VNX-369: Divide By Zero

A division or modulo whose divisor is a variable assigned from outside the program (a parsed number, a request value, a command-line argument) with no zero check above it, in C, C++, Go and Java.

Field	Value
Rule ID	`VNX-369`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++, Go, Java
CWE	CWE-369
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`divide-by-zero` `cwe-369`
Source	`internal/sast/rules/vnx-369.rego`

Overview

VNX-369 maps to CWE-369: Divide By Zero. Integer division by zero panics in Go, throws in Java and is undefined behaviour in C, so a divisor an attacker controls is a denial-of-service primitive.

The rule finds the division operator in code only. A URL, a path, a purl, a string literal or a comment that contains a slash is not a division, and a divisor that is a constant or that the program computed itself is not reported.

What Gets Flagged

// FLAGGED: n comes from the request and is divided by with no zero check
n, _ := strconv.Atoi(r.FormValue("n"))
return total / n

// FLAGGED: d comes from argv
int d = atoi(argv[1]);
return 100 / d;

// FLAGGED: compound division
count, _ := strconv.Atoi(r.URL.Query().Get("count"))
sum /= count

What Is Not Flagged

// guarded: a comparison with zero in the lines above
if n == 0 {
    return 0
}
return total / n

// not a division: the slash is inside a string or a comment
u := "https://example.com/api/request"

// bounded below by one, or clamped on assignment
if (size < 1) throw new IllegalArgumentException("size");
int secs = Math.max(1, Integer.parseInt(req.getParameter("secs")));

Test files are skipped.

Remediation

Reject or default a zero divisor before dividing, and return an error to the caller.
Bound the value at the point you parse it (n < 1 is an error).

References

CWE-369: Divide By Zero

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-369
// nosec vnx-369

Or record an ignore rule: vulnetix ignore add --rule vnx-369 --reason "...". See Suppressing findings.