VNX-770: Allocation of Resources Without Limits or Throttling

Reports configuration that disables or removes a framework limit on what one request can make the server allocate: Django upload limits set to None, Flask MAX_CONTENT_LENGTH None, Flask-Limiter disabled, sys.set_int_max_str_digits(0), unbounded express, body-parser, koa-body or koa-bodyparser limits, multer without limits, and a huge socket.io maxHttpBufferSize.

Field	Value
Rule ID	`VNX-770`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-770
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`resource-throttling` `cwe-770`
Source	`internal/sast/rules/vnx-770.rego`

Overview

VNX-770 maps to CWE-770: Allocation of Resources Without Limits or Throttling. It reports configuration that switches off, or raises out of reach, a limit the framework applies to a single request.

Python

Django DATA_UPLOAD_MAX_MEMORY_SIZE, DATA_UPLOAD_MAX_NUMBER_FIELDS or DATA_UPLOAD_MAX_NUMBER_FILES set to None
Flask MAX_CONTENT_LENGTH assigned None
Flask-Limiter turned off: RATELIMIT_ENABLED = False, Limiter(..., enabled=False)
sys.set_int_max_str_digits(0), which removes the guard against quadratic int/str conversion (CVE-2020-10735)

Node

an express or body-parser json, urlencoded, raw or text parser with limit: Infinity, a gigabyte limit or one of 50 MB and more, or parameterLimit: Infinity
multer() configured without a limits block
a socket.io maxHttpBufferSize of Infinity or 100 MB and more

Not reported: bounded values, the frameworks’ own defaults tables (dict literals such as Flask’s "MAX_CONTENT_LENGTH": None), these settings inside a configuration class named for testing, development or local use, comments, string literals and test files. A limit that is simply never configured (no body parser options at all, no rate limiter) is not judged.

Why This Matters

These limits are what stop one client from making the server buffer a multi-gigabyte body in memory, parse millions of form fields, store unbounded uploads or burn CPU converting a huge integer. Removing them turns a single request into a denial of service.

What Gets Flagged

DATA_UPLOAD_MAX_MEMORY_SIZE = None                  # flagged
app.config['RATELIMIT_ENABLED'] = False             # flagged
sys.set_int_max_str_digits(0)                       # flagged

app.use(express.json({ limit: '1gb' }))             // flagged
const upload = multer({ dest: 'uploads/' })         // flagged: no limits

Not flagged:

app.use(express.json({ limit: '100kb' }))
const upload = multer({ dest: 'uploads/', limits: { fileSize: 2 * 1024 * 1024, files: 1 } })

Remediation

Keep each limit at what the endpoint needs. For a route that genuinely accepts large uploads, raise the limit on that route only and stream the body to storage instead of buffering it.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-770
// nosec vnx-770

Or record an ignore rule: vulnetix ignore add --rule vnx-770 --reason "...". See Suppressing findings.