VNX-1070: Serializable Data Element Containing non-Serializable Item Elements

An instance field of a JDK type that is never serializable (Thread, Socket, streams, JDBC Connection, ExecutorService, Optional, Logger and similar), neither static nor transient, in a Java class whose own header implements Serializable.

Field	Value
Rule ID	`VNX-1070`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-1070
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`serializable-data-element` `cwe-1070`
Source	`internal/sast/rules/vnx-1070.rego`

Overview

VNX-1070 maps to CWE-1070: Serializable Data Element Containing non-Serializable Item Elements. Inside a Java class whose own header implements Serializable (the nearest enclosing class declaration), it reports an instance field declared with an access modifier (after any annotations, with one or several names), neither static nor transient, whose type is a JDK type that is never serializable: Thread, sockets and socket channels, InputStream/OutputStream, Reader/Writer and their common subclasses, JDBC Connection/Statement/ResultSet/DataSource, EntityManager, ExecutorService/Executor, Optional and Stream, Logger, HttpClient, URLConnection, Process, ClassLoader.

It does not report static or transient fields, fields of another class in the same file that is not Serializable, classes that are serializable only through a superclass, a simple name imported from a non-JDK package (com.acme.Process, org.slf4j.Logger), the JDBC names (Connection, Statement, ResultSet, DataSource) in a file that never mentions java.sql/javax.sql (a bank Statement), local variables, package-private fields with no modifier (a documented gap), project-defined types (whose serializability one file cannot show), comments or string literals.

Why This Matters

Serialising the object throws NotSerializableException at run time, typically when a session is replicated or a message is queued, or silently loses the resource when a custom writeObject skips it.

What Gets Flagged

public class Session implements Serializable {
    private Socket socket;                                         // FLAGGED
    private Optional<String> nickname = Optional.empty();          // FLAGGED
    private volatile Thread refresher;                             // FLAGGED
    @JsonIgnore private Logger auditLog = Logger.getLogger("a");  // FLAGGED
    private static final Logger LOG = Logger.getLogger("s");       // not flagged (static)
    private transient Connection connection;                       // not flagged (transient)
}

Remediation

Mark the field transient and re-create it in readObject or lazily on first use.
Or keep only serializable state (the host and port, not the socket).

References

CWE-1070: Serializable Data Element Containing non-Serializable Item Elements

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1070
// nosec vnx-1070

Or record an ignore rule: vulnetix ignore add --rule vnx-1070 --reason "...". See Suppressing findings.