VNX-1100: Insufficient Isolation of System-Dependent Functions

Java or Python code that launches a process through a hard-coded OS-specific shell (cmd /c, powershell, /bin/sh -c, bash -c, os.system("cls")) in a file that never checks which platform it runs on.

Field	Value
Rule ID	`VNX-1100`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, Python
CWE	CWE-1100
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`portability` `process` `maintainability` `cwe-1100`
Source	`internal/sast/rules/vnx-1100.rego`

Overview

VNX-1100 maps to CWE-1100: Insufficient Isolation of System-Dependent Functions. It reports a hard-coded, operating-system-specific shell or command (cmd, cmd.exe, cmd /c, powershell, pwsh, /bin/sh, /bin/bash, sh -c, bash -c, zsh, os.system("cls") or "clear") used in a process launch, when the file contains no platform check (os.name, sys.platform, platform.system(), System.getProperty("os.name"), SystemUtils.IS_OS_*, an isWindows flag).

Process launches recognised: Runtime.exec, ProcessBuilder, .command(...), subprocess.run/call/Popen/check_output/check_call, os.system, os.popen, os.exec*/spawn*, asyncio.create_subprocess_exec.

Why This Matters

The system-dependent call is scattered into ordinary code rather than isolated behind a platform check or adapter. On another OS the command fails outright, or a different interpreter parses the same string with different quoting and escaping rules, which is how argument handling that was safe on one shell becomes unsafe on another.

Not reported: files that branch on the platform anywhere, shell=True without a named shell, shebang lines, the literal outside a process launch (for example shutil.which("bash")), test files and comments. Whether the command is injectable is judged by the command-injection rules.

What Gets Flagged

return Runtime.getRuntime().exec("cmd.exe /c xcopy " + dir + " D:\\backup /E");   // FLAGGED
List<String> cmd = List.of("/bin/bash", "-c", script);                          // FLAGGED
ProcessBuilder pb = new ProcessBuilder(cmd);

subprocess.run(["/bin/bash", "-c", f"tar czf out.tgz {path}"], check=True)        # FLAGGED
os.system("cls")                                                                 # FLAGGED

Remediation

Run the program directly with an argument list (["tar", "czf", "out.tgz", path]) instead of going through a shell.
Where a platform-specific command is unavoidable, put it behind one platform check or adapter module.
For a confirmed false positive, add a vulnetix-ignore: VNX-1100 comment on the line.

References

CWE-1100: Insufficient Isolation of System-Dependent Functions

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1100
// nosec vnx-1100

Or record an ignore rule: vulnetix ignore add --rule vnx-1100 --reason "...". See Suppressing findings.