Standard Compliance
BrowserStack Code Quality detects violations of standards such as MISRA. To understand the percentage coverage on each standard, please read the respective sections below.
MISRA
Introduction
MISRA, The Motor Industry Software Reliability Association is a set of standards, that provides software development guidelines. BrowserStack Code Quality detects MISRA rule violations.
BrowserStack Code Quality fully supports 97.90% MISRA C:2012 rules. There is a total of 143 rules out of which BrowserStack Code Quality supports 140 and 3 rules (i.e. 18.2, 19.1, 22.3) are dynamic which BrowserStack Code Quality does not support right now.
For more information, read here.
Enabling and disabling MISRA checks in BrowserStack Code Quality
MISRA is one of the code issue type. For more details, refer to the Code Checker Configuration document. This article will be useful for enabling or disabling MISRA related code issues.
MISRA C: 2012 Compliance Matrix
| MISRA Rules | Mandatory | Required | Advisory | Decidable | Undecidable | |
|---|---|---|---|---|---|---|
| Supported | 155 | 9 | 98 | 33 | 118 | 24 |
| Unsupported | 3 | 1 | 2 | 3 | 3 | 13 |
| Total | 158 | 10 | 100 | 36 | 121 | 37 |
| Percent Coverage | 98.10% | 90% | 98.00% | 100% | 97.5% | 64.80% |
Rules updated in Amendments 1 and 2 are included in the table above.
Supported MISRA rules
MISRA guidelines ensure that your code is safe and secure. Each rule has its own key and description. All the supported rules have KPI: Robustness. Following MISRA rules are supported by the latest version of BrowserStack Code Quality.
| MISRAC-2012 ID | BrowserStack Code Quality Rule Key | Description |
|---|---|---|
| Rule 1.1 | MISRA-C2012-1.1 | The program shall contain no violations of the standard C syntax and constraints, and shall not exceed the implementation’s translation limits. |
| Rule 1.2 | MISRA-C2012-1.2 | Language extensions should not be used |
| Rule 1.3 | MISRA-C2012-1.3 | There shall be no occurrence of undefined or critical unspecified behaviour |
| Rule 2.1 | MISRA-C2012-2.1 | A project shall not contain unreachable code |
| Rule 2.2 | MISRA-C2012-2.2 | There shall be no dead code |
| Rule 2.3 | MISRA-C2012-2.3 | A project should not contain unused type declarations |
| Rule 2.4 | MISRA-C2012-2.4 | A project should not contain unused tag declarations |
| Rule 2.5 | MISRA-C2012-2.5 | A project should not contain unused macro declarations |
| Rule 2.6 | MISRA-C2012-2.6 | A function should not contain unused label declarations |
| Rule 2.7 | MISRA-C2012-2.7 | There should be no unused parameters in functions |
| Rule 3.1 | MISRA-C2012-3.1 | The character sequences /* an // shall not be used within a comment |
| Rule 3.2 | MISRA-C2012-3.2 | If the source line containing a // comment ends with a \ character in the source character set, the next line becomes part of the comment. This may result in unintentional removal of code. |
| Rule 4.1 | MISRA-C2012-4.1 | Octal and hexadecimal escape sequences shall be terminated |
| Rule 4.2 | MISRA-C2012-4.2 | Trigraphs should not be used |
| Rule 5.1 | MISRA-C2012-5.1 | External identifiers shall be distinct |
| Rule 5.2 | MISRA-C2012-5.2 | Identifiers declared in the same scope and name space shall be distinct |
| Rule 5.3 | MISRA-C2012-5.3 | An identifier declared in an inner scope shall not hide an identifier declared in an outer scope |
| Rule 5.4 | MISRA-C2012-5.4 | Macro identifiers shall be distinct |
| Rule 5.5 | MISRA-C2012-5.5 | Identifiers shall be distinct from macro names |
| Rule 5.6 | MISRA-C2012-5.6 | A typedef name shall be a unique identifier |
| Rule 5.7 | MISRA-C2012-5.7 | A tag name shall be a unique identifier |
| Rule 5.8 | MISRA-C2012-5.8 | Identifiers that define objects or functions with external linkage shall be unique |
| Rule 5.9 | MISRA-C2012-5.9 | Identifiers that define objects or functions with internal linkage should be unique |
| Rule 6.1 | MISRA_C2012-6.1 | Bit-fields shall only be declared with an appropriate type |
| Rule 6.2 | MISRA-C2012-6.2 | Single-bit named bit fields shall not be of a signed type |
| Rule 7.1 | MISRA-C2012-7.1 | Octal constants shall not be used |
| Rule 7.2 | MISRA_C2012-7.2 | A “u” or “U” suffix shall be applied to all integer constants that are represented in an unsigned type |
| Rule 7.3 | MISRA-C2012-7.3 | The lowercase character “l” shall not be used in a literal suffix |
| Rule 7.4 | MISRA-C2012-7.4 | A string literal shall not be assigned to an object unless the object's type is pointer to const-qualified char |
| Rule 8.1 | MISRA-C2012-8.1 | Types shall be explicitly specified |
| Rule 8.2 | MISRA-C2012-8.2 | Function types shall be in prototype form with named parameters |
| Rule 8.3 | MISRA-C2012-8.3 | All declarations of an object or function shall use the same names and type qualifiers |
| Rule 8.4 | MISRA-C2012-8.4 | A compatible declaration shall be visible when an object or function with external linkage is defined |
| Rule 8.5 | MISRA-C2012-8.5 | An external object or function shall be declared once in one and only one file |
| Rule 8.6 | MISRA-C2012-8.6 | An identifier with external linkage shall have exactly one external definition |
| Rule 8.7 | MISRA-C2012-8.7 | Functions and objects should not be defined with external linkage if they are referenced in only one translation unit |
| Rule 8.8 | MISRA-C2012-8.8 | The static storage class specifier shall be used in all declarations of objects and functions that have internal linkage |
| Rule 8.9 | MISRA-C2012-8.9 | An object should be defined at block scope if its identifier only appears in a single function |
| Rule 8.10 | MISRA-C2012-8.10 | An inline function shall be declared with the static storage class |
| Rule 8.11 | MISRA-C2012-8.11 | When an array with external linkage is declared, its size should be explicitly specified |
| Rule 8.12 | MISRA-C2012-8.12 | Within an enumerator list, the value of an implicitly-specified enumeration constant shall be unique |
| Rule 8.13 | MISRA-C2012-8.13 | A pointer should point to a const-qualified type whenever possible |
| Rule 8.14 | MiSRA-C2012-8.14 | The restrict type qualifi er shall not be used |
| Rule 9.1 | MISRA-C2012-9.1 | The value of an object with automatic storage duration shall not be read before it has been set |
| Rule 9.2 | MISRA-C2012-9.2 | The initializer for an aggregate or union shall be enclosed in braces |
| Rule 9.3 | MISRA-C2012-9.3 | Arrays shall not be partially initialized |
| Rule 9.4 | MISRA-C2012-9.4 | An element of an object shall not be in itialized more than once |
| Rule 9.5 | MISRA-C2012-9.5 | Where designated initializers are used t o initialize an array object the size of the array shall be specified explicitly |
| Rule 10.1 | MISRA-C2012-10.1 | Operands shall not be of an inappropriate essential type |
| Rule 10.2 | MISRA-C2012-10.2 | Expressions of essentially character type shall not be used inappropriately in addition and subtraction operations |
| Rule 10.3 | MISRA-C2012-10.3 | The value of an expression shall not be assigned to an object with a narrower essential type or of a different essential type category |
| Rule 10.4 | MISRA-C2012-10.4 | Both operands of an operator in which the usual arithmetic conversions are performed s hall have the same essential type category |
| Rule 10.5 | MISRA_C2012-10.5 | The value of an expression should not be cast to an inappropriate essential type |
