VNX-1109: Use of Same Variable for Multiple Purposes

Field	Value
Rule ID	VNX-1109
Severity	Low
SARIF level	note
Kind	sast
Languages	Python, JavaScript / TypeScript, C, C++, Java
CWE	CWE-1109
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	variable-reuse nested-loop cwe-1109
Source	internal/sast/rules/vnx-1109.rego

Overview

VNX-1109 maps to CWE-1109: Use of Same Variable for Multiple Purposes. It reports a nested loop that reuses the enclosing loop’s control variable, so the inner loop overwrites the counter or element the outer loop is still using.

Why This Matters

When one variable carries two meanings at once, one of them is silently lost. In C, C++ and Java an inner for (i = 0; ...) resets the outer counter, so the outer loop skips iterations, repeats them or never ends. In Python and in JavaScript for...in the outer iteration continues, but every statement after the inner loop sees the inner loop’s last value instead of the outer element. Checks that run per element (authorisation, validation, cleanup) then run against the wrong one.

What Gets Flagged

for i in range(len(rows)):
    row = rows[i]
    for i in range(len(row)):      # FLAGGED: reuses the outer 'i'
        total += row[i]

for (i = 0; i < 4; i++) {
    for (i = 0; i < 4; i++) {      /* FLAGGED: assigns the outer counter */
        total += m[i][i];
    }
}

for (var i = 0; i < grid.length; i++) {
  for (var i = 0; i < row.length; i++) {   // FLAGGED: 'var' is the same variable

What Does Not Get Flagged

• Sibling loops that reuse a name one after the other.
• An inner loop that declares its own variable (for (int i, for (let i).
• An inner loop inside a callback defined in the outer loop, or inside a Python def or class nested in it.
• A rollback loop followed within four lines by return, goto, throw, raise or exit, which abandons the outer loop.
• Python comprehensions (they have their own scope) and the throwaway name _.

Remediation

1. Give the inner loop its own variable (j, cell, member).
2. In JavaScript, declare loop variables with let so each loop gets its own binding.
3. For a deliberate reuse, add # vulnetix-ignore: VNX-1109 (or // vulnetix-ignore: VNX-1109) on the reported line.

References

• CWE-1109: Use of Same Variable for Multiple Purposes

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1109
// nosec vnx-1109

Or record an ignore rule: vulnetix ignore add --rule vnx-1109 --reason "...". See Suppressing findings.