Description

This vulnerability detector identifies SQL injection vulnerabilities in Rust applications using the Diesel ORM or SQLx database libraries with the Actix Web framework. It detects unsafe SQL queries where user input is directly concatenated or interpolated into SQL statements without proper parameterization or sanitization.

Detection Strategy

• Scans Rust source code files that import both database libraries (sqlx or diesel) and the actix_web framework

• Examines function calls and SQL query construction patterns within the selected code nodes

• Reports a vulnerability when it finds SQL queries that incorporate user input through string concatenation, formatting, or direct interpolation without using prepared statements or parameter binding

Vulnerable code example

use actix_web::{get, web, HttpResponse};
use diesel::sql_query;
use std::collections::HashMap;

#[get("/users/search")]
async fn search_users_vulnerable(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let name = query.get("name").unwrap();
    ...

✅ Secure code example

use actix_web::{get, web, HttpResponse};
use diesel::sql_query;
use std::collections::HashMap;

#[get("/users/search")]
async fn search_users_safe(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let name = query.get("name").unwrap();
    ...