VNX-1074: Class with Excessively Deep Inheritance
A Java class seven or more levels deep in a chain of extends clauses resolved across the project's Java files.
| Field | Value |
|---|---|
| Rule ID | VNX-1074 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | Java |
| CWE | CWE-1074 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | deep-inheritance cwe-1074 |
| Source | internal/sast/rules/vnx-1074.rego |
Overview
VNX-1074 maps to CWE-1074: Class with Excessively Deep Inheritance. It resolves every class X extends Y in the project’s Java files by simple class name (headers may carry annotations and put extends on the next line) and reports a class with seven or more extends edges above it: every class on the way declared in the project, the last parent possibly a library class. java.lang.Object is not counted.
It does not report chains of six edges or fewer (ancestors above a library class cannot be seen), interfaces and implements clauses, generic bounds (class Box<T extends Number>), chains that loop back on a name (two classes with the same simple name in different packages), test sources, or class text in comments (line or block) and strings.
Why This Matters
Each level adds behaviour a reader must keep in mind and an override that can change what the base classes rely on. Security checks placed in a base class are the ones a deep subclass most easily bypasses by accident.
What Gets Flagged
public class Container extends Component { }
public class Panel extends Container { }
// ... ScrollPanel, TabPanel, FormPanel, WizardPanel ...
public final class CheckoutWizard extends WizardPanel { } // FLAGGED: 7 levelsRemediation
- Prefer composition: hold a collaborator instead of extending it.
- Collapse intermediate classes that add little.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1074
// nosec vnx-1074Or record an ignore rule: vulnetix ignore add --rule vnx-1074 --reason "...". See Suppressing findings.