Description

This detector identifies absolute path traversal vulnerabilities in Rust applications using the Actix web framework. It finds cases where user-controlled input from Actix web requests is used to construct file paths without proper validation, allowing attackers to access files outside the intended directory structure by using absolute paths.

Detection Strategy

• The application must import the actix_web or actix_files libraries

• Code contains a response sink that handles HTTP requests or file operations

• User input from Actix web requests (form data, query parameters, path segments, etc.) flows into file path construction

• The file path construction allows absolute paths without proper validation or sanitization

• The vulnerable path leads to file read operations that could expose sensitive files

Vulnerable code example

use actix_web::{get, web, HttpRequest, HttpResponse};
use std::fs;

#[get("/read")]
async fn read_file(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
    let filename = query.get("filename").unwrap();
    
    // VULNERABLE: User controls filename, allows path traversal...

✅ Secure code example

use actix_web::{get, web, HttpResponse};
use std::fs;
use std::path::Path;

const BASE_DIR: &str = "reports";

#[get("/read")]
async fn read_file(query: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {...