VNX-1085: Invokable Control Element with Excessive Volume of Commented-out Code

Field	Value
Rule ID	VNX-1085
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-1085
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	commented-out-code maintainability cwe-1085
Source	internal/sast/rules/vnx-1085.rego

Overview

VNX-1085 maps to CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code. A Python function whose body holds 5 or more lines of commented-out code.

Why This Matters

Disabled code inside a function hides what the function used to do. A commented-out permission or CSRF check reads like a decision nobody recorded, and the dead lines go stale against the live code around them.

What Gets Flagged

One finding per function, at its def line:

class TransferView:
    def post(self, request):                                   # FLAGGED: 5 commented-out lines
        amount = int(request.POST["amount"])
        # self.check_csrf(request)
        # self.require_role(request.user, "teller")
        # if amount > LIMIT:
        #     raise PermissionDenied()
        # audit.record(request.user, amount)
        return self.transfer(request.user, amount)

A comment counts as code when it reads as a statement: an assignment, a call, an import, return/raise/del/assert, or a block header ending in a colon (if ...:, for ... in ...:, else:, try:).

What Does Not Get Flagged

• Prose comments, even ones that mention code (# Example: price(item, 3), # Note: return early if qty is zero).
• Fewer than 5 commented-out lines in a function.
• Commented-out code at module level.
• Test files.

The threshold is this rule’s choice; CWE-1085 does not fix one.

Remediation

1. Delete the commented-out lines; version control keeps the history.
2. If the code is still needed, restore it, or put it behind a feature flag with a comment saying why it is off.
3. For a deliberate exception, add # vulnetix-ignore: VNX-1085 on the def line.

References

• CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1085
// nosec vnx-1085

Or record an ignore rule: vulnetix ignore add --rule vnx-1085 --reason "...". See Suppressing findings.