Description

This detector identifies open redirect vulnerabilities in Rust applications using the Actix Web framework. Open redirects occur when user-controlled input is used to construct redirect URLs without proper validation, allowing attackers to redirect users to malicious websites for phishing or credential theft attacks.

Detection Strategy

• Scans Rust source code files that import the actix_web library or its modules

• Identifies HTTP response constructions that set redirect headers (like Location header) using potentially user-controlled data

• Detects calls to Actix Web redirect functions where the destination URL comes from unvalidated user input

• Reports vulnerabilities when redirect destinations can be manipulated by attackers through request parameters, headers, or other user-supplied data

Vulnerable code example

use actix_web::web::Redirect;
use actix_web::{get, web, HttpResponse, Responder};
use std::collections::HashMap;

#[get("/login")]
async fn login_vulnerable(query: web::Query<HashMap<String, String>>) -> impl Responder {
    let next = query.get("next").unwrap();
    // VULNERABLE: User input directly used as redirect target - enables phishing attacks...

✅ Secure code example

use actix_web::web::Redirect;
use actix_web::{get, web, HttpResponse, Responder};
use std::collections::HashMap;

// Allowlist of valid redirect paths
const ALLOWED_REDIRECTS: &[&str] = &["/dashboard", "/profile", "/home", "/checkout"];

fn validate_redirect_path(path: &str) -> String {...