Static Analysis Rules

Docs > Code Analysis > Static Analysis Rules

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Join the Preview!

Code Analysis is in Preview.

Overview

Datadog Static Analysis provides out-of-the-box rules to help detect violations in your CI/CD pipelines in code reviews and identify bugs, security, and maintainability issues. For more information, see the Setup documentation.

Ruleset ID: csharp-best-practices Rules to enforce C# best practices.

Avoid calling GC.SuppressFinalize()

avoid-call-gc-suppress-finalize

Avoid empty catch sections

no-empty-catch

Avoid empty finalizer

no-empty-finalizer

Avoid exceptions in finalizers

finalizer-no-exception

Avoid FormattableString

avoid-formattablestring

Avoid keywords as variables names

variable-names

Avoid nested operators

no-nested-ternary

Avoid NotImplementedException

avoid-notimplementedexception

Avoid protected members in sealed class

sealed-class-protected-members

Avoid redundant modifiers

redundant-modifiers

Avoid StartsWith or EndsWith with one character

strings-with-one-char

Avoid Thread.sleep in tests

no-sleep-in-tests

Avoid using a public contructor for an abstract class

public-abstract-constructors

Avoid using GC.Collect

avoid-gc-collect

Avoid using goto statements

avoid-goto-use

Checks for always-true expressions on collections and arrays

unnecessary-length-count-check

Classes with Dispose() should implement IDisposable

disposable-interface

Detects improper usage of void return in an async method

async-task-not-void

Dispose objects at most once

dispose-objects-once

Do not assign a variable to itself

no-self-assign

Do not compare with NaN

comparison-nan

Do not throw exceptions in special methods

no-exception-special-methods

Do not throw generic exceptions

use-specific-exceptions

Do not use operators that do not exists

avoid-non-existing-operators

Do not use Optional on ref or out. parameters

optional-ref-out

Do not use the same operator twice

no-double-operators

Enforce Guid parameter initialization

use-proper-new-guid

Enforces an int operand on bitwise and shift operations

bitwise-right-operand-int

Enforces that base is object when using base.Equals

base-equals

Ensure code coverage exclusions are justified

coverage-justification

Ensure objects are used

objects-ensure-use

Ensures that a ThreadStatic field is not initialized

do-not-initialize-threadstatic

Ensures ThreadStatic fields are marked static

ignored-threadstatic

Exceptions must be thrown

exception-must-be-thrown

Exceptions should be made public

exceptions-public

IndexOf function should check the first character

indexof-checks

Prevent catching NullReference

catch-nullreference

Prevent empty default cases

no-empty-default

Prevents the return of an IDisposable from a using statement

using-idisposable-return

Prevents using `==` and `!=` operators on floats and doubles

float-equality

Suggest using string's indexer property over toCharArray()

redundant-tochararray

Test method name should follow conventions

test-method-names

ToString() should never return `null`

tostring-not-return-null

Use Assembly.Load

use-assembly-load

Use Contains for simple equality

contains-not-any

Use Contains to check if a string contains something

indexof-contains

Warns on class private constructors that are dead code

class-no-private-constructors

Ruleset ID: csharp-code-style Rules to enforce C# code style.

Avoid prefix boolean returning method with `get`

boolean-get-method-name

Avoid short class names

short-class-name

Avoid short method names

short-method-name

Avoid short variable names

short-variable

Follow class naming conventions

class-naming-conventions

Follow variable naming conventions

variable-naming-conventions

Interface names should start with I

interface-first-letter

Ruleset ID: csharp-inclusive Rules to make your C# code more inclusive.

Check class definition language

class-definition

Check function definition language

method-definition

Check variable assignment language

variable-assignment

Ensure comment wording is inclusive

comments

Ruleset ID: csharp-security Rules focused on finding security issues in your C# code.

