SonarSource Rules
  • Products
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
Java

Java static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your JAVA code

  • All rules 722
  • Vulnerability58
  • Bug176
  • Security Hotspot40
  • Code Smell448

  • Quick Fix 64
 
        1. Functions should not be defined with a variable number of arguments

           Code Smell
        2. Return values should not be ignored when they contain the operation status code

           Bug
        3. Equality operators should not be used in "for" loop termination conditions

           Code Smell
        4. Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression

           Code Smell
        5. Limited dependence should be placed on operator precedence

           Code Smell
        6. Literal suffixes should be upper case

           Code Smell
        7. Privileged prompts should not be vulnerable to injection attacks

           Vulnerability
        8. Comments should start with the appropriate number of slashes

           Code Smell
        9. Types of unused record components should be removed from pattern matching

           Code Smell
        10. Markdown, HTML and Javadoc tags should be consistent

           Code Smell
        11. Unused exception parameter should use the unnamed variable pattern

           Code Smell
        12. Unnamed variable declarations should use the "var" identifier

           Code Smell
        13. Processing persistent unique identifiers is security-sensitive

           Security Hotspot
        14. Exposing native code through JavaScript interfaces is security-sensitive

           Security Hotspot
        15. Methods annotated with "@BeforeTransaction" or "@AfterTransaction" must respect the contract

           Code Smell
        16. Methods returning "Page" or "Slice" must take "Pageable" as an input parameter

           Code Smell
        17. @EventListener methods should have one parameter at most

           Bug
        18. "@Scheduled" annotation should only be applied to no-arg methods

           Bug
        19. @InitBinder methods should have void return type

           Code Smell
        20. "@Cache*" annotations should only be applied on concrete classes

           Code Smell
        21. @Cacheable and @CachePut should not be combined

           Code Smell
        22. Injecting data into static fields is not supported by Spring

           Code Smell
        23. Use appropriate @DirtiesContext modes

           Code Smell
        24. "String.isEmpty()" should be used to test for emptiness

           Code Smell
        25. Circular dependencies between classes across packages should be resolved

           Code Smell
        26. Server-side requests should not be vulnerable to traversing attacks

           Vulnerability
        27. Circular dependencies between classes in the same package should be resolved

           Code Smell
        28. Consumed Stream pipelines should not be reused

           Bug
        29. Bluetooth should be configured to use low power

           Code Smell
        30. Motion Sensor should not use gyroscope

           Code Smell
        31. Use when instead of a single if inside a pattern match body

           Code Smell
        32. "String.indexOf" should be used with correct ranges

           Bug
        33. Use Fused Location to optimize battery power

           Code Smell
        34. "Math.clamp" should be used with correct ranges

           Bug
        35. Use batch Processing in JDBC

           Code Smell
        36. Constant parameters in a "PreparedStatement" should not be set more than once

           Code Smell
        37. Virtual threads should not run tasks that include synchronized code

           Bug
        38. SQL queries should retrieve only necessary fields

           Code Smell
        39. Avoid using "FetchType.EAGER"

           Code Smell
        40. "setDaemon", "setPriority" and "getThreadGroup" should not be invoked on virtual threads

           Bug
        41. High frame rates should not be used

           Code Smell
        42. Exact alarms should not be abused

           Code Smell
        43. Proper Sensor Resource Management

           Code Smell
        44. Use built-in "Math.clamp" methods

           Code Smell
        45. Virtual threads should be used for tasks that include heavy blocking operations

           Bug
        46. Use switch instead of if-else chain to compare a variable against multiple cases

           Code Smell
        47. Use record pattern instead of explicit field access

           Code Smell
        48. Reverse view should be used instead of reverse copy in read-only cases

           Code Smell
        49. Reverse iteration should utilize reversed view

           Code Smell
        50. Set appropriate Status Codes on HTTP responses

           Bug
        51. Beans in "@Configuration" class should have different names

           Bug
        52. SpEL expression should have a valid syntax

           Bug
        53. "@PathVariable" annotation should be present if a path variable is used

           Bug
        54. "@Bean" methods for Singleton should not be invoked in "@Configuration" when proxyBeanMethods is false

           Bug
        55. Superfluous "@ResponseBody" annotations should be removed

           Code Smell
        56. "@Controller" should be replaced with "@RestController"

           Code Smell
        57. Non-singleton Spring beans should not be injected into singleton beans

           Code Smell
        58. "@Qualifier" should not be used on "@Bean" methods

           Bug
        59. Bean names should adhere to the naming conventions

           Code Smell
        60. "@Autowired" should be used when multiple constructors are provided

           Code Smell
        61. "@Autowired" should only be used on a single constructor

           Bug
        62. Use of the "@Async" annotation on methods declared within a "@Configuration" class in Spring Boot

           Bug
        63. Nullable injected fields and parameters should provide a default value

           Bug
        64. Optional REST parameters should have an object type

           Code Smell
        65. Field dependency injection should be avoided

           Code Smell
        66. Async methods should return void or Future

           Bug
        67. Methods with Spring proxy should not be called via "this"

           Code Smell
        68. Model attributes should follow the Java identifier naming convention

           Bug
        69. "@Value" annotation should inject property or SpEL expression

           Code Smell
        70. Redundant nullability annotations should be removed

           Code Smell
        71. Accessing files should not lead to filesystem oracle attacks

           Vulnerability
        72. The Singleton design pattern should be used with care

           Code Smell
        73. Environment variables should not be defined from untrusted input

           Vulnerability
        74. Methods should not perform too many tasks (aka Brain method)

           Code Smell
        75. Classes should not depend on an excessive number of classes (aka Monster Class)

           Code Smell
        76. Hash-based collections with known capacity should be initialized with the proper related static method.

