VNX-1127: Compilation with Insufficient Warnings or Errors

Reports C and C++ code and build files that switch off the compiler warnings which catch memory-safety and format-string defects. In C/C++ sources: #define _CRT_SECURE_NO_WARNINGS / _CRT_SECURE_NO_DEPRECATE / _SCL_SECURE_NO_WARNINGS, #pragma warning(disable: ...) naming C4996 (unsafe CRT functions such as strcpy) or the uninitialised-variable and buffer-overrun warnings (C4700, C4701, C4703, C4789), and #pragma GCC/clang diagnostic ignored (or the _Pragma("GCC diagnostic ignored ...") operator in a macro) for -Wall, -Wextra, -Weverything, -Wformat, -Wformat-security, -Wformat-nonliteral, -Wimplicit-function-declaration, -Wint-conversion, -Wincompatible-pointer-types or -Wreturn-type. In CMakeLists.txt, *.cmake, meson.build, Makefiles and MSBuild .vcxproj/.props files: a compiler flag that disables all warnings (-w, /W0, -Wno-everything, meson warning_level=0), -Wno-format / -Wno-format-security, MSVC /wd4996 (and /wd for C4700, C4701, C4703, C4789) and -D_CRT_SECURE_NO_WARNINGS, on a flags line (CFLAGS, CXXFLAGS, CMAKE_*_FLAGS, the COMPILE_FLAGS/COMPILE_OPTIONS properties, add_compile_options, target_compile_options, add_definitions, add_project_arguments, or a cc/gcc/clang/$(CC) command); _CRT_SECURE_NO_WARNINGS / _CRT_SECURE_NO_DEPRECATE / _SCL_SECURE_NO_WARNINGS named as a definition on any line (target_compile_definitions, add_compile_definitions, PreprocessorDefinitions) other than a message/echo; and MSBuild <WarningLevel>TurnOffAllWarnings or <DisableSpecificWarnings> listing 4996, 4700, 4701, 4703 or 4789. Not reported: a pragma or flag scoped to a GCC memory diagnostic such as -Warray-bounds, -Wstringop-overread or -Wuse-after-free (well-maintained projects silence these locally for known compiler false positives), suppression of a specific stylistic warning (fallthrough, unused parameter, constant conditional), strict flags such as -Wall -Werror, -w in a non-compiler command (sysctl -w), comments and strings in C sources.

Field	Value
Rule ID	`VNX-1127`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++, Shell, Any file
CWE	CWE-1127
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`insufficient-warnings` `cwe-1127`
Source	`internal/sast/rules/vnx-1127.rego`

Overview

VNX-1127 maps to CWE-1127: Compilation with Insufficient Warnings or Errors. Reports C and C++ code and build files that switch off the compiler warnings which catch memory-safety and format-string defects. In C/C++ sources: #define _CRT_SECURE_NO_WARNINGS / _CRT_SECURE_NO_DEPRECATE / _SCL_SECURE_NO_WARNINGS, #pragma warning(disable: …) naming C4996 (unsafe CRT functions such as strcpy) or the uninitialised-variable and buffer-overrun warnings (C4700, C4701, C4703, C4789), and #pragma GCC/clang diagnostic ignored (or the Pragma("GCC diagnostic ignored …") operator in a macro) for -Wall, -Wextra, -Weverything, -Wformat, -Wformat-security, -Wformat-nonliteral, -Wimplicit-function-declaration, -Wint-conversion, -Wincompatible-pointer-types or -Wreturn-type. In CMakeLists.txt, *.cmake, meson.build, Makefiles and MSBuild .vcxproj/.props files: a compiler flag that disables all warnings (-w, /W0, -Wno-everything, meson warning_level=0), -Wno-format / -Wno-format-security, MSVC /wd4996 (and /wd for C4700, C4701, C4703, C4789) and -D_CRT_SECURE_NO_WARNINGS, on a flags line (CFLAGS, CXXFLAGS, CMAKE*_FLAGS, the COMPILE_FLAGS/COMPILE_OPTIONS properties, add_compile_options, target_compile_options, add_definitions, add_project_arguments, or a cc/gcc/clang/$(CC) command); _CRT_SECURE_NO_WARNINGS / _CRT_SECURE_NO_DEPRECATE / _SCL_SECURE_NO_WARNINGS named as a definition on any line (target_compile_definitions, add_compile_definitions, PreprocessorDefinitions) other than a message/echo; and MSBuild TurnOffAllWarnings or listing 4996, 4700, 4701, 4703 or 4789. Not reported: a pragma or flag scoped to a GCC memory diagnostic such as -Warray-bounds, -Wstringop-overread or -Wuse-after-free (well-maintained projects silence these locally for known compiler false positives), suppression of a specific stylistic warning (fallthrough, unused parameter, constant conditional), strict flags such as -Wall -Werror, -w in a non-compiler command (sysctl -w), comments and strings in C sources.

Why This Matters

This weakness class (Compilation with Insufficient Warnings or Errors) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1127 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

#define _CRT_SECURE_NO_WARNINGS                    /* FLAGGED */
#pragma warning(disable: 4996)                    /* FLAGGED */
#pragma GCC diagnostic ignored "-Wformat-security" /* FLAGGED */

# CMakeLists.txt / Makefile
add_compile_options(-w)                           # FLAGGED
CFLAGS += -O2 -w                                  # FLAGGED
CFLAGS += -Wall -Werror -Wno-unused-parameter     # not flagged

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-1127 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-1127 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1127
// nosec vnx-1127

Or record an ignore rule: vulnetix ignore add --rule vnx-1127 --reason "...". See Suppressing findings.