VNX-1101: Reliance on Runtime Component in Generated Code

A generated Java or Kotlin source file (one carrying, before its first type declaration, a generator header such as 'This file was generated by', 'Auto-generated', 'Code generated ... DO NOT EDIT', or a @Generated annotation) imports or names a package from the Java EE modules that were removed from the JDK in Java 11 (JEP 320): javax.xml.bind (JAXB), javax.xml.ws, javax.jws and javax.xml.soap (JAX-WS/SAAJ), javax.activation, javax.annotation.Generated/PostConstruct/PreDestroy/Resource, and CORBA (org.omg.*, javax.rmi.CORBA). The generated code then cannot run without a runtime component the platform no longer ships. Reported: each import or fully qualified use. Not reported: when the project's pom.xml or Gradle build declares the replacement runtime (jaxb-api, jaxb-runtime, jaxws-api, jaxws-rt, javax.annotation-api, javax.activation, saaj, the jakarta.* API artifacts), hand-written code (no generator marker in the header; a comment further down that mentions generated classes does not count), the jakarta.* and javax.annotation.processing.Generated replacements, other generator runtimes a build declares explicitly (protobuf, Thrift, ANTLR), and the package names inside strings or comments.

Field	Value
Rule ID	`VNX-1101`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, Kotlin
CWE	CWE-1101
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`generated-code` `runtime-dependency` `java` `cwe-1101`
Source	`internal/sast/rules/vnx-1101.rego`

Overview

VNX-1101 maps to CWE-1101: Reliance on Runtime Component in Generated Code. A generated Java or Kotlin source file (one carrying, before its first type declaration, a generator header such as ‘This file was generated by’, ‘Auto-generated’, ‘Code generated … DO NOT EDIT’, or a @Generated annotation) imports or names a package from the Java EE modules that were removed from the JDK in Java 11 (JEP 320): javax.xml.bind (JAXB), javax.xml.ws, javax.jws and javax.xml.soap (JAX-WS/SAAJ), javax.activation, javax.annotation.Generated/PostConstruct/PreDestroy/Resource, and CORBA (org.omg., javax.rmi.CORBA). The generated code then cannot run without a runtime component the platform no longer ships. Reported: each import or fully qualified use. Not reported: when the project’s pom.xml or Gradle build declares the replacement runtime (jaxb-api, jaxb-runtime, jaxws-api, jaxws-rt, javax.annotation-api, javax.activation, saaj, the jakarta. API artifacts), hand-written code (no generator marker in the header; a comment further down that mentions generated classes does not count), the jakarta.* and javax.annotation.processing.Generated replacements, other generator runtimes a build declares explicitly (protobuf, Thrift, ANTLR), and the package names inside strings or comments.

Why This Matters

Code generated by xjc, wsimport or CXF from a schema or WSDL compiles against the JAXB, JAX-WS and javax.annotation packages that older JDKs bundled. Java 11 removed those modules, so the same generated sources fail to compile, or fail with NoClassDefFoundError at run time, unless the build declares the runtime separately. Nobody edits generated code, so the dependency stays hidden until the JDK is upgraded.

What Gets Flagged

// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation
import javax.xml.bind.annotation.XmlAccessType;      // FLAGGED
import javax.xml.ws.Service;                          // FLAGGED (generated JAX-WS client)
protected javax.xml.bind.JAXBElement<String> sku;    // FLAGGED (fully qualified use)

Not flagged: the same imports when pom.xml or the Gradle build declares jaxb-api/jaxb-runtime (or the JAX-WS, annotation or activation APIs), hand-written code, jakarta.xml.bind imports, javax.annotation.processing.Generated, protobuf or Thrift generated code.

Remediation

Declare the runtime the generated code needs (jakarta.xml.bind:jakarta.xml.bind-api with org.glassfish.jaxb:jaxb-runtime, jakarta.xml.ws:jakarta.xml.ws-api, javax.annotation:javax.annotation-api), or
Regenerate the sources with a generator that targets the jakarta.* namespace and declare that runtime.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1101
// nosec vnx-1101

Or record an ignore rule: vulnetix ignore add --rule vnx-1101 --reason "...". See Suppressing findings.