Description

This vulnerability detector identifies Actix Web applications that serve static files with directory listing enabled. When listing is turned on, anyone reaching the mount point gets a browsable index of the served directory, revealing file names and structure that were never meant to be linked publicly, such as backups, exports or configuration files, and handing an attacker a map of the deployment.

Detection Strategy

• Scans Rust source files that import both the 'actix_web' and 'actix_files' libraries

• Identifies static file services created with Files::new(...), whether called by the imported name or fully qualified as actix_files::Files::new(...)

• Reports the service when show_files_listing() is called anywhere in the builder chain, including when other builder methods are chained after it

• Does not report the service when the same chain also calls index_file(...), which serves a fixed entry point instead of a browsable listing

Vulnerable code example

use actix_files::Files;
use actix_web::web;

fn config_static(cfg: &mut web::ServiceConfig) {
    // VULNERABLE: show_files_listing() exposes a browsable index of "./public"
    cfg.service(Files::new("/static", "./public").show_files_listing());
}

✅ Secure code example

use actix_files::Files;
use actix_web::web;

fn config_static(cfg: &mut web::ServiceConfig) {
    // SECURE: without show_files_listing() actix-files serves files by exact path only
    cfg.service(Files::new("/static", "./public"));
}
...