VNX-1122: Excessive Halstead Complexity

Reports a single Python statement line whose expression packs 16 or more arithmetic, bitwise, comparison and boolean operators, a line-level proxy for Halstead difficulty. Type unions and flag sets built only from |, negative literals in tables, docstring rule lines, string literals, comments, signatures, decorators and test files are not counted or reported.

Field	Value
Rule ID	`VNX-1122`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-1122
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`excessive-halstead` `cwe-1122` `maintainability`
Source	`internal/sast/rules/vnx-1122.rego`

Overview

VNX-1122 maps to CWE-1122: Excessive Halstead Complexity. Halstead’s measures grow with the number of operators and operands a reader has to hold at once. This rule measures the most concentrated form of that: a single physical Python line whose expression contains 16 or more operators:

arithmetic + - * / // % ** @;
bitwise & | ^ ~ << >>;
comparison == != < > <= >=;
boolean and, or, not.

String literals and trailing comments are removed before counting. Not reported: def signatures and decorators (*args, **kwargs, ->), whole-line comments, test files, and expressions already broken over several lines (each physical line is measured on its own). It is a line-level proxy, not a full per-function Halstead volume.

Why This Matters

A dense expression is where operator-precedence mistakes, off-by-one bounds and wrong bit masks hide, and when the expression is a permission or validation check, the mistake is a security bug that reviewers read past.

What Gets Flagged

# FLAGGED: 19 operators in one permission check
return (mode & 0o400 and uid == owner) or (mode & 0o040 and gid == group and not uid == 0) or (mode & 0o004 and ~mode & 0o002 == 0 and mode >> 9 | 1 != 0)

# NOT FLAGGED: the same computation through named intermediate values
subtotal = base * qty
taxes = subtotal * tax / 100
total = subtotal + taxes - discount + fee

Remediation

Split the expression into named intermediate values that each say what they compute.
Move compound permission or validation conditions into small predicate functions with descriptive names.
Add parentheses wherever precedence between and/or or between bitwise and comparison operators matters.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1122
// nosec vnx-1122

Or record an ignore rule: vulnetix ignore add --rule vnx-1122 --reason "...". See Suppressing findings.