VNX-462: Duplicate Key in Associative List (Alist)

Reports a Python dict literal that names the same string or integer key twice at the same level, where the later entry silently replaces the earlier one.

Field	Value
Rule ID	`VNX-462`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-462
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`duplicate-key` `cwe-462`
Source	`internal/sast/rules/vnx-462.rego`

Overview

VNX-462 maps to CWE-462: Duplicate Key in Associative List (Alist). It reports, in a multi-line dict literal, an entry whose key (a string in either quote style, or an integer) an earlier entry at the same indentation of the same literal already used, and a single-line {...} literal without nested braces that repeats a key. The same key in sibling nested dicts or in different dicts of a list, keys that differ only in case, set literals, dict()/update() calls and computed keys are not reported.

Why This Matters

Python keeps only the last value for a repeated key and raises no error. A security setting written correctly at the top of a configuration dict and contradicted further down is silently disabled.

What Gets Flagged

SECURITY = {
    "session_cookie_secure": True,
    "hsts_seconds": 31536000,
    "session_cookie_secure": False,   # FLAGGED: replaces the True above
}

# NOT FLAGGED: same key in different nested dicts
SCHEMA = {"user": {"type": "object"}, "group": {"type": "object"}}

Remediation

Remove the duplicate entry and keep the value that was intended.
Enable a linter check for duplicate keys (for example pyflakes F601) in CI.
For confirmed false positives, add a # vulnetix-ignore: VNX-462 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-462
// nosec vnx-462

Or record an ignore rule: vulnetix ignore add --rule vnx-462 --reason "...". See Suppressing findings.