Description

Detects hardcoded passwords in Rust database connection strings when using Diesel or SQLx ORM libraries with Actix Web framework. This vulnerability exposes sensitive credentials in source code, making them accessible to anyone with code access and creating security risks if code is shared or stored in version control.

Detection Strategy

• The detector only runs when both database libraries (sqlx or diesel) AND the actix_web framework are imported in the Rust code

• Identifies string literals or expressions that match database connection string patterns containing embedded credentials

• Flags method calls that set password parameters directly on connection configuration objects

• Reports vulnerabilities when hardcoded password values are found in database connection URLs or configuration methods

Vulnerable code example

use diesel::pg::PgConnection;
use diesel::Connection;
use sqlx::postgres::{PgConnectOptions, PgPool};

fn main() {
    // Hardcoded credentials in DSN string
    let _conn = PgConnection::establish("postgres://admin:[email protected]/app").unwrap();
    ...

✅ Secure code example

use diesel::pg::PgConnection;
use diesel::Connection;
use sqlx::postgres::{PgConnectOptions, PgPool};
use std::env;

fn main() {
    // Read credentials from environment variables instead of hardcoding
    let database_url = env::var("DATABASE_URL").expect("DATABASE_URL must be set");...