VNX-710: Security-relevant compiler warning suppressed in source

Reports C and C++ source that disables a compiler warning built to catch memory-safety or format-string defects: MSVC C4996/C4789/C6386 and similar, GCC/clang -Wformat-security, -Wstringop-overflow, -Warray-bounds and similar, and _CRT_SECURE_NO_WARNINGS.

Field	Value
Rule ID	`VNX-710`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-710
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`improper-adherence-to-coding-standards` `compiler-warnings` `cwe-710`
Source	`internal/sast/rules/vnx-710.rego`

Overview

VNX-710 maps to CWE-710: Improper Adherence to Coding Standards. It reports the one form of that weakness a scanner can recognise: source code that turns off a warning written to catch memory-safety, uninitialised-value or format-string defects. That covers #pragma warning(disable|suppress: ...) for C4996, C4789, C4700, C4701, C4703, C6385, C6386, C6387 or C6011, and #pragma GCC|clang diagnostic ignored for -Wformat-security, -Wformat-nonliteral, -Wformat-overflow, -Wformat-truncation, -Wstringop-*, -Warray-bounds, -Wuninitialized, -Wmaybe-uninitialized, -Wreturn-local-addr, -Wreturn-stack-address, -Wfree-nonheap-object, -Wuse-after-free and -Wdangling-pointer. It also covers the __pragma(...) and _Pragma("...") macro spellings of those directives, and #define _CRT_SECURE_NO_WARNINGS or _CRT_SECURE_NO_DEPRECATE.

What Gets Flagged

#pragma warning(disable: 4996)                     // FLAGGED
#pragma GCC diagnostic ignored "-Wformat-security" // FLAGGED
#define _CRT_SECURE_NO_WARNINGS                    // FLAGGED

Not reported: style and portability warnings such as -Wunused-parameter, -Wsign-compare, -Wdeprecated-declarations, C4100 and C4244. Also not reported: #pragma warning(push|pop|default|error: ...), flags in build files, comments and strings. A directive written with spaces between # and pragma (# pragma) is not reported, because the engine reads that line as a comment.

Remediation

Fix the code the warning reports. Replace strcpy/sprintf with bounded calls, and pass a constant format string.
If a suppression cannot be avoided, keep it to one audited line (#pragma warning(suppress: ...) or push/pop) and record why.

References

CWE-710: Improper Adherence to Coding Standards

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-710
// nosec vnx-710

Or record an ignore rule: vulnetix ignore add --rule vnx-710 --reason "...". See Suppressing findings.