VNX-617: Reachable Assertion

Field	Value
Rule ID	VNX-617
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Python
CWE	CWE-617
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	assertion cwe-617
Source	internal/sast/rules/vnx-617.rego

Overview

VNX-617 maps to CWE-617: Reachable Assertion. It reports an assert statement outside tests whose expression reads the request (request.form, .args, .json, .GET, .POST, .headers, .user, .query_params, .session, .method, …), a variable assigned from one in the 10 lines above, or a permission predicate (.is_authenticated, .is_superuser, .is_staff, .has_perm(), .has_permission, check_password(), can_*(), is_authorized(), …). Multi-line assert (...) expressions are read.

Not reported: can_* helpers that are not about a user (can_connect(host)), test files and conftest.py, internal invariants (isinstance(request, ...), x is not None, len(x) > 0), checks that raise an exception, and assert text in comments, strings and docstrings.

Why This Matters

An assertion a caller can reach turns bad input into an unhandled AssertionError (a 500 and a log flood). Worse, python -O and PYTHONOPTIMIZE strip every assert, so an authorisation or validation check written as one silently disappears in an optimised deployment.

What Gets Flagged

assert request.user.is_superuser, "admins only"
assert request.form["amount"].isdigit()

size = int(request.headers.get("content-length", "0"))
assert size < 10_000_000

def reindex(x_admin_token: str = Header(...)):
    assert x_admin_token == settings.ADMIN_TOKEN

Remediation

1. Replace the assert with an explicit check that raises: if not request.user.is_superuser: raise PermissionDenied, abort(403), raise ValueError(...).
2. Keep assert for internal invariants that no caller can influence.
3. For a confirmed false positive, add a # vulnetix-ignore: VNX-617 comment on the line.

References

• CWE-617: Reachable Assertion
• Python reference: the assert statement

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-617
// nosec vnx-617

Or record an ignore rule: vulnetix ignore add --rule vnx-617 --reason "...". See Suppressing findings.