VNX-453: Insecure default: a security parameter defaults to its unsafe value

Detects Python and JavaScript/TypeScript function signatures whose security parameter defaults to the weaker setting (verify/verify_ssl/check_hostname/rejectUnauthorized/strictSSL = false, secure/httponly = false, autoescape or CSRF off, insecure/skip_verify/shell/debug = true), so every caller that omits it gets the insecure behaviour.

Field	Value
Rule ID	`VNX-453`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Python, JavaScript / TypeScript
CWE	CWE-453
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`insecure-default` `configuration` `cwe-453`
Source	`internal/sast/rules/vnx-453.rego`

Overview

VNX-453 maps to CWE-453: Insecure Default Variable Initialization. A helper written as def fetch(url, verify=False) makes the insecure behaviour the one every caller gets unless they remember to opt out. Defaults are where most callers end up, so the default must be the safe value.

The rule reports a function signature (Python def, single or multi-line, with or without type annotations; JS/TS function declarations, arrow functions, methods, constructors and destructured option defaults) where:

a verification or protection parameter defaults to off: verify, verify_ssl, ssl_verify, check_hostname, validate_certs, verify_signature, rejectUnauthorized, strictSSL, secure, httponly/httpOnly, autoescape, csrf*, require_auth, login_required;
an unsafe switch defaults to on: insecure, insecure_skip_verify, skip_verify, no_verify, skip_auth, allow_unsafe*, allow_pickle, shell, debug.

Not reported: a call that passes the weak value explicitly (requests.get(url, verify=False) is a call-site concern for other rules), object literals ({ rejectUnauthorized: false }), ordinary assignments, safe defaults, transport choices such as ssl=False or use_tls=False whose right value depends on the deployment, mutable default arguments (a correctness bug, not an insecure security default), comments, strings, docstrings and test files.

What Gets Flagged

# FLAGGED
def fetch_invoice(url, timeout=10, verify=False):
    return requests.get(url, timeout=timeout, verify=verify)

def set_session_cookie(response, value, secure=False, httponly=False):
    ...

// FLAGGED
function createAgent({ keepAlive = true, rejectUnauthorized = false } = {}) {
  return new https.Agent({ keepAlive, rejectUnauthorized });
}

Remediation

Make the safe value the default (verify=True, rejectUnauthorized = true, secure=True, shell=False) and let the rare caller that needs otherwise opt out explicitly, where reviewers can see it.

References

CWE-453

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-453
// nosec vnx-453

Or record an ignore rule: vulnetix ignore add --rule vnx-453 --reason "...". See Suppressing findings.