Description

This detector identifies hardcoded passwords in Rust applications that use Redis or MongoDB connection strings. It looks for string literals containing credentials embedded directly in the source code when connecting to these databases. This creates a significant security risk as passwords are exposed in plaintext and could be accessed by anyone with code repository access.

Detection Strategy

• The code must import Redis or MongoDB connection libraries (detected by checking for specific library import prefixes)

• String literals in the code must match patterns typical of database connection strings (DSN - Data Source Name format)

• The connection strings must contain embedded credentials or password information in plaintext format

• A vulnerability is reported when both conditions are met: the relevant database libraries are imported AND hardcoded connection strings with credentials are found in the code

Vulnerable code example

use mongodb::Client;
use redis::Client as RedisClient;

fn hardcoded_redis() -> redis::RedisResult<()> {
    let _client = RedisClient::open("redis://admin:password123@localhost:6379")?; // Hardcoded credentials in DSN
    Ok(())
}
...

✅ Secure code example

use mongodb::Client;
use redis::Client as RedisClient;
use std::env;

fn safe_redis() -> redis::RedisResult<()> {
    // Read credentials from environment variables - no hardcoded secrets in source
    let redis_url = env::var("REDIS_URL").expect("REDIS_URL environment variable not set");
    let _client = RedisClient::open(redis_url)?;...