VNX-1114: Inappropriate Whitespace Style

Python indentation that mixes tabs and spaces where indentation decides the block structure.

Field	Value
Rule ID	`VNX-1114`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-1114
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`inappropriate-whitespace` `indentation` `cwe-1114`
Source	`internal/sast/rules/vnx-1114.rego`

Overview

VNX-1114 maps to CWE-1114: Inappropriate Whitespace Style. In Python, indentation is syntax. The rule reports indentation that mixes tabs and spaces where it decides which block a statement belongs to.

Why This Matters

With mixed indentation, the block a statement belongs to depends on the tab width the reader assumes. A reviewer’s editor can show a statement inside an if that the interpreter runs unconditionally, or the reverse. Python 3 raises TabError only when it can tell the meaning is ambiguous, so not every case fails loudly.

What Gets Flagged

A statement whose own indentation contains both a tab and a space:

def f(x):
    if x:
    →return 1        # FLAGGED: four spaces then a tab

In a file that indents statements with both characters, the first statement of the less-used one:

def f(x):
    if x:
        y = 1
→return y            # FLAGGED: tab in a file indented with spaces

What Does Not Get Flagged

Continuation lines inside brackets or after a backslash, including a closing bracket aligned under its opener and a line after an open bracket with a trailing comment (their alignment does not affect blocks).
Whitespace-only lines, tabs inside string literals, lines inside triple-quoted strings, and comment lines.
Files that consistently use tabs, or consistently use spaces.

Remediation

Re-indent the file with spaces (PEP 8), for example with your formatter (black, ruff format) or expand -t 4.
Configure the editor to insert spaces for Python files.

References

CWE-1114: Inappropriate Whitespace Style

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1114
// nosec vnx-1114

Or record an ignore rule: vulnetix ignore add --rule vnx-1114 --reason "...". See Suppressing findings.