VNX-607: Public Static Final Field References Mutable Object
Reports a Java public static final field (or interface constant) initialised with a mutable collection, Date, SimpleDateFormat, StringBuilder, Arrays.asList, EnumSet or a Guava Lists/Maps/Sets.newXxx call, whose contents any code can change.
| Field | Value |
|---|---|
| Rule ID | VNX-607 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | Java |
| CWE | CWE-607 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | public-static-final-mutable cwe-607 |
| Source | internal/sast/rules/vnx-607.rego |
Overview
VNX-607 maps to CWE-607: Public Static Final Field References Mutable Object. It reports a field declared public, static and final (in any order) whose initializer, on the same line or the next, is a new HashMap/TreeMap/ConcurrentHashMap/Hashtable/Properties/EnumMap, HashSet/TreeSet, ArrayList/LinkedList/Vector/ArrayDeque, Date, StringBuilder/StringBuffer or BitSet, Arrays.asList(...) or EnumSet.of/noneOf/allOf.
Not reported: Collections.unmodifiable*, List.of/Set.of/Map.of, Guava Immutable*, Collections.empty*, fields assigned in a static block, non-public and instance fields, strings, boxed numbers, and arrays (VNX-582 covers public static final arrays).
Why This Matters
final fixes the reference, not the object. Any class, including untrusted plugin or library code, can add, remove or replace entries in a public static map or list, and so change permissions, allow-lists or configuration for the whole application.
What Gets Flagged
public static final Map<String, String> PERMISSIONS = new HashMap<>();
public static final List<String> TRUSTED = Arrays.asList("10.0.0.1", "10.0.0.2");
public final static ConcurrentHashMap<String, Object> HANDLERS =
new ConcurrentHashMap<>();
public static final SimpleDateFormat STAMP = new SimpleDateFormat("yyyy-MM-dd");
public interface Routes {
Map<String, String> ALIASES = new HashMap<>(); // implicitly public static final
}Remediation
- Expose an unmodifiable view:
Collections.unmodifiableMap(m),List.of(...),Map.of(...). - Or make the field private and provide accessors that return copies.
- For a confirmed false positive, add a
// vulnetix-ignore: VNX-607comment on the line.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-607
// nosec vnx-607Or record an ignore rule: vulnetix ignore add --rule vnx-607 --reason "...". See Suppressing findings.