Agile & DevOps

Best Practice

Security Reviewer rule

Return without result code

Yes

Duplicated Method/Class

Duplicated Branch

Duplicated File

Yes

Yes

Yes

Reduce the number of returns of this method down to the maximum allowed

Yes

No explicit constants directly used in the code

Yes

Class should not be public

Yes

Switch Case - Improper use of throw

Yes

Expression is always true

Expression is always false

Impossible equality is always false

Yes

Yes

Yes

No assignment '=' within 'if' statement

No assignment '=' within 'while' statement

Yes

Unsigned Less Than Zero (Checking if unsigned variable is less than zero)

Yes

Comparison Error

Yes

Goto statement is deprecated

Yes

Suspicious Comment

Yes

Objects instantiated in a loop

Yes

A "for" loop iterator is modified in the body of the loop

Yes

A file has an insufficient level of code coverage

No

Source files have an insufficient density of comments

Yes

Components are calling too many other components

Yes

Class hierarchies are too deep

Yes

A method or a function have too many parameters

Yes

Test for equality between floating point variables

Yes

Method or constructor is accessed

without the expected lock

Yes

Methods or functions are highly complex

Yes

Too deeply nested statements

Yes

Classes are wrongly coupled

Yes

A parent class references any of its child classes

Yes

An interface has more than 50 services (functions or methods)

NO

Operations that might be incorrect because of numerical approximations

Yes

Incorrect uses of == and equals()

Yes

Inconsistent class redefinitions or method overriding

NO

Missing call to super()

Yes

Suspicious call over arrays

NO

Incorrect class loading

Yes

Incorrect object cloning

Yes

Infinite recursion

Yes

Logical bitwise operation is used instead of a logical Boolean operation

Yes

Nullable Parameter

Yes

Null Array length

Yes

toString on array

Yes

Commented-out code > 20%

Yes

Method should not return null

Yes

Float Counter used in a loop

Yes

Coverage

92%

Rule

Security Reviewer

Empty Event Handler

Empty control statement

Empty try block

Empty catch block

Empty Class Declaration

Empty Function or Method

Yes

NO

Yes

Yes

Yes

Yes

Code is unreachable

Yes

Unused Object

Unused Private Method

Unused Function

Unused Label

Unused Return Value

Yes

Yes

Yes

Yes

NO

Redundant control flow jump statement

Redundant code (unreachable Code)

Redundant Assign In Switch

Redundant code (redundant Get And Set)

Redundant code (Assignment of function parameter has no effect outside the function)

Redundant code (Const Statement)

Yes

Yes

Yes

Yes

Yes

Yes

Useless call

NO

Variable is assigned a value that is never used

Unused Variable

Field|Costant is never used or is only assigned but its value is never used

Yes

Yes

Yes

Unused Parameter

Yes

Unused Local Variable

Yes

Useless code

Useless Constructor

Useless Field

Yes

Yes

Yes

Unused resources

Yes

Unused classes

Yes

Useless instanceof operations

Yes

Useless test statements

Yes

Coverage

94%

Attack

Security Reviewer

API Abuse

Yes

Application Misconfiguration

Yes

Auto-complete Not Disabled on Password Parameters

Yes

Buffer Overflow

Yes

Command Injection

Yes

Credential/Session Prediction

Yes

Cross-site Scripting

Yes

Dangerous Native Method

Yes

Denial of Service

Yes

Escalation of Privileges

Yes

Insecure Cryptography

Yes

Format String

Yes

Hardcoded Credentials

Yes

HTTP Response Splitting

Yes

Improper Input Handling

Yes

Improper Output Encoding

Yes

Information Leakage

Yes

Insecure Data Caching

Yes

Insecure File Upload

Yes

Insufficient Account Lockout

Yes

Insufficient Authentication

Yes

Insufficient Authorization

Yes

Insufficient/Insecure Logging

Yes

Insufficient Password Complexity Requirements

Yes

Insufficient Password History Requirements

Yes

Insufficient Session Expiration

Yes

Insecure Randomness

Yes

Integer Overflows

Yes

LDAP Injection

Yes

Mail Command Injection

Yes

Null Byte Injection

Yes

Open Redirect Attacks

Yes

OS Command Injection

Yes

Path Traversal

Yes

Race Conditions

Yes

Reflection Injection

Yes

Resource Injection

Yes

Remote File Inclusion

Yes

Second Order Injection

Yes

Session Fixation

Session Injection

Session HighJacking

Yes

Yes

Yes

SQL Injection

Yes

Unreleased Resource

Yes

URL Injection

Yes

URL Redirection Abuse

Yes

XPATH Injection

Yes

XML External Entities

Yes

XML Entity Expansion

Yes

XML Injection Attacks

Yes

XPATH Injection

Yes

Coverage

100%