Description

This vulnerability detector identifies Rust code that sets persistent cookies containing sensitive information without proper security configurations. Persistent cookies that contain sensitive data can be exposed to security risks if not properly configured with security flags like HttpOnly, Secure, or SameSite attributes.

Detection Strategy

• Scans Rust source code for cookie-setting operations that create persistent cookies

• Identifies cookies with extended expiration times or explicit persistence configurations

• Checks if cookies containing potentially sensitive data lack proper security attributes

• Reports vulnerabilities when sensitive persistent cookies are found without adequate security protections

Vulnerable code example

use actix_web::cookie::{Cookie, time::Duration};
use actix_web::{HttpResponse, Responder};

async fn set_session_cookie(token: String) -> impl Responder {
    // VULNERABLE: Cookie persists 30 days beyond browser session
    HttpResponse::Ok()
        .cookie(Cookie::build("session_token", token).max_age(Duration::days(30)).finish())
        .finish()...

✅ Secure code example

use actix_web::cookie::{Cookie, time::Duration};
use actix_web::{HttpResponse, Responder};

async fn set_session_cookie(token: String) -> impl Responder {
    // SAFE: Session cookie with no max_age() persists only for browser session
    HttpResponse::Ok()
        .cookie(Cookie::build("session_token", token).secure(true).finish())
        .finish()...