VNX-1116: Inaccurate Source Code Comments

Field	Value
Rule ID	VNX-1116
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-1116
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	comments inaccurate-comments docstring cwe-1116
Source	internal/sast/rules/vnx-1116.rego

Overview

VNX-1116 maps to CWE-1116: Inaccurate Source Code Comments. It reports a Python docstring entry (Google-style Args:/Parameters: or Sphinx :param name:) naming a parameter that is not in the function’s signature.

Why This Matters

A docstring that describes a parameter the function no longer takes is evidence that the comment and the code have drifted apart. Readers trust the comment, so they pass an argument that is ignored or misread what the function checks. The same drift often hides changed behaviour around validation or access control.

What Gets Flagged

Reported at the docstring line that names the stale parameter:

def load_user(db, user_id):
    """Load a user.

    Args:
        db: Database handle.
        userid: The user's primary key.      # FLAGGED: no parameter 'userid'
    """

def write_blob(path, data):
    """Write bytes to disk.

    :param path: destination file
    :param verbose: print progress            # FLAGGED: no parameter 'verbose'
    """

What Does Not Get Flagged

• Functions that take **kwargs, whose keyword arguments are legitimately documented by name.
• *args/**kwargs entries, description continuation lines, and Returns/Raises/Yields sections.
• NumPy-style dashed sections (not parsed).
• Test files.

Remediation

1. Rename the docstring entry to match the parameter, or remove it if the parameter is gone.
2. Re-read the rest of the docstring: a stale parameter is often a sign the described behaviour changed too.

References

• CWE-1116: Inaccurate Source Code Comments

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1116
// nosec vnx-1116

Or record an ignore rule: vulnetix ignore add --rule vnx-1116 --reason "...". See Suppressing findings.