VNX-1072: Data Resource Access without Use of Connection Pooling
Java production code that opens database connections without a pool: DriverManager.getConnection(...), new DriverManagerDataSource or new SimpleDriverDataSource, or a vendor non-pooling DataSource with no pool in the file.
| Field | Value |
|---|---|
| Rule ID | VNX-1072 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | Java |
| CWE | CWE-1072 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | connection-pooling cwe-1072 |
| Source | internal/sast/rules/vnx-1072.rego |
Overview
VNX-1072 maps to CWE-1072: Data Resource Access without Use of Connection Pooling. It reports a call to java.sql.DriverManager.getConnection(...) and the construction of Spring’s non-pooling DataSources (new DriverManagerDataSource, new SimpleDriverDataSource), each of which opens a new physical connection for every request. The call is also found split across lines (DriverManager / .getConnection(...)) and as a bare getConnection(...) after import static java.sql.DriverManager.getConnection. A vendor non-pooling DataSource (PGSimpleDataSource, MysqlDataSource, MariaDbDataSource, SQLServerDataSource, OracleDataSource, H2 JdbcDataSource) is reported when the file configures no pool.
It does not report getConnection() on a pooled DataSource (HikariCP, DBCP, c3p0, a container JNDI DataSource), a vendor DataSource handed to a pool (HikariConfig.setDataSource(...)), other DriverManager calls (registerDriver, getDriver), other receivers named like a driver manager, test sources, comments (including a trailing comment on a code line) or string literals. A short-lived command-line tool that legitimately opens one connection is still reported; suppress it there.
Why This Matters
Under load, opening a connection per request exhausts the database’s connection slots (a denial of service any client can trigger by sending traffic) and makes every request pay the TCP, TLS and authentication handshake.
What Gets Flagged
try (Connection c = DriverManager.getConnection(URL, "app", pw)) { // FLAGGED
DriverManagerDataSource ds = new DriverManagerDataSource(); // FLAGGED
return new SimpleDriverDataSource(new org.h2.Driver(), "jdbc:h2:mem:"); // FLAGGED
PGSimpleDataSource ds = new PGSimpleDataSource(); // FLAGGED (no pool in the file)Not flagged: HikariDataSource ds = new HikariDataSource(cfg); ds.getConnection();
Remediation
- Obtain connections from a pooled DataSource (HikariCP, or the application server’s JNDI pool).
- Size the pool for the database’s connection limit.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1072
// nosec vnx-1072Or record an ignore rule: vulnetix ignore add --rule vnx-1072 --reason "...". See Suppressing findings.