VNX-471: Modification of Assumed-Immutable Data (MAID)

Reports Java public static final fields that hold a mutable value (a new ArrayList/HashMap/HashSet/Date/StringBuilder and similar, or Arrays.asList), where final freezes only the reference. Immutable collections, non-public fields, test sources and comments are not reported. A public static final array is the same weakness in its array-specific form and is reported by VNX-582, not here.

Field	Value
Rule ID	`VNX-471`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java
CWE	CWE-471
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`assumed-immutable` `mutable-constant` `cwe-471`
Source	`internal/sast/rules/vnx-471.rego`

Overview

VNX-471 maps to CWE-471: Modification of Assumed-Immutable Data (MAID). Reports Java public static final fields that hold a mutable value (a new ArrayList/HashMap/HashSet/Date/StringBuilder and similar, or Arrays.asList), where final freezes only the reference. Immutable collections, non-public fields, test sources and comments are not reported. A public static final array is the same weakness in its array-specific form and is reported by VNX-582, not here.

Why This Matters

This weakness class (Modification of Assumed-Immutable Data) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-471 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// NOT FLAGGED here: reported by VNX-582 (public static final array)
public static final String[] TRUSTED_HOSTS = {"api.acme.example", "auth.acme.example"};

// FLAGGED: a "constant" list anyone can add to
public static final List<String> ADMINS = new ArrayList<>();

// NOT FLAGGED: immutable
public static final List<String> SCOPES = List.of("read", "write");

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-471 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-471 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-471
// nosec vnx-471

Or record an ignore rule: vulnetix ignore add --rule vnx-471 --reason "...". See Suppressing findings.