VNX-1112: Incomplete Documentation of Program Execution

A Python argparse, optparse or click command-line option declared without help text.

Field	Value
Rule ID	`VNX-1112`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-1112
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`incomplete-execution-docs` `cli` `cwe-1112`
Source	`internal/sast/rules/vnx-1112.rego`

Overview

VNX-1112 maps to CWE-1112: Incomplete Documentation of Program Execution. It reports command-line options and arguments that change how a Python program runs but are missing from its --help output.

Why This Matters

--help is the documentation operators read before running a tool. An option missing from it (a --force, a --skip-verify, a destination path) is an execution control nobody knows to review. It gets used without anyone understanding it, or left at a default nobody chose.

What Gets Flagged

Reported at the line that opens the call, which may span several lines:

parser.add_argument("--output", default="out.csv")         # FLAGGED
parser.add_argument(                                       # FLAGGED
    "--retries",
    type=int,
)
parser.add_option("-f", "--force", action="store_true")    # FLAGGED (optparse)

@click.option("--verbose", is_flag=True)                   # FLAGGED

Django management commands (add_arguments) and subparsers are covered.

What Does Not Get Flagged

Calls that pass help=, including help=argparse.SUPPRESS (a deliberate choice to hide an option).
Calls that expand **options, since help may be inside them.
action="version" and action="help", for which argparse writes the help text itself.
add_option calls whose first argument is not a - flag (a menu or config API, not optparse), and calls inside a triple-quoted usage example.
add_argument_group, add_mutually_exclusive_group and click.argument (which takes no help).
Commented-out calls and test files.

Remediation

Add help="..." describing what the option changes and its default.
Hide internal options explicitly with help=argparse.SUPPRESS or hidden=True in click.

References

CWE-1112: Incomplete Documentation of Program Execution

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1112
// nosec vnx-1112

Or record an ignore rule: vulnetix ignore add --rule vnx-1112 --reason "...". See Suppressing findings.