VNX-1126: Declaration of Variable with Unnecessarily Wide Scope

Reports a Python global statement inside a function or method body (global counter, global a, b), which makes the function rebind a module-level variable: every caller, thread and request then shares and mutates that one binding, so state set for one caller leaks into the next. The finding is the global line itself. Not reported: a global statement at module level (it has no effect), nonlocal (closure scope), globals that are only module dunders such as __doc__ or __all__, the word 'global' in a comment, a string or prose, and test files (including conftest.py). A global line inside a triple-quoted string is not a statement and is not reported. Whether a particular module-level variable should be wider than its function is a design judgement; the rule reports the statement that widens it.

Field	Value
Rule ID	`VNX-1126`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-1126
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`wide-variable-scope` `cwe-1126`
Source	`internal/sast/rules/vnx-1126.rego`

Overview

VNX-1126 maps to CWE-1126: Declaration of Variable with Unnecessarily Wide Scope. Reports a Python global statement inside a function or method body (global counter, global a, b), which makes the function rebind a module-level variable: every caller, thread and request then shares and mutates that one binding, so state set for one caller leaks into the next. The finding is the global line itself. Not reported: a global statement at module level (it has no effect), nonlocal (closure scope), globals that are only module dunders such as doc or all, the word ‘global’ in a comment, a string or prose, and test files (including conftest.py). A global line inside a triple-quoted string is not a statement and is not reported. Whether a particular module-level variable should be wider than its function is a design judgement; the rule reports the statement that widens it.

Why This Matters

This weakness class (Declaration of Variable with Unnecessarily Wide Scope) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1126 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

counter = 0

def record(user):
    global counter          # FLAGGED: function rebinds module state
    counter += 1

global settings             # not flagged: module level, no effect

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-1126 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-1126 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1126
// nosec vnx-1126

Or record an ignore rule: vulnetix ignore add --rule vnx-1126 --reason "...". See Suppressing findings.