VNX-1063: Creation of Class Instance within a Static Code Block

Field	Value
Rule ID	VNX-1063
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-1063
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	class-instance-in-static-block initialization java cwe-1063
Source	internal/sast/rules/vnx-1063.rego

Overview

VNX-1063 maps to CWE-1063: Creation of Class Instance within a Static Code Block. Java: a static { ... } initializer constructs an object (new Type(...)) of an application or library class. The object is built when the class is first loaded, on whatever thread touches it first, before any configuration or dependency injection runs; a failure surfaces as ExceptionInInitializerError and leaves the class unusable, and the instance cannot be replaced in tests. Not reported: the JDK containers and value types a static block normally fills (HashMap, ArrayList, HashSet, StringBuilder, Object, boxed numbers, atomics, locks), exceptions being thrown, arrays, new in instance initializers, static methods or static field initializers outside a static block, and comments or string literals.

Why This Matters

This weakness class (Creation of Class Instance within a Static Code Block) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1063 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

public class Registry {
    private static final Client CLIENT;
    static {
        // FLAGGED: built at class-load time, before configuration
        CLIENT = new Client(new Config("prod"));
    }
}

Not flagged: static { MAP = new HashMap<>(); MAP.put("a", 1); }, new in an instance initializer or a method, or throw new IllegalStateException(...).

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-1063 or a false positive.
2. Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-1063 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-1063: Creation of Class Instance within a Static Code Block
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1063
// nosec vnx-1063

Or record an ignore rule: vulnetix ignore add --rule vnx-1063 --reason "...". See Suppressing findings.