VNX-1108: Excessive Reliance on Global Variables

A Python or PHP module relies on mutable global state from inside its functions to an excessive degree: the file contains three or more `global` statements (Python `global name`, PHP `global $name`), or a single `global` statement that rebinds four or more names. Functions coupled through shared globals cannot be reasoned about or tested in isolation, and in a long-lived web worker the values leak between requests and users. Reported: each `global` statement in such a file. Not reported: a file with one or two narrow `global` statements (the lazy singleton or module cache), the word global in strings, docstrings and comments, identifiers such as global_counter or GLOBAL_TIMEOUT, nonlocal, $GLOBALS array access, PHP statements that name only WordPress core globals ($wpdb, $post, $wp_query and the like, which WordPress exposes only that way), global statements shown as examples inside Python docstrings, and test files.

Field	Value
Rule ID	`VNX-1108`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python, PHP
CWE	CWE-1108
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`maintainability` `global-state` `cwe-1108`
Source	`internal/sast/rules/vnx-1108.rego`

Overview

VNX-1108 maps to CWE-1108: Excessive Reliance on Global Variables. A Python or PHP module relies on mutable global state from inside its functions to an excessive degree: the file contains three or more global statements (Python global name, PHP global $name), or a single global statement that rebinds four or more names. Functions coupled through shared globals cannot be reasoned about or tested in isolation, and in a long-lived web worker the values leak between requests and users. Reported: each global statement in such a file. Not reported: a file with one or two narrow global statements (the lazy singleton or module cache), the word global in strings, docstrings and comments, identifiers such as global_counter or GLOBAL_TIMEOUT, nonlocal, $GLOBALS array access, PHP statements that name only WordPress core globals ($wpdb, $post, $wp_query and the like, which WordPress exposes only that way), global statements shown as examples inside Python docstrings, and test files.

Why This Matters

Functions that communicate through module globals depend on call order and share state between every caller. In a web worker that serves many users, a global _user set by one request is still set when the next request runs.

What Gets Flagged

def login(name):
    global _user, _cache      # FLAGGED (third global statement in the module)

def load(env):
    global HOST, PORT, DEBUG, SECRET   # FLAGGED (four names in one statement)

function db_query($sql) {
    global $db;               // FLAGGED (when the file has three or more)

Not flagged: a single lazy-singleton global _client, identifiers such as global_counter, the word in strings and comments, nonlocal, and test files.

Remediation

Pass state explicitly: function parameters, a class instance, a request context or dependency injection.

References

CWE-1108: Excessive Reliance on Global Variables

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1108
// nosec vnx-1108

Or record an ignore rule: vulnetix ignore add --rule vnx-1108 --reason "...". See Suppressing findings.