Avoid predictable IV

predictable-iv

Avoid pseudo-random numbers

no-pseudo-random

Avoid temporary hardcoded files

no-hardcoded-tempfile

Avoid unsafe blocks

avoid-unsafe

Avoid unsafe CORS headers

unsafe-cors

Avoid unsafe temporary file creation

unsafe-temp-file

Avoid using protocols without SSL

avoid-unencrypted-protocols

Avoid weak hash algorithms

weak-hash-algorithms

Do not bypass certificates validation

check-server-ssl-sertificates

Do not use a predictable salt

no-predictable-salt

Do not use BinaryFormatter as it is insecure and vulnerable

avoid-binary-formatter

Do not use weak ciphers

weak-cipher

Do not use weak SSL protocols

weak-ssl-protocols

Ensure cookies have the secure flag

cookie-http-only

Ensure cookies have the secure flag

cookie-secure-flag

Filter large requests

request-length

JWT must always be verified

jwt-verify

Prevent LDAP injection

ldap-injection

Prevent shell injection

shell-injection

Prevent SQL queries built from strings

sql-injection

Prevent XXE attack from XML parser

avoid-xml-xxe

Request validation should not be disabled

disable-request-validation

Unintended property updates expose sensitive data

avoid-autobinding

Use standard crypto algorithms

use-standard-crypto

Ruleset ID: docker-best-practices Best practices for using Docker.

Always pin versions in apt-get install

apt-pin-version

Always pin versions with pip

pip-pin-versions

Always tag the version of an image

tag-image-version

Always use -y with apt-get install

apt-get-yes

Always use -y with dnf install

dnf-use-y

Always use -y with yum install

yum-use-y

Always use -y with zypper install

zypper-use-y

Avoid commands not made for containers

avoid-commands-not-relevant

Avoid fetching data from HTTP endpoint

avoid-http

Do not expose sensitive ports

expose-admin-ports

Do not give wide permissions on files

avoid-chmod-777

Do not use cache when installing packages

pip-no-cache

Do not use multiple CMD

multiple-cmd

Do not use multiple ENTRYPOINT

multiple-entrypoint

Do not use multiple HEALTHCHECK

multiple-healthcheck

Dockerfiles should specify a base image

no-from-image

Expose a valid UNIX port number

expose-valid-port

FROM aliases must be unique

alias-must-be-unique

Last user should not be root

no-root-user

The maintainer entry is deprecated

maintainer-deprecated

Use absolute workdir

absolute-workdir

Ruleset ID: github-actions Rules to check your GitHub Actions and detect unsafe patterns, such as permissions or version pinning.

Dangerous GitHub Actions trigger

dangerous-trigger

Script injection through user controlled values

script-injection

Unspecified workflows level permissions

permissions

Workflow depends on unpinned GitHub Actions

unpinned-actions

Ruleset ID: go-best-practices Rules to make writing Go code faster and easier. From code style to preventing bugs, this ruleset helps developers writing performant, maintainable, and efficient Go code.

