VNX-636: Not Failing Securely ('Failing Open')

Detects access checks that grant access when they fail: an except/catch handler in an auth, permission, verify, token or policy function that returns true, calls next() without the error, or swallows the exception and falls through to return true. Java, JavaScript/TypeScript and Python.

Field	Value
Rule ID	`VNX-636`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java, JavaScript / TypeScript, Python
CWE	CWE-636
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`fail-open` `exception-handling` `authorization` `cwe-636`
Source	`internal/sast/rules/vnx-636.rego`

Overview

VNX-636 maps to CWE-636: Not Failing Securely (‘Failing Open’). When the code that decides access raises (the policy engine times out, the token is malformed, the signature does not verify), the safe answer is “no”. This rule reports handlers that answer “yes”.

Reported, inside a function or method whose name says it decides access (auth, permission, access, allow, privilege, admin, verify, signature, token, csrf, trust, acl, policy, role, guard, canActivate, login, session, credential, entitle, grant, canX/can_x):

a Python except or a Java/JavaScript/TypeScript catch whose body returns True/true (on the same line or within the handler);
a JavaScript middleware catch that calls next() with no error;
a promise rejection handler that resolves to true: .catch(() => true);
an exception swallowed (except ...: pass, an empty catch {}) followed directly by return True/return true.

What Gets Flagged

def has_permission(user, resource):
    try:
        return resource.acl.allows(user)
    except Exception:
        return True          # FLAGGED

function requireAuth(req, res, next) {
  try {
    req.user = jwt.verify(req.headers.authorization, secret);
    next();
  } catch (err) {
    next();                  // FLAGGED: an invalid token is let through
  }
}

} catch (Exception e) { return true; }   // FLAGGED inside isTokenValid()

What Is Not Flagged

Handlers that return False/false, raise or rethrow, respond 401/403, or pass the error on with next(err).
The same shapes in functions whose names are not about access (fileExists, isCached, isNumeric).
Test code and comments.

Remediation

Deny on error and log the failure:

except Exception:
    log.exception("permission check failed")
    return False

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-636
// nosec vnx-636

Or record an ignore rule: vulnetix ignore add --rule vnx-636 --reason "...". See Suppressing findings.