VNX-1288: Improper Validation of Consistency within Input

Field	Value
Rule ID	VNX-1288
Severity	Low
SARIF level	note
Kind	sast
Languages	JavaScript / TypeScript, Python
CWE	CWE-1288
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	input-validation-data cwe-1288
Source	internal/sast/rules/vnx-1288.rego

Overview

VNX-1288 maps to CWE-1288: Improper Validation of Consistency within Input. Some inputs consist of fields that must agree. The commonest one in web applications is a password and its confirmation. A handler that reads the confirmation and never checks it against the password accepts a request whose two fields disagree, so a typo or a forged request sets a password nobody confirmed (OWASP Juice Shop’s “Repetitive Registration”).

Reported: the first line that reads a confirmation field (passwordRepeat, repeatPassword, confirmPassword, password_confirm(ation), confirm_password, password2, retypePassword, passwordAgain and their spellings) from req.body/req.query/ctx.request.body (property, bracket and destructuring reads) or from Flask/Django/DRF request.form/POST/values/args/json/get_json()/data, when nothing in the file compares that field, or the variable assigned from it, with ==, !=, === or !== against something other than undefined, null, None, a number, a boolean or an empty string, passes it to compare_digest/constant_time_compare/timingSafeEqual, or names it in a schema reference (Joi.ref, sameAs, equalTo).

Not reported: client-side code that only sends the field, comments and strings. Other consistency rules (a start before an end, a total that matches its items) are not detected.

What Gets Flagged

router.post('/users', async (req, res) => {
  req.body.passwordRepeat = req.body.passwordRepeat.trim();   // FLAGGED: never compared
  const hash = await bcrypt.hash(req.body.password, 12);
});

def signup(request):
    password1 = request.POST["password1"]
    password2 = request.POST.get("password2", "")   # FLAGGED
    User.objects.create_user(username=username, password=password1)

What Is Not Flagged

p1 = request.POST.get("password1")
p2 = request.POST.get("password2")
if p1 and p1 == p2:
    return create(request)

Remediation

1. Compare the confirmation with the password on the server before saving, and reject a mismatch.
2. Do not rely on client-side validation for consistency checks.

References

• CWE-1288: Improper Validation of Consistency within Input
• OWASP Input Validation Cheat Sheet

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1288
// nosec vnx-1288

Or record an ignore rule: vulnetix ignore add --rule vnx-1288 --reason "...". See Suppressing findings.