapping(value="/{user}") public void getUser() { } } }	Maintainability
Variables Should Not Be Self Assigned	Self-assignment of the variables can be confusing and leads to bugs; however, one should not assign a variable to itself. Hence, this statement can be redundant and removed.	Non-compliant code class Demo { public void demo(String name, String surName) { String surName = surName; name = name; } } Compliant code class Demo { public void setName(String name) { this.name = name; } }	Functionality
Externalizable Must Have No Arguments Constructor	Externalizable interface cannot be deserialized without a non-argument constructor,so non-argument constructor must be implemented.	Non-compliant code public class Car implements Externalizable { public Car(String color,String model,int avg){ } } Compliant code public class Car implements Externalizable { public Car() {} public Car (String color,String model,int avg){ }	Efficiency
Getters And Setters Should Access The Expected Fields	Getter and Setter methods must access the expected fields. For each instance variable, a getter method returns its value, while a setter method sets or updates its value. For example, 'active' is an instance variable and 'setActive' (boolean value) is a setter method. Instead of unexpectedly updating any field, it must update or set the active variable.	Non-compliant code class Demo { // Non-compliant code private boolean active; public void setActive(boolean b) { this.Y = b; } Compliant code private boolean active; public void setActive(boolean b) { this.active = b; } }	Functionality
RunFinalizersOnExit Should Not Be Called	Remove Runtime::runFinalizersOnExit and System::runFinalizersOnExit methods. It can be enabled with "System.runFinalizersOnExit" and "Runtime.runFinalizersOnExit".It may result in finalizers being called on live objects while other threads are concurrently manipulating those objects, resulting in unexpected behavior or deadlock. - [CWE-586]- Explicit Call to Finalize()	Non-compliant code public static void main(String [] args) { System.runFinalizersOnExit(true); // Noncompliant } Compliant code public static void main(String [] args) { Runtime.addShutdownHook(new Runnable() { public void run(){ doSomething(); } });	Efficiency
Big Integer Instantiation	Use already existing BigIntegers (BigInteger.ZERO, BigInteger.ONE, BigInteger.TEN).Instead of creating a new object with new BigInteger better use one static object which is created once when the BigInteger class is loaded. It is likely to yield significantly better space and time performance. Zero and One is probably the most fundamental number in mathematics. Using static objects avoids the allocation about 48 bytes and the need to collect them back later in a tight loop that can matter.	Non-compliant code BigInteger bigInteger = new BigInteger("1"); int n=4; for (int i = 2; i <=n ; i++){ bigInteger = bigInteger.multiply(BigInteger.valueOf(i)); } System.out.println("Factorial of 4 : "+bigInteger); Compliant code BigInteger bigInteger = BigInteger.ONE; int n=4; for (int i = 2; i <=n ; i++){ bigInteger = bigInteger.multiply(BigInteger.valueOf(i)); } System.out.println("Factorial of 4 : "+bigInteger);	Efficiency
Maps With Enum Values Replace With EnumMap	If Map has all the key values from the same Enum then Map should be replaced with EnumMap because the underlying data structure is a simple array so it will be more efficient than other sets.	Non-compliant code public class MyClass { public enum CITY { PUNE, MUMBAI, GOA, NAGPUR; } public void mapMood() { Map moodMap = new HashMap (); } } Compliant code public class MyClass { public enum CITY { PUNE, MUMBAI, GOA, NAGPUR; } public void mapMood() { EnumMap moodMap = new EnumMap<> (CITY.class); } }	Functionality
Mismatch Regex Boundaries Should Not Be Used	In the regular expression by switching $ and ^ boundaries it will never match and it can be misused.	Noncompliant Code pattern.compile("$[a-z]+^"); Compliant Code pattern.compile("^[a-z]+$");	Functionality
Avoid Concatenating Char As String	Avoid concatenating characters as strings because using string rather than char creates unnecessarily space accommodation in heap space. Appending a character as a char will always be faster than appending it as a String.	Noncompliant Code class Demo { StringBuffer sb = new StringBuffer("Hi "); sb.append("i"); System.out.println(sb); } Compliant Code class Demo { StringBuffer sb = new StringBuffer("Hi "); sb.append('i'); System.out.println(sb); }	Functionality
Empty String Should Not Be Used	Concatenating empty string with literals during conversion is inefficient.	Noncompliant Code String s = "" + 456; Compliant Code String t = Integer.toString(456);	Functionality
Exceptions Should Not Be Thrown In Finally Block	Exception that is thrown in finally block will mask any previous exception in try or catch block and the stack trace and exception message will be lost.	Noncompliant Code try { throw new IllegalArgumentException(); } finally { throw new RuntimeException(); } Compliant Code try { throw new IllegalArgumentException(); } finally { }	Functionality

Rule	Description	Example	KPI
Log Level Info In Catch Block	The catch block handles exception that occurs in associated try block. In this block, the logger level is expected to be as "error". This is a good list describing the log levels : 1. Debug : Used for development and testing. 2. Information : Used to output information that is useful to run and manage your system. 3. Warning : Used for handled 'exceptions' or other important log events. 4. Error : Used to log all unhandled exceptions. This is typically logged inside a catch block at the boundary of your application. 5. Fatal : Used for special exceptions/conditions where it is imperative that we can quickly pick out these events.	Non-compliant code: class Demo { public void process1() { try { //statements where exceptions may occur } catch(Exception ex) { logger.info("some information",ex); } } } Compliant code: class Demo { public void process2() { try { //statements where exceptions may occur } catch(Exception ex) { logger.error("some information",ex); } } }	Analyzability
Non Thread Safe Field Declaration	A field declared inside the spring component should be thread safe. By default, beans in spring are singleton. Multiple threads accessing the same component may produce inconsistent results, if they access fields declared globally.	Non-compliant code: class Demo { @Service public class LoggingClass extends BaseChecker { private Map map = new HashMap(); void modifyMap(){ map.add("key","value"); } } } Compliant code: class Demo { @Service public class LoggingClass extends BaseChecker { void modifyMap(){ Map map = new HashMap(); map.add("key","value"); } } }	Robustness

Rule	Description	Example	KPI
String Concatenation In Logging	Instead of string concatenation use parameterized logging. Concatenation is calculated before the condition check. If you call your logging framework multiple times which turns to be false, this effort will be a waste of time. E.g. if you call your logging framework 10K times conditionally and all of them evaluates to be false, concatenation will happen 10K times.	Non-compliant code: class Demo { //If log level is not debug, then also string concatenation will happen. public void process1() { logger.debug("Comparing objects: " + object1 + " and " + object2); } } Compliant code: class Demo { public void process2() { //Compliant code logger.debug("Comparing objects: {} and {}",object1, object2); } }	Efficiency
Tightly Coupled Class	A spring component such as repository, service and controller should auto-wire the interface, instead of its implementation class. Ignoring this, will increase tight coupling among the classes	Non-compliant code: class Demo { @RequestMapping("/users") public class UserController { @Autowire UserServiceImpl userServiceImpl; } } Compliant code: class Demo { @RequestMapping("/users") public class UserController { @Autowire UserService userService; } }	Maintainability

PMD is an open source static code analyser which detects code issues and bugs in Java programs. Visit their website for more detailed information on PMD and the ruleset found below.

---

---

---

---