Description

This detector identifies Rust code that logs sensitive information through actix_web logging macros. Logging sensitive data like passwords, API keys, or personal information in application logs creates security risks as logs are often stored insecurely or accessed by unauthorized personnel.

Detection Strategy

• The code must import or use the actix_web library or its components

• A logging macro call (such as info!, debug!, warn!, error!, trace!) must be present in the code

• The logging macro must contain arguments that appear to contain sensitive information based on variable names, string content, or data patterns that suggest secrets, credentials, or personal data

Vulnerable code example

use actix_web::{get, web, HttpResponse};

#[get("/login")]
async fn login_vulnerable(form: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
    let password = form.get("password").unwrap();
    
    // VULNERABLE: Sensitive credential logged in cleartext
    log::info!("login attempt with password {}", password);...

✅ Secure code example

use actix_web::{get, web, HttpResponse};

#[get("/login")]
async fn login_secure(form: web::Query<std::collections::HashMap<String, String>>) -> HttpResponse {
    let password = form.get("password").unwrap();
    
    // SAFE: Log authentication attempt without exposing sensitive data
    log::info!("login attempt received");...