           Code Smell
        77. Accessing an array element should not trigger an ArrayIndexOutOfBoundsException

           Bug
        78. Credentials should not be hard-coded

           Vulnerability
        79. Counter Mode initialization vectors should not be reused

           Vulnerability
        80. Hard-coded secrets are security-sensitive

           Security Hotspot
        81. Collections should not be modified while they are iterated

           Bug
        82. Calls to methods should not trigger an exception

           Bug
        83. Types used as keys in Maps should implement Comparable

           Code Smell
        84. XML operations should not be vulnerable to injection attacks

           Vulnerability
        85. JSON operations should not be vulnerable to injection attacks

           Vulnerability
        86. Character classes in regular expressions should not contain only one character

           Code Smell
        87. Superfluous curly brace quantifiers should be avoided

           Code Smell
        88. Non-capturing groups without quantifier should not be used

           Code Smell
        89. Thread suspensions should not be vulnerable to Denial of Service attacks

           Vulnerability
        90. Components should not be vulnerable to intent redirection

           Vulnerability
        91. XML signatures should be validated securely

           Vulnerability
        92. XML parsers should not be vulnerable to Denial of Service attacks

           Vulnerability
        93. XML parsers should not load external schemas

           Vulnerability
        94. XML parsers should not allow inclusion of arbitrary files

           Vulnerability
        95. Enabling file access for WebViews is security-sensitive

           Security Hotspot
        96. Enabling JavaScript support for WebViews is security-sensitive

           Security Hotspot
        97. Deprecated annotations should include explanations

           Code Smell
        98. Regular expression quantifiers and character classes should be used concisely

           Code Smell
        99. Constructing arguments of system commands from user input is security-sensitive

           Security Hotspot
        100. Regular expressions should not contain empty groups

           Code Smell
        101. Regular expressions should not contain multiple spaces

           Code Smell
        102. Unsupported methods should not be called on some collection implementations

           Bug
        103. Cast operations should not trigger a ClassCastException

           Bug
        104. Mobile database encryption keys should not be disclosed

           Vulnerability
        105. Using unencrypted files in mobile applications is security-sensitive

           Security Hotspot
        106. Using biometric authentication without a cryptographic solution is security-sensitive

           Security Hotspot
        107. Using unencrypted databases in mobile applications is security-sensitive

           Security Hotspot
        108. Authorizing non-authenticated users to use keys in the Android KeyStore is security-sensitive

           Security Hotspot
        109. Applications should not create session cookies from untrusted input

           Vulnerability
        110. Using long-term access keys is security-sensitive

           Security Hotspot
        111. AWS region should not be set with a hardcoded String

           Code Smell
        112. Lambdas should not invoke other lambdas synchronously

           Code Smell
        113. Consumer Builders should be used

           Code Smell
        114. Reusable resources should be initialized at construction time of Lambda functions

           Code Smell
        115. Credentials Provider should be set explicitly when creating a new "AwsClient"

           Code Smell
        116. Region should be set explicitly when creating a new "AwsClient"

           Code Smell
        117. 'serialVersionUID' field should not be set to '0L' in records

           Code Smell
        118. Equals method should be overridden in records containing array fields

           Bug
        119. Permitted types of a sealed class should be omitted if they are declared in the same file

           Code Smell
        120. Reflection should not be used to increase accessibility of records' fields

           Bug
        121. Restricted Identifiers should not be used as Identifiers

           Code Smell
        122. Local-Variable Type Inference should be used

           Code Smell
        123. Custom getter method should not be used to override record's getter behavior

           Code Smell
        124. Members ignored during record serialization should not be used

           Bug
        125. Comma-separated labels should be used in Switch with colon case

           Code Smell
        126. Redundant constructors/methods should be avoided in records

           Code Smell
        127. Records should be used instead of ordinary classes when representing immutable data structure

           Code Smell
        128. Switch arrow labels should not use redundant keywords

           Code Smell
        129. "Stream.toList()" method should be used instead of "collectors" when unmodifiable list needed

           Code Smell
        130. Text blocks should not be used in complex expressions

           Code Smell
        131. Operator "instanceof" should be used instead of "A.class.isInstance()"

           Code Smell
        132. Pattern Matching for "instanceof" operator should be used instead of simple "instanceof" + cast

           Code Smell
        133. Reflection should not be vulnerable to injection attacks

           Vulnerability
        134. String multiline concatenation should be replaced with Text Blocks

           Code Smell
        135. Map "computeIfAbsent()" and "computeIfPresent()" should not be used to add "null" values.

           Bug
        136. AssertJ assertions with "Consumer" arguments should contain assertion inside consumers

           Bug
        137. Extracting archives should not lead to zip slip vulnerabilities

           Vulnerability
        138. Mockito argument matchers should be used on all parameters

           Bug
        139. The regex escape sequence \cX should only be used with characters in the @-_ range

           Bug
        140. Call to Mockito method "verify", "when" or "given" should be simplified

           Code Smell
        141. Single-character alternations in regular expressions should be replaced with character classes

           Code Smell
        142. Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string

           Code Smell
        143. Regex lookahead assertions should not be contradictory

           Bug
        144. Back references in regular expressions should only refer to capturing groups that are matched before the reference

           Bug
        145. Regular expressions should not overflow the stack

           Bug
        146. Regex boundaries should not be used in a way that can never be matched

           Bug
        147. Regex patterns following a possessive quantifier should not always fail

           Bug
        148. Constructors of an "abstract" class should not be declared "public"

           Code Smell
        149. Annotated Mockito objects should be initialized

           Bug
        150. Tests should use fixed data instead of randomized data

           Code Smell
        151. Similar tests should be grouped in a single Parameterized test

           Code Smell
        152. Tests should be stable

           Code Smell
        153. Spring's ModelAndViewAssert assertions should be used instead of other assertions

           Code Smell
        154. Mocking all non-private methods of a class should be avoided

           Code Smell
        155. Tests method should not be annotated with competing annotations

           Bug
        156. Test methods should not contain too many assertions

           Code Smell
        157. Assertions should not be used in production code

           Bug
        158. AssertJ "assertThatThrownBy" should not be used alone

           Code Smell
        159. DateTimeFormatters should not use mismatched year and week numbers

           Bug
        160. OS commands should not be vulnerable to argument injection attacks

           Vulnerability
        161. A new session should be created during user authentication

           Vulnerability
        162. Character classes in regular expressions should not contain the same character twice

           Code Smell
        163. Unicode Grapheme Clusters should be avoided inside regex character classes

           Bug
        164. Unicode-aware versions of character classes should be preferred

           Code Smell
        165. Case insensitive Unicode regular expressions should enable the "UNICODE_CASE" flag

           Bug
        166. Assertions should not compare an object to itself

           Bug
        167. Names of regular expressions named groups should be used

           Code Smell
        168. Character classes should be preferred over reluctant quantifiers in regular expressions

           Code Smell
        169. Regular expressions should be syntactically valid

           Bug
        170. Regex alternatives should not be redundant

           Bug
        171. Regexes containing characters subject to normalization should use the CANON_EQ flag

           Code Smell
        172. Consecutive AssertJ "assertThat" statements should be chained

           Code Smell
        173. Using slow regular expressions is security-sensitive

           Security Hotspot
        174. Alternatives in regular expressions should be grouped when used with anchors

           Bug
        175. Empty lines should not be tested with regex MULTILINE flag

           Code Smell
        176. Assertions comparing incompatible types should not be made

           Bug
        177. Regular expressions should not be too complicated

           Code Smell
        178. Repeated patterns in regular expressions should not match the empty string

