VNX-546: Suspicious Comment
Detects TODO, FIXME, HACK, XXX and BUG comments that admit a security gap (missing authorization, unsanitised input, disabled TLS verification, plain-text passwords...) in Python, JavaScript/TypeScript, Java, Go, C and C++.
| Field | Value |
|---|---|
| Rule ID | VNX-546 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | C, C++, Go, Java, JavaScript / TypeScript, Python |
| CWE | CWE-546 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | comments todo-comment cwe-546 |
| Source | internal/sast/rules/vnx-546.rego |
Overview
VNX-546 maps to CWE-546: Suspicious Comment. A marker comment that says the code beside it is insecure is a record of a known, unfixed weakness. The rule reports a comment that starts with TODO, FIXME, HACK, XXX or BUG (also TODO(name): and @todo) and whose text names a security concern: authentication, authorization, permissions, privileges, passwords, credentials, secrets, CSRF, XSS, injection, sanitising, escaping, validation, encryption, plain text, SSL/TLS, certificates, overflow, unsafe, insecure, vulnerable, hard-coded values, rate limiting, access control or traversal. Whole-line, block-comment continuation and trailing comments are read.
What Gets Flagged
// FIXME: escape the name before it goes into the HTML
return fmt.Sprintf("<h1>%s</h1>", name)strcpy(dst, src); // FIXME: possible buffer overflow, src is uncheckedWhat Is Not Flagged
- Ordinary TODOs (refactoring, performance, naming) and security prose without a marker.
- Markers inside string literals and URLs, identifiers containing the word (
TODO_AUTH,todoSecurity) andXXXXXXplaceholders. - Test files.
- In Go, Java, JavaScript/TypeScript and Python, a marker that admits a missing, disabled or broken control (
// FIXME: no authorization check here,// HACK: skip TLS verification,// TODO: verify the webhook signature,// XXX insecure) is reported by VNX-635, so the same comment is not reported twice.
Remediation
Fix the weakness the comment describes. If it cannot be fixed now, track it in the issue tracker with an owner and a date rather than leaving the admission in the source.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-546
// nosec vnx-546Or record an ignore rule: vulnetix ignore add --rule vnx-546 --reason "...". See Suppressing findings.