VNX-1052: Hard-coded Endpoint Literal in Datastore Client Initialization

Field	Value
Rule ID	VNX-1052
Severity	Low
SARIF level	note
Kind	sast
Languages	Go, Java, Python, JavaScript / TypeScript, PHP
CWE	CWE-1052
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	hard-coded-literals hard-coded-endpoint configuration database code-quality cwe-1052
Source	internal/sast/rules/vnx-cwe1052-auto.rego

Overview

VNX-1052 reports a database, cache or broker client that is initialised with a hard-coded network endpoint: a non-loopback IP address or a real host name written as a literal (CWE-1052, a hard-coded literal used in initialization). It recognises:

• a connection URI that starts a string literal: mysql://, postgres://, mongodb://, redis://, amqp://, jdbc:<driver>://, jdbc:oracle:thin:@, including SQLAlchemy driver schemes such as postgresql+psycopg2://;
• a go-sql-driver/mysql DSN, user@tcp(host:port)/db;
• a key=value DSN with host= or server= (PDO mysql:host=..., libpq host=...);
• a host/addr/server field or keyword argument inside a client constructor (redis.Options{Addr: ...}, psycopg2.connect(host=...), mysql.createPool({ host: ... }), pika.ConnectionParameters(host=...), a BullMQ connection: { host: ... });
• the host as the first argument of new Jedis, new MongoClient, new mysqli, mysqli_connect, redis.Redis, pika.ConnectionParameters, phpredis ->connect/->pconnect and Memcached ->addServer; the second argument of ioredis new Redis(6379, host); an IP literal dialled with grpc.Dial.

Why This Matters

An endpoint written into the code cannot change without a release, ships the internal network layout to everyone who can read the source, and is usually where the credentials sit next to it. Configuration that differs between environments belongs in configuration.

What Gets Flagged

rdb := redis.NewClient(&redis.Options{
	Addr: "10.20.0.7:6379", // FLAGGED
})
sql.Open("postgres", "host=db-primary.acme-corp.net port=5432 user=app") // FLAGGED

DriverManager.getConnection("jdbc:mysql://10.0.4.12:3306/orders", user, secret); // FLAGGED
new Jedis("cache01.prod.acme.io", 6379); // FLAGGED

new PDO('mysql:host=10.0.0.21;dbname=shop', $user, $pass); // FLAGGED

What Is Not Flagged

• localhost, 127.x, 0.0.0.0, ::1 and placeholder domains (example.com, .test, .invalid, .local).
• A literal on a line that reads the environment or configuration, where it is only a fallback: process.env.DB_HOST || 'db.acme.net', os.environ.get("DATABASE_URL", "postgres://...").
• Single-label service names (host="db"), a URI inside a longer log message or help text, comments, test files, and host-like values outside a client constructor.
• Plain socket and HTTP endpoints: net.Dial("udp", "8.8.8.8:80") (the outbound-address idiom), a gRPC dial to a public API host name (pubsub.googleapis.com:443), requests.get("https://..."), and sqlite:/// file paths.

Credentials inside connection strings are reported by the connection-string rules (VNX-SEC-008, VNX-SEC-061).

Remediation

Read the endpoint from configuration or the environment (os.Getenv("REDIS_ADDR"), process.env.DATABASE_URL, Spring spring.datasource.url) and keep per-environment values out of the source tree.

References

• CWE-1052: Excessive Use of Hard-Coded Literals in Initialization

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1052
// nosec vnx-1052

Or record an ignore rule: vulnetix ignore add --rule vnx-1052 --reason "...". See Suppressing findings.