           Bug
        179. AssertJ assertions "allMatch" and "doesNotContains" should also test for emptiness

           Bug
        180. Chained AssertJ assertions should be simplified to the corresponding dedicated assertion

           Code Smell
        181. AssertJ methods setting the assertion context should come before an assertion

           Bug
        182. AssertJ configuration should be applied

           Bug
        183. Methods setUp() and tearDown() should be correctly annotated starting with JUnit4

           Code Smell
        184. JUnit5 test classes and methods should not be silently ignored

           Bug
        185. Authorizations should be based on strong decisions

           Vulnerability
        186. Allowing user enumeration is security-sensitive

           Security Hotspot
        187. Class members annotated with "@VisibleForTesting" should not be accessed from production code

           Code Smell
        188. Migrate your tests from JUnit4 to the new JUnit5 annotations

           Code Smell
        189. JUnit5 inner test classes should be annotated with @Nested

           Bug
        190. JUnit5 test classes and methods should have default package visibility

           Code Smell
        191. JUnit assertTrue/assertFalse should be simplified to the corresponding dedicated assertion

           Code Smell
        192. Only one method invocation is expected when testing checked exceptions

           Bug
        193. Assertion methods should not be used within the try block of a try-catch catching an Error

           Bug
        194. Only one method invocation is expected when testing runtime exceptions

           Code Smell
        195. Exception testing via JUnit @Test annotation should be avoided

           Code Smell
        196. Exception testing via JUnit ExpectedException rule should not be mixed with other assertions

           Code Smell
        197. "@Deprecated" code marked for removal should never be used

           Code Smell
        198. Allowing requests with excessive content length is security-sensitive

           Security Hotspot
        199. Disclosing fingerprints from web application technologies is security-sensitive

           Security Hotspot
        200. OpenSAML2 should be configured to prevent authentication bypass

           Vulnerability
        201. Vararg method arguments should not be confusing

           Code Smell
        202. Escape sequences should not be used in text blocks

           Code Smell
        203. Whitespace for text block indent should be consistent

           Code Smell
        204. Simple string literal should be used for single line strings

           Code Smell
        205. JWT should be signed and verified with strong cipher algorithms

           Vulnerability
        206. Lambdas should not have too many lines

           Code Smell
        207. Cipher algorithms should be robust

           Vulnerability
        208. Encryption algorithms should be used with secure mode and padding scheme

           Vulnerability
        209. Server hostnames should be verified during SSL/TLS connections

           Vulnerability
        210. Server-side templates should not be vulnerable to injection attacks

           Vulnerability
        211. Insecure temporary file creation methods should not be used

           Vulnerability
        212. Using publicly writable directories is security-sensitive

           Security Hotspot
        213. 'List.remove()' should not be used in ascending 'for' loops

           Code Smell
        214. Avoid using boxed "Boolean" types directly in boolean expressions

           Code Smell
        215. "String#replace" should be preferred to "String#replaceAll"

           Code Smell
        216. Passwords should not be stored in plaintext or with a fast hashing algorithm

           Vulnerability
        217. Dynamic code execution should not be vulnerable to injection attacks

           Vulnerability
        218. Using clear-text protocols is security-sensitive

           Security Hotspot
        219. Collection constructors should not be used as java.util.function.Function

           Code Smell
        220. Accessing Android external storage is security-sensitive

           Security Hotspot
        221. Receiving intents is security-sensitive

           Security Hotspot
        222. Broadcasting intents is security-sensitive

           Security Hotspot
        223. "ActiveMQConnectionFactory" should not be vulnerable to malicious code deserialization

           Vulnerability
        224. "else" statements should be clearly matched with an "if"

           Code Smell
        225. Disabling auto-escaping in template engines is security-sensitive

           Security Hotspot
        226. Use Java 14 "switch" expression

           Code Smell
        227. "ThreadLocal" variables should be cleaned up when no longer used

           Bug
        228. NoSQL operations should not be vulnerable to injection attacks

           Vulnerability
        229. HTTP request redirections should not be open to forging attacks

           Vulnerability
        230. Logging should not be vulnerable to injection attacks

           Vulnerability
        231. Server-side requests should not be vulnerable to forging attacks

           Vulnerability
        232. Deserialization should not be vulnerable to injection attacks

           Vulnerability
        233. Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks

           Vulnerability
        234. "Bean Validation" (JSR 380) should be properly configured

           Code Smell
        235. Having a permissive Cross-Origin Resource Sharing policy is security-sensitive

           Security Hotspot
        236. Expanding archive files without controlling resource consumption is security-sensitive

           Security Hotspot
        237. Type parameters should not shadow other type parameters

           Code Smell
        238. Strings and Boxed types should be compared using "equals()"

           Bug
        239. Derived exceptions should not hide their parents' catch blocks

           Code Smell
        240. The upper bound of type variables and wildcards should not be "final"

           Code Smell
        241. "read(byte[],int,int)" should be overridden

           Code Smell
        242. "serialVersionUID" should not be declared blindly

           Code Smell
        243. "Class.forName()" should not load JDBC 4.0+ drivers

           Code Smell
        244. An iteration on a Collection should be performed on the type handled by the Collection

           Code Smell
        245. Server certificates should be verified during SSL/TLS connections

           Vulnerability
        246. Configuring loggers is security-sensitive

           Security Hotspot
        247. Using weak hashing algorithms is security-sensitive

           Security Hotspot
        248. Java features should be preferred to Guava

           Code Smell
        249. "StandardCharsets" constants should be preferred

           Code Smell
        250. Persistent entities should not be used as arguments of "@RequestMapping" methods

           Vulnerability
        251. "@CheckForNull" or "@Nullable" should not be used on primitive types

           Code Smell
        252. String offset-based methods should be preferred for finding substrings from offsets

           Code Smell
        253. Spring beans should be considered by "@ComponentScan"

           Code Smell
        254. "@EnableAutoConfiguration" should be fine-tuned

           Code Smell
        255. "@SpringBootApplication" and "@ComponentScan" should not be used in the default package

           Bug
        256. "HttpSecurity" URL patterns should be correctly ordered

           Vulnerability
        257. Enum values should be compared with "=="

           Code Smell
        258. Using unsafe Jackson deserialization configuration is security-sensitive

           Security Hotspot
        259. "default" clauses should be last

           Code Smell
        260. Input.read() implementation should not return a signed byte

           Bug
        261. Setting JavaBean properties is security-sensitive

           Security Hotspot
        262. Delivering code in production with debug features activated is security-sensitive

           Security Hotspot
        263. Disabling CSRF protections is security-sensitive

           Security Hotspot
        264. Composed "@RequestMapping" variants should be preferred

