VNX-430: Deployment of Wrong Handler

Reports a static-file handler deployed on the application's own directory (express.static/serve-static/serve-index/koa-static/@fastify/static on __dirname or '.', Flask static_folder, StaticFiles, send_from_directory, add_static or STATICFILES_DIRS on the project root), which makes server source, configuration and secrets downloadable.

Field	Value
Rule ID	`VNX-430`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-430
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`deployment-of-wrong-handler` `static-files` `source-disclosure` `cwe-430`
Source	`internal/sast/rules/vnx-430.rego`

Overview

VNX-430 maps to CWE-430: Deployment of Wrong Handler. The handler meant for public assets is attached to the directory that holds the application itself, so a request for server.js, app.py, settings.py, .env or package.json is answered by the static handler instead of being refused.

What Gets Flagged

JavaScript/TypeScript: express.static, serve-static, serve-index, koa-static and @fastify/static (root:) given __dirname, process.cwd(), '.', './', '..', path.join(__dirname) with nothing below it, or a variable assigned one of those up to fifty lines above.
Python: Flask static_folder, Starlette/FastAPI StaticFiles(directory=...), send_from_directory, aiohttp add_static and Django STATICFILES_DIRS given '.', os.getcwd(), os.path.dirname(__file__), Path(__file__).parent, app.root_path or BASE_DIR.

app.use(express.static(__dirname));                            // FLAGGED
app.use(serveStatic(process.cwd(), { index: false }));         // FLAGGED
app.use(express.static(path.join(__dirname, 'public')));       // not flagged

app = Flask(__name__, static_folder=".", static_url_path="")   # FLAGGED
STATICFILES_DIRS = [BASE_DIR / "static"]                       # not flagged

Not reported: a dedicated subdirectory, directories chosen at run time, test files, comments and strings. A broad exception handler is not a wrong handler and is not reported.

Remediation

Serve a dedicated public/ or static/ directory that contains only files meant to be public.
Keep source, configuration and .env files outside every served directory.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-430
// nosec vnx-430

Or record an ignore rule: vulnetix ignore add --rule vnx-430 --reason "...". See Suppressing findings.