C++ coding standards are essential for any software engineer to ensure the software being developed is high quality, secure, and robust. They provide guidelines for software development, so it’s crucial to be familiar with them. In this blog post, we’ll explore four major C++ coding standards supported by CppDepend.
CERT, or the Computer Emergency Response Team, is a set of guidelines designed to help organizations and developers create secure, high-quality software. It provides advice on best practices for developing secure C++ code, such as how to handle errors, security issues, and coding styles.
For example, CERT recommends that all software be developed with a secure coding style and that all code should be tested before being put into production.
After analyzing your project with CppDepend, Navigate to the Queries and Rules Explorer section, and select the Cert C++ Rules from the left-hand menu (Highlighted in red in the image below). This will display all the related Cert C++ rules on the right. Upon clicking a Rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue’s location and significance.
MISRA, or the Motor Industry Software Reliability Association, is a set of coding standards designed specifically for the automotive industry. It’s focused on safety-critical software and provides guidance for mitigating potential security flaws, such as buffer overflows and integer overflows.
For example, MISRA recommends that all variables be declared with their types and that all code should be tested against known coding standards.
After analyzing your project with CppDepend, Navigate to the Queries and Rules Explorer section, and select the Misra Rules from the left-hand menu (Highlighted in red in the image below). This will display all the related Misra rules on the right. Upon clicking a Rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue’s location and significance.
AUTOSAR, or the Automotive Open System Architecture, is an open-source framework for developing in-vehicle applications. It’s focused on providing a safe and secure operating environment for applications and provides a set of guidelines for designing secure software.
For example, AUTOSAR recommends that all code be tested for potential security vulnerabilities and that developers use secure coding techniques to mitigate those vulnerabilities.
After analyzing your project with CppDepend, Navigate to the Queries and Rules Explorer section, and select the Autosar C++ 2014 Rules from the left-hand menu (Highlighted in red in the image below). This will display all the related Autosar C++ 2014 rules on the right. Upon clicking a Rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue’s location and significance.
CWE, or the Common Weakness Enumeration, is a catalog of software weaknesses that can be used to identify and address security issues. It provides descriptions of weaknesses and their associated risks and provides guidance on how to fix them.
For example, CWE suggests that all code should be tested for potential security flaws and that developers use secure coding techniques to fix them.
After analyzing your project with CppDepend, Navigate to the Queries and Rules Explorer section, and select the CWE Rules from the left-hand menu (Highlighted in red in the image below). This will display all the related CWE rules on the right. Upon clicking a Rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue’s location and significance.
Use Case:
An example of how these coding standards can be used together is a software application that uses a database:
- The CERT guidelines would recommend that the code be tested for any potential security flaws and that coding techniques be used to mitigate them.
- MISRA would recommend that all variables be declared with their types and that all code should be tested against known coding standards.
- AUTOSAR would recommend that the software be tested for potential security vulnerabilities and that secure coding techniques be used to fix them.
- Finally, CWE would suggest that all code be tested for potential security flaws and that secure coding techniques be used to fix them.
By following these C++ coding standards, organizations and developers can ensure the software they develop is secure, high quality, and robust. It’s important to be familiar with each of these standards and how to use them together to ensure that the software is as secure and reliable as possible.
Consider downloading CppDepend to verify if your projects adhere to the established coding standards.
