Description

This detector identifies uncontrolled memory allocation vulnerabilities in Rust code using the Actix Web framework. The vulnerability occurs when memory allocation functions receive unbounded or user-controlled input sizes, potentially leading to denial-of-service attacks through excessive memory consumption or out-of-memory conditions.

Detection Strategy

• The code must import or use the actix_web library (checked via import prefix detection)

• The code contains function calls to known memory allocation functions (allocation sinks)

• The allocation function receives arguments that represent unbounded or unvalidated size parameters

• The size argument is not properly bounded or validated before being passed to the allocation function

Vulnerable code example

use actix_web::{post, web, HttpResponse};
use serde::Deserialize;

#[derive(Deserialize)]
struct Request {
    size: usize,
}
...

✅ Secure code example

use actix_web::{post, web, HttpResponse};
use serde::Deserialize;

#[derive(Deserialize)]
struct Request {
    size: usize,
}
...