VNX-647: Authorization decided on a non-canonical request path

Reports an access-control check that compares the raw request path or URL (getRequestURI or Kotlin requestURI, req.path/url/originalUrl, request.path) with a '/...' literal or a regex test anchored on '/' and then denies or allows access, in Java, Kotlin, JavaScript/TypeScript and Python. Normalised paths and route registration are not reported.

Field	Value
Rule ID	`VNX-647`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	Java, Kotlin, JavaScript / TypeScript, Python
CWE	CWE-647
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`authorization` `canonicalization` `path` `cwe-647`
Source	`internal/sast/rules/vnx-647.rego`

Overview

VNX-647 maps to CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions. It reports a startsWith/equals/===/in (...) comparison of the raw request path against a literal such as "/admin", on the value itself or a variable assigned from it, when the same line or the next three take an access decision (401/403, sendError, abort, a login redirect, a role or session check).

Why This Matters

Servers accept many spellings of one path: /ADMIN on a case-insensitive router, //admin, /admin;jsessionid=x in servlet containers, /%61dmin, /public/../admin. A check on the raw string sees a different path from the one the router dispatches, so the protected resource is served without the check.

What Gets Flagged

if (request.getRequestURI().startsWith("/admin") && !isAdmin(request)) {
    response.sendError(HttpServletResponse.SC_FORBIDDEN);

if (req.path.startsWith('/admin') && !req.user?.isAdmin) {
  return res.status(403).send('Forbidden');

if request.path.startswith("/admin") and not session.get("is_admin"):
    abort(403)

Not flagged: URI.create(request.getRequestURI()).normalize().getPath(), request.getServletPath(), router.get('/admin', requireAdmin, ...), and path checks with no access decision nearby (/static caching, /health).

Remediation

Enforce access in the router or the framework’s security layer (Spring Security matchers, route middleware, view decorators) rather than by string tests on the URL.
If a path test is unavoidable, decode and normalise the path first (resolve . and .., collapse slashes, strip path parameters) and compare case-consistently.
Deny by default and allow known paths, not the other way round.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-647
// nosec vnx-647

Or record an ignore rule: vulnetix ignore add --rule vnx-647 --reason "...". See Suppressing findings.