Clean Code definition

The example below shows inconsistent indentation in Java code. It’s not about tabs versus spaces, it’s about consistency.

Non-compliant code

class Foo {

  public int a;

    public int b;

  public void doSomething() {

    if(something) {

          doSomethingElse();

  }

  }

}

Compliant code

class Foo {

  public int a;

  public int b;

  public void doSomething() {

    if(something) {

      doSomethingElse();

    }

  }

}

For more information, see the corresponding Sonar rule.

In C++ from version 11, ​​type aliases can be declared via either typedef or using, however, you should prefer the latter for modern code.

Non-compliant code

typedef void (*FunctionPointerType)(int);

Compliant code

using FunctionPointerType = void (*)(int);

For more information, see the corresponding Sonar rule.

Consider code written in C#, where PascalCase is used for all identifiers except parameter names. In this context, using underscores or other casing styles to differentiate words in an identifier is unacceptable.

Non-compliant code

class my_class {...}
class SOMEName {...}

Compliant code

class MyClass {...}
class SomeName {...}

For more information, see the corresponding Sonar rule.

In the non-compliant example of Python code below, and you'll notice that variables message and i are defined but never used. When readers encounter such cases, they might wonder if it's a coding error that was supposed to do something else or if it's just leftover code that can be safely deleted.

Non-compliant code

def hello(name):
    message = "Hello " + name
    print(name)
for i in range(10):
    foo()

Compliant code

def hello(name):
    message = "Hello " + name
    print(message)
for _ in range(10):
    foo()

For more information, see the corresponding Sonar rule.

In JavaScript, there's NaN, which stands for Not-a-Number. It represents a numeric data type that isn't a valid number. NaN is not equal to any value, even itself, and this behavior can lead to unexpected results.

Non-compliant code

if (a !== NaN) {

  console.log("this is always logged");

}

Compliant code

if (!isNaN(a)) {

  console.log("a is not NaN");

}

For more information, see the corresponding Sonar rule.

An example in PHP is the use of secure cookies. The method setcookie allows you to create cookies that can be transmitted via HTTP by default, making their contents readable. Since cookies often carry sensitive data, it's important to ensure they are transferred securely to fulfill their intended purpose. You need to pass a last argument to enable HTTPS only.

Non-compliant code

$value = "sensitive data";

setcookie($name, $value, $expire, $path, $domain);

Compliant code

$value = "sensitive data";

setcookie($name, $value, $expire, $path, $domain, true);

For more information, see the corresponding Sonar rule.

Most Linux package managers create a cache by default when working with Docker. Unless you remember to remove these files in your Dockerfile, they will increase the size of your image without providing any additional value.

Non-compliant code

RUN apt-get update \
  && apt-get install nginx

Compliant code

RUN apt-get update \
  && apt-get install nginx \
  && apt-get clean

In Swift, it's best practice to keep types, such as classes, in separate files. This helps prevent an excessive accumulation of instructions or an overwhelming amount of complexity within a single file.

Non-compliant code

class MyViewController: UIViewController {
  // …
}
extension MyViewController: UIScrollViewDelegate {
  // …
}
class UnrelatedController: UIViewController {
  // …
}

Compliant code

class MyViewController: UIViewController {
  // …
}
extension MyViewController: UIScrollViewDelegate {
  // …
}

For more information, see the corresponding Sonar rule.

Duplicating string literals raises the risk of errors when making updates since each occurrence must be changed separately. A better approach is to use constants that can be referenced from multiple places, allowing updates to be made in a single location. Here’s an example using Ruby.

Non-compliant code

def foo()
  prepare('action random1')
  execute('action random1')
  release('action random1')
end

Compliant code

def foo()
  action1 = 'action random1'
  prepare(action1)
  execute(action1)
  release(action1)
end

For more information, see the corresponding Sonar rule.

A key aspect of this is encapsulation. In Object-Oriented languages, encapsulation often involves making fields private. This way, the class retains control over the details of its internal representation and prevents other parts of the code from having too much knowledge about its inner workings.

However, there are multiple levels of encapsulation, and even minor improvements can make a difference. For example, if you're working with VB.Net, which allows publicly accessible fields, it's better to avoid using them and instead use properties. Properties work similarly to fields but are part of the interface and can be overridden by getters and setters.

Non-compliant code

Class Foo
    Public Bar = 42
End Class

Compliant code

Class Foo
    Public Property Bar = 42
End Class

For more information, see the corresponding Sonar rule.

There are odd examples, where you have a test folder or test files, without actual test cases inside, which can mislead other developers. See the corresponding Sonar rule. 

There are also cases where tests are skipped and accidentally committed like that, which might go unnoticed if not tracked in any way. See the corresponding Sonar rule. 

One common example is companies enforcing copyright headers in their code files:

/*
 * SonarQube, open source software for clean code.
 * Copyright (C) 2008-2024 SonarSource
 * mailto:contact AT sonarsource DOT com
 *
 * SonarQube is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 3 of the License, or (at your option) any later version.
 *
 * SonarQube is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 */

For more information, see the corresponding Sonar rule.

Below is a simplified example using Go.

Non-compliant code

func connect()  {
  user := "root"
  password:= "supersecret"

  url := "login=" + user + "&passwd=" + password
}

Compliant code

func connect()  {
  user := getEncryptedUser()
  password:= getEncryptedPass()

  url := "login=" + user + "&passwd=" + password
}

For more information, see the corresponding Sonar rule.

Non-compliant code

Master / Slave
Blacklist / Whitelist

Compliant code

Primary / Secondary
Denylist / Allowlist