Avoid bare returns

avoid-bare-return

Avoid calling the GC directly

avoid-call-to-gc

Avoid custom time format

time-parse-format

Avoid empty critical sections

avoid-empty-critical-sections

Avoid invalid regular expression

valid-regular-expression

Avoid manual string trimming

manual-string-trimming

Avoid negative zero

negative-zero

Avoid redundant nil check

redundant-nil-check

Avoid regexp.Match in a loop

loop-regexp-match

Avoid select statement with one case

single-case-select

Avoid superfluous else

superfluous-else

Avoid useless bit operations

useless-bitwise-operation

Bad nil guard

bad-nil-guard

Call the context cancellation function

context-cancelable

Check to prevent a length less than 0

check-len

Common invalid host-port pairs

invalid-host-port-pair

Declare and assign variables in one statement

merge-declaration-assignment

Do not check address to nil

comparing-address-nil

Do not compare to true

comparison-true

Do not copy a slice in a for loop

replace-loop-copy

Do not defer Lock

defer-lock

Do not modify function parameter

modify-parameter

Do not redefine built-in ID

redefine-builtin-id

Do not use append for assignment

equivalent-append

Do not use bytes.SplitN or bytes.SplitAfterN with limit < 0

bytes-splitn

Do not use Printf with Sprintf

printf-sprintf

Do not use redundant negation

redundant-negation

Do not use strings.Split[After]N with negative limit

strings-splitn

Don't put time units in Duration variables

duration-variable-names

Dot imports should be avoided

avoid-dot-imports

Errors should be named errFoo or ErrFoo

err-prefixed-with-err

Expand math.Pow calls

math-pow-expansion

fmt.Sprintf("%s", var) should not be used if var is a string

simplify-sprintf-with-string

Functions prefixed by get should return something

get-return

Functions returning boolean should not use prefix get

boolean-get-function-name

Inefficient string comparison

inefficient-string-comparison

Invalid seek value

invalid-seek-value

Invalid signal being trapped

signal-trapped

No need to check for nil before a loop

avoid-nil-check-loop

No value is equal to NaN

do-not-compare-nan

Omit default slices

omit-default-slice-index

Omit redundant type declaration

redundant-type-var-declaration

os.FileMode value appears it should be in octal

non-octal-os-filemode

Prevent empty default case for select without condition

for-select-default-empty

Prevent identical comparison

compare-identical

Prevent self-assignment of variables

self-assignment

Prevent using escapes in regular expression

regexp-raw-string

Put constants and values on the right

avoid-yoda-conditions

Regexp FindAll with n=0 returns nothing

regexp-zero-results

Remove unnecessary blank identifiers

unnecessary-blank-identifier

Replace errors.New(fmt.Sprintf()) with fmt.Errorf()

use-errorf-when-possible

Replace var % 1 by 0

mod-one-always-zero

Replace w.Write([]byte(fmt.Sprintf())) with fmt.Fprintf()

use-fprintf-when-possible

Simplify boolean expression

simplify-boolean-expression

Simplify make and avoid 0 as second argument

simplify-make

Simplify pointer operation

simplify-pointer-operation

Sleep is in nanoseconds by default; verify short sleep

verify-short-sleep

strings.Replace with 0 does not do anything

strings-replace-zero

The Context should be the first argument in a function

context-first-argument

The default case of a switch should be first or last

switch-default-first-or-last

Use append to concatenate slices

concatenate-slices

Use bytes.Equal instead of bytes.Compare

bytes-compare-equal

Use bytes.ReplaceAll instead of bytes.Replace

bytes-replaceall

Use fmt.Errorf instead of new errors with Sprintf

errors-new-errorf

Use Since() instead of Now().Sub()

time-now-sub

Use strings.Contains instead of strings.Index with -1

strings-index-contains

Use strings.ReplaceAll instead of strings.Replace

strings-replaceall

Verify that duplicate imports are necessary

duplicate-imports

Ruleset ID: go-inclusive Check Go code for wording issues.

Use inclusive language in comments

comments

Use inclusive language in function declarations

function-declaration

Use inclusive language in type declarations

types

Use inclusive language in variable names

variables

Ruleset ID: go-security Detect common security issues (such as SQL injection, XSS, or shell injection) in your Go codebase.

Avoid command injection

command-injection

Avoid formatted string in templates

unescape-template-data-js

Avoid hardcoded temporary file

tempfile-creation

Avoid HTTP functions without timeouts

http-support-timeout

Avoid insecure GRPC connection

grpc-client-insecure

Avoid insecure GRPC server

grpc-server-insecure

Avoid leaking data to a logger

error-leakage

Avoid manually built SQL queries

sql-format-string

Avoid SetString() from big.Rat

avoid-rat-setstring

Binding to 0.0.0.0 opens up the application to all traffic

do-not-bind-all-interfaces

Calling hmac.New with unchanging hash.New

hmac-needs-new

CGI is outdated

import-cgi

DES and Triple DES are now insecure

import-des

Do not build SQL queries with string concatenations

sql-string-concatenation

Do not bypass HTML escaping with ResponseWriter

responsewriter-no-fprintf

Do not create a directory with write permissions for all

mkdir-permissions

Do not create a file with too much permissions

write-file-permissions

Do not ignore SSH host validation

ssh-ignore-keys

Do not use insecure ciphers

tls-cipher

Do not use tainted URL

taint-url

Do not use telnet without encryption

telnet-request

Ensure JWT use a secure algorithm

jwt-algorithm

Ensure MinVersion is defined for TLS client

ssl-min-version

Ensure TLS verification

tls-skip-verify

Ensure we use https://

http-request-secure

File permissions

chmod-permissions

Math/rand random number generation is insecure

math-rand-insecure

Odd hash.Sum call flow

hashsum

Prevent decompression bomb

decompression-bomb

Prevent Memory Aliasing

range-memory-aliasing

Prevent XSS injection by setting HttpOnly to false

session-http-only

Prevent XSS injection by setting HttpOnly to true

cookie-http-only

RC4 encryption is now insecure

import-rc4

RSA keys should have a minimum of 2,048 bits

minimum-rsa-key-length

Session must be secure

cookie-secure

Session must be secure

session-secure

SSLv3 is not secure and should be avoided

ssl-v3-insecure

The md5 hashing algorithm is insecure

import-md5

The SHA-1 algorithm family is no longer secure

import-sha1

Unsafe reflection

unsafe-reflection

Ruleset ID: java-best-practices Rules to enforce Java best practices.

