VNX-412: Unrestricted Externally Accessible Lock

Java locks other code can take and hold: synchronized on an interned string, a String constant, Boolean.TRUE/FALSE or a boxed valueOf cache; public Lock/ReentrantLock/ReadWriteLock/StampedLock/Semaphore fields or a public Object the class synchronizes on; and public getters that return the lock, including Lombok @Getter on a lock field.

Field	Value
Rule ID	`VNX-412`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java
CWE	CWE-412
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`unrestricted-lock` `cwe-412`
Source	`internal/sast/rules/vnx-412.rego`

Overview

VNX-412 maps to CWE-412: Unrestricted Externally Accessible Lock. The rule reports Java locks that code outside the class can acquire and hold, blocking the class indefinitely.

Why This Matters

String literals are interned and Boolean.TRUE or small boxed integers are shared JVM-wide, so any library that happens to synchronize on the same value contends with this class. A public lock field or getter lets any caller take the lock and never release it.

What Gets Flagged

synchronized ("refresh") { ... }                          // FLAGGED: interned literal
synchronized (user.intern()) { ... }                      // FLAGGED
synchronized (CACHE_LOCK) { ... }                         // FLAGGED when CACHE_LOCK = "token-cache"
public final Object lock = new Object();                  // FLAGGED when the class synchronizes on it
public static final ReentrantLock WRITE_LOCK = new ReentrantLock();  // FLAGGED
public ReadWriteLock getLock() { return rw; }             // FLAGGED

Not flagged: synchronized (this), synchronized methods and synchronized (Foo.class) (an ordinary idiom), private or package-private lock fields, public fields that are never used as a lock, test files, comments and strings.

Remediation

Lock on a private final Object lock = new Object(); owned by the class.
Do not return lock objects from public methods; expose operations instead.
For confirmed false positives, add a // vulnetix-ignore: VNX-412 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-412
// nosec vnx-412

Or record an ignore rule: vulnetix ignore add --rule vnx-412 --reason "...". See Suppressing findings.