VNX-1092: Use of Same Invokable Control Element in Multiple Architectural Layers

A Python data-layer module (models.py, repositories/, dao/) that imports or reads the web layer's request and response objects (Flask request/session/redirect, django.http, django.shortcuts, FastAPI Request).

Field	Value
Rule ID	`VNX-1092`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-1092
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`architecture` `layering` `maintainability` `cwe-1092`
Source	`internal/sast/rules/vnx-1092.rego`

Overview

VNX-1092 maps to CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers. It reports Python data-layer modules that use the presentation layer’s request/response machinery: the request object, the session, redirects and response builders. A data-layer module is models.py, repository.py, dao.py, or any file in a models/, repository/, repositories/, dao/ or dal/ package.

Why This Matters

When a model reads request.args itself, the same control element runs in both the view and the data layer. Data access then depends on whichever HTTP request happens to be active, the model cannot be used from a job or a CLI, and validation the view performs can be bypassed by a model method that reads the raw request directly.

Reported: imports of request, session, render_template, redirect, make_response, flash or abort from Flask, anything from django.http or django.shortcuts, Request from FastAPI, Starlette or DRF, and reads such as request.form, request.GET, request.json, session[...] when session is imported from Flask, and the same reads through a parameter annotated : Request (req.json).

Not reported: flask.g and current_app (the documented way to share a connection), django.urls.reverse for get_absolute_url, view and service modules, test files and comments.

What Gets Flagged

# shop/models.py
from flask import request, g                        # FLAGGED

class Order(Base):
    @classmethod
    def from_form(cls):
        note = request.form.get("note", "")         # FLAGGED
        return cls(note=note)

Remediation

Read and validate request data in the view, and pass plain values to the model (Order.create(note=note)).
Raise domain exceptions from the data layer and translate them to HTTP responses in the view.
For a confirmed false positive, add a # vulnetix-ignore: VNX-1092 comment on the line.

References

CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1092
// nosec vnx-1092

Or record an ignore rule: vulnetix ignore add --rule vnx-1092 --reason "...". See Suppressing findings.