Avoid Calendar class use

avoid-calendar-creation

Avoid creating FileStream directly

avoid-filestream

Avoid declaring a field type as MessageDigest

avoid-message-digest-field

Avoid instantiating strings

avoid-string-instantiation

Avoid reassigning parameters

avoid-reassigning-parameters

Avoid redundant initialization

redundant-initializer

Avoid switch with very few branches

switch-few-branches

Avoid using printStackTrace()

avoid-printstacktrace

Avoid using specific implementation types

loose-coupling

Default label should be last in a switch

default-label-not-last-in-switch

Do not add an empty string

add-empty-string

Do not append char as strings

sb-append-char

Do not return internal array

return-internal-array

Do not use a string with only one character

indexof-char

Do not use StringBuffer or StringBuilder as a class field

string-buffer-field

Don't reassign a catch variable

avoid-reassigning-catch-vars

Loops can be simplified or removed

while-loop-with-literal-boolean

Preserve the thrown stack trace

preserve-stack-trace

Replace Vector with List

replace-vector-with-list

Separate lines for each field declaration

one-declaration-per-line

Should clone array

array-is-stored-directly

Should use Map instead of Hashtable

replace-hashtable-with-map

Switch statements should have a default case

missing-switch-statement-default

Test assertions for booleans can be simplified

simplify-test-assertions-boolean

Test assertions using equals comparison can be simplified

simplify-test-assertions-equals

Test assertions using null comparison can be simplified

simplify-test-assertions-null

Test assertions using operator comparison can be simplified

simplify-test-assertions-ops

The literals should be first in String comparisons

literals-first-in-comparison

Too many control variables in for loop

forloop-variable-count

Use asList to create a list from array

arrays-aslist

Use StringBuffer to concatenate strings

use-stringbuffer

Ruleset ID: java-code-style Rules to enforce Java code style.

Avoid negation in your ternary operation

confusing-ternary

Avoid prefix boolean returning method with `get`

boolean-get-method-name

Avoid unnecessary object extend

extends-object

Avoid useless final type in interface method

final-param-in-abstract-method

Avoid using dollar signs in variable names

avoid-dollar-signs

Avoid using Java native code

avoid-using-native-code

Avoid using protected field in final class

avoid-protected-in-final-class

Consider calling super in constructor

call-super-in-constructor

Enforce a naming convention for any type of class

class-naming-conventions

Enforce generic naming standards

generics-naming

Enforce using control statement brackets

control-statement-braces

Enforce using the LocalHome suffix for Session EJB

local-home-naming-convention

Package names should not contain uppercase characters

package-case

Simplify for loops for while loops

for-loop-should-be-while-loop

Ruleset ID: java-inclusive Rules for Java to avoid inappropriate wording in the code and comments.

Check class definition language

class-definition

Check function definition language

function-definition

Check variable assignment language

variable-assignment

Ruleset ID: java-security Rules focused on finding security issues in Java code.

