C++ coding standards are essential for software engineers who want to ensure that the software they develop is high-quality, secure, and robust. They provide valuable guidelines for software development, so it is important to be familiar with them. In this blog post, we’ll explore four major C++ coding standards supported by CppDepend.
CERT, or the Computer Emergency Response Team, is a set of guidelines designed to help organizations and developers create secure, high-quality software. It provides guidance on best practices for developing secure C++ code, including error handling, security issues, and coding style.
For example, CERT recommends that all software be developed with a secure coding style and that all code should be tested before being put into production.
After analyzing your project with CppDepend, navigate to the Queries and Rules Explorer section and select the CERT C++ Rules from the left-hand menu (highlighted in red in the image below). This will display all the related CERT C++ rules on the right. Upon clicking a rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue’s location and significance.
MISRA, or the Motor Industry Software Reliability Association, is a set of coding standards designed specifically for the automotive industry. It focuses on safety-critical software and provides guidance on mitigating potential security flaws, such as buffer overflows and integer overflows.
For example, MISRA recommends that all variables be declared with their types and that all code should be tested against known coding standards.
After analyzing your project with CppDepend, navigate to the Queries and Rules Explorer section and select the MISRA Rules from the left-hand menu (highlighted in red in the image below). This will display all the related MISRA rules on the right. Upon clicking a rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue’s location and significance.
AUTOSAR, or the Automotive Open System Architecture, is an open-source framework for developing in-vehicle applications. It focuses on providing a safe and secure operating environment for applications and includes a set of guidelines for designing secure software.
For example, AUTOSAR recommends that all code be tested for potential security vulnerabilities and that developers use secure coding techniques to mitigate those vulnerabilities.
After analyzing your project with CppDepend, navigate to the Queries and Rules Explorer section and select the AUTOSAR C++ 2014 Rules from the left-hand menu (highlighted in red in the image below). This will display all the related AUTOSAR C++ 2014 rules on the right. Upon clicking a rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue’s location and significance.
CWE, or the Common Weakness Enumeration, is a catalog of software weaknesses that can be used to identify and address security issues. It provides descriptions of weaknesses and their associated risks and provides guidance on how to fix them.
For example, CWE suggests that all code should be tested for potential security flaws and that developers use secure coding techniques to fix them.
After analyzing your project with CppDepend, navigate to the Queries and Rules Explorer section and select the CWE Rules from the left-hand menu (highlighted in red in the image below). This will display all the related CWE rules on the right. Upon clicking a rule, the corresponding CQLinq query and the relevant source code will be automatically generated. Additionally, the Metrics View section provides a visualization of the issue’s location and significance.
Use case
Consider, for example, a software application that uses a database. These coding standards can be applied together as follows:
- The CERT guidelines would recommend that the code be tested for any potential security flaws and that coding techniques be used to mitigate them.
- MISRA would recommend that all variables be declared with their types and that all code should be tested against known coding standards.
- AUTOSAR would recommend that the software be tested for potential security vulnerabilities and that secure coding techniques be used to fix them.
- Finally, CWE would suggest that all code be tested for potential security flaws and that secure coding techniques be used to fix them.
By following these C++ coding standards, organizations and developers can help ensure that the software they develop is secure, high-quality, and robust. It is important to understand each of these standards and how they can be used together to make software as secure and reliable as possible.
Consider downloading CppDepend to verify that your projects adhere to the established coding standards.