VNX-698: Execution After Redirect (EAR)

Reports a PHP header('Location: ...') or wp_redirect() not followed by exit/die/return/throw, and a Laravel, Flask, Django or Starlette redirect built as a bare statement and never returned, so the handler keeps executing after the redirect.

Field	Value
Rule ID	`VNX-698`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	PHP, Python
CWE	CWE-698
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`execution-after-redirect` `cwe-698`
Source	`internal/sast/rules/vnx-698.rego`

Overview

VNX-698 maps to CWE-698: Execution After Redirect (EAR). A handler sends a redirect, usually to the login page when an access check fails, but does not stop. The code after the redirect still runs: the protected action is performed, or the protected page is rendered into the body of the redirect response, for any client that ignores the Location header (curl, a script, a proxy).

The rule reports:

PHP header('Location: ...') (any case, any quotes) and WordPress wp_redirect()/wp_safe_redirect() whose next statement is ordinary code rather than exit, die, return or throw, including a redirect that closes an if block when code follows the block;
Laravel redirect(...), redirect()->... and Redirect::... called as a bare statement in a file that uses Illuminate: the response is built and thrown away;
Flask, Django, Starlette redirect(...), HttpResponseRedirect(...), HttpResponsePermanentRedirect(...) and RedirectResponse(...) called as a bare statement (not returned, assigned or raised), which does nothing at all.

Not reported: a redirect followed by exit, die, return, throw or break (also on the same line, and with comments or further header()/setcookie() calls between), a redirect that ends a helper function (the caller decides), a redirect followed by an else branch or ?>, returned or assigned redirects, bottle’s redirect() (which raises), plain PHP files that define their own redirect() helper, test files, comments and string literals. Ruby on Rails redirect_to is not covered.

What Gets Flagged

if (empty($_SESSION['is_admin']))
    header("Location: /login.php");          // FLAGGED: the DELETE still runs
$db->query("DELETE FROM users WHERE id = $id");

@app.route("/admin/purge", methods=["POST"])
def purge():
    if not session.get("is_admin"):
        redirect(url_for("login"))           # FLAGGED: not returned
    purge_all_records()

What Is Not Flagged

if (empty($_SESSION['user'])) {
    header("Location: /login.php");
    exit;
}

if not session.get("is_admin"):
    return redirect(url_for("login"))

Remediation

In PHP, call exit; immediately after header('Location: ...') or wp_redirect().
In Laravel, Flask, Django and Starlette, return the redirect response.
Prefer framework access control (middleware, decorators, @login_required) to inline checks.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-698
// nosec vnx-698

Or record an ignore rule: vulnetix ignore add --rule vnx-698 --reason "...". See Suppressing findings.