Avoid DES keys

keygenerator-avoid-des

Avoid LDAP injections

ldap-injection

Avoid manual SQL queries

sql-string-tainted

Avoid NullCipher

avoid-null-cipher

Avoid overly permissive CORS

permissive-cors

Avoid SQL injection

sql-injection

Avoid unsafe deserialization

json-unsafe-deserialization

Avoid user-generated class names for reflection

unsafe-reflection

Avoid user-input file

spring-request-file-tainted

Bad hexadecimal concatenation

bad-hexa-concatenation

Blowfish should use a large key

blowfish-short-key

Cookies HTTP only

cookies-http-only

Cookies should not have a long expiration

cookies-persistence

DefaultHttpClient with default constructor is not secure

default-http-client-def-cons

Detect an XPath input from an HTTP request

tainted-xpath

Do not disable CSRF

spring-csrf-disable

Do not give write access to others

files-permissions

Do not use a pseudo-random number to generate a secret

no-pseudo-random-secret

Do not use custom digest

message-digest-custom

Do not use DES

no-des-cipher

Do not use unvalidated request

unvalidated-redirect

Do not use weak SSL context

ssl-context

ECB mode is insecure

aes-ecb-insecure

ECB mode is insecure

cipher-padding-oracle

Enforce trust boundaries

trust-boundaries

Ensure cookies have the secure flag

cookies-secure-flag

HostnameVerifier should check certificates

hostname-verifier-true

Ignore SAML comments

ignore-saml-comment

MD2, MD4, and MD5 are weak hash functions

weak-message-digest-md5

No hardcoded secret with algorithm methods

algorithm-no-hardcoded-secret

Potential code injection when using GroovyShell

groovyshell-code-injection

Potential code injection when using Spring Expression

spring-expression-injection

Potential path traversal from request

path-traversal-file-read

Prefer SecureRandom over Random

avoid-random

Prevent command injection

command-injection

Prevent deserialization

object-deserialization

Prevent HTTP parameter pollution

http-parameter-pollution

Prevent LDAP Entry Poisoning

ldap-entry-poisoning

Prevent path traversal

path-traversal

Prevent SSRF

tainted-url-host

Prevent XSS attacks

xss-protection

RSA should use a long key

rsa-short-key

RSA with no padding is insecure

no-rsa-no-padding

Secret should not be hardcoded in code

hardcoded-crypto-key

SHA-1 is a weak hash function

weak-message-digest-sha1

SMTP server identify must be enforced

smtp-insecure-connection

Spring CSRF unrestricted RequestMapping

spring-csrf-requestmapping

SQL injection in BasePeer

sql-injection-turbine

SQL injection in Hibernate

sql-injection-hibernate

SQL injection in SqlUtil.execQuery

potential-sql-injection

Use a randomly-generated IV

random-iv

Use of socket on HTTP port

unencrypted-socket

XML parsing vulnerable to XEE

xml-parsing-xee

XML parsing vulnerable to XXE for SAX Parsers

xml-parsing-xxe-saxparser

XML parsing vulnerable to XXE for TransformerFactory

xml-parsing-xxe-transformer

XML parsing vulnerable to XXE for XML Reader

xml-parsing-xxe-xmlreader

XML parsing vulnerable to XXE for XPath

xml-parsing-xxe-xpath

Ruleset ID: javascript-best-practices Rules to enforce JavaScript best practices.

Avoid assignment operators in conditional expressions

no-cond-assign

Avoid bind calls that are unnecessary

no-unnecessary-bind

Avoid constructors that do nothing or only call super

no-useless-constructor

Avoid default parameters before normal parameters

default-param-last

Avoid direct comparison with NaN

use-isnan

Avoid duplicate case labels

no-duplicate-case

Avoid duplicate class members

no-dupe-class-members

Avoid duplicate keys in object literals

no-dupe-keys

Avoid empty block statements

no-empty

Avoid empty character classes in regular expressions

no-empty-character-class

Avoid empty destructuring patterns

no-empty-pattern

Avoid leaving console debug statements

no-console

Avoid lexical declarations in case clauses

no-case-declarations

Avoid negating the left operand of relational operators

no-unsafe-negation

Avoid new statements with the Symbol object

no-new-symbol

Avoid reassigning exceptions in catch clauses

no-ex-assign

Avoid the use of alert, confirm, and prompt

no-alert

Avoid the use of arguments.caller or arguments.callee

no-caller

Avoid the use of the __iterator__ property

no-iterator

Avoid the use of the __proto__ property

no-proto

Avoid throwing literals instead of an object or error type

no-throw-literal

Avoid unnecessary classes containing only static members

no-unnecessary-class

Avoid unnecessary if-else chains that only returns a boolean

no-if-else-return

Avoid unnecessary jump statements

no-useless-jumps

Avoid unnecessary ternary operations that return a boolean

no-unnecessary-ternary

Avoid unused expressions

no-unused-expressions

Avoid using delete on variables directly

no-delete-var

Avoid using JavaScript in URLs

no-script-url

Avoid using octal literals to prevent unexpected behavior

no-octal

Avoid variable or function declaration in nested blocks

no-inner-declarations

Check for loop is moving in the right direction

for-direction

Compare typeof expressions against valid strings

valid-typeof

Direct comparison with -0 detected

no-compare-neg-zero

Disallow reassigning const variables

no-const-assign

Disallow reassigning function declarations

no-func-assign

Disallow the use of debugger

no-debugger

Disallow unreachable code

no-unreachable

Ensure you don't use promises without `await`ing them first.

