VNX-448: Obsolete Feature in UI

Detects a Java web endpoint marked obsolete but still served: @Deprecated (or OpenAPI deprecated = true) in the same annotation block as a Spring @*Mapping, JAX-RS @GET/@POST/@Path, Micronaut @Get/@Post, or on a @Controller/@RestController class, unless it answers 410 Gone or redirects.

Field	Value
Rule ID	`VNX-448`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-448
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`obsolete` `deprecated-endpoint` `cwe-448`
Source	`internal/sast/rules/vnx-448.rego`

Overview

VNX-448 maps to CWE-448: Obsolete Feature in UI. A deprecated endpoint usually keeps the weaker behaviour it was retired for (an old login flow, an unescaped export) and stops receiving fixes, while clients and attackers can still call it.

The rule reports @Deprecated, @Operation(deprecated = true) or @ApiOperation(... deprecated = true) in the same contiguous annotation block as a URL mapping (@GetMapping, @RequestMapping, @GET, @Path…) or a controller class annotation.

Not reported: @Deprecated on methods, fields and classes that are not mapped to a URL, an endpoint whose body answers 410 Gone or redirects to its replacement, declarative HTTP clients (@FeignClient, Micronaut @Client, @RegisterRestClient, @HttpExchange), Javadoc @deprecated tags, comments, strings and test files.

What Gets Flagged

// FLAGGED: retired but still routed
@Deprecated
@PostMapping("/v1/login")
public Session legacyLogin(@RequestParam String user, @RequestParam String password) { ... }

// NOT FLAGGED: the old route only says it is gone
@Deprecated
@GetMapping("/v1/export")
public ResponseEntity<Void> legacyExport() {
    return ResponseEntity.status(HttpStatus.GONE).build();
}

Remediation

Remove the mapping once clients have migrated.
Until then, answer 410 Gone or redirect to the replacement, and keep it covered by the same security fixes as the current version.

References

CWE-448

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-448
// nosec vnx-448

Or record an ignore rule: vulnetix ignore add --rule vnx-448 --reason "...". See Suppressing findings.