VNX-1080: Source Code File with Excessive Number of Lines of Code

Field	Value
Rule ID	VNX-1080
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-1080
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	excessive-file-length maintainability cwe-1080
Source	internal/sast/rules/vnx-1080.rego

Overview

VNX-1080 maps to CWE-1080: Source Code File with Excessive Number of Lines of Code. A hand-written Python module with more than 2000 lines of code (blank lines and # comments not counted).

Why This Matters

A module that large is hard to review as a unit. A security-relevant change inside it, such as a removed check or a widened query, is easy to miss in review because the reviewer cannot hold the module in their head.

What Gets Flagged

One finding per file, at its first line of code, when the file holds more than 2000 code lines:

# Order service.

import logging          # FLAGGED (first code line of a 2,400-line module)

log = logging.getLogger(__name__)

def handler_0(request, store):
    ...

What Does Not Get Flagged

• Files of 2000 code lines or fewer, however many blank and comment lines they carry.
• Test files.
• Generated code: *_pb2.py/*_pb2_grpc.py, Django migrations/, and files whose first 1000 characters say Generated by, @generated, DO NOT EDIT or autogenerated.
• Third-party trees (site-packages, vendor, node_modules, .venv).

Remediation

1. Split the module along its responsibilities (for example, one module per resource or per stage).
2. Move shared helpers into their own module so each piece can be reviewed and tested on its own.
3. For a deliberate exception, add # vulnetix-ignore: VNX-1080 on the reported line.

References

• CWE-1080: Source Code File with Excessive Number of Lines of Code

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1080
// nosec vnx-1080

Or record an ignore rule: vulnetix ignore add --rule vnx-1080 --reason "...". See Suppressing findings.