VNX-349: Acceptance of Extraneous Untrusted Data With Trusted Data

Verified JWT claims, the session or the authenticated principal merged wholesale with the request body or query, and the request spread into Express render options, in JavaScript/TypeScript, Python and Java.

Field	Value
Rule ID	`VNX-349`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java, JavaScript / TypeScript, Python
CWE	CWE-349
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`extraneous-data` `cwe-349`
Source	`internal/sast/rules/vnx-349.rego`

Overview

VNX-349 maps to CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data. It reports a trusted object merged wholesale with request data, so every extra field the client sends is accepted alongside the data the server vouched for:

JavaScript/TypeScript: Object.assign(), lodash _.merge/extend/assign/defaults (also merge imported by name from lodash) and {...a, ...b} combining such an object with req.body/query/params/cookies; and ...req.body spread into the options of res.render();
Python: .update(), {**a, **b} and dict(a, **b) with request.json/get_json()/form/args/values/data/POST/GET;
Java: putAll(request.getParameterMap()) and Jackson readerForUpdating(x).readValue(request.getInputStream()).

The trusted side is recognised by name: session, claims/*Claims, decoded*, verified*, principal, current_user, auth_user/auth_context, req.user/request.user. The request side may be inline or a variable assigned from the request in the 15 lines above.

Why This Matters

Code downstream reads the merged object as if all of it were verified. A client that adds "role": "admin" or "sub": "victim" to its body overwrites, or adds to, the claims the token proved. Spread into render options, the body can set the view engine’s own layout or settings, which in Express/hbs is a known local-file read.

Not reported: individually picked fields ({ theme: req.body.theme }), merges into a fresh object or into an object not named as trusted (mass assignment onto a model is VNX-915’s concern), merges of server-side data, comments and string literals. Python session.update(request.form) is also reported by VNX-501.

What Gets Flagged

const claims: any = jwt.verify(token, key);
const ctx = { ...claims, ...req.body };

claims = jwt.decode(token, key, algorithms=["HS256"])
claims.update(request.get_json())

claims.putAll(request.getParameterMap());

Remediation

Copy only the fields you expect from the request, validated, into a separate object.
Keep verified claims and the session read-only to request handlers; never let the request write into them wholesale.
Pass template engines an explicit view model, never the request body.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-349
// nosec vnx-349

Or record an ignore rule: vulnetix ignore add --rule vnx-349 --reason "...". See Suppressing findings.