VNX-440: Expected Behavior Violation

Reports Python assert statements in production code that the code relies on: an assert whose condition is an authentication, authorisation or integrity check, and assert False/0/None used to stop a branch. python -O strips them, so the check silently stops running.

Field	Value
Rule ID	`VNX-440`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-440
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`unexpected-behavior` `assert` `python-optimize` `cwe-440`
Source	`internal/sast/rules/vnx-440.rego`

Overview

VNX-440 maps to CWE-440: Expected Behavior Violation. assert does not behave the way a guard is expected to: python -O and PYTHONOPTIMIZE remove every assert statement, so a permission check written as an assert vanishes in an optimised deployment, and an assert False meant to stop an impossible branch lets execution carry on.

What Gets Flagged

Outside test files:

an assert whose condition (not its message) mentions an authentication, authorisation or integrity decision: is_authenticated, is_admin, is_superuser, is_staff, is_active, has_perm, has_permission, has_role, is_owner, can_*, check_password, verify*, is_valid*, compare_digest, or a name containing authorized, allowed, permission, csrf, signature or password, or a qualified token name (api_token, auth_token, session_token…). A parenthesised condition on the following lines (assert ( … )) is read up to its closing parenthesis;
assert False, assert 0 or assert None.

assert request.user.is_staff or request.user.has_perm("billing.delete_invoice")   # FLAGGED
assert hmac.compare_digest(sent, expected), "bad signature"                         # FLAGGED
else:
    assert False, "unknown status"                                                 # FLAGGED

if not request.user.is_staff:
    raise PermissionDenied                                                          # not flagged

Not reported: asserts in tests (tests/, test_*.py, *_test.py, conftest.py), assert isinstance(...) on its own, inspect.signature() checks, parser asserts on a bare token, other invariants, the words appearing only in the message or a comment, raise AssertionError(...). An assert on request data is VNX-617.

Remediation

Replace security asserts with an explicit if and an exception (PermissionDenied, abort(403)).
Replace assert False with raise RuntimeError(...) or raise AssertionError(...).

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-440
// nosec vnx-440

Or record an ignore rule: vulnetix ignore add --rule vnx-440 --reason "...". See Suppressing findings.