Description

This detector identifies insecure file permission settings in Rust applications using the actix_web framework. It detects when files or directories are created with overly permissive access rights that could allow unauthorized users to read, write, or execute sensitive resources.

Detection Strategy

• The vulnerability is detected when both actix_web library and permission-related modules are imported in the Rust code

• The scanner identifies function calls that set file or directory permissions using potentially unsafe permission values

• A security issue is reported when permission settings grant excessive access rights (such as world-readable/writable permissions) that could compromise file security

Vulnerable code example

use std::fs::{OpenOptions, Permissions};
use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};

fn vulnerable_file_permissions() {
    // VULNERABLE: 0o777 grants world-writable and executable permissions
    let file = OpenOptions::new().create(true).mode(0o777).open("sensitive.txt");
    
    let mut perms = std::fs::metadata("config.dat").unwrap().permissions();...

✅ Secure code example

use std::fs::{OpenOptions, Permissions};
use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};

fn secure_file_permissions() {
    // SAFE: 0o600 restricts access to owner only (no world/group access)
    let file = OpenOptions::new().create(true).mode(0o600).open("sensitive.txt");
    
    let mut perms = std::fs::metadata("config.dat").unwrap().permissions();...