VNX-166: Improper Handling of Missing Special Element

Reports Python and JavaScript/TypeScript code that splits request data on a delimiter and indexes or unpacks the result as if the delimiter were always present, such as req.headers.authorization.split(' ')[1].

Field	Value
Rule ID	`VNX-166`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-166
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`special-element` `parsing` `delimiter` `cwe-166`
Source	`internal/sast/rules/vnx-166.rego`

Overview

VNX-166 maps to CWE-166: Improper Handling of Missing Special Element. It reports request data split on a delimiter whose result is used as if the delimiter were present:

an index of 1 or more into the result of .split();
Python tuple unpacking of a split (user, pw = decoded.split(":", 1)), which raises ValueError when the : is missing;
parts = value.split(...) followed by parts[1] with no length check.

The split value must be read from the request on the same line (Flask/Django/DRF request.headers/args/form/cookies/COOKIES/GET/POST/META, Express/Koa req/ctx headers/query/body/params/cookies, Lambda event headers/query/body) or assigned from it, directly or through one intermediate assignment, in the 8 lines above. A request without the delimiter then crashes the handler with a 500, or carries undefined forward as a token or value.

What Gets Flagged

token = request.headers.get("Authorization", "").split(" ")[1]   # FLAGGED
username, password = decoded.split(":", 1)                        # FLAGGED (decoded from the header)

const token = req.headers.authorization.split(' ')[1]   // FLAGGED
const parts = raw.split('|')
const expires = new Date(parts[1])                      // FLAGGED

What Is Not Flagged

A membership or format check of the value in the 4 lines above (" " in h, h.includes(" "), h.startswith("Bearer "), re.match).
A len(parts) or parts.length check, or code inside a try block.
Index [0], .pop(), str.partition(), constants and non-request data.

Remediation

Check that the delimiter is present, or that the split produced the expected number of parts, before indexing. In Python, str.partition() never raises.

References

CWE-166: Improper Handling of Missing Special Element

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-166
// nosec vnx-166

Or record an ignore rule: vulnetix ignore add --rule vnx-166 --reason "...". See Suppressing findings.