VNX-477: Use of Obsolete Function

Detects calls to and imports of Java and Python standard-library APIs that are deprecated (most for removal) or already removed (Thread.stop, boxed-primitive constructors, one-argument URLEncoder.encode, Class.newInstance, finalize, the PEP 594 modules, ssl.wrap_socket, cgi.escape, collections ABC aliases and more), each with its replacement.

Field	Value
Rule ID	`VNX-477`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, Python
CWE	CWE-477
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`deprecated` `cwe-477`
Source	`internal/sast/rules/vnx-477.rego`

Overview

VNX-477 maps to CWE-477: Use of Obsolete Function. An obsolete API was usually retired for a reason: it is unsafe (Thread.stop, ssl.wrap_socket without hostname checking), silently wrong (URLEncoder.encode(s) uses the platform charset, cgi.escape does not escape quotes), or about to disappear and break the build on the next runtime upgrade. The rule reports concrete calls and imports, each with the replacement in the message:

Java: Thread.stop/suspend/resume/countStackFrames, runFinalizersOnExit, new Integer(...) and the other boxed-primitive constructors, one-argument URLEncoder.encode/URLDecoder.decode, new Date(String) and Date.parse, Class.newInstance(), DataInputStream.readLine(), overriding finalize(), System.setSecurityManager, AccessController.doPrivileged, Character.isSpace/isJavaLetter, the BigDecimal.ROUND_* int constants.
Python: importing a module removed by PEP 594 or PEP 632 (imp, asyncore, asynchat, smtpd, distutils, cgi, telnetlib, pipes, crypt and the rest), ssl.wrap_socket, platform.linux_distribution, base64.encodestring/decodestring, cgi.escape, inspect.getargspec, os.tempnam, time.clock, logging.warn (also .warn on a logger created by logging.getLogger in the same file), sys.setcheckinterval, locale.format, unittest.makeSuite, Element.getchildren()/getiterator() in a file using xml.etree (not lxml, which keeps them), collections.Mapping and the other ABCs without .abc, xml.etree.cElementTree, asyncio.async, @asyncio.coroutine, and the removed unittest aliases (assertEquals, assertItemsEqual, assertRegexpMatches, failUnless).

Not reported: @Deprecated annotations and warnings.warn(...) calls (they deprecate the project’s own API, which is not using an obsolete function), the supported replacements, and names inside strings and comments.

What Gets Flagged

workerThread.stop();                               // FLAGGED
Integer count = new Integer(v);                    // FLAGGED
return "/search?q=" + URLEncoder.encode(name);     // FLAGGED
return Class.forName(cls).newInstance();           // FLAGGED

import imp                                          # FLAGGED
from distutils.core import setup                    # FLAGGED
return ssl.wrap_socket(sock)                        # FLAGGED
return isinstance(x, collections.Mapping)           # FLAGGED

What Is Not Flagged

URLEncoder.encode(name, StandardCharsets.UTF_8);
Integer.valueOf(v);
Class.forName(cls).getDeclaredConstructor().newInstance();

from collections.abc import Mapping
ctx = ssl.create_default_context()
ctx.wrap_socket(sock, server_hostname=host)

Remediation

Replace each call with the replacement named in the finding message.
For removed Python modules, use the documented successor (importlib, asyncio, setuptools, html, shutil/shlex, email/smtplib, http.server).
Run the test suite on the newest runtime you intend to support; removed APIs fail at import or call time.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-477
// nosec vnx-477

Or record an ignore rule: vulnetix ignore add --rule vnx-477 --reason "...". See Suppressing findings.