VNX-657: Violation of Secure Design Principles

Field	Value
Rule ID	VNX-657
Severity	Low
SARIF level	note
Kind	sast
Languages	JavaScript / TypeScript, Python
CWE	CWE-657
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	comments violation-of-secure-design security-debt cwe-657
Source	internal/sast/rules/vnx-657.rego

Overview

VNX-657 maps to CWE-657: Violation of Secure Design Principles. The CWE is a design-level class with no single code shape, so the rule reports its most concrete static signal: the author writing down that a control is not there. A TODO, FIXME, XXX or HACK comment (whole-line, trailing or inside a block comment) is reported when it is followed by:

• security, insecure, vulnerable or exploitable as a word (not part of a file or package name such as express-security.txt), or
• a verb of absence (add, implement, missing, no, not, enable, disable, bypass, skip, remove, without, lacks, turn off) within forty characters of a control: authentication, authorization, access control, permission check, CSRF, sanitizing, escaping, validation, encryption, TLS/SSL, certificate verification, rate limiting, a hard-coded secret, password, key or token; or
• the control named first and then its absence within thirty characters (SSL verification disabled, certificate verification is turned off); or
• an order to add the control right after the marker (TODO(bob): escape user input, sanitize filename, validate the token).

Not reported: ordinary TODOs (performance, refactoring, layout), notes about adding tests or documentation, statements that a control exists, the same words in a string literal, and test files.

Why This Matters

A comment like this is a known, unfixed gap that ships. It is often the only record that an endpoint has no authentication or that TLS verification was turned off “temporarily”.

What Gets Flagged

# TODO: add authentication before release                     # FLAGGED
@csrf_exempt  # HACK: disable CSRF until the mobile client sends the token   # FLAGGED

// FIXME: security - file name is not sanitized                # FLAGGED
const secret = 'dev-secret' // TODO: remove hardcoded secret   // FLAGGED

# NOT FLAGGED
# TODO: paginate this query
# TODO: add more security tests

Remediation

1. Implement the control the comment describes, or track it as a security defect with an owner and a date.
2. Remove the comment once the gap is closed.

References

• CWE-657: Violation of Secure Design Principles
• CWE-546: Suspicious Comment

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-657
// nosec vnx-657

Or record an ignore rule: vulnetix ignore add --rule vnx-657 --reason "...". See Suppressing findings.