Description

This detector identifies database connections in Rust applications using SQLx or Diesel libraries with empty or missing passwords. Empty passwords in database connection strings create severe security vulnerabilities that allow unauthorized database access.

Detection Strategy

• Check if both database libraries (sqlx or diesel) and web framework (actix_web) are imported in the Rust code

• Scan for database connection strings (DSN strings) that contain empty password fields or missing password parameters

• Look for password setter method calls where the password value is empty or not provided

• Flag any database connection configuration that allows authentication without a password

Vulnerable code example

use diesel::mysql::MysqlConnection;
use diesel::Connection;
use sqlx::mysql::{MySqlConnectOptions, MySqlPool, MySqlPoolOptions};

fn diesel_mysql_empty_password() {
    // Empty password in MySQL connection string (root:@)
    let database_url = "mysql://root:@localhost/legacy_db";
    let _conn = MysqlConnection::establish(database_url).unwrap();...

✅ Secure code example

use diesel::mysql::MysqlConnection;
use diesel::Connection;
use sqlx::mysql::{MySqlConnectOptions, MySqlPool, MySqlPoolOptions};
use std::env;

fn diesel_mysql_secure_password() {
    // Use environment variable for credentials instead of hardcoded empty password
    let database_url = env::var("DATABASE_URL")...