VNX-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference

Field	Value
Rule ID	VNX-395
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, Kotlin, C#
CWE	CWE-395
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	error-handling cwe-395
Source	internal/sast/rules/vnx-395.rego

Overview

VNX-395 maps to CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference. It reports Java catch (NullPointerException e) (including final, java.lang.NullPointerException and multi-catch A | NullPointerException e), Kotlin catch (e: NullPointerException) and catch (e: KotlinNullPointerException), and C# catch (NullReferenceException) with or without a variable, including System.NullReferenceException.

Not reported: throwing NullPointerException, Objects.requireNonNull, assertThrows(NullPointerException.class, ...), instanceof tests, class names that merely contain the word, test files, comments and strings.

Why This Matters

Catching the null-dereference exception hides which reference was null, costs a stack unwind for what should be a branch, and also swallows null-pointer bugs thrown by unrelated code deeper in the call, so a real defect is reported as “anonymous user” or -1.

What Gets Flagged

try {
    return user.getProfile().getDisplayName().trim();
} catch (NullPointerException e) {          // FLAGGED
    return "anonymous";
}

} catch (e: NullPointerException) {          // FLAGGED

catch (NullReferenceException)               // FLAGGED

Remediation

1. Test the reference for null, or use Optional, Kotlin ?./?:, or C# ?./??.
2. Validate required arguments at the boundary with Objects.requireNonNull or ArgumentNullException.ThrowIfNull.

References

• CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-395
// nosec vnx-395

Or record an ignore rule: vulnetix ignore add --rule vnx-395 --reason "...". See Suppressing findings.