VNX-754: Class resource used without checking for null

Reports Java getResourceAsStream()/getResource() results, which are null when the resource is missing, that are dereferenced or handed to a consumer such as Properties.load() before any null check.

Field	Value
Rule ID	`VNX-754`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-754
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`unchecked-conditions` `null-dereference` `cwe-754`
Source	`internal/sast/rules/vnx-754.rego`

Overview

VNX-754 maps to CWE-754: Improper Check for Unusual or Exceptional Conditions. When a resource is missing, getResourceAsStream() on a Class, ClassLoader or ServletContext returns null instead of throwing. Class/ClassLoader.getResource() does the same. The rule reports the result when it is:

dereferenced in the same expression
passed straight to a consumer that dereferences it: Properties.load, new InputStreamReader(...), IOUtils.toString, FileCopyUtils.copyToByteArray, a parser, and so on. The consumer can also open on the line above.
assigned to a variable that the next 15 lines use before any null check

What Gets Flagged

return Banner.class.getResourceAsStream("/banner.txt").readAllBytes();   // FLAGGED
props.load(Settings.class.getClassLoader().getResourceAsStream("app.properties")); // FLAGGED
InputStream in = Keystore.class.getResourceAsStream("/server.p12");      // FLAGGED
ks.load(in, pass);

Not reported:

results checked with == null, != null, Objects.requireNonNull, Optional.ofNullable or checkNotNull before use
Spring ResourceLoader.getResource(), which never returns null
test code and comments

Remediation

Check the result before using it, and fail with a message that names the missing resource:

InputStream in = Objects.requireNonNull(
    getClass().getResourceAsStream("/app.properties"), "app.properties missing from classpath");

References

CWE-754: Improper Check for Unusual or Exceptional Conditions

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-754
// nosec vnx-754

Or record an ignore rule: vulnetix ignore add --rule vnx-754 --reason "...". See Suppressing findings.