| Rule 10.6 | MISRA-C2012-10.6 | The value of a composite expression shall not be assigned to an object with wider essential type |
| Rule 10.7 | MISRA-C2012-10.7 | If a composite expression is used as one operand of an operator in which the usual arithmetic conversions are performed then the other operand shall not have wider essential type |
| Rule 10.8 | MISRA-C2012-10.8 | The value of a composite expression shall not be cast to a different essential type category or a wider essential type |
| Rule 11.1 | MISRA-C2012-11.1 | Conversions shall not be performed between a pointer to a function and any other type |
| Rule 11.2 | MISRA-C2012-11.2 | Conversions shall not be performed between a pointer to an incomplete type and any other type |
| Rule 11.3 | MISRA-C2012-11.3 | A cast shall not be performed between a pointer to object type and a pointer to a diff erent object type |
| Rule 11.4 | MISRA-C2012-11.4 | A conversion should not be performed between a pointer to object and an integer type |
| Rule 11.5 | MISRA-C2012-11.5 | A conversion should not be performed from pointer to void into pointer to object |
| Rule 11.6 | MISRA-C2012-11.6 | A cast shall not be performed between pointer to void and an arithmetic type |
| Rule 11.7 | MISRA-C2012-11.7 | A cast shall not be performed between pointer to object and a noninteger arithmetic type |
| Rule 11.8 | MISRA-C2012-11.8 | A cast shall not remove any const or volatile qualification from the type pointed to by a pointer |
| Rule 11.9 | MISRA-C2012-11.9 | The macro NULL shall be the only per mitted form of integer null pointer constant |
| Rule 12.1 | MiSRA-C2012-12.1 | The precedence of operators within expressions should be made explicit |
| Rule 12.2 | MISRA-C2012-12.2 | The right hand operand of a shift operator shall lie in the range zero to one less than the width in bits of the essential type of the left hand operand |
| Rule 12.3 | MISRA-C2012-12.3 | The comma operator should not be used |
| Rule 12.4 | MISRA-C2012-12.4 | Evaluation of constant expressions should not lead to unsigned integer wrap-around |
| Rule 13.1 | MISRA-C2012-13.1 | Initializer lists shall not contain persistent side eff ects |
| Rule 13.2 | MISRA-C2012-13.2 | The value of an expression and its persistent side eff ects shall be the same under all permitted evaluation orders |
| Rule 13.3 | MISRA-C2012-13.3 | A full expression containing an increment (++) or decrement (--) operator should hav e no other potential side eff ects other than that caused by the increment or decrement operator |
| Rule 13.4 | MISRA-C2012-13.4 | The result of an assignment operator should not be used |
| Rule 13.5 | MISRA-C2012-13.5 | The right hand operand of a logical && or || operator shall not contain persistent side effects |
| Rule 13.6 | MISRA-C2012-13.6 | The operand of the sizeof operator shall not contain any expression which has potential side effects |
| Rule 14.1 | MISRA-C2012-14.1 | A loop counter shall not have essentially fl oating type |
| Rule 14.2 | MISRA-C2012-14.2 | A for loop shall be well-formed |
| Rule 14.3 | MISRA-C2012-14.3 | Controlling expressions shall not be invariant |
| Rule 14.4 | MISRA-C2012-14.4 | The controlling expression of an if statement and the controlling expression of an iteration- statement shall have essentially Boolean type |
| Rule 15.1 | MISRA-C2012-15.1 | The goto statement should not be used |
| Rule 15.2 | MISRA-C2012-15.2 | The goto statement shall jump to a label declared later in the same function |
| Rule 15.3 | MISRA-C2012-15.3 | Any label referenced by a goto statement shall be declared in the same block, or in any block enclosing the goto statement |
| Rule 15.4 | MISRA-C2012-15.4 | There should be no more than one break or goto statement used to terminate any iteration statement |
| Rule 15.5 | MISRA-C2012-15.5 | A function should have a single point of exit at the end |
| Rule 15.6 | MISRA-C2012-15.6 | The body of an iteration-statement or a selection-statement shall be a compound-statement |
| Rule 15.7 | MISRA-C2012-15.7 | All if … else if constructs shall be terminated with an else statement |
| Rule 16.1 | MISRA-C2012-16.1 | All switch statements shall be well-formed |
| Rule 16.2 | MISRA-C2012-16.2 | A switch label shall only be used when the most closely-enclosing compound statement is the body of a switch statement |
| Rule 16.3 | MISRA-C2012-16.3 | An unconditional break statement shall terminate every switch-clause |
| Rule 16.4 | MISRA-C2012-16.4 | Every switch statement shall have a default label |
| Rule 16.5 | MISRA-C2012-16.5 | A default label shall appear as either the first or the last switch label of a switch statement |
| Rule 16.6 | MISRA-C2012-16.6 | Every switch statement shall have at least two switch-clauses |
| Rule 16.7 | MISRA-C2012-16.7 | A switch-expression shall not have essentially Boolean type |
| Rule 17.1 | MISRA-C2012-17.1 | The features of |
| Rule 17.2 | MISRA-C2012-17.2 | Functions shall not call themselves, either directly or indirectly |
| Rule 17.3 | MISRA-C2012-17.3 | A function shall not be declared implicitly |
| Rule 17.4 | MISRA-C2012-17.4 | All exit paths from a function with non-void return type shall have an explicit return statement with an expression |
| Rule 17.5 | MISRA-C2012-17.5 | The function argument corresponding to a parameter declared to have an array type shall have an appropriate number of elements |
| Rule 17.6 | MISRA-C2012-17.6 | The declaration of an array parameter shall not contain the static keyword between the [ ] |
| Rule 17.7 | MISRA-C2012-17.7 | The value returned by a function having non-void return type shall be used |
| Rule 17.8 | MISRA-C2012-17.8 | A function parameter should not be modifi ed |
| Rule 18.1 | MISRA-C2012-18.1 | A pointer resulting from arithmetic on a pointer operand shall address an element of the same array as that pointer operand |
| Rule 18.3 | MISRA-C2012-18.3 | The relational operators >, >=, < and <= shall not be applied to objects of pointer type except where they point into the same object |
| Rule 18.4 | MISRA-C2012-18.4 | The +, -, += and -= operators should not be applied to an expression of pointer type |
| Rule 18.5 | MISRA-C2012-18.5 | Declarations should contain no more than two levels of pointer nesting |
| Rule 18.6 | MISRA-C2012-18.6 | The address of an object with automatic storage shall not be copied to another object that persists after the first object has ceased to exist |
| Rule 18.7 | MISRA-C2012-18.7 | Flexible array members shall not be declared |
| Rule 18.8 | MISRA-C2012-18.8 | Variable-length array types shall not be used |
| Rule 19.2 | MiSRA-C2012-19.2 | The union keyword should not be used |
| Rule 20.1 | MISRA-C2012-20.1 | #include directives should only be preceded by preprocessor directives or comments |
| Rule 20.2 | MISRA-C2012-20.2 | The ', " or \ characters and the /* or // character sequences shall not occur in a header file name |
| Rule 20.3 | MISRA-C2012-20.3 | The #include directive shall be followed by either a |
| Rule 20.4 | MISRA-C2012-20.4 | A macro shall not be defined with the same name as a keyword |
| Rule 20.5 | MISRA-C2012-20.5 | #undef should not be used |
| Rule 20.6 | MISRA-C2012-20.6 | Tokens that look like a preprocessing directive shall not occur within a macro argument |
| Rule 20.7 | MISRA-C2012-20.7 | Expressions resulting from the expansion of macro parameters shall be enclosed in parentheses |
