VNX-1055: Multiple Inheritance from Concrete Classes

Reports a Python class that inherits from two or more concrete classes defined in the same file, each with its own methods or attributes. Mixins, ABCs, interfaces, empty marker classes, imported bases and test files are not reported.

Field	Value
Rule ID	`VNX-1055`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-1055
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`multiple-inheritance` `design` `cwe-1055`
Source	`internal/sast/rules/vnx-1055.rego`

Overview

VNX-1055 maps to CWE-1055: Multiple Inheritance from Concrete Classes. It reports a Python class whose bases include two or more concrete classes defined in the same file. A base is concrete when its body defines a method or assigns an attribute and it is not abstract. The class header may span several lines.

A base counts as abstract, and is ignored, when its name ends in Mixin, Base, ABC, Interface or Protocol (or starts with Abstract), it derives from ABC, ABCMeta, Protocol or a mixin, or its body uses @abstractmethod or raises NotImplementedError.

Why This Matters

When two concrete bases both carry state and behaviour, the method resolution order decides whose __init__, attributes and overrides win. A reordering of the base list, or a new method in either base, silently changes the subclass, and security-relevant behaviour such as validation or authorisation can be skipped.

Not reported: one concrete base combined with mixins or ABCs, bases imported from other modules (the rule cannot see whether they are concrete), empty marker classes such as exception tag hierarchies (class ConnectTimeout(ConnectionFailed, TimedOut) whose bases only pass), Generic[...] and metaclass= arguments, test files and comments.

What Gets Flagged

class FileStore:
    def __init__(self, path):
        self.path = path

class SqlStore:
    def __init__(self, dsn):
        self.conn = sqlite3.connect(dsn)

class HybridStore(FileStore, SqlStore):
    ...

Not flagged:

class ReportView(BaseView, JsonMixin, Renderer):
    ...

Remediation

Prefer composition: hold an instance of the second class instead of inheriting from it.
Keep one concrete base and turn the others into stateless mixins or abstract interfaces.

References

CWE-1055: Multiple Inheritance from Concrete Classes

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1055
// nosec vnx-1055

Or record an ignore rule: vulnetix ignore add --rule vnx-1055 --reason "...". See Suppressing findings.