VNX-585: Empty synchronized block

Reports synchronized (lock) blocks in Java and Kotlin that contain no code. Blocks with statements and synchronized methods are not reported.

Field	Value
Rule ID	`VNX-585`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, Kotlin
CWE	CWE-585
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`empty-sync` `cwe-585`
Source	`internal/sast/rules/vnx-585.rego`

Overview

VNX-585 maps to CWE-585: Empty Synchronized Block. It reports a synchronized (lock) statement whose body is {} on the same line, or whose opening brace (same line or next) is followed only by blank and comment lines before the closing brace.

Why This Matters

An empty synchronized block guards nothing. It is usually a critical section whose statements were moved out by mistake, or an attempt to wait for another thread that depends on undocumented timing and does not establish the ordering the author expects.

What Gets Flagged

synchronized (lock) {}
synchronized (mutex) {
}

synchronized(lock) {}

Not flagged: synchronized (lock) { count++; }, public synchronized void reset() {}, comments and strings.

Remediation

Put the statements that need the lock inside the block.
To wait for another thread, use wait/notify, a CountDownLatch, or another java.util.concurrent synchronizer.

References

CWE-585: Empty Synchronized Block

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-585
// nosec vnx-585

Or record an ignore rule: vulnetix ignore add --rule vnx-585 --reason "...". See Suppressing findings.