| Rule 20.8 | MISRA-C2012-20.8 | The controlling expression of a #if or #elif preprocessing directive shall evaluate to 0 or 1 |
| Rule 20.9 | MISRA-C2012-20.9 | All identifiers used in the controlling expression of #if or #elif preprocessing directives shall be #defi ne’d before evaluation |
| Rule 20.10 | MISRA-C2012-21.10 | The # and ## preprocessor operators should not be used |
| Rule 20.11 | Misra-c2012-21.11 | A macro parameter immediately following a # operator shall not immediately be followed by a ## operator |
| Rule 20.12 | MISRA-C2012-21.12 | A macro parameter used as an operand to the # or ## o perators, which is itself subj ect to further macro replacement, shall only be used as an operand to these operators |
| Rule 20.13 | MISRA-C2012-20.13 | A line whose first token is # shall be a valid preprocessing directive |
| Rule 20.14 | MISRA-C2012-20.14 | All #else, #elif and #endif preprocessor directives shall reside in the same file as the #if, #ifdef or #ifndef directive to which they are related |
| Rule 21.1 | MISRA-C2012-21.1 | #defi ne and #undef shall not be used on a reserved identifier or reserved macro name |
| Rule 21.2 | MISRA-C2012-21.2 | A reserved identifier or macro name shall not be declared |
| Rule 21.3 | MISRA-C2012-21.3 | The memory allocation and deallocation functions of |
| Rule 21.4 | MISRA-C2012-21.4 | The standard header file |
| Rule 21.5 | MISRA-C2012-21.5 | The standard header file |
| Rule 21.6 | MISRA-C2012-21.6 | The Standard Library input/output functions shall not be used |
| Rule 21.7 | MISRA-C2012-21.7 | The atof, atoi, atol and atoll functions of |
| Rule 21.8 | MISRA-C2012-21.8 | The library functions abort, exit, getenv and system of |
| Rule 21.9 | MISRA-C2012-21.9 | The library functions bsearch and qsort of |
| Rule 21.10 | MISRA-C2012-21.10 | The Standard Library time and date functions shall not be used |
| Rule 21.11 | MISRA-C2012-21.11 | The standard header file |
| Rule 21.12 | MISRA-C2012-21.12 | The exception handling features of |
| Rule 22.1 | MISRA-C2012-22.1 | All resources obtained dynamically by means of Standard Library functions shall be explicitly released |
| Rule 22.2 | MISRA-C2012-22.2 | A block of memory shall only be freed if it was allocated by means of a Standard Library function |
| Rule 22.4 | MISRA-C2012-22.4 | There shall be no attempt to write to a stream which has been opened as read-only |
| Rule 22.5 | MISRA-C2012-22.5 | A pointer to a FILE object shall not be dereferenced |
| Rule 22.6 | MISRA-C2012-22.6 | The value of a pointer to a FILE shall not be used after the associated stream has been closed |
The above table states that approximately 97.90% of rules (i.e. 140 rules out of 143) are supported by BrowserStack Code Quality.
MISRA 2008
Below are the list of MISRA 2008 rules supported by BrowserStack Code Quality:
| RULE | RULE NAME |
|---|---|
| Rule 0-1-1 | A project shall NOt contain unreachable code. |
| Rule 0-1-2 | A project shall NOt contain infeasible paths. |
| Rule 0-1-3 | A project shall NOt contain unused variables. |
| Rule 0-1-5 | A project shall NOt contain unused type declarations. |
| Rule 0-1-7 | The value returned by a function having a NOn-void return type that is NOt an overloaded operator shall always be used. |
| Rule 0-1-9 | There shall be NO dead code. |
| Rule 0-1- 10 | Every defined function shall be called at least once. |
| Rule 0-1- 11 | There shall be NO unused parameters (named or unnamed) in NOn-virtual functions. |
| Rule 2-3-1 | Trigraphs shall NOt be used. |
| Rule 2-5-1 | Digraphs should NOt be used. |
| Rule 2-7-1 | The character sequence /* shall NOt be used within a C-style comment. |
| Rule 2-7-2 | Sections of code shall NOt be “commented out” using C-style comments. |
| Rule 2-7-3 | Sections of code should NOt be “commented out” using C++ comments. |
| Rule 2-10-2 | Identifiers declared in an inner scope shall NOt hide an identifier declared in an outer scope. |
| Rule 2-10-3 | A typedef name (including qualification, if any) shall be a unique identifier. |
| Rule 2-10-4 | The identifier name of a NOn-member object or function with static storage duration should NOt be reused. |
| Rule 2-10-5 | If an identifier refers to a type, it shall NOt also refer to an object or a function in the same scope. |
| Rule 2-13-1 | Only those escape sequences that are defined in ISO/IEC 14882:2003 shall be used. |
| Rule 2-13-2 | Octal constants (other than zero) and octal escape sequences (other than “\0”) shall NOt be used. |
| Rule 2-13-3 | A “U ” suffix shall be applied to all octal or hexadecimal integer literals of unsigned type. |
| Rule 2-13-4 | Literal suffixes shall be upper case. |
| Rule 2-13-5 | Narrow and wide string literals shall NOt be concatenated. |
| Rule 3-1-3 | When an array is declared, its size shall either be stated explicitly or defined implicitly by initialization. |
| Rule 3-2-1 | All declarations of an object or function shall have compatible types. |
| Rule 3-2-2 | The One Definition Rule shall NOt be violated. |
| Rule 3-2-3 | A type, object or function that is used in multiple translation units shall be declared in one and only one file. |
| Rule 3-2-4 | An identifier with external linkage shall have exactly one definition. |
| Rule 3-3-2 | If a function has internal linkage then all re-declarations shall include the static storage class specifier. |
| Rule 5-Rule 5-0-1 0-1 | The value of an expression shall be the same under any order of evaluation that the standard permits. |
| Rule 5-0-2 | Limited dependence should be placed on C++ operator precedence rules in expressions. |
| Rule 5-0-4 | An implicit integral conversion shall NOt change the signedness of the underlying type. |
| Rule 5-0-5 | There shall be NO implicit floating-integral conversions. |
| Rule 5-0-6 | An implicit integral or floating-point conversion shall NOt reduce the size of the underlying type. |
| Rule 5-0-8 | An explicit integral or floating-point conversion shall NOt increase the size of the underlying type of a cvalue expression. |
| Rule 5-0-9 | An explicit integral conversion shall NOt change the signedness of the underlying type of a cvalue expression. |
| Rule 5-0- 13 | The condition of an if‑statement and the condition of an iteration‑ statement shall have type bool . |
| Rule 5-0- 17 | Subtraction between pointers shall only be applied to pointers that address elements of the same array. |
| Rule 5-0- 18 | >, >=, <, <= shall NOt be applied to objects of pointer type, except where they point to the same array. |
| Rule 5-0- 21 | Bitwise operators shall only be applied to operands of unsigned underlying type. |
| Rule 5-2-3 | Casts from a base class to a derived class should NOt be performed on polymorphic types. |
| Rule 5-2-4 | C-style casts (other than void casts) and functional NOtation casts (other than explicit constructor calls) shall NOt be used. |
| Rule 5-2-5 | A cast shall NOt remove any const or volatile qualification from the type of a pointer or reference. |
| Rule 5-2-6 | A cast shall NOt convert a pointer to a function to any other pointer type, including a pointer to function type. |
| Rule 5-2-7 | An object with pointer type shall NOt be converted to an unrelated pointer type, either directly or indirectly. |
| Rule 5-2-8 | An object with integer type or pointer to void type shall NOt be converted to an object with pointer type. |
