VNX-241: Improper Handling of Unexpected Data Type

A Python JSON request body value (Flask request.json, DRF request.data, json.loads(request.body)), whose type the client controls, is used with a str method and no type check. The JavaScript form is reported by VNX-1287.

Field	Value
Rule ID	`VNX-241`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-241
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`unexpected-data-type` `cwe-241` `type-confusion` `input-validation`
Source	`internal/sast/rules/vnx-241.rego`

Overview

VNX-241 maps to CWE-241: Improper Handling of Unexpected Data Type. It reports a Python JSON request body value used as a str when the client decides its type: a str method (lower, upper, strip, split, replace, startswith, endswith, encode, casefold and similar) on a field of request.json or request.get_json() (Flask), DRF request.data or json.loads(request.body) (Django), inline, through the dict assigned from the body, or through a variable assigned from one of its fields.

The same weakness in Node.js/TypeScript, a string method or .length on a value of req.query or req.body, is reported by VNX-1287, and this rule does not report it a second time.

Why This Matters

A JSON body can hold any type. A JSON number, list, object or null where a string was expected makes Python’s .lower() or .strip() raise AttributeError, which turns a malformed request into a crash or a 500 rather than a 400.

Not reported: a value checked with isinstance(..., str) or type() in the ten lines above, a value coerced with str(), Flask request.args/request.form/request.headers (always strings), comments and string literals.

What Gets Flagged

email = request.json["email"].lower()

data = json.loads(request.body)
new_name = data["name"].strip()   # {"name": 5} raises AttributeError

Remediation

email = request.json.get("email")
if not isinstance(email, str):
    abort(400)

Validating the whole request with a schema (pydantic, marshmallow, DRF serializers) fixes every field at once.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-241
// nosec vnx-241

Or record an ignore rule: vulnetix ignore add --rule vnx-241 --reason "...". See Suppressing findings.