Description

This detector identifies Rust code vulnerable to command argument injection attacks when using the actix_web library. The vulnerability occurs when user-controlled input is passed to command execution functions without proper sanitization, allowing attackers to inject malicious arguments or commands that could lead to arbitrary code execution.

Detection Strategy

• Scan Rust source code files that import the actix_web library using any import prefix

• Examine function calls and array operations that handle command arguments

• Flag instances where user input from web requests could be directly passed to system command execution functions

• Report vulnerability when potentially dangerous argument handling patterns are detected in command execution contexts

Vulnerable code example

use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;
use std::process::Command;

#[get("/clone")]
async fn clone_vulnerable(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let repo = query.get("repo").unwrap();
    ...

✅ Secure code example

use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;
use std::process::Command;
use regex::Regex;

#[get("/clone")]
async fn clone_safe(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let repo = query.get("repo").unwrap();...