Description

This vulnerability detector identifies instances in Rust code where sensitive information may be exposed through URLs in HTTP redirects or outbound requests. When applications include sensitive data like passwords, tokens, or personal information in URLs, this information can be logged in web server logs, browser history, or referrer headers, creating a security risk.

Detection Strategy

• Scans Rust source code that imports the actix_web library

• Identifies HTTP redirect operations that may include sensitive data in the URL

• Identifies outbound HTTP requests that may include sensitive information in the URL

• Reports vulnerabilities when sensitive data could be exposed through URL parameters or paths in web requests

Vulnerable code example

use actix_web::{get, web, HttpResponse};
use awc::Client;

#[get("/reset")]
async fn reset_vulnerable(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
    let token = query.get("token").unwrap();
    
    // VULNERABLE: User-controlled token interpolated into Location header...

✅ Secure code example

use actix_web::{get, web, HttpResponse};
use awc::Client;

#[get("/reset")]
async fn reset_secure(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
    let token = query.get("token").unwrap();
    
    // SAFE: Token sent via Authorization header, not exposed in Location URL...