Description

This vulnerability detector identifies insecure Content Security Policy (CSP) configurations in Rust web applications using the actix-web framework. It finds CSP headers with unsafe directives like 'unsafe-inline' or 'unsafe-eval' that can expose applications to XSS attacks and other security vulnerabilities.

Detection Strategy

• The detector activates only when the actix-web library is imported in the Rust code

• It examines HTTP header configurations throughout the codebase looking for Content-Security-Policy header definitions

• When a CSP header is found, the detector analyzes the header value to check if it contains insecure directives

• A vulnerability is reported if the CSP header value includes unsafe configurations such as 'unsafe-inline', 'unsafe-eval', or overly permissive policies that weaken security protections

Vulnerable code example

use actix_web::middleware::DefaultHeaders;
use actix_web::{App, HttpResponse};

// Vulnerable - allows unsafe-inline in script-src directive
fn app_with_unsafe_csp() -> App<()> {
    App::new().wrap(
        DefaultHeaders::new()
            .add(("Content-Security-Policy", "script-src 'self' 'unsafe-inline'"))...

✅ Secure code example

use actix_web::middleware::DefaultHeaders;
use actix_web::{App, HttpResponse};

// Safe - restricts scripts to 'self' only, no unsafe directives
fn app_with_secure_csp() -> App<()> {
    App::new().wrap(
        DefaultHeaders::new()
            .add(("Content-Security-Policy", "script-src 'self'")) // Removed 'unsafe-inline'...