           Code Smell
        265. "equals" method parameters should not be marked "@Nonnull"

           Code Smell
        266. Nullness of parameters should be guaranteed

           Code Smell
        267. Allowing deserialization of LDAP objects is security-sensitive

           Security Hotspot
        268. LDAP connections should be authenticated

           Vulnerability
        269. Cryptographic keys should be robust

           Vulnerability
        270. "Integer.toHexString" should not be used to build hexadecimal strings

           Code Smell
        271. Weak SSL/TLS protocols should not be used

           Vulnerability
        272. "compareTo" should not be overloaded

           Bug
        273. "write(byte[],int,int)" should be overridden

           Code Smell
        274. "iterator" should not return "this"

           Bug
        275. Secure random number generators should not output predictable values

           Vulnerability
        276. Spring components should use constructor injection

           Code Smell
        277. Functional Interfaces should be as specialised as possible

           Code Smell
        278. Getters and setters should access the expected fields

           Bug
        279. Asserts should not be used to check the parameters of a public method

           Code Smell
        280. "Stream.collect()" calls should not be redundant

           Code Smell
        281. Regex patterns should not be created needlessly

           Code Smell
        282. Null checks should not be used with "instanceof"

           Code Smell
        283. Local constants should follow naming conventions for constants

           Code Smell
        284. Assignments should not be redundant

           Code Smell
        285. Methods should not have identical implementations

           Code Smell
        286. Map values should not be replaced unconditionally

           Bug
        287. "close()" calls should not be redundant

           Code Smell
        288. "ThreadLocal.withInitial" should be preferred

           Code Smell
        289. "java.nio.Files#delete" should be preferred

           Code Smell
        290. Searching OS commands in PATH is security-sensitive

           Security Hotspot
        291. "Stream" call chains should be simplified when possible

           Code Smell
        292. Packages containing only "package-info.java" should be removed

           Code Smell
        293. Track uses of disallowed constructors

           Code Smell
        294. Week Year ("YYYY") should not be used for date formatting

           Bug
        295. Unused "private" classes should be removed

           Code Smell
        296. Exceptions should not be created without being thrown

           Bug
        297. Collection sizes and array length comparisons should make sense

           Bug
        298. A conditionally executed single line should be denoted by indentation

           Code Smell
        299. Conditionals should start on new lines

           Code Smell
        300. Consumed Stream pipelines should not be reused

           Bug
        301. Intermediate Stream methods should not be left unused

           Bug
        302. Number patterns should be regular

           Code Smell
        303. All branches in a conditional structure should not have exactly the same implementation

           Bug
        304. Arrays should not be created for varargs parameters

           Code Smell
        305. "Stream.peek" should be used with caution

           Code Smell
        306. "Map.get" and value test should be replaced with single method call

           Code Smell
        307. Cognitive Complexity of methods should not be too high

           Code Smell
        308. "@Controller" classes that use "@SessionAttributes" must call "setComplete" on their "SessionStatus" objects

           Bug
        309. Allowing both safe and unsafe HTTP methods is security-sensitive

           Security Hotspot
        310. "@RequestMapping" methods should not be "private"

           Code Smell
        311. Spring "@Controller" classes should not use "@Scope"

           Bug
        312. Members of Spring components should be injected

           Code Smell
        313. Raw types should not be used

           Code Smell
        314. Java 8's "Files.exists" should not be used

           Code Smell
        315. Track uses of disallowed classes

           Code Smell
        316. Unit tests should throw exceptions

           Code Smell
        317. Optional value should only be accessed after calling isPresent()

           Bug
        318. Database queries should not be vulnerable to injection attacks

           Vulnerability
        319. "Arrays.stream" should be used for primitive arrays

           Code Smell
        320. Jump statements should not be redundant

           Code Smell
        321. Double Brace Initialization should not be used

           Bug
        322. Test methods should comply with a naming convention

           Code Smell
        323. Test classes should comply with a naming convention

           Code Smell
        324. "Optional" should not be used for parameters

           Code Smell
        325. Overrides should match their parent class methods in synchronization

           Bug
        326. Custom resources should be closed

           Bug
        327. Zero should not be a possible denominator

           Bug
        328. Methods returns should not be invariant

           Code Smell
        329. Format strings should be used correctly

           Code Smell
        330. Value-based objects should not be serialized

           Code Smell
        331. Value-based classes should not be used for locking

           Bug
        332. Loggers should be named for their enclosing classes

           Code Smell
        333. Assertion arguments should be passed in the correct order

           Code Smell
        334. Tests should be kept in a dedicated source directory

           Code Smell
        335. Methods should not return constants

           Code Smell
        336. "private" methods called only by inner classes should be moved to those classes

           Code Smell
        337. "this" should not be exposed from constructors

           Code Smell
        338. Ternary operators should not be nested

           Code Smell
        339. Expressions used in "assert" should not produce side effects

           Bug
        340. Creating cookies without the "HttpOnly" flag is security-sensitive

           Security Hotspot
        341. Cipher Block Chaining IVs should be unpredictable

           Vulnerability
        342. Constructor injection should be used instead of field injection

           Bug
        343. Factory method injection should be used in "@Configuration" classes

           Code Smell
        344. Default annotation parameter values should not be passed as arguments

           Code Smell
        345. "static" base class members should not be accessed via derived types

           Code Smell
        346. Method parameters should be declared with base types

           Code Smell
        347. "volatile" variables should not be used with compound operators

           Bug
        348. Non-primitive fields should not be "volatile"

           Bug
        349. "getClass" should not be used for synchronization

           Bug
        350. "enum" fields should not be publicly mutable

           Code Smell
        351. Min and max used in combination should not always return the same value

           Bug
        352. Assignment of lazy-initialized members should be the last step with double-checked locking

           Bug
        353. Fields should not be initialized to default values

           Code Smell
        354. Multiple loops over the same set should be combined

           Code Smell
        355. "wait" should not be called when multiple locks are held

           Bug
        356. "writeObject" should not be the only "synchronized" code in a class

           Code Smell
        357. Indexes to passed to "String" operations should be within the string's bounds

           Bug
        358. Abstract methods should not be redundant

           Code Smell
        359. Raw byte values should not be used in bitwise operations in combination with shifts

           Bug
        360. JEE applications should not "getClassLoader"

           Bug
        361. Classes should not have too many "static" imports

           Code Smell
        362. "Collection.toArray()" should be passed an array of the proper type

           Bug
        363. "ThreadGroup" should not be used

           Code Smell
        364. Arrays and lists should not be copied using loops

           Code Smell
        365. Reflection should not be used to increase accessibility of classes, methods, or fields

