Description

Detects when password fields are stored in plaintext within Rust applications using the Diesel ORM framework. The vulnerability occurs when sensitive password data is inserted into the database without proper hashing or encryption, exposing user credentials to potential data breaches.

Detection Strategy

• Code must import both 'diesel' and 'actix_web' libraries

• Code must contain a function call that acts as a Diesel values sink (typically database insertion operations)

• One of the function arguments must be identified as a password field based on naming patterns or context

• The password argument must be passed in an unsafe manner (without hashing or encryption)

Vulnerable code example

use diesel::prelude::*;
use diesel::PgConnection;

#[derive(Insertable)]
#[diesel(table_name = users)]
struct NewUser {
    username: String,
    password: String, // Plain text password field...

✅ Secure code example

use bcrypt::{hash, DEFAULT_COST};
use diesel::prelude::*;
use diesel::PgConnection;

#[derive(Insertable)]
#[diesel(table_name = users)]
struct NewUser {
    username: String,...