VNX-500: Public Static Field Not Marked Final

Detects public static fields that are not final (Java) or not readonly/const (C#), which any code in the process can reassign.

Field	Value
Rule ID	`VNX-500`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, C#
CWE	CWE-500
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`static-non-final` `cwe-500`
Source	`internal/sast/rules/vnx-500.rego`

Overview

VNX-500 maps to CWE-500: Public Static Field Not Marked Final. A public static field is global state. Without final (Java) or readonly/const (C#), any class, plugin or deserialised object in the process can replace it, so a configuration flag, a singleton, a trusted-host list or a connection string other code depends on can change underneath it.

The rule reports the declaration, in any modifier order (static public, public volatile static), with or without an annotation or initialiser.

What Gets Flagged

public static String adminEmail = "ops@example.com";   // FLAGGED
static public boolean debug = false;                    // FLAGGED
public static String[] trustedHosts = {"a.example.com"}; // FLAGGED

public static string ConnectionString = "Server=db;Database=app"; // FLAGGED

What Is Not Flagged

public static final (Java) and public static readonly / public const (C#) fields.
Non-public statics, methods, nested classes and generic methods.
C# properties ({ get; set; }), expression-bodied members (=> "x") and events.
Fields of a Java interface, which are implicitly final.
Test code, comments and string literals.

A final field that refers to a mutable object (an array or a collection) can still be changed in place; that is a separate weakness (CWE-582).

Remediation

Declare the field final (readonly in C#).
If it must change, make it private and expose controlled accessors.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-500
// nosec vnx-500

Or record an ignore rule: vulnetix ignore add --rule vnx-500 --reason "...". See Suppressing findings.