| Rule 5-2-9 | A cast should NOt convert a pointer type to an integral type. |
| Rule 5-2- 12 | An identifier with array type passed as a function argument shall NOt decay to a pointer. |
| Rule 5-3-4 | Evaluation of the operand to the sizeof operator shall NOt contain side effects. |
| Rule 5-14-1 | The right hand operand of a logical && or || operator shall NOt contain side effects. |
| Rule 5-18-1 | The comma operator shall NOt be used. |
| Rule 6-3-1 | The statement forming the body of a switch, while, do... while or for statement shall be a compound statement. |
| Rule 6-4-2 | All if ... else if constructs shall be terminated with an else clause. |
| Rule 6-4-3 | A switch statement shall be a well‑formed switch statement. |
| Rule 6-4-5 | An unconditional throw or break statement shall terminate every NOnempty switch‑clause. |
| Rule 6-4-6 | The final clause of a switch statement shall be the default‑ clause. |
| Rule 6-4-7 | The condition of a switch statement shall NOt have bool type |
| Rule 6-4-8 | Every switch statement shall have at least one case‑clause. |
| Rule 6-5-3 | The loop‑counter shall NOt be modified within condition or statement. |
| Rule 6-5-5 | A loop‑control‑variable other than the loop‑counter shall NOt be modified within condition or expression. |
| Rule 6-5-6 | A loop‑control‑variable other than the loop‑counter which is modified in statement shall have type bool . |
| Rule 6-6-3 | The continue statement shall only be used within a well‑formed for loop. |
| Rule 6-6-4 | For any iteration statement there shall be NO more than one break or goto statement used for loop termination. |
| Rule 6-6-5 | A function shall have a single point of exit at the end of the function. |
| Rule 7-5-3 | A function shall NOt return a reference or a pointer to a parameter that is passed by reference or const reference. |
| Rule 7-5-4 | Functions should NOt call themselves, either directly or indirectly. |
| Rule 8-4-3 | All exit paths from a function with NOn-void return type shall have an explicit return statement with an expression. |
| Rule 8-5-1 | All variables shall have a defined value before they are used. |
| Rule 9-3-1 | const member functions shall NOt return NOn-const pointers or references to class‑data. |
| Rule 9-5-1 | Unions shall NOt be used. |
| Rule 10- 1-1 | Classes should NOt be derived from virtual bases. |
| Rule 10- 3-2 | Each overriding virtual function shall be declared with the virtual keyword. |
| Rule 15- 3-2 | There should be at least one exception handler to catch all otherwise unhandled exceptions |
| Rule 15- 3-5 | A class type exception shall always be caught by reference. |
| Rule 15- 5-1 | A class destructor shall NOt exit with an exception. |
| Rule 16- 0-1 | #include directives in a file shall only be preceded by other preprocessor directives or comments. |
| Rule 16- 0-8 | If the # token appears as the first token on a line, then it shall be immediately followed by a preprocessing token. |
| Rule 16- 2-1 | The pre-processor shall only be used for file inclusion and include guards. |
| Rule 16- 2-2 | C++ macros shall only be used for include guards, type qualifiers, or storage class specifiers. |
| Rule 16- 2-3 | Include guards shall be provided. |
| Rule 16- 2-4 | The ′,″,/* or // characters shall NOt occur in a header file name. |
| Rule 16- 2-5 | The \ character should NOt occur in a header file name. |
| Rule 16- 2-6 | The #include directive shall be followed by either a ″filename″ sequence |
| Rule 16- 3-1 | There shall be at most one occurrence of the # or ## operators in a single macro definition. |
| Rule 16- 3-2 | The # and ## operators should NOt be used. |
| Rule 17- 0-1 | Reserved identifiers, macros and functions in the standard library shall NOt be defined, redefined or undefined. |
| Rule 17- 0-2 | The names of standard library macros and objects shall NOt be reused |
| Rule 17- 0-5 | The setjmp macro and the longjmp function shall NOt be used. |
| Rule 18- 0-1 | The C library shall NOt be used. |
| Rule 18- 0-2 | The library functions atof, atoi and atol from library shall NOt be used. |
| Rule 18- 0-3 | The library functions abort, exit, getenv and system from library |
| Rule 18- 0-4 | The time handling functions of library |
| Rule 18- 0-5 | The unbounded functions of library |
| Rule 18- 2-1 | The macro offsetof shall NOt be used. |
| Rule 18- 4-1 | Dynamic heap memory allocation shall NOt be used. |
| Rule 18- 7-1 | The signal handling facilities of |
| Rule 19- 3-1 | The error indicator errNO shall NOt be used. |
| Rule 27- 0-1 | The stream input/output library |
| Rule 0-1- 12 | There shall be NO unused parameters (named or unnamed) in the set of parameters for a virtual function and all the functions that override it. |
| Rule 3-9-1 | The types used for an object, a function return type, or a function parameter shall be token-for-token identical in all declarations and redeclarations. |
| Rule 3-9-1 | A pointer operand and any pointer resulting from pointer arithmetic using that operand shall both address elements of the same array. |
| Rule 5-19-1 | Evaluation of constant unsigned integer expressions should NOt lead to wrap-around. |
| Rule 6-4-1 | The else keyword shall be followed by either a compound statement, or aNOther if statement. |
| Rule 6-4-4 | A switch‑label shall only be used when the most closely- enclosing compound statement is the body of a switch statement. |
| Rule 7-1-2 | A pointer or reference parameter in a function shall be declared as pointer to const or reference to const if the corresponding object is NOt modified. |
| Rule 7-5-1 | A function shall NOt return a reference or a pointer to an automatic variable (including parameters), defined within the function. |
| Rule 7-5-2 | The address of an object with automatic storage shall NOt be assigned to aNOther object that may persist after the first object has ceased to exist. |
| Rule 10- 3-3 | A virtual function shall only be overridden by a pure virtual function if it is itself declared as pure virtual. |
| Rule 11- 0-1 | Member data in NOn-POD class types shall be private. |
| Rule 12- 8-2 | The copy assignment operator shall be declared protected or private in an abstract class |
| Rule 16- 0-7 | Undefined macro identifiers shall NOt be used in #if or #elif preprocessor directives, except as operands to the defined operator. |
| Rule 16- 0-7 | All #else, #elif and #endif preprocessor directives shall reside in the same file as the #if or #ifdef directive to which they are related. |
MISRA 2004
Below are the list of MISRA 2004 rules supported by BrowserStack Code Quality:
| Rule | Description |
|---|---|
| Rule 2.3 | The character sequence /* shall NOt be used within a comment. |
| Rule 2.4 | Sections of code should NOt be “commented out”. |
| Rule 4.2 | Trigraphs shall NOt be used. |
| Rule 5.2 | Identifiers in an inner scope shall NOt use the same name as an identifier in an outer scope, and therefore hide that identifier. |
| Rule 5.3 | A typedef name shall be a unique identifier. |
| Rule 5.4 | A tag name shall be a unique identifier. |
| Rule 5.7 | NO identifier name should be reused. |
| Rule 6.4 | Bit fields shall only be defined to be of type unsigned int or signed int. |
| Rule 6.5 | Bit fields of signed type shall be at least 2 bits long. |
| Rule 7.1 | Octal constants (other than zero) and octal escape sequences shall NOt be used. |
