VNX-1103: Use of Platform-Dependent Third Party Components

Field	Value
Rule ID	VNX-1103
Severity	Low
SARIF level	note
Kind	sast
Languages	Java, Kotlin
CWE	CWE-1103
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	portability jdk-internal java cwe-1103
Source	internal/sast/rules/vnx-1103.rego

Overview

VNX-1103 maps to CWE-1103: Use of Platform-Dependent Third Party Components. Java or Kotlin code imports or names a JDK-implementation-internal package that is not part of the Java SE platform and is not guaranteed to exist, or to behave the same, on another JVM, JDK vendor or release: sun.* (sun.misc.Unsafe, sun.misc.BASE64Encoder, sun.security., sun.nio.ch.), jdk.internal., the com.sun..internal.* and com.sun.org.apache.* repackaged copies, and the unexported implementation packages com.sun.crypto.provider, com.sun.jndi, com.sun.imageio, com.sun.media.sound and com.sun.java.swing. Code built on them breaks on a JDK upgrade or a different runtime (BASE64Encoder was removed in Java 9; jdk.internal is closed by the module system). Reported: each import, static import and fully qualified use in code. Not reported: the supported, exported com.sun APIs (com.sun.net.httpserver, com.sun.management, com.sun.jna), the standard replacements (java.util.Base64, VarHandle), class names inside string literals (the reflective probe-and-fall-back pattern), third-party libraries that merely live under com.sun (com.sun.mail, com.sun.jersey, the com.sun.xml.bind and com.sun.xml.ws reference implementations), lookalike packages (sunrise, sunflower) and comments.

Why This Matters

The sun.* and jdk.internal.* packages are implementation details of one JDK build. sun.misc.BASE64Encoder disappeared in Java 9, jdk.internal is closed by the module system, and other vendors’ runtimes need not ship them at all. Code that depends on them fails on the next upgrade or on a different JVM.

What Gets Flagged

import sun.misc.Unsafe;                                   // FLAGGED
import sun.misc.BASE64Encoder;                            // FLAGGED
import com.sun.org.apache.xerces.internal.impl.dv.util.Base64; // FLAGGED
byte[] b = new sun.misc.BASE64Decoder().decodeBuffer(s);  // FLAGGED

Not flagged: com.sun.net.httpserver, com.sun.management, com.sun.jna, java.util.Base64, Class.forName("sun.misc.Unsafe") probes inside strings, and packages such as com.acme.sunrise.

Remediation

1. Replace the internal API with its supported equivalent: java.util.Base64, VarHandle or the Foreign Function & Memory API instead of Unsafe, java.security APIs instead of sun.security.
2. Run jdeps --jdk-internals to list the remaining uses.

References

• CWE-1103: Use of Platform-Dependent Third Party Components
• JEP 260: Encapsulate Most Internal APIs

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1103
// nosec vnx-1103

Or record an ignore rule: vulnetix ignore add --rule vnx-1103 --reason "...". See Suppressing findings.