VNX-635: Unresolved security TODO/FIXME in production code

Field	Value
Rule ID	VNX-635
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Go, Java, Kotlin, JavaScript / TypeScript, PHP, Python, Ruby
CWE	CWE-635
CAPEC	CAPEC-97
ATT&CK	T1557
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	security-todo comments cwe-635
Source	internal/sast/rules/vnx-635.rego

Overview

CWE-635 is a view (the weaknesses NVD used from 2008 to 2016), not a weakness with a code shape of its own. This rule reports the most concrete code-level signal that maps onto it: a work marker in which the author admits that a security control is missing, disabled or broken. Such a comment is a deferred decision that is easy to ship and easy for anyone reading the source to exploit.

A finding needs a TODO, FIXME, XXX or HACK marker (upper case) inside a comment (//, #, /* or a block-comment line), followed on the same line by an admission:

• the code is called insecure or vulnerable, a security hole/issue/risk/bug/flaw/fix is named, or an injection (SQL, command, template…), XSS, SSRF, open redirect or path traversal risk is named;
• verify the signature, certificate, HMAC or JWT;
• add, implement, missing, need, enable or no followed by authentication, authorization, CSRF/XSRF, access control, permission checks, (input) validation, sanitising, escaping, encryption, rate limiting, or signature/certificate verification;
• input not validated / sanitised / escaped / authenticated / authorised / encrypted / verified (or unvalidated, unsanitized, …);
• validate / sanitise / escape user input, escape output, remove this bypass;
• a hard-coded (API) password, secret, key, credential or token;
• disable, skip or bypass SSL/TLS, certificates, CSRF, auth, signatures or verification, in either order (hostname verification disabled).

What Gets Flagged

// TODO: add authentication before exposing this handler     // FLAGGED
id := r.URL.Query().Get("id") // FIXME: id is not validated  // FLAGGED

# FIXME: path is unsanitized, sanitize before shelling out   # FLAGGED
# TODO disable ssl verification only for staging             # FLAGGED

// HACK: skipping signature verification, vulnerable to token forgery  // FLAGGED
// FIXME: remove this bypass before going to prod                      // FLAGGED

What Is Not Flagged

• Ordinary work markers: TODO: refactor, FIXME: handle overflow, TODO add tests, TODO: validate the config schema.
• Comments that describe a control as present (“authentication is added by the router middleware”).
• The words inside string literals, test code and documentation files.

Remediation

Resolve the gap before release. If it has to wait, track it as a security issue with an owner and a priority, and remove the comment’s claim from the code path that ships.

References

• CWE-635: Weaknesses Originally Used by NVD from 2008 to 2016
• OWASP Code Review Guide

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-635
// nosec vnx-635

Or record an ignore rule: vulnetix ignore add --rule vnx-635 --reason "...". See Suppressing findings.