VNX-498: Cloneable Class Containing Sensitive Information

Field	Value
Rule ID	VNX-498
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-498
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	cloneable-sensitive cwe-498
Source	internal/sast/rules/vnx-498.rego

Overview

VNX-498 maps to CWE-498: Cloneable Class Containing Sensitive Information. Object.clone() copies an object field by field without running a constructor. A cloneable class that holds a secret lets any caller make another copy of it, one that no wipe, access check or audit in the constructor covers.

The rule reports the declaration of a class that implements Cloneable (the implements clause may span lines) and declares a non-static field holding a secret: a String, char[], byte[] or CharSequence whose name says password, passphrase, pwd, pin, secret, API key, private key, an access/refresh/auth/session/bearer/id/csrf token, credential, credit card or card number, CVV or SSN, or a field of type PrivateKey, SecretKey, SecretKeySpec, KeyPair, KeyStore or Key.

What Gets Flagged

// FLAGGED
public class Credentials implements Cloneable {
    private String username;
    private char[] password;

// FLAGGED: implements clause on a continuation line
public final class KeyHolder extends Holder<String>
        implements Serializable, Cloneable {
    private PrivateKey privateKey;

What Is Not Flagged

• A class whose clone() throws CloneNotSupportedException.
• Static constants (private static final String PASSWORD_KEY = "password").
• Names that describe a secret rather than hold it (passwordLength, secretName), and non-text types.
• Classes that do not implement Cloneable, test code, comments and string literals.

A class that inherits Cloneable from a superclass is not resolved.

Remediation

1. Do not implement Cloneable on classes that hold secrets; provide an explicit copy method that decides what is copied.
2. If a superclass forces Cloneable, override clone() with throw new CloneNotSupportedException().

References

• CWE-498
• SEI CERT OBJ07-J: Sensitive classes must not let themselves be copied

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-498
// nosec vnx-498

Or record an ignore rule: vulnetix ignore add --rule vnx-498 --reason "...". See Suppressing findings.