VNX-1090: Method Containing Access of a Member Element from Another Class

Field	Value
Rule ID	VNX-1090
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-1090
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	encapsulation maintainability cwe-1090
Source	internal/sast/rules/vnx-1090.rego

Overview

VNX-1090 maps to CWE-1090: Method Containing Access of a Member Element from Another Class. It reports Python code that reaches into another class’s private (double-underscore) member through the name-mangled spelling _Owner__attr, either as an attribute access or through getattr/setattr/hasattr/delattr with that name as a string. A subclass reaching its parent’s private member is reported too.

Why This Matters

A double-underscore attribute is the owning class’s private state. Code elsewhere that writes it skips whatever the class’s own methods enforce (validation, locking, audit logging), and code that reads it breaks silently when the class changes its internals. This is the most explicit way Python code can access a member element of another class, so it is the one a static rule can report without guessing.

Not reported: a class using its own mangled name, single-underscore (protected) attributes, dunder names such as __class__ and __dict__, the mangled name in a plain string or a comment, and test files. Access to another class’s protected or public members is not judged, because without types it cannot be told apart from ordinary use.

What Gets Flagged

class Auditor:
    def reset(self, account):
        account._Account__balance = 0           # FLAGGED

def rotate(vault, new_key):
    setattr(vault, "_Vault__master_key", new_key)   # FLAGGED

class AdminSession(BaseSession):
    def elevate(self):
        return self._BaseSession__token          # FLAGGED

Remediation

1. Add a method to the owning class that performs the operation and keeps its invariants, and call it instead.
2. If the value really is part of the public contract, expose it as a property.
3. For a confirmed intentional access, add a # vulnetix-ignore: VNX-1090 comment on the line.

References

• CWE-1090: Method Containing Access of a Member Element from Another Class
• Python tutorial: Private Variables

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1090
// nosec vnx-1090

Or record an ignore rule: vulnetix ignore add --rule vnx-1090 --reason "...". See Suppressing findings.