VNX-687: Function Call With Incorrectly Specified Argument Value

Detects calls given a wrong argument value: strncat bounded by the whole buffer, strncpy bounded by strlen of its source, sizes of sizeof(buf) + N, invalid fopen modes, and file permissions written in decimal instead of octal (C, C++, Python, Go, PHP, JavaScript, TypeScript, Ruby).

Field	Value
Rule ID	`VNX-687`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++, Python, Go, PHP, JavaScript / TypeScript, Ruby
CWE	CWE-687
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`function-call-wrong-argument-specification` `cwe-687`
Source	`internal/sast/rules/vnx-687.rego`

Overview

VNX-687 maps to CWE-687: Function Call With Incorrectly Specified Argument Value. The argument has the right type but the wrong value: a bound that does not limit the copy, a size one past the buffer, or 755 where 0755 was meant (decimal 755 is octal 1363, which sets the sticky bit and leaves the group and others with odd permissions).

What Gets Flagged

strncat(full, file, sizeof(full));      // FLAGGED: bound must be the space left
strncpy(path, file, strlen(file));      // FLAGGED: bounds nothing, drops the NUL
fgets(line, sizeof(line) + 1, fp);      // FLAGGED: one past the buffer
FILE *fp = fopen(path, "rw");           // FLAGGED: not a valid mode
mkdir(dir, 755);                        // FLAGGED: decimal permission

os.makedirs(base, 755)                  # FLAGGED
Path(base, "run").mkdir(mode=700)       # FLAGGED

os.MkdirAll(dir, 755)                   // FLAGGED
os.WriteFile(path, data, 644)           // FLAGGED

fs.mkdirSync(dir, { recursive: true, mode: 755 });   // FLAGGED
fs.chmodSync(file, 644);                              // FLAGGED

mkdir($dir, 755, true);                 // FLAGGED

FileUtils.mkdir_p(dir, mode: 755)       # FLAGGED
File.chmod(644, file)                   # FLAGGED

What Is Not Flagged

strncat(d, s, sizeof(d) - strlen(d) - 1) and strncpy(d, s, sizeof(d) - 1).
sizeof(buf) + N passed to an allocator.
Valid modes such as r+, rb, wbx and a+e.
Octal (0755, 0o755) and symbolic (S_IRUSR | S_IWUSR) permissions.
Comments and string literals.

Remediation

Bound copies by the destination, use snprintf or strlcpy/strlcat where available, pass a valid fopen mode, and write permissions in octal: 0755 in C and Go, 0o755 in Python.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-687
// nosec vnx-687

Or record an ignore rule: vulnetix ignore add --rule vnx-687 --reason "...". See Suppressing findings.