VNX-589: Call to non-ubiquitous API

Reports calls to C library functions that exist only on some platforms (Annex K *_s functions, Microsoft-only names, BSD and GNU extensions) in files with no platform guard. Guarded files, platform-specific paths and project-provided implementations are not reported.

Field	Value
Rule ID	`VNX-589`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-589
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`non-portable-api` `cwe-589`
Source	`internal/sast/rules/vnx-589.rego`

Overview

VNX-589 maps to CWE-589: Call to Non-ubiquitous API. It reports calls to:

C11 Annex K functions only Microsoft’s runtime ships: strcpy_s, strcat_s, sprintf_s, memcpy_s, fopen_s, gets_s, scanf_s and related names.
Microsoft-only names: _stricmp, _strnicmp, _strdup, _snprintf, _vsnprintf, _itoa, itoa.
BSD extensions: strlcpy, strlcat, arc4random*, strtonum, getprogname.
GNU extensions: memrchr, strchrnul, mempcpy, and qsort_r, whose argument order differs between glibc and BSD.

Why This Matters

Code that calls one of these builds on the author’s platform and fails to compile or link elsewhere. Worse, qsort_r compiles on both glibc and BSD with the comparator and context arguments swapped, so it misbehaves at run time.

What Gets Flagged

errno_t e = fopen_s(&fp, path, "r");
strlcpy(buf, name, n);
qsort_r(buf, n, 1, cmp, NULL);

return _stricmp(a, b) == 0 &&

Not flagged: a file with an #if/#ifdef on a platform or HAVE_* macro, or that defines _GNU_SOURCE or __STDC_WANT_LIB_EXT1__; a file whose path names a platform (impl/apple/, win32_io.c); a function the project defines, declares at file scope or #defines itself (a compat implementation); my_strlcpy(), ops->strlcpy(); comments and strings.

Remediation

Use the portable equivalent (snprintf, memcpy, strcasecmp), or
guard the call with a feature test (HAVE_STRLCPY, _WIN32) and provide a fallback implementation.

References

CWE-589: Call to Non-ubiquitous API

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-589
// nosec vnx-589

Or record an ignore rule: vulnetix ignore add --rule vnx-589 --reason "...". See Suppressing findings.