| Rule 8.2 | Whenever an object or function is declared or defined, its type shall be explicitly stated. |
| Rule 8.7 | Objects shall be defined at block scope if they are only accessed from within a single function. |
| Rule 8.8 | An external object or function shall be declared in one and only one file. |
| Rule 8.9 | An identifier with external linkage shall have exactly one external definition. |
| Rule 8.11 | The static storage class specifier shall be used in definitions and declarations of objects and functions that have internal linkage. |
| Rule 8.12 | When an array is declared with external linkage, its size shall be stated explicitly or defined implicitly by initialisation. |
| Rule 9.1 | All automatic variables shall have been assigned a value before being used. |
| Rule 9.2 | Braces shall be used to indicate and match the structure in the NOn-zero initialisation of arrays and structures. |
| Rule 9.3 | In an enumerator list, the “=” construct shall NOt be used to explicitly initialise members other than the first, unless all items are explicitly initialised. |
| Rule 10.1 | The value of an expression of integer type shall NOt be implicitly converted to a different underlying type if: (a) it is NOt a conversion to a wider integer type of the same signedness, or (b) signedness, or the expression is complex, or (c) the expression is NOt constant and is a function argument, or (d) the expression is NOt constant and is a return expression. |
| Rule 10.3 | The value of a complex expression of integer type shall only be cast to a type of the same signedness that is NO wider than the underlying type of the expression. |
| Rule 10.4 | The value of a complex expression of floating type shall only be cast to a floating type that is narrower or of the same size. |
| Rule 10.6 | A “U” suffix shall be applied to all constants of unsigned type. |
| Rule 11.1 | Conversions shall NOt be performed between a pointer to a function and any type other than an integral type. |
| Rule 11.2 | Conversions shall NOt be performed between a pointer to object and any type other than an integral type, aNOther pointer to object type or a pointer to void |
| Rule 11.3 | A cast should NOt be performed between a pointer type and an integral type. |
| Rule 11.4 | A cast should NOt be performed between a pointer to object type and a different pointer to object type. |
| Rule 11.5 | A cast shall NOt be performed that removes any const or volatile qualification from the type addressed by a pointer. |
| Rule 12.1 | Limited dependence should be placed on C’s operator precedence rules in expressions. |
| Rule 12.2 | The value of an expression shall be the same under any order of evaluation that the standard permits. |
| Rule 12.4 | The right-hand operand of a logical && or || operator shall NOt contain side effects. |
| Rule 12.7 | Bitwise operators shall NOt be applied to operands whose underlying type is signed. |
| Rule 12.10 | The comma operator shall NOt be used. |
| Rule 12.11 | Evaluation of constant unsigned integer expressions should NOt lead to wrap-around. |
| Rule 13.4 | The controlling expression of a for statement shall NOt contain any objects of floating type. |
| Rule 14.1 | There shall be NO unreachable code. |
| Rule 14.4 | The goto statement shall NOt be used. |
| Rule 14.6 | For any iteration statement there shall be at most one break statement used for loop termination. |
| Rule 14.7 | A function shall have a single point of exit at the end of the function. |
| Rule 14.8 | The statement forming the body of a switch, while, do ... while or for statement shall be a compound statement. |
| Rule 14.9 | An if (expression) construct shall be followed by a compound statement. The else keyword shall be followed by either a compound statement, or aNOther if statement. |
| Rule 14.10 | All if ... else if constructs shall be terminated with an else clause. |
| Rule 15.0 | The MISRA C switch syntax shall be used |
| Rule 15.1 | A switch label shall only be used when the most closely- enclosing compound statement is the body of a switch statement. |
| Rule 15.2 | An unconditional break statement shall terminate every NOn- empty switch clause. |
| Rule 15.3 | The final clause of a switch statement shall be the default clause. |
| Rule 15.4 | A switch expression shall NOt represent a value that is effectively Boolean. |
| Rule 15.5 | Every switch statement shall have at least one case clause. |
| Rule 16.1 | Functions shall NOt be defined with a variable number of arguments. |
| Rule 16.2 | Functions shall NOt call themselves, either directly or indirectly. |
| Rule 16.3 | Identifiers shall be given for all of the parameters in a function prototype declaration. |
| Rule 16.4 | The identifiers used in the declaration and definition of a function shall be identical. |
| Rule 16.6 | The number of arguments passed to a function shall match the number of parameters. |
| Rule 16.7 | A pointer parameter in a function prototype should be declared as pointer to const if the pointer is NOt used to modify the addressed object. |
| Rule 16.8 | All exit paths from a function with NOn-void return type shall have an explicit return statement with an expression. |
| Rule 17.2 | Pointer subtraction shall only be applied to pointers that address elements of the same array. |
| Rule 17.3 | >, >=, <, <= shall NOt be applied to pointer types except where they point to the same array. |
| Rule 18.2 | An object shall NOt be assigned to an overlapping object. |
| Rule 18.4 | Unions shall NOt be used. |
| Rule 19.1 | #include statements in a file should only be preceded by other preprocessor directives or comments. |
| Rule 19.2 | NOn-standard characters should NOt occur in header file names in #include directives. |
| Rule 19.3 | The #include directive shall be followed by either a ″filename″ sequence. |
| Rule 19.4 | C macros shall only expand to a braced initialiser, a constant, a string literal, a parenthesised expression, a type qualifier, a storage class specifier, or a do-while-zero construct. |
| Rule 19.5 | Macros shall NOt be #define’d or #undef’d within a block. |
| Rule 19.6 | #undef shall NOt be used. |
| Rule 19.7 | A function should be used in preference to a function-like macro. |
| Rule 19.12 | There shall be at most one occurrence of the # or ## operators in a single macro definition. |
| Rule 19.13 | The # and ## operators should NOt be used. |
| Rule 19.17 | All #else, #elif and #endif preprocessor directives shall reside in the same file as the #if or #ifdef directive to which they are related. |
| Rule 20.1 | Reserved identifiers, macros and functions in the standard library, shall NOt be defined, redefined or undefined. |
| Rule 20.2 | The names of standard library macros, objects and functions shall NOt be reused. |
| Rule 20.5 | The error indicator errNO shall NOt be used. |
| Rule 20.7 | The setjmp macro and the longjmp function shall NOt be used. |
| Rule 20.8 | The signal handling facilities of |
| Rule 20.9 | The input/output library |
| Rule 20.10 | The library functions atof, atoi and atol from library be used. |
| Rule 20.11 | The library functions abort, exit, getenv and system from library |
| Rule 20.12 | The time handling functions of library |
MISRA Reports
Users can download MISRA compliance and MISRA reports. To know more about download reports, refer to this article.
