The Sonar Rules catalog is the entry point where you can discover all the existing rules. While running an analysis, SonarLint raises an issue every time a piece of code breaks a coding rule.
Issues in your code are linked to Clean Code code attributes. When an issue is detected, it signifies that this part of your code is not consistent, intentional, adaptable, or responsible enough and that it impacts one or multiple software qualities.
For more information about Clean Code attributes and software qualities, check out the Clean Code page.
Issue types (bug, vulnerability, and code smell) are deprecated. Issues are now tied to Clean Code attributes and software qualities impacted. See the Clean Code page details.
When opening a project containing C#, VB, C++, JS or TS files, SonarLint for Visual Studio will check your code against the following rules:
- C and C++ rules
- C# rules
- CSS rules (from SonarLint for Visual Studio v6.16)
- Secrets detection rules
- TypeScript rules
- VB.NET rules
For C# and VB.Net, new issues will be reported as you type. You do not have to select Run Code Analysis from the Analyze menu - the rules are run automatically. Note that by default, Visual Studio is configured to only run Roslyn analyzers on files that are currently open. You can choose to have the analysis run on the entire solution as described in the Microsoft docs, although this is obviously more processor-intensive.
You can access the detailed rule description directly from the issue in the Error List, using the Show Error help option on the contextual menu.
See the page on Connected Mode for more details about language support for analyses while connected to SonarQube or SonarCloud.
The rules can be enabled and disabled locally. It is not currently possible to suppress individual issues. If you are using Connected Mode with SonarQube or SonarCloud, the rule severities defined in the Quality Profile will be used.
Define C# or VB.NET rules for local analysis
SonarLint itself does not have any special behavior in relation to configuring the set of Sonar C#/VB.NET rules. The Sonar C# and VB.NET rules are implemented as Roslyn analyzers and use the standard Visual Studio features to enable and disable rules.
The simplest approach is just to reference the ruleset directly from the project and check the ruleset file in to source control. This won't have any adverse impact on machines that don't have SonarLint installed; Visual Studio will load the ruleset file, but it won't have any impact on build or in the IDE because the analyzers are not available.
How can I configure the C#/VB.NET rules to use without changing the project file or checking files in to source control?
There are a number of ways to achieve this, depending on the version of VS you are using. Some of the possible solutions are listed below. There may be others - see the Microsoft documentation Customize your build for more ideas.
The Visual Studio will search up the directory tree from the solution folder to locate a .editorconfig file. Create a .editorconfig file containing the required settings and drop it in a folder above the solution that is not under source control. See Set rule severity in an EditorConfig file in the Microsoft documentation for more information (setting a severity to "none" will disable a rule).
- this will only work in VS2019 or later
- it won't work if your solution already references a .editorconfig file
The Directory.Build.props file will automatically be imported by MSBuild (and by extension Visual Studio). The file can be in the project directory or any parent directory so it should be possible to put it in a folder above the project/solution that is not under source code control.
- this will only work on VS2017 or later.
- it won't work if your solution has a Directory.Build.props file checked in.
- it won't work if your solution already references a ruleset file.
3) Conditionally reference the ruleset file from the project, but don't check the ruleset file in to source control. The ruleset can be placed anywhere on your machine.
- this does involve changing the project file(s), but only to add a single property.
Project files that use the standard Microsoft build targets will automatically import any targets files that are exist in a well-known location. You can use this feature to conditionally import a ruleset.
This is similar to option (2) above but works with all versions of MSBuild.
- the location of the
ImportBeforefolder varies depending on the version of MSBuild, based on the following standard pattern:
[VERSION]values for MSBuild 14 and 15 are
15.0respectively. MSBuild 16 and latter use
ImportBeforefolder does not exist by default so you might have to create it.
- it won't work if your project already references a ruleset file.
- the location of the ImportBefore folder varies according to the version of MSBuild, so if you are using multiple versions of Visual Studio you will need to drop the same file in multiple locations.
Define C, C++, JS, TS or secrets detection rules for local analysis
In SonarLint for Visual Studio 7.3 and newer, changing the Sonar severity of an issue is no longer possible.
In standalone mode, it is possible to enable or disable rules, configure rule parameters, and in versions 4.13-7.2, change the reported rule severity. Not all options are supported for all languages. See the table below for more information:
|Language||From version||Enable/disable||Change severity||Configure rule parameters|
|C||4.13||Supported||Supported in v4.13-7.2||Supported|
|C++||4.13||Supported||Supported in v4.13-7.2||Supported|
|TypeScript||4.35||Supported||Not supported. See #2399.||Not supported. See #2400.|
|Secrets detection||6.4||Supported||Not Supported||Not applicable|
To disable a rule, select an instance of the rule in the Error List and select the Disable SonarLint rule command on the context menu:
You can view and change the current rule settings by selecting Edit rules settings from the SonarLint > Tools > Options page:
When the rule settings are changed (either by using the
Disable SonarLint rule command or by directly editing and saving the settings.json file), SonarLint will automatically re-analyze all open documents.
The SonarLint Output window tab contains text output describing the processing that has taken place; see this example:
settings.json file is stored in user's roaming profile
%APPDATA%\SonarLint for Visual Studio. It applies to all supported versions of Visual Studio. If the machine is domain-joined, then the settings file will be automatically copied to any other machine in the domain that the user logs on to.
The format of the settings file is as follows:
The format of the rule key in the file is
Valid severity values are
Info. Changing the severity of a rule only affects the label in the
Category column in the Error List.
If the settings file does not contain an entry for a rule then the default setting for the rule in the SonarWay Quality Profile will be used.
From SonarLint for Visual Studio v6.14+, users are able to visualize descriptive and educational content associated with each issue. Simply select the issue’s rule as shown below to open the Sonar Rule Help view to view the rule descriptions.
The Sonar Rule Help view brings rule descriptions and patch instructions relevant to the library or framework you’re using, directly into the IDE. The rule descriptions include a brief explanation of the rule as well as Noncompliant and Compliant code samples.
Users are able to visualize a diff view for the non & compliant code samples which should help you fix your issue. Note that diff highlighting is only available for rules descriptions migrated to the new format, and we're progressively migrating all existing rules to the new format.
An issue’s Clean Code attribute, software qualities, and severity are presented to you when opening the Sonar Rule Help view. Below the rule title, you will find the Clean Code issue badges that highlight an issue’s Clean Code classification.
Be sure to check out the Investigating issues page for more details about how issues appear in your IDE.
Connected Mode syncs your SonarQube or SonarCloud Quality Profile with the local analysis to suppress issues reported in the IDE. See the Connected Mode documentation for more information.
If you are using Connected Mode, the rule severities defined in the Quality Profile will be used.
In SonarLint for Visual Studio 7.3 and newer, changing the Sonar severity of an issue is not possible.
Starting with v6.4, SonarLint for Visual Studio will detect and report hard-coded cloud secrets as issues.
All types of text files are analysed, irrespective of the type of content (code, configuration, documentation etc). Analysis is triggered whenever a text file is opened or saved.
Documentation for individual rules can be found on the Rules website.
Secrets detection rules are only run in the IDE.
They do not appear in SonarQube/SonarCloud i.e. they can only be configured locally, and the secrets detection rules will not be run by the various Sonar scanners.
© 2015-2023, SonarSource S.A, Switzerland. Except where otherwise noted, content in this space is licensed under the GNU Lesser General Public License, Version 3.0. SONARLINT is a trademark of SonarSource SA. All other trademarks and copyrights are the property of their respective owners. See SonarSource.com for everything you need to know about the Sonar Solution.