VNX-573: Remote URL read through an API that cannot set a timeout

Field	Value
Rule ID	VNX-573
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, Kotlin
CWE	CWE-573
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	improper-spec-api timeout network cwe-573
Source	internal/sast/rules/vnx-573.rego

Overview

VNX-573 maps to CWE-573: Improper Following of Specification by Caller. URL.openStream() and the helpers built on it open a URLConnection with the JDK default timeouts, which are zero: wait forever. A network call must be bounded by its caller, and these APIs give the caller no way to do it, so a slow or unresponsive server (or one an attacker controls, as in SSRF) holds the calling thread indefinitely and can exhaust a request pool.

What Gets Flagged

try (InputStream in = new URL(link).openStream()) { ... }

URL url = new URL(endpoint);
return url.openStream().available();

IOUtils.toString(remote, StandardCharsets.UTF_8);
FileUtils.copyURLToFile(remote, dest);

fun latest(): String = URL("$endpoint/latest").readText()

Reported receivers: new URL(...), URL(...), uri.toURL(), and names declared as a URL in the file. Guava Resources.toString/toByteArray(url) are reported too.

What Is Not Flagged

• Classpath and file URLs: getResource(...), file.toURI().toURL(), "file:"/"jar:" literals.
• openConnection() followed by setConnectTimeout/setReadTimeout.
• The four-argument FileUtils.copyURLToFile(url, file, connectTimeout, readTimeout).
• A file that sets sun.net.client.defaultReadTimeout.
• Kotlin File.readText() and reader readText().
• The calls in comments or string literals.

Remediation

1. Open a connection and bound it:

   URLConnection c = url.openConnection();
   c.setConnectTimeout(5_000);
   c.setReadTimeout(10_000);
   try (InputStream in = c.getInputStream()) { ... }

2. Or use java.net.http.HttpClient with connectTimeout(...) and a per-request timeout(...).
3. Use FileUtils.copyURLToFile(url, file, connectTimeout, readTimeout) in place of the two-argument form.

References

• CWE-573: Improper Following of Specification by Caller
• URLConnection.setReadTimeout

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-573
// nosec vnx-573

Or record an ignore rule: vulnetix ignore add --rule vnx-573 --reason "...". See Suppressing findings.