AUTOSAR
AUTOSAR guidelines ensure that your code is safe and secure. Each rule has its own description. Below are the list of AUTOSAR rules supported by BrowserStack Code Quality:
| Rule | Description |
|---|---|
| Rule M0-1-1 | A project shall NOt contain unreachable code |
| Rule M0-1-2 | A project shall NOt contain infeasible paths. |
| Rule M0-1-3 | A project shall NOt contain unused variables. |
| Rule M0-1- | A project shall NOt contain unused type declarations. |
| Rule A0-1-2 | The value returned by a function having a NOn-void return type that is NOt aNOverloaded operator shall be used. |
| Rule M0-1-9 | There shall be NO dead code. |
| Rule M0-1-10 | Every defined function should be called at least once |
| Rule M0-1-11 | There shall be NO unused parameters (named or unnamed) in NOnvirtualfunctions. |
| Rule M0-1-12 | There shall be NO unused parameters (named or unnamed) in the set ofparameters for a virtual function and all the functions that override it. |
| Rule A2-5-1 | Trigraphs shall NOt be used. |
| Rule A2-6-1 | Digraphs shall NOt be used. |
| Rule A2-8-1 | The character \ shall NOt occur as a last character of a C++ comment |
| Rule A2-8-2 | Sections of code shall NOt be “commented out”. |
| Rule A2-8-4 | C-style comments shall NOt be used. |
| Rule A2-11-1 | An identifier declared in an inner scope shall NOt hide an identifier declaredin an outer scope |
| Rule M2-10-3 | A typedef name (including qualification, if any) shall be a unique identifier |
| Rule M2-13-3 | A “U” suffix shall be applied to all octal or hexadecimal integer literals ofunsigned type. |
| Rule M2-13-4 | Literal suffixes shall be upper case. |
| Rule A3-1-4 | When an array with external linkage is declared, its size shall be statedexplicitly. |
| Rule M3-2-1 | All declarations of an object or function shall have compatible types |
| Rule M3-2-2 | The One Definition Rule shall NOt be violated |
| Rule M3-2-3 | A type, object or function that is used in multiple translation units shall bedeclared in one and only one file. |
| Rule M3-2-4 | An identifier with external linkage shall have exactly one definition. |
| Rule A3-3- | Objects or functions with external linkage (including members of namednamespaces) shall be declared in a header file. |
| Rule M3-3-2 | If a function has internal linkage then all re-declarations shall include thestatic storage class specifier. |
| Rule M3-4-1 | An identifier declared to be an object or type shall be defined in a block thatminimizes its visibility. |
| Rule M3-9-1 | The types used for an object, a function return type, or a function parametershall be token-for-token identical in all declarations and redeclarations. |
| Rule M5-0-3 | A cvalue expression shall NOt be implicitly converted to a different underlyingtype |
| Rule M5-0-4 | An implicit integral conversion shall NOt change the signedness of theunderlying type. |
| Rule M5-0-5 | There shall be NO implicit floating-integral conversions. |
| Rule M5-0-6 | An implicit integral or floating-point conversion shall NOt reduce the size ofthe underlying type |
| Rule M5-0-16 | A pointer operand and any pointer resulting from pointer arithmetic usingthat operand shall both address elements of the same array. |
| Rule M5-0-17 | Subtraction between pointers shall only be applied to pointers that addresselements of the same array. |
| Rule M5-0-18 | >,>=,<,<=shall NOt be applied to objects of pointer type, except wherethey point to the same array |
| Rule A5-2-1 | dynamic_cast should NOt be used. |
| Rule A5-2-2 | Traditional C-style casts shall NOt be used |
| Rule A5-2-3 | A cast shall NOt remove any const or volatile qualification from the type of apointer or reference |
| Rule M5-2-6 | A cast shall NOt convert a pointer to a function to any other pointer type,including a pointer to function type. |
| Rule M5-2-8 | An object with integer type or pointer to void type shall NOt be converted toan object with pointer type |
| Rule M5-2-9 | A cast shall NOt convert a pointer type to an integral type |
| Rule A5-2-5 | An array shall NOt be accessed beyond its range |
| Rule M5-3-4 | Evaluation of the operand to the sizeof operator shall NOt contain sideeffects. |
| Rule A5-5-1 | The right hand operand of the integer division or remainder operators shallNOt be equal to zero. |
| Rule M5-8-1 | The right hand operand of a shift operator shall lie between zero and oneless than the width in bits of the underlying type of the left hand operand |
| Rule M5-18-1 | The comma operator shall NOt be used. |
| Rule M6-3-1 | The statement forming the body of a switch, while, do ... while or forstatement shall be a compound statement. |
| Rule M6-4-1 | An if ( condition ) construct shall be followed by a compound statement. Theelse keyword shall be followed by either a compound statement, or aNOtherif statement. |
| Rule M6-4-2 | All if ... else if constructs shall be terminated with an else clause. |
| Rule M6-4-3 | A switch statement shall be a well-formed switch statement |
| Rule M6-4-5 | An unconditional throw or break statement shall terminate every NOnemptyswitch-clause |
| Rule M6-4-6 | The final clause of a switch statement shall be the default-clause |
| Rule M6-4-7 | The condition of a switch statement shall NOt have bool type |
| Rule A6-4-1 | A switch statement shall have at least two case-clauses, distinct from thedefault label. |
| Rule A6-5-2 | A for loop shall contain a single loop-counter which shall NOt have floatingpoint type |
| Rule M6-5-3 | The loop-counter shall NOt be modified within condition or statement. |
| Rule M6-5-5 | A loop-control-variable other than the loop-counter shall NOt be modifiedwithin condition or expression |
| Rule M6-5-6 | A loop-control-variable other than the loop-counter which is modified instatement shall have type bool |
| Rule A6-6-1 | The goto statement shall NOt be used. |
| Rule A7-5-1 | A function shall NOt return a reference or a pointer to a parameter that ispassed by reference to const. |
| Rule A7-5-2 | Functions shall NOt call themselves, either directly or indirectly. |
| Rule A8-4-1 | Functions shall NOt be defined using the ellipsis NOtation. |
| Rule M8-4-2 | The identifiers used for the parameters in a re-declaration of a function shallbe identical to those in the declaration. |
| Rule A8-4-2 | All exit paths from a function with NOn-void return type shall have an explicitreturn statement with an expression. |
