VNX-1084: Invokable Control Element with Excessive File or Data Access Operations

Field	Value
Rule ID	VNX-1084
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-1084
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	invokable-element-excessive-file-operations maintainability cwe-1084
Source	internal/sast/rules/vnx-1084.rego

Overview

VNX-1084 maps to CWE-1084: Invokable Control Element with Excessive File or Data Access Operations. A Python function whose body performs more than 7 file or data access operations (open, execute, os/shutil/pathlib file operations).

Why This Matters

A function that does that much I/O mixes several responsibilities. Its error handling, its cleanup on failure, and its authorisation of each path or query are hard to review when they are interleaved in one body.

What Gets Flagged

One finding per function, at its def line, when its body has more than 7 lines with a file or data access operation:

def export_all(out_dir, data):          # FLAGGED: 8 open() calls
    with open(f"{out_dir}/users.json", "w") as f:
        json.dump(data["users"], f)
    with open(f"{out_dir}/orders.json", "w") as f:
        ...

Counted operations: open(...) (also Path.open/os.open), .execute(...), .executemany(...), .executescript(...), os.remove/unlink/rename/replace/makedirs/mkdir/rmdir/removedirs, shutil.copy/copy2/copyfile/copytree/move/rmtree, and pathlib read_text/write_text/read_bytes/write_bytes/touch. Operations are counted per source line inside the function’s indented body (up to 400 lines); nested functions count toward the enclosing one.

What Does Not Get Flagged

• Functions with 7 operations or fewer, including the same work split across several functions.
• Operations named in comments or string literals.
• Test files.

The threshold is this rule’s choice; CWE-1084 does not fix one.

Remediation

1. Split the function so each piece does one kind of I/O (read inputs, write outputs, clean up).
2. Put repeated operations in a loop or a helper.
3. For a deliberate exception, add # vulnetix-ignore: VNX-1084 on the def line.

References

• CWE-1084: Invokable Control Element with Excessive File or Data Access Operations

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1084
// nosec vnx-1084

Or record an ignore rule: vulnetix ignore add --rule vnx-1084 --reason "...". See Suppressing findings.