VNX-248: Request input parsed without catching the parse exception

Reports Java and Python handlers that parse a request parameter, header or body with a call that throws on malformed text (parseInt, UUID.fromString, int(), json.loads) when no surrounding try catches the error.

Field	Value
Rule ID	`VNX-248`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, Python
CWE	CWE-248
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`error-handling` `denial-of-service` `cwe-248`
Source	`internal/sast/rules/vnx-248.rego`

Overview

A request value converted with a throwing parser lets any client make the handler fail with an uncaught exception: an HTTP 500, often with a stack trace, or an operation aborted half way. This maps to CWE-248: Uncaught Exception.

What Gets Flagged

Java: Integer.parseInt/valueOf, Long.parseLong/valueOf, Short.parseShort, Byte.parseByte, Double.parseDouble, Float.parseFloat, UUID.fromString, new BigDecimal, new BigInteger applied to request.getParameter()/getHeader(), to a variable assigned from one a few lines above, or to a String bound with @RequestParam/@PathVariable/@RequestHeader/@CookieValue.
Python: int(), float(), Decimal(), uuid.UUID(), json.loads(), date/datetime.fromisoformat() applied to request.args/form/values/GET/POST/data/json/headers/cookies directly or through a variable.

int page = Integer.parseInt(request.getParameter("page"));           // flagged
return repo.find(Integer.valueOf(orderId));                          // flagged, orderId is a @RequestParam String

page = int(request.args.get("page"))                                 # flagged
raw = request.GET.get("id")
order = Order.objects.get(pk=int(raw))                               # flagged

Not flagged: a call inside a try whose catch/except covers the parse error (NumberFormatException, IllegalArgumentException, RuntimeException, Exception; ValueError, TypeError, JSONDecodeError, Exception, a bare except), a value validated first (isdigit, fullmatch, matches(), NumberUtils.isDigits), a Java file with a matching @ExceptionHandler or a project whose @ControllerAdvice handles it, Flask’s request.args.get(..., type=int), constants, configuration and system properties, comments, strings and test code.

Remediation

int page;
try {
    page = Integer.parseInt(request.getParameter("page"));
} catch (NumberFormatException e) {
    response.sendError(400);
    return;
}

page = request.args.get("page", 1, type=int)

References

CWE-248

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-248
// nosec vnx-248

Or record an ignore rule: vulnetix ignore add --rule vnx-248 --reason "...". See Suppressing findings.