VNX-1287: Improper Validation of Specified Type of Input

Field	Value
Rule ID	VNX-1287
Severity	Low
SARIF level	note
Kind	sast
Languages	JavaScript / TypeScript
CWE	CWE-1287
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	input-validation-type cwe-1287
Source	internal/sast/rules/vnx-1287.rego

Overview

VNX-1287 maps to CWE-1287: Improper Validation of Specified Type of Input. Express’s query parser turns ?q[]=a into an array and ?q[x]=1 into an object, and a JSON body field can be any JSON type. Code that treats such a value as a string either throws (a crash or a 500) or, for length, includes, indexOf and startsWith checks, gets an answer for an array and lets the request past the check.

Reported:

• JavaScript/TypeScript: a string method (toLowerCase, trim, split, startsWith, endsWith, includes, indexOf, replace, match, search, slice, substring, concat, repeat and others) or .length on a field of req.query, req.body, request.body, ctx.query or ctx.request.body, directly or through a variable or destructured name assigned from it in the 10 lines above. The same weakness in Python, a str method on a field of a JSON body (request.json, request.get_json(), DRF request.data, json.loads(request.body)), is reported by VNX-241, and this rule does not report it a second time.

Not reported: route params (always strings); values checked with typeof or Array.isArray, or coerced with String(); files that use express-validator, Joi, zod, yup, celebrate, ajv, class-validator or superstruct; comments and strings.

What Gets Flagged

if (req.body.email.length !== 0 && req.body.password.length !== 0) {   // FLAGGED
  req.body.email = req.body.email.trim();                               // FLAGGED
}

const { tags } = req.query;
const list = tags.split(',');                                           // FLAGGED: ?tags[]=a is an array

What Is Not Flagged

const q = req.query.q;
if (typeof q !== 'string') return res.status(400).end();
const term = q.toLowerCase();

Remediation

1. Check the type (typeof value === 'string') before using a request value as a string.
2. Validate request bodies and query strings against a schema.
3. In Express, consider app.set('query parser', 'simple') so query values are never arrays or objects.

References

• CWE-1287: Improper Validation of Specified Type of Input
• OWASP Input Validation Cheat Sheet

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1287
// nosec vnx-1287

Or record an ignore rule: vulnetix ignore add --rule vnx-1287 --reason "...". See Suppressing findings.