           Code Smell
        366. Static fields should not be updated in constructors

           Code Smell
        367. Static non-final field names should comply with a naming convention

           Code Smell
        368. "clone" should not be overridden

           Code Smell
        369. Classes without "public" constructors should be "final"

           Code Smell
        370. Escaped Unicode characters should not be used

           Code Smell
        371. Inner classes should not have too many lines of code

           Code Smell
        372. Assertions should be complete

           Code Smell
        373. Unnecessary semicolons should be omitted

           Code Smell
        374. "Thread.sleep" should not be used in tests

           Code Smell
        375. JUnit rules should be used

           Code Smell
        376. Getters and setters should be synchronized in pairs

           Bug
        377. Non-thread-safe fields should not be static

           Bug
        378. "entrySet()" should be iterated when both the key and value are needed

           Code Smell
        379. "null" should not be used with "Optional"

           Bug
        380. Nested "enum"s should not be declared static

           Code Smell
        381. Unary prefix operators should not be repeated

           Bug
        382. Non-existent operators like "=+" should not be used

           Bug
        383. XML parsers should not be vulnerable to XXE attacks

           Vulnerability
        384. "catch" clauses should do more than rethrow

           Code Smell
        385. "DateUtils.truncate" from Apache Commons Lang library should not be used

           Code Smell
        386. Literal boolean values and nulls should not be used in assertions

           Code Smell
        387. Tests should include assertions

           Code Smell
        388. Test assertions should include messages

           Code Smell
        389. Instance methods should not write to "static" fields

           Code Smell
        390. "PreparedStatement" and "ResultSet" methods should be called with valid indices

           Bug
        391. Inner classes which do not reference their owning classes should be "static"

           Code Smell
        392. Threads should not be started in constructors

           Code Smell
        393. "indexOf" checks should not be for positive numbers

           Code Smell
        394. Files opened in append mode should not be used with "ObjectOutputStream"

           Bug
        395. Multiline blocks should be enclosed in curly braces

           Code Smell
        396. "read" and "readLine" return values should be used

           Bug
        397. "Math.abs" and negation should not be used on numbers that could be "MIN_VALUE"

           Bug
        398. "readObject" should not be "synchronized"

           Code Smell
        399. The value returned from a stream read should be checked

           Bug
        400. Classes should not be loaded dynamically

           Vulnerability
        401. Basic authentication should not be used

           Vulnerability
        402. Inappropriate regular expressions should not be used

           Bug
        403. Method overrides should not change contracts

           Code Smell
        404. "@NonNull" values should not be set to null

           Bug
        405. Regular expressions should not be vulnerable to Denial of Service attacks

           Vulnerability
        406. "Preconditions" and logging arguments should not require evaluation

           Code Smell
        407. Setting loose POSIX file permissions is security-sensitive

           Security Hotspot
        408. Boolean expressions should not be gratuitous

           Code Smell
        409. Conditionally executed code should be reachable

           Bug
        410. Whitespace and control characters in literals should be explicit

           Code Smell
        411. "null" should not be returned from a "Boolean" method

           Code Smell
        412. "notifyAll()" should be preferred over "notify()"

           Bug
        413. Blocks should be synchronized on "private final" fields

           Bug
        414. Lazy initialization of "static" fields should be "synchronized"

           Code Smell
        415. Synchronizing on a "Lock" object should be avoided

           Code Smell
        416. Non-serializable objects should not be stored in "javax.servlet.http.HttpSession" instances

           Bug
        417. Classes with only "static" methods should not be instantiated

           Code Smell
        418. "Thread" should not be used where a "Runnable" argument is expected

           Code Smell
        419. Unnecessary bit operations should not be performed

           Code Smell
        420. Classes should not access their own subclasses during class initialization

           Bug
        421. Inner class calls to super class methods should be unambiguous

           Code Smell
        422. Child class fields should not shadow parent class fields

           Code Smell
        423. Mutable fields should not be "public static"

           Code Smell
        424. Private mutable members should not be stored or returned directly

           Code Smell
        425. Redundant modifiers should not be used

           Code Smell
        426. Unused type parameters should be removed

           Code Smell
        427. "private" and "final" methods that don't access instance data should be "static"

           Code Smell
        428. Files should not be empty

           Code Smell
        429. "deleteOnExit" should not be used

           Code Smell
        430. Public methods should not contain selector arguments

           Code Smell
        431. The diamond operator ("<>") should be used

           Code Smell
        432. "wait(...)" should be used instead of "Thread.sleep(...)" when a lock is held

           Bug
        433. Printf-style format strings should not lead to unexpected behavior at runtime

           Bug
        434. "Object.wait(...)" and "Condition.await(...)" should be called inside a "while" loop

           Code Smell
        435. "Object.wait()", "Object.notify()" and "Object.notifyAll()" should only be called from synchronized code

           Bug
        436. "Iterator.next()" methods should throw "NoSuchElementException"

           Bug
        437. Java parser failure

           Code Smell
        438. Null pointers should not be dereferenced

           Bug
        439. Null pointers should not be dereferenced

           Bug
        440. Using non-standard cryptographic algorithms is security-sensitive

           Security Hotspot
        441. "HttpServletRequest.getRequestedSessionId()" should not be used

           Vulnerability
        442. Track uses of disallowed methods

           Code Smell
        443. Loop conditions should be true at least once

           Bug
        444. A "for" loop update clause should move the counter in the right direction

           Bug
        445. Collection methods with O(n) performance should be used carefully

           Code Smell
        446. Using pseudorandom number generators (PRNGs) is security-sensitive

           Security Hotspot
        447. Methods "wait(...)", "notify()" and "notifyAll()" should not be called on Thread instances

           Bug
        448. "IllegalMonitorStateException" should not be caught

           Code Smell
        449. Parameters should be passed in the correct order

           Code Smell
        450. "ResultSet.isLast()" should not be used

           Code Smell
        451. Methods with Spring proxying annotations should be public

           Bug
        452. Methods should not call same-class methods with incompatible "@Transactional" values

           Bug
        453. Servlets should not have mutable instance fields

           Bug
        454. "toString()" and "clone()" methods should not return null

           Bug
        455. Locks should be released on all paths

           Bug
        456. "Exception" should not be caught when not required by called methods

           Code Smell
        457. Types should be used in lambdas

           Code Smell
        458. "static" members should be accessed statically

           Code Smell
        459. Wildcard imports should not be used

           Code Smell
        460. ".equals()" should not be used to test the values of "Atomic" classes

           Bug
        461. "collect" should be used with "Streams" instead of "list::add"

           Code Smell
        462. Return values from functions without side effects should not be ignored

