VNX-447: Unimplemented or Unsupported Feature in UI

Detects Java security operations that are offered but do nothing (an empty or return-true setter/enable/change/verify for passwords, MFA, encryption, TLS, audit, sessions, roles, tokens) and request handlers whose whole body throws UnsupportedOperationException or NotImplementedException.

Field	Value
Rule ID	`VNX-447`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-447
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`unimplemented-function` `cwe-447`
Source	`internal/sast/rules/vnx-447.rego`

Overview

VNX-447 maps to CWE-447: Unimplemented or Unsupported Feature in UI. A user who switches on two-factor authentication, changes a password or enables encryption is told it worked. If the method behind the button is a stub, nothing changed and the user believes they are protected.

The rule reports:

Silent security stubs. A method whose name is a set/enable/disable/change/reset/revoke/verify/validate/enforce verb naming a password, MFA/2FA/OTP, encryption, SSL/TLS, audit, lockout, CAPTCHA, CSRF, session, permission, role, token, credential, signature or certificate, whose body is empty, only comments, return; or return true;.
Endpoints for features that do not exist. A Spring @*Mapping, JAX-RS @GET/@POST/... or servlet doGet/doPost/... whose whole body throws UnsupportedOperationException or NotImplementedException.

Not reported: UnsupportedOperationException in ordinary methods (read-only collections and iterators fail loudly, which is correct), a throw inside one branch of an implemented handler, empty non-security methods, dependency setters such as setSessionFactory or setPasswordEncoder, comments, strings and test files.

What Gets Flagged

// FLAGGED: reports success, changes nothing
public boolean changePassword(String oldPassword, String newPassword) {
    return true;
}

// FLAGGED: an exposed endpoint for a missing feature
@PostMapping("/account/mfa")
public ResponseEntity<Void> enableMfa(@RequestBody MfaRequest req) {
    throw new UnsupportedOperationException("not yet");
}

Remediation

Implement the operation, or remove it and the UI that offers it.
Until it exists, fail visibly (an error the user sees), never report success.

References

CWE-447

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-447
// nosec vnx-447

Or record an ignore rule: vulnetix ignore add --rule vnx-447 --reason "...". See Suppressing findings.