VNX-168: Improper Handling of Inconsistent Special Elements

Reports CSV parsed by splitting each line on every comma, which ignores CSV quoting so a quoted comma shifts every later column, in files that use no CSV parser.

Field	Value
Rule ID	`VNX-168`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python, JavaScript / TypeScript, Java, Go, PHP
CWE	CWE-168
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`inconsistent-special-element` `csv` `parsing` `cwe-168`
Source	`internal/sast/rules/vnx-168.rego`

Overview

VNX-168 maps to CWE-168: Improper Handling of Inconsistent Special Elements. In CSV a comma is a separator outside quotes and data inside them. Splitting on every comma treats both the same. The rule reports:

Python, JavaScript/TypeScript and Java .split(","), including the regex spellings /,/ and "\\s*,\\s*", re.split and a chained .split(",") on a continuation line
Go strings.Split(x, ",") and strings.SplitN(x, ",", n)
PHP explode(",", ...) and preg_split('/,/', ...)

within 25 code lines of a CSV reference (a .csv name, text/csv, a csv file/row/line/upload name, a 'csv' upload field or a name ending in _csv), in a file that uses no CSV parser (Python csv/pandas, papaparse, csv-parse, csv-parser, fast-csv, d3-dsv, OpenCSV, Commons CSV, Jackson CSV, univocity, Go encoding/csv, PHP fgetcsv/str_getcsv/League\Csv).

Not reported: comma-separated values that are not CSV documents (headers, environment variables, query parameters, tag lists), a comma list read from configuration (process.env, os.environ/getenv, System.getenv, a config./settings. object) or from a request parameter (req.query, request.args, $_GET, FormValue, getParameter) even beside CSV code, a split of a string literal, files that parse CSV with a library, comments, string literals and test files.

Why This Matters

An uploaded or exported CSV with a field like "Smith, John" splits into one column too many. Every later column moves: an email lands in the role column, an amount in the account column. Someone who controls one field can choose which column their next value lands in.

What Gets Flagged

# FLAGGED
with open("uploads/users.csv") as f:
    for line in f:
        name, email, role = line.strip().split(",")

// FLAGGED
f, _ := os.Open("data/records.csv")
...
out = append(out, strings.Split(sc.Text(), ","))

// FLAGGED
String[] cols = line.split("\\s*,\\s*");   // reading invoices.csv

# NOT FLAGGED: a CSV parser
for name, email, role in csv.reader(f):
    ...

Remediation

Parse CSV with a CSV parser: Python csv.reader, Go encoding/csv, PHP fgetcsv/str_getcsv, Java Commons CSV or OpenCSV, JavaScript papaparse or csv-parse.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-168
// nosec vnx-168

Or record an ignore rule: vulnetix ignore add --rule vnx-168 --reason "...". See Suppressing findings.