           Bug
        463. "compareTo" results should not be checked for specific values

           Bug
        464. Modulus results should not be checked for direct equality

           Code Smell
        465. Switches should be used for sequences of simple "String" tests

           Code Smell
        466. Recursion should not be infinite

           Bug
        467. Loops should not be infinite

           Bug
        468. JUnit test cases should call super methods

           Code Smell
        469. TestCases should contain tests

           Code Smell
        470. JUnit assertions should not be used in "run" methods

           Code Smell
        471. Do not perform unnecessary mathematical operations

           Code Smell
        472. Math operands should be cast before assignment

           Bug
        473. Ints and longs should not be shifted by zero or more than their number of bits-1

           Bug
        474. Short-circuit logic should be used in boolean contexts

           Code Smell
        475. Child class methods named for parent class methods should be overrides

           Bug
        476. Class names should not shadow interfaces or superclasses

           Code Smell
        477. Inappropriate "Collection" calls should not be made

           Bug
        478. Double-checked locking should not be used

           Bug
        479. "compareTo" should not return "Integer.MIN_VALUE"

           Bug
        480. Classes named like "Exception" should extend "Exception" or a subclass

           Code Smell
        481. "finalize" should not set fields to "null"

           Code Smell
        482. Math should not be performed on floats

           Bug
        483. "equals" methods should be symmetric and work for subclasses

           Bug
        484. Subclasses that add fields to classes that override "equals" should also override "equals"

           Code Smell
        485. Unnecessary equality checks should not be made

           Bug
        486. "Cloneables" should implement "clone"

           Code Smell
        487. "final" classes should not have "protected" members

           Code Smell
        488. Dissimilar primitive wrappers should not be used with the ternary operator without explicit casting

           Bug
        489. Unnecessary boxing and unboxing should be avoided

           Bug
        490. "runFinalizersOnExit" should not be called

           Bug
        491. Underscores should be used to make large numbers readable

           Code Smell
        492. Catches should be combined

           Code Smell
        493. "java.time" classes should be used for dates and times

           Code Smell
        494. "InterruptedException" and "ThreadDeath" should not be ignored

           Bug
        495. Classes that don't define "hashCode()" should not be used in hashes

           Bug
        496. Methods of "Random" that return floating point values should not be used in random integer generation

           Code Smell
        497. Exceptions should be either logged or rethrown but not both

           Code Smell
        498. Classes extending java.lang.Thread should provide a specific "run" behavior

           Bug
        499. Objects should not be created only to invoke "getClass"

           Code Smell
        500. Primitives should not be boxed just for "String" conversion

           Code Smell
        501. Parsing should be used to convert "Strings" to primitives

           Code Smell
        502. Constructors should not be used to instantiate "String", "BigInteger", "BigDecimal" and primitive-wrapper classes

           Code Smell
        503. "Double.longBitsToDouble" should take "long" as argument

           Bug
        504. Values should not be uselessly incremented

           Bug
        505. "ScheduledThreadPoolExecutor" should not have 0 core threads

           Bug
        506. String operations with predictable outcomes should be avoided

           Bug
        507. "Random" objects should be reused

           Bug
        508. "writeObject" argument must implement "Serializable"

           Bug
        509. "hashCode" and "toString" should not be called on array instances

           Bug
        510. A secure password should be used when connecting to a database

           Vulnerability
        511. Collections should not be passed as arguments to their own methods

           Bug
        512. "URL.hashCode" and "URL.equals" should be avoided

           Code Smell
        513. "BigDecimal(double)" should not be used

           Bug
        514. Invalid "Date" values should not be used

           Bug
        515. Reflection should not be used to check non-runtime annotations

           Bug
        516. "equals(Object obj)" should test the argument's type

           Bug
        517. "main" should not "throw" anything

           Code Smell
        518. Resources should be closed

           Bug
        519. Classes should not be empty

           Code Smell
        520. Try-with-resources should be used

           Code Smell
        521. Creating cookies without the "secure" flag is security-sensitive

           Security Hotspot
        522. XPath expressions should not be vulnerable to injection attacks

           Vulnerability
        523. I/O function calls should not be vulnerable to path injection attacks

           Vulnerability
        524. LDAP queries should not be vulnerable to injection attacks

           Vulnerability
        525. Formatting SQL queries is security-sensitive

           Security Hotspot
        526. OS commands should not be vulnerable to command injection attacks

           Vulnerability
        527. Hard-coded passwords are security-sensitive

           Security Hotspot
        528. "Serializable" inner classes of non-serializable outer classes should be "static"

           Bug
        529. Fields in non-serializable classes should not be "transient"

           Code Smell
        530. Comparators should be "Serializable"

           Code Smell
        531. "readResolve" methods should be inheritable

           Code Smell
        532. Custom serialization methods should have required signatures

           Bug
        533. "Externalizable" classes should have no-arguments constructors

           Bug
        534. "Serializable" inner classes of "Serializable" classes should be static

           Code Smell
        535. "Serializable" classes should have a "serialVersionUID"

           Code Smell
        536. The non-serializable super class of a "Serializable" class should have a no-argument constructor

           Bug
        537. Password hashing functions should use an unpredictable salt

           Vulnerability
        538. The names of methods with boolean return values should start with "is" or "has"

           Code Smell
        539. Member variable visibility should be specified

           Code Smell
        540. Files should contain only one top-level class or interface each

           Code Smell
        541. "for" loop increment clauses should modify the loops' counters

           Code Smell
        542. Exceptions should not be thrown from servlet methods

           Vulnerability
        543. Fields in a "Serializable" class should either be transient or serializable

           Code Smell
        544. Classes and methods that rely on the default system encoding should not be used

           Code Smell
        545. Simple class names should be used

           Code Smell
        546. Variables should not be declared before they are relevant

           Code Smell
        547. Boolean checks should not be inverted

           Code Smell
        548. Extensions and implementations should not be redundant

           Code Smell
        549. Redundant casts should not be used

           Code Smell
        550. "@Deprecated" code should not be used

           Code Smell
        551. Classes should not be compared by name

           Bug
        552. Two branches in a conditional structure should not have exactly the same implementation

           Code Smell
        553. Related "if/else if" statements should not have the same condition

           Bug
        554. Synchronization should not be done on instances of value-based classes

           Bug
        555. "toString()" should never be called on a String object

           Code Smell
        556. Unused assignments should be removed

           Code Smell
        557. "Iterator.hasNext()" should not call "Iterator.next()"

           Bug
        558. Methods and field names should not be the same or differ only by capitalization

           Code Smell
        559. "Object.wait" should not be called on objects that implement "java.util.concurrent.locks.Condition"

