VNX-695: Low-level functionality prohibited by the EJB specification used in an enterprise bean

Reports an EJB (@Stateless, @Stateful, @Singleton, @MessageDriven or a SessionBean/EntityBean/MessageDrivenBean) that creates threads, listens on sockets, uses java.io file streams, loads native code, synchronizes, calls System.exit, or replaces the standard streams, security manager or a class loader, all of which the EJB specification reserves to the container.

Field	Value
Rule ID	`VNX-695`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-695
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`low-level-functionality` `ejb` `j2ee` `cwe-695`
Source	`internal/sast/rules/vnx-695.rego`

Overview

VNX-695 maps to CWE-695: Use of Low-Level Functionality: code that uses low-level functionality its framework or specification explicitly prohibits. The concrete, checkable case is the EJB specification’s programming restrictions. The container owns threads, connections, files, synchronisation and the JVM lifecycle, and a bean that manages them itself breaks pooling, transactions, security propagation and clustering.

In a .java file that imports javax.ejb/jakarta.ejb and declares a bean, the rule reports:

thread creation: new Thread(, Executors.new..., new ThreadPoolExecutor/ForkJoinPool/Timer (CWE-383);
listening sockets and multicast: new ServerSocket/MulticastSocket, new DatagramSocket(port), ServerSocketChannel.open() (CWE-577). A bean may be a socket client, so new Socket(host, port) and new DatagramSocket() are not reported;
java.io file access: new FileInputStream/FileOutputStream/FileReader/FileWriter/RandomAccessFile (CWE-576);
native code: System.loadLibrary/System.load, native method declarations (CWE-111);
synchronized methods and blocks (CWE-574);
System.exit and Runtime.getRuntime().halt (CWE-382);
replacing the standard streams, the security manager or a class loader: System.setOut/setErr/setIn/setSecurityManager, new ...ClassLoader(, setContextClassLoader(.

A bean is recognised by an import of javax.ejb/jakarta.ejb or a fully qualified @javax.ejb.Stateless-style annotation.

Not reported: the same code in classes that are not EJBs (Spring @Service, javax.inject.Singleton, plain classes), container-managed alternatives (ManagedExecutorService, @Asynchronous, @Resource), comments, string literals and lookalike identifiers. Helper classes called from a bean are not followed. Inline assembly in C, which an earlier version reported, is not prohibited by any specification and is no longer reported.

What Gets Flagged

@Stateless
public class InvoiceService {
    public void render(Invoice inv) {
        new Thread(() -> pdf(inv)).start();                 // FLAGGED
    }
}

public class LedgerBridgeBean implements SessionBean {
    public void listen() throws IOException {
        ServerSocket server = new ServerSocket(9090);       // FLAGGED
    }
}

What Is Not Flagged

@Stateless
public class AsyncMailer {
    @Resource
    private ManagedExecutorService executor;

    @Asynchronous
    public Future<Boolean> send(Mail m) {
        executor.submit(() -> deliver(m));
        return new AsyncResult<>(true);
    }
}

Remediation

Use ManagedExecutorService, @Asynchronous or timers from TimerService instead of creating threads.
Use container-managed resources (@Resource data sources, JMS, JCA connectors) instead of sockets and files.
Leave concurrency to the container (@Lock on singletons) instead of synchronized.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-695
// nosec vnx-695

Or record an ignore rule: vulnetix ignore add --rule vnx-695 --reason "...". See Suppressing findings.