Description

This detector identifies path traversal vulnerabilities in Rust applications using the Axum web framework where user input can be used to write files to arbitrary paths. Attackers could exploit this to overwrite critical system files or place malicious files in sensitive directories by manipulating file paths with sequences like "../" to escape the intended directory structure.

Detection Strategy

• Code must import the Axum web framework library

• Code must contain file write operations that accept user-controlled input

• User input must originate from Axum request sources (path parameters, query parameters, request body, headers, etc.)

• The user input must flow to a file write function without proper path validation or sanitization

• The file path used in the write operation must be directly influenced by the user input

Vulnerable code example

use axum::extract::Query;
use std::collections::HashMap;
use std::fs;

async fn write_vulnerable(query: Query<HashMap<String, String>>) -> &'static str {
    let filename = query.get("filename").unwrap();
    
    // VULNERABLE: User controls the destination path for file write...

✅ Secure code example

use axum::extract::Query;
use std::collections::HashMap;
use std::fs;
use std::path::Path;

const BASE_DIR: &str = "uploads";

async fn write_safe(query: Query<HashMap<String, String>>) -> &'static str {...