VNX-621: Variable extraction from request data (PHP extract/parse_str/variable variables)

Reports PHP code that turns request data into local variables: extract() on superglobals or request arrays, single-argument parse_str(), import_request_variables() and $$key assignments over a superglobal.

Field	Value
Rule ID	`VNX-621`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	PHP
CWE	CWE-621
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`variable-extraction` `php` `cwe-621`
Source	`internal/sast/rules/vnx-621.rego`

Overview

VNX-621 maps to CWE-621: Variable Extraction Error. Extracting request data into the local scope lets a client define or overwrite any variable, such as an $is_admin flag, a $price or a file path.

What Gets Flagged

extract($_POST);
extract($request->all());

$input = $_POST;
extract($input);

parse_str($_SERVER['QUERY_STRING']);

foreach ($_GET as $key => $value) {
    $$key = $value;
}

Not flagged: extract(..., EXTR_PREFIX_ALL, ...), extract() on trusted arrays (template data, database rows, constants), parse_str($str, $result), methods named extract (->extract, ::extract), SQL and JSON extract functions, comments and string literals.

Remediation

Read the fields you need explicitly:

$name  = $_POST['name']  ?? '';
$email = $_POST['email'] ?? '';
parse_str($_SERVER['QUERY_STRING'], $params);

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-621
// nosec vnx-621

Or record an ignore rule: vulnetix ignore add --rule vnx-621 --reason "...". See Suppressing findings.