VNX-563: Assignment to Variable without Use

Field	Value
Rule ID	VNX-563
Severity	Low
SARIF level	note
Kind	sast
Languages	Python
CWE	CWE-563
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	assignment-without-use dead-store cwe-563
Source	internal/sast/rules/vnx-563.rego

Overview

VNX-563 maps to CWE-563: Assignment to Variable without Use. It reports a dead store in a Python function: a variable is assigned a computed value and then assigned again, at the same indentation in the same block, before anything reads the first value.

Why This Matters

A dead store is a computation the code believes it uses. When the overwritten value was a check, the check is gone: a signature computed and then replaced by the value it was meant to be compared with always compares equal.

What Gets Flagged

def verify(token, secret, payload):
    expected = hmac.new(secret, payload, hashlib.sha256).hexdigest()   # FLAGGED
    expected = token
    return hmac.compare_digest(expected, token)

def handle(self, request):
    result = self.validate(request)     # FLAGGED: validation result discarded
    result = self.process(request)
    return result

Not flagged: trivial initialisers (None, 0, "", [], {}), names starting with _, a value read in between (including f-strings, closures and nonlocal/global), self-referencing updates such as x = x + 1, assignments in different branches or try/except arms, loops that continue or break between the two, functions calling locals() or vars(), module and class attributes, keyword arguments in multi-line calls, annotated and tuple assignments, docstrings and comments.

Remediation

1. Decide which value the code needs. If the first was a check, use its result (if not self.validate(request): raise ...).
2. Delete the first assignment if its value is genuinely not needed; keep the call alone if it is called for its side effect.

References

• CWE-563: Assignment to Variable without Use

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-563
// nosec vnx-563

Or record an ignore rule: vulnetix ignore add --rule vnx-563 --reason "...". See Suppressing findings.