VNX-1106: Insufficient Use of Symbolic Constants
A Java source file repeats the same non-trivial numeric literal (three or more digits, or a hexadecimal literal of three or more digits, such as 15000, 5242880, 413 or 0xCAFEBABE) in three or more separate statements instead of naming it once as a constant. Timeouts, size limits, status codes and magic values written out at each use drift apart when one copy is changed and the others are not, which is how a limit enforced in one place is forgotten in another. Reported: every statement that repeats the literal. Not reported: a literal used once or twice, a literal on a final/static final constant declaration (the symbolic constant itself), serialVersionUID, annotation arguments, lines that are tables of three or more numbers (array initialisers, lookup tables), round and bit-width values (powers of ten, 128 to 65536 and their masks 255/0xFF/0xFFFF/0xFFFFFFFF), decimals, numbers inside strings, Java text blocks and comments, generated sources (a generator header before the first type declaration, or @Generated), and test files. Literals that are each used only once are not judged: a single magic number is a style choice this line-oriented rule cannot weigh.
| Field | Value |
|---|---|
| Rule ID | VNX-1106 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | Java |
| CWE | CWE-1106 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | maintainability magic-number java cwe-1106 |
| Source | internal/sast/rules/vnx-1106.rego |
Overview
VNX-1106 maps to CWE-1106: Insufficient Use of Symbolic Constants. A Java source file repeats the same non-trivial numeric literal (three or more digits, or a hexadecimal literal of three or more digits, such as 15000, 5242880, 413 or 0xCAFEBABE) in three or more separate statements instead of naming it once as a constant. Timeouts, size limits, status codes and magic values written out at each use drift apart when one copy is changed and the others are not, which is how a limit enforced in one place is forgotten in another. Reported: every statement that repeats the literal. Not reported: a literal used once or twice, a literal on a final/static final constant declaration (the symbolic constant itself), serialVersionUID, annotation arguments, lines that are tables of three or more numbers (array initialisers, lookup tables), round and bit-width values (powers of ten, 128 to 65536 and their masks 255/0xFF/0xFFFF/0xFFFFFFFF), decimals, numbers inside strings, Java text blocks and comments, generated sources (a generator header before the first type declaration, or @Generated), and test files. Literals that are each used only once are not judged: a single magic number is a style choice this line-oriented rule cannot weigh.
Why This Matters
A size limit written as 5242880 in three checks is three limits. When one is raised and the others are not, the check that was meant to stop an oversized upload in every path stops it in only some of them.
What Gets Flagged
c.setConnectTimeout(15000); // FLAGGED
c.setReadTimeout(15000); // FLAGGED
Thread.sleep(15000); // FLAGGED (third use of the same literal)Not flagged: private static final int TIMEOUT_MS = 15000; and its uses, a literal used once or twice, 1024, 1000, 255, 0xFF, annotation arguments, array initialisers, serialVersionUID, strings, comments and test files.
Remediation
Define the value once as a named static final constant (or an enum or configuration property) and use the name everywhere.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1106
// nosec vnx-1106Or record an ignore rule: vulnetix ignore add --rule vnx-1106 --reason "...". See Suppressing findings.