           Code Smell
        560. "switch" statements and expressions should not be nested

           Code Smell
        561. Classes should not have too many fields

           Code Smell
        562. The ternary operator should not be used

           Code Smell
        563. Identical expressions should not be used on both sides of a binary operator

           Bug
        564. Loops with at most one iteration should be refactored

           Bug
        565. Standard functional interfaces should not be redefined

           Code Smell
        566. Annotation repetitions should not be wrapped

           Code Smell
        567. A field should not duplicate the name of its containing class

           Code Smell
        568. Constructors should only call non-overridable methods

           Code Smell
        569. "==" and "!=" should not be used when "equals" is overridden

           Code Smell
        570. "NullPointerException" should not be caught

           Code Smell
        571. "NullPointerException" should not be explicitly thrown

           Code Smell
        572. An abstract class should have both abstract and concrete methods

           Code Smell
        573. Multiple variables should not be declared on the same line

           Code Smell
        574. Variables should not be self-assigned

           Bug
        575. Strings should not be concatenated using '+' in a loop

           Code Smell
        576. Sets with elements that are enum values should be replaced with EnumSet

           Code Smell
        577. Maps with keys that are enum values should use the EnumMap implementation

           Code Smell
        578. Lambdas should be replaced with method references

           Code Smell
        579. Parentheses should be removed from a single lambda parameter when its type is inferred

           Code Smell
        580. Abstract classes without fields should be converted to interfaces

           Code Smell
        581. JUnit4 @Ignored and JUnit5 @Disabled annotations should be used to disable tests and should provide a rationale

           Code Smell
        582. Anonymous inner classes containing only one method should become lambdas

           Code Smell
        583. Lambdas containing only one statement should not nest this statement in a block

           Code Smell
        584. Package declaration should match source file directory

           Code Smell
        585. "Collections.EMPTY_LIST", "EMPTY_MAP", and "EMPTY_SET" should not be used

           Code Smell
        586. Methods should not be too complex

           Code Smell
        587. Local variables should not be declared and then immediately returned or thrown

           Code Smell
        588. Unused local variables should be removed

           Code Smell
        589. "switch" statements should not have too many "case" clauses

           Code Smell
        590. Generic wildcard types should not be used in return types

           Code Smell
        591. Track lack of copyright and license headers

           Code Smell
        592. Private fields only used as local variables in methods should become local variables

           Code Smell
        593. String operations should not rely on the default system locale

           Code Smell
        594. Classes should not have too many methods

           Code Smell
        595. "public static" fields should be constant

           Code Smell
        596. Comments should not be located at the end of lines of code

           Code Smell
        597. Methods should not have too many lines

           Code Smell
        598. Loops should not contain more than a single "break" or "continue" statement

           Code Smell
        599. Control flow statements "if", "for", "while", "switch" and "try" should not be nested too deeply

           Code Smell
        600. Declarations should use Java collection interfaces such as "List" rather than specific implementation classes such as "LinkedList"

           Code Smell
        601. "StringBuilder" and "StringBuffer" should not be instantiated with a character

           Bug
        602. Track uses of "CHECKSTYLE:OFF" suppression comments

           Code Smell
        603. Octal values should not be used

           Code Smell
        604. Using hardcoded IP addresses is security-sensitive

           Security Hotspot
        605. Loggers should be "private static final" and should share a naming convention

           Code Smell
        606. Track uses of "NOPMD" suppression comments

           Code Smell
        607. "switch" statements should have "default" clauses

           Code Smell
        608. Track uses of "@SuppressWarnings" annotations

           Code Smell
        609. "switch" statements should have at least 3 "case" clauses

           Code Smell
        610. Track uses of "NOSONAR" comments

           Code Smell
        611. Switch cases should end with an unconditional "break" statement

           Code Smell
        612. "for" loop stop conditions should be invariant

           Code Smell
        613. A "while" loop should be used instead of a "for" loop

           Code Smell
        614. "if ... else if" constructs should end with "else" clauses

           Code Smell
        615. Classes and enums with private members should have a constructor

           Code Smell
        616. Sections of code should not be commented out

           Code Smell
        617. Floating point numbers should not be tested for equality

           Bug
        618. Track comments matching a regular expression

           Code Smell
        619. Packages should have a javadoc file 'package-info.java'

           Code Smell
        620. Method parameters, caught exceptions and foreach variables' initial values should not be ignored

           Bug
        621. Non-constructor methods should not have the same name as the enclosing class

           Code Smell
        622. Methods should not be named "tostring", "hashcode" or "equal"

           Bug
        623. The default unnamed package should not be used

           Code Smell
        624. Statements should be on separate lines

           Code Smell
        625. "switch" statements should not contain non-case labels

           Code Smell
        626. "Thread.run()" should not be called directly

           Bug
        627. Execution of the Garbage Collector should be triggered only by the JVM

           Code Smell
        628. Interfaces should not solely consist of constants

           Code Smell
        629. The members of an interface or class declaration should appear in a pre-defined order

           Code Smell
        630. "equals(Object obj)" should be overridden along with the "compareTo(T obj)" method

           Code Smell
        631. Control structures should use curly braces

           Code Smell
        632. "equals(Object obj)" and "hashCode()" should be overridden in pairs

           Bug
        633. "equals" method overrides should accept "Object" parameters

           Bug
        634. Classes should not be coupled to too many other classes

           Code Smell
        635. Package names should comply with a naming convention

           Code Smell
        636. Nested code blocks should not be used

           Code Smell
        637. Array designators "[]" should be on the type, not the variable

           Code Smell
        638. Array designators "[]" should be located after the type in method signatures

           Code Smell
        639. "java.lang.Error" should not be extended

           Code Smell
        640. Exception types should not be tested using "instanceof" in catch blocks

           Code Smell
        641. String literals should not be duplicated

           Code Smell
        642. Classes from "sun.*" packages should not be used

           Code Smell
        643. Future keywords should not be used as names

           Code Smell
        644. Type parameter names should comply with a naming convention

           Code Smell
        645. Anonymous classes should not have too many lines

           Code Smell
        646. Methods should not be empty

           Code Smell
        647. Overriding methods should do more than simply call the same method in the super class

           Code Smell
        648. Classes that override "clone" should be "Cloneable" and call "super.clone()"

           Code Smell
        649. Throwable and Error should not be caught

           Code Smell
        650. Abstract class names should comply with a naming convention

           Code Smell
        651. Public types, methods and fields (API) should be documented with Javadoc

           Code Smell
        652. The signature of "finalize()" should match that of "Object.finalize()"

           Bug
        653. "Object.finalize()" should remain protected (versus public) when overriding

