VNX-1071: Empty Code Block

A Java if, else, for, while, synchronized, try, finally or do block with nothing between its braces, or an if or for whose body is a stray semicolon.

Field	Value
Rule ID	`VNX-1071`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-1071
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`empty-code-block` `cwe-1071`
Source	`internal/sast/rules/vnx-1071.rego`

Overview

VNX-1071 maps to CWE-1071: Empty Code Block. It reports a Java control-flow block whose body is empty, on one line (if (x) {}) or across lines, and an if or for whose body is a stray semicolon (if (token == null);, for (Item i : items);), which makes the block after it run once, unconditionally. while (...); is not reported: spinning on a condition that does the work is a common idiom.

It does not report a block holding any statement or a comment (a comment records an intentional no-op), empty method and constructor bodies and lambdas (no-op overrides are legitimate), empty catch blocks (VNX-1069 owns those), try-with-resources, array initialisers, test sources, or the pattern inside strings and comments.

Why This Matters

An empty block usually marks unfinished or deleted logic: an authorisation check whose body was removed still reads like a check. A stray semicolon after if turns the guarded block into code that always runs.

What Gets Flagged

if (u.isAdmin()) {}                     // FLAGGED
} finally {                             // FLAGGED (empty body)
}
if (token == null);                     // FLAGGED (the next block always runs)
{
    deny();
}

Remediation

Finish the block or delete it.
For a deliberate no-op, put a comment inside the braces saying why.
Remove the semicolon after an if (...) header.

References

CWE-1071: Empty Code Block

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1071
// nosec vnx-1071

Or record an ignore rule: vulnetix ignore add --rule vnx-1071 --reason "...". See Suppressing findings.