VNX-665: Improper Initialization

Reports a catch clause inside a Java static initializer whose body is empty or only prints, logs or prints the stack trace, leaving the class loaded with partly initialised static state.

Field	Value
Rule ID	`VNX-665`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-665
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`initialization` `static-initializer` `swallowed-exception` `cwe-665`
Source	`internal/sast/rules/vnx-665.rego`

Overview

VNX-665 maps to CWE-665: Improper Initialization. It reports a catch inside a static { } block whose body is empty or only calls printStackTrace(), System.out/err.print* or a logger. The catch line is reported.

Not reported: a catch that rethrows (ExceptionInInitializerError, IllegalStateException…), assigns a fallback value or returns, catches outside a static initializer (an empty catch in a method is a different weakness), comments.

Why This Matters

When a static initializer swallows the failure, the class loads anyway. Its keystore, connection or configuration stays null, and every later caller fails with a NullPointerException far from the real cause, or worse, runs with a missing security setting.

What Gets Flagged

static {
    try {
        STORE = KeyStore.getInstance("PKCS12");
        STORE.load(in, password());
    } catch (Exception e) {          // FLAGGED
    }
}

// NOT FLAGGED
} catch (Exception e) {
    throw new ExceptionInInitializerError(e);
}

Remediation

Rethrow as ExceptionInInitializerError so the class fails to load at the cause.
Or assign an explicit, safe fallback value in the catch.
Prefer lazy initialisation with explicit error handling over work in static blocks.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-665
// nosec vnx-665

Or record an ignore rule: vulnetix ignore add --rule vnx-665 --reason "...". See Suppressing findings.