           Code Smell
        654. Unused method parameters should be removed

           Code Smell
        655. Only static class initializers should be used

           Code Smell
        656. Public constants and fields initialized at declaration should be "static final" rather than merely "final"

           Code Smell
        657. Local variable and method parameter names should comply with a naming convention

           Code Smell
        658. Empty arrays and collections should be returned instead of null

           Code Smell
        659. Exception handlers should preserve the original exceptions

           Code Smell
        660. Exception classes should have final fields

           Code Smell
        661. Exceptions should not be thrown in finally blocks

           Code Smell
        662. Checked exceptions should not be thrown

           Code Smell
        663. "@Override" should be used on overriding and implementing methods

           Code Smell
        664. Public methods should throw at most one checked exception

           Code Smell
        665. Field names should comply with a naming convention

           Code Smell
        666. Primitive wrappers should not be instantiated only for "toString" or "compareTo" calls

           Code Smell
        667. Case insensitive string comparisons should be made without intermediate upper or lower casing

           Code Smell
        668. "Collection.isEmpty()" should be used to test for emptiness

           Code Smell
        669. "String.valueOf()" should not be appended to a "String"

           Code Smell
        670. "switch case" clauses should not have too many lines of code

           Code Smell
        671. "Enumeration" should not be implemented

           Code Smell
        672. Constant names should comply with a naming convention

           Code Smell
        673. Synchronized classes "Vector", "Hashtable", "Stack" and "StringBuffer" should not be used

           Code Smell
        674. Exit methods should not be called

           Code Smell
        675. Unused "private" methods should be removed

           Code Smell
        676. Jump statements should not occur in "finally" blocks

           Bug
        677. Methods should not have too many return statements

           Code Smell
        678. Try-catch blocks should not be nested

           Code Smell
        679. Interface names should comply with a naming convention

           Code Smell
        680. Track uses of "TODO" tags

           Code Smell
        681. Track uses of "FIXME" tags

           Code Smell
        682. Deprecated code should be removed

           Code Smell
        683. Strings literals should be placed on the left side when checking for equality

           Code Smell
        684. Exceptions in "throws" clauses should not be superfluous

           Code Smell
        685. Files should end with a newline

           Code Smell
        686. Unnecessary imports should be removed

           Code Smell
        687. Return of boolean expressions should not be wrapped into an "if-then-else" statement

           Code Smell
        688. Boolean literals should not be redundant

           Code Smell
        689. Modifiers should be declared in the correct order

           Code Smell
        690. Deprecated elements should have both the annotation and the Javadoc tag

           Code Smell
        691. Assignments should not be made from within sub-expressions

           Code Smell
        692. Source code should be indented consistently

           Code Smell
        693. Generic exceptions should never be thrown

           Code Smell
        694. Labels should not be used

           Code Smell
        695. Utility classes should not have public constructors

           Code Smell
        696. Local variables should not shadow class fields

           Code Smell
        697. Empty statements should be removed

           Code Smell
        698. "super.finalize()" should be called at the end of "Object.finalize()" implementations

           Bug
        699. The "Object.finalize()" method should not be overridden

           Code Smell
        700. The "Object.finalize()" method should not be called

           Bug
        701. Redundant pairs of parentheses should be removed

           Code Smell
        702. A close curly brace should be located at the beginning of a line

           Code Smell
        703. Close curly brace and the next "else", "catch" and "finally" keywords should be on two different lines

           Code Smell
        704. Close curly brace and the next "else", "catch" and "finally" keywords should be located on the same line

           Code Smell
        705. An open curly brace should be located at the beginning of a line

           Code Smell
        706. An open curly brace should be located at the end of a line

           Code Smell
        707. Class variable fields should not have public accessibility

           Code Smell
        708. Inheritance tree of classes should not be too deep

           Code Smell
        709. Magic numbers should not be used

           Code Smell
        710. Nested blocks of code should not be left empty

           Code Smell
        711. URIs should not be hardcoded

           Code Smell
        712. Methods should not have too many parameters

           Code Smell
        713. Unused "private" fields should be removed

           Code Smell
        714. Expressions should not be too complex

           Code Smell
        715. Mergeable "if" statements should be combined

           Code Smell
        716. Unused labels should be removed

           Code Smell
        717. Standard outputs should not be used directly to log anything

           Code Smell
        718. Tabulation characters should not be used

           Code Smell
        719. Files should not have too many lines of code

           Code Smell
        720. Lines should not be too long

           Code Smell
        721. Class names should comply with a naming convention

           Code Smell
        722. Method names should comply with a naming convention

           Code Smell

        Methods should not have too many parameters

        adaptability - focused
        maintainability
        Code Smell
        • brain-overload

        Why is this an issue?

        Methods with a long parameter list are difficult to use because maintainers must figure out the role of each parameter and keep track of their position.

        void setCoordinates(int x1, int y1, int z1, int x2, int y2, int z2) { // Noncompliant
            // ...
        }
        

        The solution can be to:

        • Split the method into smaller ones
        // Each function does a part of what the original setCoordinates function was doing, so confusion risks are lower
        void setOrigin(int x, int y, int z) {
           // ...
        }
        
        void setSize(int width, int height, int depth) {
           // ...
        }
        
        • Find a better data structure for the parameters that group data in a way that makes sense for the specific application domain
        class Point // In geometry, Point is a logical structure to group data
        {
            public int x;
            public int y;
            public int z;
         };
        
        void setCoordinates(Point p1, Point p2) {
            // ...
        }
        

        This rule raises an issue when a method has more parameters than the provided threshold.

        Exceptions

        Methods annotated with :

        • Spring’s @RequestMapping (and related shortcut annotations, like @GetRequest)
        • JAX-RS API annotations (like @javax.ws.rs.GET)
        • Bean constructor injection with @org.springframework.beans.factory.annotation.Autowired
        • CDI constructor injection with @javax.inject.Inject
        • @com.fasterxml.jackson.annotation.JsonCreator
        • Micronaut’s annotations (like @io.micronaut.http.annotation.Get)

        may have a lot of parameters, encapsulation being possible. Therefore the rule ignores such methods.

        Also, if a class annotated as a Spring component (like @org.springframework.stereotype.Component) has a single constructor, that constructor will be considered @Autowired and ignored by the rule.

          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your , Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube Community BuildAnalyze code in your
          on-premise CI
          Available Since
          9.1
        • SonarQube ServerAnalyze code in your
          on-premise CI
          Developer Edition
          Available Since
          9.1

        © 2008-2025 SonarSource SA. All rights reserved.

        Sonar helps developers write Clean Code.
        Privacy Policy| Cookie Policy| Terms of Use