VNX-796: Only Filtering Special Elements Relative to a Marker

Field	Value
Rule ID	VNX-796
Severity	Low
SARIF level	note
Kind	sast
Languages	Python, JavaScript / TypeScript
CWE	CWE-796
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	only-end-special-element cwe-796
Source	internal/sast/rules/vnx-796.rego

Overview

VNX-796 maps to CWE-796: Only Filtering Special Elements Relative to a Marker. It reports sanitising that removes special elements only at the beginning or end of a value:

• Python str.strip/lstrip/rstrip and lodash _.trim/_.trimStart/_.trimEnd whose character set mixes a dot with a path separator ('./', '../\\'), or holds two or more shell metacharacters (;, |, &, $, a backtick), or one of them with a command (exec, subprocess, os.system…) within six lines
• Python str.removeprefix/removesuffix of a .. sequence (removeprefix('../') removes one copy)
• Python re.sub and JavaScript replace() with an empty replacement whose pattern is anchored with ^ or $ and removes dots with path separators (^(\.\./)+, ^[./\\]+) or shell metacharacters (with the same two-or-command test)

Plain normalisation (rstrip('/'), lstrip('.'), strip('"'), strip('<>') on a Message-ID, rstrip(';') on an SQL statement, strip('$') on a price), stripping a file extension (/\.[^/.]+$/) and unanchored global replacements are not reported.

Why This Matters

'a/../../etc/passwd'.lstrip('./') is unchanged, and re.sub(r'^(\.\./)+', '', 'x/../../etc') removes nothing. The filter only acts at the edge of the value, so the same sequence one character in survives.

What Gets Flagged

name = name.lstrip("./")                  # FLAGGED
return re.sub(r'^(\.\./)+', '', p)        # FLAGGED
arg = arg.rstrip(";|&")                   # FLAGGED

const clean = name.replace(/^(\.\.\/)+/, '');   // FLAGGED

Remediation

1. Resolve the joined path (os.path.realpath, path.resolve) and check it is under the base directory.
2. Validate the whole value against an allow-list rather than trimming its ends.

References

• CWE-796: Only Filtering Special Elements Relative to a Marker

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-796
// nosec vnx-796

Or record an ignore rule: vulnetix ignore add --rule vnx-796 --reason "...". See Suppressing findings.