| Rule M8-5-1 | All variables shall have a defined value before they are used |
| Rule M9-5-1 | Unions shall NOt be used |
| Rule A12-8-1 | Move and copy constructors shall only move and respectively copy baseclasses and data members of a class, without any side effects |
| Rule A15-2-1 | Constructors that are NOt NOexcept shall NOt be invoked before programstartup. |
| Rule A15-3-5 | A class type exception shall be caught by reference or const reference. |
| Rule A15-5-1 | A class destructor, “delete” operators, move constructor, move assignmentoperator and “swap” function shall NOt exit with an exception. They shall beall specified as “NOexcept” |
| Rule A15-5-3 | The std::terminate() function shall NOt be called implicitly |
| Rule M16-1-2 | All #else, #elif and #endif pre-processor directives shall reside in the samefile as the #if or #ifdef directive to which they are related |
| Rule A16-2-1 | The’, ", /*, //, \characters shall NOt occur in a header file name or in#include directive |
| Rule M16-3-1 | There shall be at most one occurrence of the # or ## operators in a singlemacro definition |
| Rule M16-3-2 | The # and ## operators should NOt be used. |
| Rule A17-0-1 | Reserved identifiers, macros and functions in the C++ standard library shallNOt be defined, redefined or undefined. |
| Rule M17-0-5 | The setjmp macro and the longjmp function shall NOt be used |
| Rule A18-0-2 | The library functions atof, atoi and atol from library beused. |
| Rule M18-0-3 | The library functions abort, exit, getenv and system from library |
| Rule M18-0-4 | The time handling functions of library |
| Rule M18-0-5 | The unbounded functions of library |
| Rule A18-1-1 | C-style arrays should NOt be used |
| Rule M18-2-1 | The macro offsetof shall NOt be used. |
| Rule A18-5-1 | Functions malloc, calloc, realloc and free shall NOt be used. |
| Rule A18-5-3 | The form of delete operator shall match the form of new operator used toallocate the memory. |
| Rule A18-5-4 | If a project has sized or unsized version of operator “delete” globally defined,then both sized and unsized versions shall be defined |
| Rule M18-7-1 | The signal handling facilities of |
| Rule M19-3-1 | The error indicator errNO shall NOt be used |
| Rule M27-0-1 | The stream input/output library |
OWASP
Supported OWASP rules
Embold supports OWASP top-10 related code issues.
Supported Language: Java
You can check the list of issues in the following table:
| Level | OWASP Top-10 code issues |
|---|---|
| A1 | Injection |
| A2 | Broken Authentication |
| A3 | Sensitive Data Exposure |
| A4 | XML External Entities |
| A5 | Broken Access Control |
| A6 | Security Misconfiguration |
| A7 | Cross-Site Scripting XSS |
| A8 | Insecure Deserialization |
| A10 | Insufficient Logging & Monitoring |
CWE
CWE (Common Weakness Enumeration) is the most common and impactful issue that allows developers, testers, users, project managers to find the severe and current security weak code checks.
C/CPP
The below table will provide you with insight into currently supported CWE C/CPP security checks.
| Sr. No | Supported CWE checks |
|---|---|
| 1 | CWE-910 : The software uses or accesses a file descriptor after it has been closed. |
| 2 | CWE-415: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. |
| 3 | CWE-404: The program does not release or incorrectly releases a resource before it is made available for re-use. |
| 4 | CWE-401: The software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. |
| 5 | CWE-369: The product divides a value by zero. |
| 6 | CWE-252: The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. |
| 7 | CWE-783: The program uses an expression in which operator precedence causes incorrect logic to be used. |
| 8 | CWE-561: The software contains dead code, which can never be executed. |
| 9 | CWE-484 : The program omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition. |
| 10 | CWE-478: The code does not have a default case in a switch statement, which might lead to complex logical errors and resultant weaknesses. |
| 11 | CWE-338: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
| 12 | CWE-121: Stack-based Buffer Overflow |
| 13 | CWE-122: Heap-based Buffer Overflow |
| 14 | CWE-124: Buffer Underwrite ('Buffer Underflow') |
| 15 | CWE-126: Buffer Over-read |
| 16 | CWE-127: Buffer Under-read |
| 17 | CWE-197: Numeric Truncation Error |
| 18 | CWE-242: Use of Inherently Dangerous Function |
| 19 | CWE-398: Indicator of Poor Code Quality |
| 20 | CWE-401: Improper Release of Memory Before Removing Last Reference ('Memory Leak') |
| 21 | CWE-416: Use After Free |
| 22 | CWE-457: Use of Uninitialized Variable |
| 23 | CWE-476: NULL Pointer Dereference |
| 24 | CWE-483: Incorrect Block Delimitation |
| 25 | CWE-562: Return of Stack Variable Address |
| 26 | CWE-563: Assignment to Variable without Use ('Unused Variable') |
| 27 | CWE-570: Expression is Always False |
| 28 | CWE-571: Expression is Always True |
| 29 | CWE-674: Uncontrolled Recursion |
| 30 | CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior |
| 31 | CWE-762: Mismatched Memory Management Routines |
| 32 | CWE-704: Incorrect Type Conversion or Cast |
| 33 | CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') |
| 34 | CWE-15: External Control of System or Configuration Setting |
| 35 | CWE-908: Use of Uninitialized Resource |
| 36 | CWE-911: Improper Update of Reference Count |
| 37 | CWE-772: Missing Release of Resource after Effective Lifetime |
| 38 | CWE-833: Improper Locking |
| 39 | CWE-413: Improper Resource Locking |
| 40 | CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) |
| 41 | CWE-468: Incorrect Pointer Scaling |
| 42 | CWE-825: Expired Pointer Dereference |
| 43 | CWE-466: Return of Pointer Value Outside of Expected Range |
| 44 | CWE-390: Detection of Error Condition Without Action |
| 45 | CWE-1069: Empty Exception Block |
| 46 | CWE-477: Use of Obsolete Function |
| 47 | CWE-676: Use of Potentially Dangerous Function |
| 48 | CWE-749: Exposed Dangerous Method or Function |
| 49 | CWE-547: Use of Hard-coded, Security-relevant Constants |
| 50 | CWE-628: Function Call with Incorrectly Specified Arguments |
| 51 | CWE-694: Use of Multiple Resources with Duplicate Identifier |
| 52 | CWE-1041: Use of Redundant Code |
| 53 | CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor |
| 54 | CWE-1046: Creation of Immutable Text Using String Concatenation |
| 55 | CWE-1116: Inaccurate Comments |
