VNX-1113: Inappropriate Comment Style

A /* block comment opened inside another block comment, in a language where block comments do not nest.

Field	Value
Rule ID	`VNX-1113`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++, Java, JavaScript / TypeScript, Go, C#, PHP
CWE	CWE-1113
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`comments` `inappropriate-comment` `nested-comment` `cwe-1113`
Source	`internal/sast/rules/vnx-1113.rego`

Overview

VNX-1113 maps to CWE-1113: Inappropriate Comment Style. It reports a /* ... */ comment opened inside another block comment in C, C++, Java, JavaScript/TypeScript, Go, C# or PHP, where block comments do not nest.

Why This Matters

The usual cause is disabling a block of code by wrapping it in /* ... */ when the block already contains a comment. The inner */ closes the outer comment, so the code after it is compiled and run while the author believes it is disabled. A disabled check can then still run, or a check believed active can be left inside the comment. The outer */ is left stray.

What Gets Flagged

/* disabled while the header parser is rewritten
int parse_header(struct buf *b)
{
    /* keep the lock held across the read */      /* FLAGGED */
    lock(b);
    return read_header(b);
}
*/

What Does Not Get Flagged

Block comments that close before the next one opens.
/* in the middle of a line, such as a glob (a/*.c) or a string. The one mid-line opener that is reported is a complete trailing comment after code (int cap = 1 << 20; /* 1 MiB */) inside a commented-out block.
Rust, Swift, Kotlin and Scala, whose block comments nest legally.
Openers more than 50 lines apart.

Remediation

Disable code with the preprocessor (#if 0 ... #endif) or with line comments, or delete it and rely on version control.
Remove the stray */ left after the nested comment.

References

CWE-1113: Inappropriate Comment Style

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1113
// nosec vnx-1113

Or record an ignore rule: vulnetix ignore add --rule vnx-1113 --reason "...". See Suppressing findings.