VNX-1124: Excessively Deep Nesting

Field	Value
Rule ID	VNX-1124
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-1124
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	deep-nesting cwe-1124 maintainability
Source	internal/sast/rules/vnx-1124.rego

Overview

VNX-1124 maps to CWE-1124: Excessively Deep Nesting. It reports a Python control-flow statement (if, elif, else, for, while, try, except, finally, with, match, case) nested inside five or more enclosing control blocks of the same function.

Depth is measured by indentation from the enclosing def, using that function’s own indent step (4 spaces, 2 spaces or a tab), so it is the same whether the function is top level or a method. Each function is reported once, on the first statement that reaches the depth.

Not reported: nesting of four blocks or fewer; depth that comes from a nested def (the inner function is measured from its own def); continuation lines inside brackets (comprehension if clauses, wrapped arguments); comments, docstrings and test files.

Why This Matters

At six levels a reader can no longer see which conditions guard a statement. An authorisation check, an error branch or an else placed one level off is easy to misread, and the mistake survives review because nobody can hold the whole condition stack in mind.

What Gets Flagged

def sync(accounts, ledger):
    for acct in accounts:
        if acct.active:
            for entry in ledger.entries(acct):
                if entry.pending:
                    with ledger.lock(entry):
                        if entry.amount > acct.limit:   # FLAGGED: inside 5 blocks
                            entry.reject()

Remediation

1. Return or continue early on guard conditions (if not acct.active: continue) instead of nesting the rest of the body.
2. Extract the inner loop body into a named function.
3. Replace nested lookups with a precomputed index or a generator that yields the filtered items.

References

• CWE-1124: Excessively Deep Nesting
• The Zen of Python: Flat is better than nested

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1124
// nosec vnx-1124

Or record an ignore rule: vulnetix ignore add --rule vnx-1124 --reason "...". See Suppressing findings.