promise-await

Function parameters redeclared

no-dupe-args

Invoking a constructor must use parentheses

new-parens

Prefer an optional chain instead of chaining operators

prefer-optional-chain

Prefer using an object spread over `Object.assign`

prefer-object-spread

Prevent assigning to imported bindings

no-import-assign

Prevent the use methods similar to eval()

no-implied-eval

Promise executor cannot be an async function

no-async-promise-executor

Require yield in generator functions

require-yield

The with statement can lead to ambiguous code

no-with

Ruleset ID: javascript-browser-security Rules focused on finding security issues in your JavaScript web applications.

Avoid manual sanitization of inputs

manual-sanitization

Check origin of events

event-check-origin

Do not inject unsanitized HTML

react-dangerously-inner-html

Do not modify innerHTML or outerHTML

inner-outer-html

Do not store sensitive data to local storage

local-storage-sensitive-data

Do not use variable for regular expressions

regexp-non-literal

Specify origin in postMessage

postmessage-permissive-origin

Websockets must use SSL connections

insecure-websocket

Ruleset ID: javascript-code-style Rules to enforce JavaScript code style.

Assignment name should use camelCase

assignment-name

Avoid Array constructors

no-array-constructor

Avoid assignment operators in return statements

no-return-assign

Avoid comparisons where both sides are exactly the same

no-self-compare

Avoid duplicate module imports

no-duplicate-imports

Avoid equal signs at the beginning of regular expressions

no-div-regex

Avoid if statements as the only statement in else blocks

no-lonely-if

Avoid leading or trailing decimal points in numbers

no-floating-decimal

Avoid new operators outside of assignments or comparisons

no-new

Avoid new operators with the Function object

no-new-func

Avoid Object constructors

no-new-object

Avoid the use of chained assignment expressions

no-multi-assign

Class name should be `PascalCase`

class-name

Consistent use of the radix argument using parseInt

radix

Enforce a maximum number of parameters in a function

max-params

Enforce named function expressions

func-names

Enforce the use of === and !==

strict-equals

Function name should use camelCase or PascalCase

function-naming

Function names must match the name of the assignation.

func-name-matching

Method name should use camelCase

method-name

Parameter name should use camelCase

parameter-name

Require let or const instead of var

no-var

Ruleset ID: javascript-common-security Rules focused on finding security issues in your JavaScript code.

Avoid insecure HTTP requests with Axios

axios-avoid-insecure-http

Do not use external XML entities

xml-no-external-entities

Function argument names should be unique

unique-function-arguments

Ruleset ID: javascript-express Rules specifically for Express.js best practices and security.

Avoid allowing access to unintended directories or files

path-traversal

Avoid rendering resource based on unsanitized user input

external-resource

Avoid sending unsanitized user input in response

xss-vulnerability

Avoid setting insecure cookie settings

insecure-cookie

Avoid using an insecure Access-Control-Allow-Origin header

insecure-allow-origin

Avoid using unsanitized user input with sendFile

external-filename-upload

Enforce overriding default config

default-session-config

Ensure an isRevoked method is used for tokens

jwt-not-revoked

Express application should use Helmet

missing-helmet

Limit exposure to sensitive directories and files

access-restriction

Server fingerprinting misconfiguration

reduce-server-fingerprinting

Use `https` protocol over `http`

https-protocol-missing

Ruleset ID: javascript-inclusive Rules for JavaScript to avoid inappropriate wording in the code and comments.

Check comments for wording issues

comments

Check declaration names for wording issues

declarations

Check identifier names for wording issues

identifiers

Check parameter names for wording issues

formal-parameters

Ruleset ID: javascript-node-security Rules to identify potential security hotspots in Node. This may include false positives that require further triage.

Avoid `eval` with expressions

detect-eval-with-expression

Avoid Buffer(argument) with non-literal values

detect-new-buffer

Avoid calls to 'buffer' with 'noAssert' flag set

detect-buffer-noassert

Avoid command injection

command-injection

Avoid DES and 3DES

avoid-des

Avoid hardcoded HMAC keys

hardcoded-hmac-key