Description

This vulnerability detector identifies Rust applications using Diesel ORM with Actix Web that store passwords weakly encoded with Base64 instead of using proper cryptographic hashing. Base64 is an encoding scheme, not a security mechanism, making passwords easily reversible and vulnerable to attacks.

Detection Strategy

• The application must import all three libraries: diesel (ORM), actix_web (web framework), and base64 (encoding library)

• Code contains a call to Diesel's values() method for database operations

• At least one argument passed to the values() method contains a password field that has been Base64 encoded rather than properly hashed

• The detector identifies this pattern as a security risk because Base64 encoding provides no cryptographic security for password storage

Vulnerable code example

use base64::engine::general_purpose::STANDARD;
use base64::Engine;
use diesel::prelude::*;

#[derive(Insertable)]
#[diesel(table_name = users)]
struct User {
    username: String,...

✅ Secure code example

use argon2::{Argon2, password_hash::{PasswordHasher, SaltString, rand_core::OsRng}};
use diesel::prelude::*;

#[derive(Insertable)]
#[diesel(table_name = users)]
struct User {
    username: String,
    password: String,...