VNX-1062: Parent Class with References to Child Class

Field	Value
Rule ID	VNX-1062
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-1062
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	parent-class-ref-to-child inheritance maintainability java cwe-1062
Source	internal/sast/rules/vnx-1062.rego

Overview

VNX-1062 maps to CWE-1062: Parent Class with References to Child Class. Java: a class refers to one of its own subclasses. The rule collects every class Child extends Parent (or extends pkg.Parent) declaration in the scanned Java files, then reports a line of Parent’s own source file (Parent.java) that tests instanceof Child, matches case Child c -> in a pattern switch, compares getClass() == Child.class, casts to (Child), or constructs new Child( for a subclass declared in a different file. The parent then depends on its children, so adding or changing a subclass forces a change to the base class, and type switches in the parent bypass polymorphism. Not reported: Child.class registrations that are not type tests (Jackson @JsonSubTypes and similar annotations), references to the parent’s own type, unrelated classes with similar names, a sealed class’s permits clause, subclasses nested in the parent’s own file, and comments or string literals. Subclasses declared outside the scanned files are not known.

Why This Matters

This weakness class (Parent Class with References to Child Class) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1062 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// Shape.java (FLAGGED: the parent switches on its child types)
public abstract class Shape {
    double area() {
        if (this instanceof Circle) {
            return ((Circle) this).radius();
        }
        return 0;
    }
}

// Circle.java
public class Circle extends Shape { ... }

Also flagged in the parent: case Circle c -> ... and getClass() == Circle.class.

Not flagged: @JsonSubTypes.Type(value = Circle.class, ...) on the parent, a subclass that uses its parent, a sealed class’s permits clause, or a class with a similar name that does not extend the parent.

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-1062 or a false positive.
2. Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-1062 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-1062: Parent Class with References to Child Class
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1062
// nosec vnx-1062

Or record an ignore rule: vulnetix ignore add --rule vnx-1062 --reason "...". See Suppressing findings.