VNX-561: Dead Code

Code that can never run: a statement after an unconditional return, throw, break or continue in the same block (JavaScript/TypeScript, Python), or a block guarded by a literal false condition (Java, JavaScript/TypeScript, Python).

Field	Value
Rule ID	`VNX-561`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, JavaScript / TypeScript, Python
CWE	CWE-561
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`dead-code` `unreachable-code` `cwe-561`
Source	`internal/sast/rules/vnx-561.rego`

Overview

VNX-561 maps to CWE-561: Dead Code. It reports statements that can never execute.

Why This Matters

Dead code is usually a mistake about order: the audit call, the cleanup or the log line was written after the return, so it never happens and nothing says so. A block behind if (false) is code that is still read, reviewed and maintained but never tested, and is one edit away from being switched back on.

What Gets Flagged

if (!user) {
  throw new Error('not signed in');
  audit('anonymous access');        // FLAGGED: never runs
}

if user.is_admin:
    return True
    audit(user)                     # FLAGGED: never runs

if (false) {                        // FLAGGED
    refundAll();
}

Not flagged: a closing brace, else/elif/except/catch/finally, a case/default label or a dedent after the exit; hoisted JavaScript function declarations after a return; multi-line return expressions; braceless if bodies; the generator idioms return then yield and if False: yield; if False: guarding type-only imports; named flags such as if (DEBUG) and TYPE_CHECKING; Java statements after an exit (javac rejects them); test files; comments, block comments, docstrings and string literals. Comparisons that are always false are reported by VNX-570.

Remediation

Move the statement before the exit if it was meant to run, or delete it.
Delete if (false) blocks, or put the code behind a named configuration flag that is tested.

References

CWE-561: Dead Code

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-561
// nosec vnx-561

Or record an ignore rule: vulnetix ignore add --rule vnx-561 --reason "...". See Suppressing findings.