VNX-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations

Reports Java arithmetic on a boxed numeric type inside a loop, where every iteration unboxes the value, computes, and allocates a new wrapper object: a for loop whose counter is declared as Integer, Long, Short, Byte, Double, Float or Character (for (Integer i = 0; i < n; i++)), and a local variable declared as one of those wrapper types with a numeric initial value (Long sum = 0L) that is then updated with ++, --, +=, -=, *=, /= or x = x + ... inside a for, while or do loop opened after it within the next 40 lines, including a single-statement loop body on the loop header line. Not reported: primitive counters and accumulators, enhanced-for loops over a List<Integer> (the element must be boxed anyway), wrapper variables that are only compared or reassigned, updates outside the loop, fields declared with an access modifier, comments and strings. This is a performance weakness: in a hot path the allocations raise GC pressure and latency, which is how it becomes a denial-of-service concern.

Field	Value
Rule ID	`VNX-1235`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-1235
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`autoboxing` `cwe-1235`
Source	`internal/sast/rules/vnx-1235.rego`

Overview

VNX-1235 maps to CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations. Reports Java arithmetic on a boxed numeric type inside a loop, where every iteration unboxes the value, computes, and allocates a new wrapper object: a for loop whose counter is declared as Integer, Long, Short, Byte, Double, Float or Character (for (Integer i = 0; i < n; i++)), and a local variable declared as one of those wrapper types with a numeric initial value (Long sum = 0L) that is then updated with ++, –, +=, -=, *=, /= or x = x + … inside a for, while or do loop opened after it within the next 40 lines, including a single-statement loop body on the loop header line. Not reported: primitive counters and accumulators, enhanced-for loops over a List (the element must be boxed anyway), wrapper variables that are only compared or reassigned, updates outside the loop, fields declared with an access modifier, comments and strings. This is a performance weakness: in a hot path the allocations raise GC pressure and latency, which is how it becomes a denial-of-service concern.

Why This Matters

This weakness class (Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1235 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

for (Integer i = 0; i < n; i++) { ... }   // FLAGGED

Long sum = 0L;
for (long v : values) {
    sum += v;                               // FLAGGED
}

long total = 0L;                            // primitive: not flagged
for (Integer v : values) { total += v; }

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-1235 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-1235 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1235
// nosec vnx-1235

Or record an ignore rule: vulnetix ignore add --rule vnx-1235 --reason "...". See Suppressing findings.