| 56 | CWE-1077: Floating Point Comparison with Incorrect Operator |
| 57 | CWE-681: Incorrect Conversion between Numeric Types |
| 58 | CWE-1071: Empty Code Block |
| 59 | CWE-1126: Declaration of Variable with Unnecessarily Wide Scope |
| 60 | CWE-1113: Inappropriate Comment Style |
| 61 | CWE-1109: Use of Same Variable for Multiple Purposes |
| 62 | CWE-1108: Excessive Reliance on Global Variables |
| 63 | CWE-1102: Reliance on Machine-Dependent Data Representation |
| 64 | CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element |
| 65 | CWE-1078: Inappropriate Source Code Style or Formatting |
| 66 | CWE-590: Free of Memory not on the Heap |
| 67 | CWE-664: Improper Control of a Resource Through its Lifetime |
| 68 | CWE-788: Access of Memory Location After End of Buffer |
| 69 | CWE-786: Access of Memory Location Before Start of Buffer |
| 70 | CWE-687: Function Call With Incorrectly Specified Argument Value |
| 71 | CWE-688: Function Call With Incorrect Variable or Reference as Argument |
| 72 | CWE-686: Function Call With Incorrect Argument Type |
| 73 | CWE-665: Improper Initialization |
| 74 | CWE-391: Unchecked Error Condition |
| 75 | CWE-703: Improper Check or Handling of Exceptional Conditions |
| 76 | CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer |
| 77 | CWE-685: Function Call With Incorrect Number of Arguments |
| 78 | CWE-672: Operation on a Resource after Expiration or Release |
| 79 | CWE-771: Missing Reference to Active Allocated Resource |
| 80 | CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime |
| 81 | CWE-190: Integer Overflow or Wraparound |
| 82 | CWE-595: Comparison of Object References Instead of Object Contents |
| 83 | CWE-467: Use of sizeof() on a Pointer Type |
| 84 | CWE-682: Incorrect Calculation |
| 85 | CWE-587: Assignment of a Fixed Address to a Pointer |
| 86 | CWE-131: Incorrect Calculation of Buffer Size |
| 87 | CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| 88 | CWE-195: Signed to Unsigned Conversion Error |
| 89 | CWE-128: Wrap-around Error |
| 90 | CWE-597: Use of Wrong Operator in String Comparison |
| 91 | CWE-834: Excessive Iteration |
| 92 | CWE-768: Incorrect Short Circuit Evaluation |
| 93 | CWE-392: Missing Report of Error Condition |
| 94 | CWE-415: Double Free |
| 95 | CWE-606: Unchecked Input for Loop Condition |
| 96 | CWE- 835: Loop with Unreachable Exit Condition |
| 97 | CWE-129: An unvalidated argument is passed to a function that uses it to access an array. |
| 98 | CWE-664: invalid iterator |
| 99 | CWE-476: unconditional pointer return dref |
Java
The below table will provide you with insight into currently supported Java security checks.
| Sr. No | Supported Rules |
|---|---|
| 1 | CWE-352 : Do not disable spring security's CSRF |
| 2 | CWE-359 : Avoid logging of application sensitive data |
| 3 | CWE- 624: Regex pattern coming as input (method parameter, web request attribute, etc.) |
| 4 | CWE- 459: Close the resources in finally block |
| 5 | CWE- 404: Close the resources in finally block |
| 6 | CWE- 330: Secure Random should not initialize in method |
| 7 | CWE- 327: Use a stronger cipher algorithm |
| 8 | CWE- 833: Avoid using Thread.sleep() in a synchronized block or method |
| 9 | CWE- 820: Non-private field accessed in synchronized block indicates possibly partial synchronization |
| 10 | CWE- 521: Use password while creating database connection. |
| 11 | CWE- 78: Potential Command Injection |
| 12 | CWE- 521: LDAP connections should be authenticated |
| 13 | CWE- 489: Web applications should not have a \"main\" method |
| 14 | CWE- 807: HttpServletRequest.getRequestedSessionId() should not be used |
| 15 | CWE- 22: Potential Path Traversal |
| 16 | CWE- 312: Accessing Android external storage is security-sensitive |
| 17 | CWE- 20: Accessing Android external storage is security-sensitive |
| 18 | CWE- 502:Using unsafe Jackson deserialization configuration is security-sensitive |
| 19 | CWE- 15: Setting JavaBean properties is security-sensitive |
| 20 | CWE- 572: Do not call run() method directly |
| 21 | CWE- 586: RunFinalizersOnExit Should Not Be Called |
| 22 | CWE- 579: Non Serializable In Session |
| 23 | CWE- 500: Public Static Field Should Be Final |
| 24 | CWE- 585: Empty Synchronized Block |
| 25 | CWE- 584: Return In Finally Block |
| 26 | CWE- 586: Explicit Call To Finalize |
CERT
CERT is a secure coding standard that supports C/CPP programming languages. These standards are reliable, safe, and secure for the software systems used.
The below table will provide you with insight into currently supported C/CPP security checks.
| CERT Tag | Description |
|---|---|
| CERT-FLP30-C | Do not use floating-point variables as loop counters |
| CERT-DCL03-C | Use a static assertion to test the value of a constant expression |
| CERT-DCL16-C | Use "L," not "l," to indicate a long value |
| CERT-ENV33-C | Do not call system() |
| CERT-ERR34-C | Detect errors when converting a string to a number. |
| CERT-FIO38-C | Do not copy a FILE object |
| CERT-FLP30-C | Do not use floating-point variables as loop counters |
| CERT-MSC30-C | Do not use the rand() function for generating pseudorandom numbers |
| CERT-MSC32-C | Ensure your random number generator is properly seeded |
| CERT-MEM-35-C | Allocate sufficient memory for an object |
| CERT-FLP30-CPP | Do not use floating-point variables as loop counters |
| CERT-DCL21-CPP | Overloaded postfix increment and decrement operators should return a const object. |
| CERTDCL50-CPP | Do not define a C-style variadic function |
| CERT-DCL54-CPP | Overload allocation and deallocation functions as a pair in the same scope |
| CERT-DCL58-CPP | Do not modify the standard namespaces Skip to end of metadata. |
| CERT-DCL59-CPP | Do not define an unnamed namespace in a header file. |
| CERT-ERR09-CPP | Catch exceptions by lvalue reference |
| CERT-ERR52-CPP | Do not use setjmp() or longjmp(). |
| CERT-ERR58-CPP | Handle all exceptions thrown before main() begins executing |
| CERT-ERR60-CPP | Exception objects must be nothrow copy constructible |
| CERT-ERR61-CPP | Catch exceptions by lvalue reference |
| CERT-MSC50-CPP | Do not use std::rand() for generating pseudorandom numbers |
| CERT-MSC51-CPP | Ensure your random number generator is properly seeded |
| CERT-OOP11-CPP | Do not copy-initialize members or base classes from a move constructor. |
| CERT-OOP54-CPP | Gracefully handle a self-copy assignment |