VNX-581: Object Model Violation: Just One of Equals and Hashcode Defined

Field	Value
Rule ID	VNX-581
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, Kotlin
CWE	CWE-581
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	equals-hashcode object-model cwe-581
Source	internal/sast/rules/vnx-581.rego

Overview

VNX-581 maps to CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined. Objects that are equal must have equal hash codes. A class that overrides only one of the two breaks that contract: HashMap, HashSet and caches miss entries, store duplicates, or fail to find a key that is present. That can defeat de-duplication, permission sets and lookups keyed by the object.

What Gets Flagged

The line declaring the lone method: public boolean equals(Object) or public int hashCode() in Java, and override fun equals(other: Any?) or override fun hashCode() in Kotlin. The pairing is judged per class, so a nested class that defines only one is reported even when its outer class defines both.

public class Sku {
    @Override
    public boolean equals(Object o) {
        ...
    }
    // no hashCode()
}

class Version(val major: Int, val minor: Int) {
    override fun equals(other: Any?): Boolean { ... }
    // no hashCode()
}

What Is Not Flagged

• A class that defines both.
• A Kotlin data class or Java record, whose other method the compiler generates over the same components.
• An equals overload with another parameter type (equals(Range r)), which is a different mistake.
• Calls of hashCode() or equals() on other objects.
• Test code, comments and string literals.

Remediation

1. Override both, over the same fields: Objects.equals(...) in equals, Objects.hash(...) in hashCode.
2. In Kotlin, a data class derives both from its properties.

References

• CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined
• Object.hashCode contract

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-581
// nosec vnx-581

Or record an ignore rule: vulnetix ignore add --rule vnx-581 --reason "...". See Suppressing findings.