VNX-582: Array declared public, final and static

Reports public static final array fields and interface array constants in Java and public static readonly arrays in C#, whose elements any code can overwrite. Zero-length arrays, non-public fields, collections and test files are not reported.

Field	Value
Rule ID	`VNX-582`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java, C#
CWE	CWE-582
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`array-public` `cwe-582`
Source	`internal/sast/rules/vnx-582.rego`

Overview

VNX-582 maps to CWE-582: Array Declared Public, Final, and Static. It reports a public static final array field in Java (any modifier order, int[] X or String X[], initialised inline or in a static block), an array constant declared in a Java interface (implicitly public static final), and a public static readonly array in C#.

Why This Matters

final and readonly fix the reference, not the contents. Any class can write Limits.ALLOWED_ROLES[0] = "guest" and change what every other caller sees, which turns a constant allow-list, key table or limit into shared mutable state.

What Gets Flagged

public static final int[] RETRY_DELAYS = {100, 200, 400};
public final static String[] ALLOWED_ROLES = new String[] {"admin", "editor"};
public static final String ADMINS[] = {

public interface Scopes {
    String[] DEFAULT_SCOPES = {"read", "write"};
}

public static readonly string[] TrustedHosts = { "api.example.com" };

Not flagged: private static final int[], public static final int[] EMPTY = new int[0];, public static final List<String> X = List.of(...), public static readonly IReadOnlyList<string>, Array.Empty<int>(), methods returning arrays, comments, strings and test files.

Remediation

Make the array private and expose an unmodifiable view (Collections.unmodifiableList(Arrays.asList(...)), List.of(...)) or return a defensive copy (ARRAY.clone()).
In C#, expose IReadOnlyList<T> or ImmutableArray<T> instead of T[].

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-582
// nosec vnx-582

Or record an ignore rule: vulnetix ignore add --rule vnx-582 --reason "...". See Suppressing findings.