VNX-233: Improper Handling of Parameters

Python request parameters (request.GET/POST/args/form/json/get_json()/data/query_params) are unpacked with ** into a call or dict, inline or through a variable, so every extra parameter a client sends is accepted.

Field	Value
Rule ID	`VNX-233`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-233
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`improper-handling-of-parameters` `cwe-233` `mass-assignment`
Source	`internal/sast/rules/vnx-233.rego`

Overview

VNX-233 maps to CWE-233: Improper Handling of Parameters. It reports Python ** unpacking of a Flask, Django or DRF request mapping (request.GET, POST, args, form, values, json, get_json(), data, query_params, params, with or without .dict(), .to_dict() or .copy()) into a call or dict literal, inline or through a variable assigned from one in the ten lines above.

Why This Matters

The code never decides which parameters it accepts, so it handles extra and undefined ones by passing them on. Into an ORM filter() a client can add lookups such as password__startswith=a and read a field one character at a time; into a constructor, create() or update() it can set fields the form never offered (is_admin, owner_id).

Not reported: explicit keyword arguments, a dict built by a comprehension that filters keys, serializer.validated_data and form.cleaned_data, **kwargs in a def, exponentiation, the text in comments and string literals, and test code.

What Gets Flagged

users = User.objects.filter(**request.GET.dict())
user = User(**request.json)

data = request.get_json()
account.update(**data)

Remediation

Name the parameters you accept, or unpack validated data:

ALLOWED = {"name", "email"}
fields = {k: v for k, v in request.json.items() if k in ALLOWED}
User(**fields)

serializer.is_valid(raise_exception=True)
Invoice.objects.create(**serializer.validated_data)

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-233
// nosec vnx-233

Or record an ignore rule: vulnetix ignore add --rule vnx-233 --reason "...". See Suppressing findings.