VNX-580: clone() Method Without super.clone()

Field	Value
Rule ID	VNX-580
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java
CWE	CWE-580
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	clone object-model cwe-580
Source	internal/sast/rules/vnx-580.rego

Overview

VNX-580 maps to CWE-580: clone() Method Without super.clone(). Object.clone() returns an object of the runtime class of this. A clone() that builds its copy with a constructor (new Account(this), new Settings()) always returns the declaring class instead. Any subclass that inherits that method, or calls super.clone() in its own, then gets an instance of the parent: the copy loses the subclass’s type and fields, and casting it fails.

What Gets Flagged

The declaration line of a public or protected clone() with a body, in a class that is not final, when the body never calls super.clone():

public class Account implements Cloneable {
    @Override
    public Account clone() {
        return new Account(this);
    }
}

@Override
public Object clone() throws CloneNotSupportedException {
    Settings copy = new Settings();
    copy.values = new HashMap<>(values);
    return copy;
}

What Is Not Flagged

• A clone() that calls super.clone().
• A clone() in a final class, a record or an enum (no subclass can inherit it).
• An abstract or interface clone() with no body.
• A clone() that only throws (CloneNotSupportedException, UnsupportedOperationException) or returns this.
• Calls of clone() on fields and arrays (limits.clone()).
• Test code and comments.

Remediation

1. Start from super.clone() and deep-copy the mutable fields:

   Order o = (Order) super.clone();
   o.lines = new ArrayList<>(lines);
   return o;

2. Or make the class final so no subclass can inherit the method, or replace clone() with a copy constructor or static factory.

References

• CWE-580: clone() Method Without super.clone()

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-580
// nosec vnx-580

Or record an ignore rule: vulnetix ignore add --rule vnx-580 --reason "...". See Suppressing findings.