VNX-793: Only Filtering One Instance of a Special Element

Path, command and header sanitising that replaces only the first ../, .., shell metacharacter or CR/LF: JavaScript replace() with a string or non-global regex, Python replace(..., 1).

Field	Value
Rule ID	`VNX-793`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-793
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`only-filtering-one-occurrence` `cwe-793`
Source	`internal/sast/rules/vnx-793.rego`

Overview

VNX-793 maps to CWE-793: Only Filtering One Instance of a Special Element. It reports sanitising that removes or rewrites only the first occurrence of a special element:

JavaScript/TypeScript String.replace() with a string literal, or a regex literal without the g flag, whose pattern is a .., ../, ..\ or \.\.[\/\\] traversal sequence, a shell metacharacter (&&, ||, a backtick, $(; and ;, |, $ or a deleted & when a command such as exec, subprocess or cmd appears within six lines), CR/LF or a NUL byte
Python str.replace(..., 1) and re.sub(..., count=1) with the same tokens

A lone $, | or ; far from any command (a price, a table cell, a CSS value) is not reported.

Global replacements (reported by VNX-791 when they delete the token), anchored patterns (VNX-796) and markup tokens (VNX-792) are not reported.

Why This Matters

'../../etc/passwd'.replace('../', '') is ../etc/passwd. Any input that repeats the element keeps all but the first occurrence, so the filter only stops payloads that never repeat.

What Gets Flagged

relativePath = relativePath.replace('..', '.')            // FLAGGED
const h = host.replace(';', '').replace('|', '');         // FLAGGED: exec() follows
res.setHeader('Location', target.replace('\r\n', ''));    // FLAGGED
return p.replace(/\.\.\//, '');                           // FLAGGED: no g flag

Remediation

Resolve paths and check the result stays under the base directory instead of editing the string.
Run commands with an argument list and no shell.
Reject header values that contain CR or LF.

References

CWE-793: Only Filtering One Instance of a Special Element

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-793
// nosec vnx-793

Or record an ignore rule: vulnetix ignore add --rule vnx-793 --reason "...". See Suppressing findings.