VNX-1086: Class with Excessive Number of Child Classes

Field	Value
Rule ID	VNX-1086
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-1086
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	excessive-child-classes maintainability cwe-1086
Source	internal/sast/rules/vnx-1086.rego

Overview

VNX-1086 maps to CWE-1086: Class with Excessive Number of Child Classes. A Python class defined in the project that more than 20 classes in the project derive from directly.

Why This Matters

A base class with that many children is a change amplifier. Every edit to it, including a security fix to a method the children inherit or override, has to be checked against all of them, and that check is the one that gets skipped.

What Gets Flagged

One finding per base class definition, with the child count:

class Handler(abc.ABC):        # FLAGGED when 21+ classes derive from Handler
    @abc.abstractmethod
    def handle(self, event): ...

class Kind0Handler(Handler): ...
class Kind1Handler(Handler): ...
# ... 19 more

Children are counted across every non-test Python file by the last component of the base name, so class X(Handler), class X(Mixin, Handler), class X(handlers.Handler) and a class head split across lines all count.

What Does Not Get Flagged

• Bases with 20 children or fewer.
• Bases not defined in the project (models.Model, Exception, object), including a project class that shadows one (class Migration(migrations.Migration)).
• Children in test files, Django migrations and third-party trees.
• Class heads in comments or doctests.

Two unrelated classes with the same name are counted as one. The threshold is this rule’s choice; CWE-1086 does not fix one.

Remediation

1. Prefer composition: pass the varying behaviour in as an object or function instead of subclassing.
2. Split the hierarchy with intermediate bases so a change to the root reaches fewer classes.
3. For a deliberate plugin-style base, add # vulnetix-ignore: VNX-1086 on the class line.

References

• CWE-1086: Class with Excessive Number of Child Classes

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1086
// nosec vnx-1086

Or record an ignore rule: vulnetix ignore add --rule vnx-1086 --reason "...". See Suppressing findings.