VNX-449: The UI Performs the Wrong Action

Detects a C/C++ confirmation dialog (Win32 MessageBox, Qt QMessageBox, GTK gtk_message_dialog_new) whose answer is compared with a button the dialog does not offer, so the confirmed branch never runs or always runs.

Field	Value
Rule ID	`VNX-449`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-449
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`wrong-function` `dialog` `cwe-449`
Source	`internal/sast/rules/vnx-449.rego`

Overview

VNX-449 maps to CWE-449: The UI Performs the Wrong Action. A dialog that asks “Delete everything? Yes / No” and then tests the answer against IDOK can never see IDOK: the user’s choice is ignored, so a confirmed action never happens, or an != test makes it happen whatever they click.

The rule reads the button set from the dialog call (MB_YESNO, MB_OKCANCEL, … for Win32, or the default lone OK when only icon or modality flags are given; the StandardButtons passed, or question()‘s Yes/No and the others’ Ok default for Qt; GTK_BUTTONS_* for GTK) and reports a comparison or case against a button outside that set, in the call itself, through the variable assigned from it, or in a switch on it within the next lines.

Not reported: comparisons with a button the dialog offers, button sets held in a variable (Win32 flags or a Qt buttons argument), GTK dialogs whose buttons are added later, GTK_RESPONSE_DELETE_EVENT/NONE, comments and strings.

What Gets Flagged

// FLAGGED: a Yes/No dialog never returns IDOK
if (MessageBox(hwnd, TEXT("Wipe the vault?"), TEXT("Confirm"), MB_YESNO) == IDOK)
    WipeVault();

// FLAGGED: question() offers Yes and No by default
if (QMessageBox::question(this, tr("Purge"), tr("Purge all audit logs?")) == QMessageBox::Ok)
    m_audit->purge();

Remediation

Compare the result with the buttons the dialog shows (IDYES for MB_YESNO, QMessageBox::Yes for question()), and prefer testing for the affirmative answer rather than != the negative one.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-449
// nosec vnx-449

Or record an ignore rule: vulnetix ignore add --rule vnx-449 --reason "...". See Suppressing findings.