VNX-594: Persisted or session-scoped Java class that is not Serializable

Reports a JPA @Entity, @Embeddable or @MappedSuperclass, or a CDI @SessionScoped or @ConversationScoped bean, whose class declaration neither implements Serializable or Externalizable nor extends another class.

Field	Value
Rule ID	`VNX-594`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-594
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`java` `jpa` `cdi` `serialization` `cwe-594`
Source	`internal/sast/rules/vnx-594.rego`

Overview

VNX-594 maps to CWE-594: J2EE Framework: Saving Unserializable Objects to Disk. The container may write some objects to disk or move them between nodes: it passivates session-scoped beans, replicates sessions across a cluster, and detaches entities to send them to remote callers. Those objects must be Serializable.

The rule reports the class declaration of a JPA @Entity, @Embeddable or @MappedSuperclass (javax or jakarta), or of a CDI @SessionScoped or @ConversationScoped bean, when the declaration (which may span lines) neither implements Serializable or Externalizable nor extends another class.

It does not report classes that implement Serializable, Externalizable or a Spring Security interface that extends it (UserDetails, GrantedAuthority, Authentication), classes that extend a superclass (which may be Serializable; superclasses are not resolved), interfaces, records and enums, lookalike annotations such as @EntityListeners, or annotations in comments.

Why This Matters

When serialisation fails the container either throws at passivation or replication time, under load and in production, or drops the object’s state. A user’s cart or wizard state disappears on fail-over, and a detached entity cannot be returned to a remote client.

What Gets Flagged

@Entity
@Table(name = "customers")
public class Customer {              // FLAGGED
    @Id private Long id;
}

@SessionScoped
public class CartBean implements Cloneable {   // FLAGGED

// NOT FLAGGED
@Entity
public class Product implements Serializable {
    private static final long serialVersionUID = 1L;
}

@Entity
public class Invoice extends BaseEntity { }    // superclass not resolved

Remediation

Implement java.io.Serializable on the class and declare a serialVersionUID.
Mark fields that cannot be serialised (connections, streams, loggers) transient and restore them after deserialisation.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-594
// nosec vnx-594

Or record an ignore rule: vulnetix ignore add --rule vnx-594 --reason "...". See Suppressing findings.