VNX-1115: Source Code Element without Standard Prologue

Field	Value
Rule ID	VNX-1115
Severity	Low
SARIF level	note
Kind	sast
Languages	C, C++, Go, Java, JavaScript / TypeScript, Python, Rust
CWE	CWE-1115
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	missing-prologue license-header cwe-1115
Source	internal/sast/rules/vnx-1115.rego

Overview

VNX-1115 maps to CWE-1115: Source Code Element without Standard Prologue. It works out the project’s standard prologue from the scanned files and reports each file that lacks it.

Why This Matters

A project that puts a licence or copyright header on its files does it so provenance and licensing can be read from each file. A file without the header is often code copied in from elsewhere, under terms nobody reviewed, or a file that skipped the review the others went through.

What Gets Flagged

A language has a project standard when at least four of its files carry a prologue and at least 80% of them do. A prologue is an SPDX-License-Identifier, Copyright, (c) followed by a year, ©, Licensed under or License: in the first 3000 characters. Each file without one is reported once, at its first line of code:

// src/extra.c, where the other five C files start with
// /* SPDX-License-Identifier: BSD-3-Clause */
#include "util.h"            /* FLAGGED */
int g(void) { return 1; }

What Does Not Get Flagged

• Projects where no prologue prevails (fewer than four files, or under 80%).
• Files whose header is a prologue in another wording: the ASF header (“Licensed to the Apache Software Foundation”), “under the Apache License”, or “All rights reserved”.
• Test files, empty files and minified files.
• Generated files (Code generated, @generated, DO NOT EDIT, autogenerated, automatically generated, generated by near the top).
• Vendored and third-party trees (vendor, third_party, node_modules, Pods, Carthage, .venv, site-packages, deps) and fixtures under testdata/fixtures.
• Files of another language: each language is judged against its own files.

Remediation

1. Add the project’s standard header to the file.
2. If the file is third-party code, move it under a vendored directory and record its licence.

References

• CWE-1115: Source Code Element without Standard Prologue

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1115
// nosec vnx-1115

Or record an ignore rule: vulnetix ignore add --rule vnx-1115 --reason "...". See Suppressing findings.