VNX-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses

Field	Value
Rule ID	VNX-1073
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-1073
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	excessive-data-access cwe-1073
Source	internal/sast/rules/vnx-1073.rego

Overview

VNX-1073 maps to CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses. It reports a Java method (a declaration with a modifier, or a package-private method whose return type, name, parameters and opening brace are on one line) that makes five or more data-resource accesses of its own:

• JDBC executeQuery/executeUpdate/executeLargeUpdate/executeBatch, and execute() on a statement
• JdbcTemplate query*/update/batchUpdate/execute
• JPA createQuery/createNativeQuery/createNamedQuery, EntityManager find/persist/merge/remove/refresh/getReference
• Spring Data repository find*/save*/delete*/exists*/count*
• Hibernate Session and MyBatis SqlSession get/load/save/saveOrUpdate/persist/merge/update/delete/selectOne/selectList/insert on a receiver named *session

The finding is on the method declaration. Accesses spread over several methods are counted per method; a statement prepared once and run as one batch counts once. Abstract methods, interface methods with no modifier, test sources and comments are not reported. The method ends at the next method declaration (at most 200 lines), so an anonymous class inside a method is counted with it.

Why This Matters

A method that makes many round trips to the database is slow under load, hard to keep transactional (a failure part-way leaves the earlier writes in place) and easy to turn into an N+1 pattern.

What Gets Flagged

@Transactional
public Order checkout(long userId) {                       // FLAGGED: 5 accesses
    Cart cart = cartRepository.findByUserId(userId);
    Integer stock = jdbcTemplate.queryForObject("SELECT stock ...", Integer.class, cart.itemId());
    jdbcTemplate.update("UPDATE item SET stock = stock - 1 WHERE id = ?", cart.itemId());
    Order order = orderRepository.save(new Order(cart));
    cartRepository.delete(cart);
    return order;
}

Remediation

1. Combine the reads into one query (a join, or a view) and the writes into one statement or batch.
2. Move the work into a stored procedure or a single data-access operation.

References

• CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1073
// nosec vnx-1073

Or record an ignore rule: vulnetix ignore add --rule vnx-1073 --reason "...". See Suppressing findings.