Description

This vulnerability detector identifies Rust web applications that include sensitive information in HTTP responses. When applications return JSON responses containing credentials, tokens, or other sensitive data, this creates an information disclosure risk where unauthorized users could gain access to confidential information through API responses.

Detection Strategy

• The code must import the actix_web library (or similar web framework)

• A JSON response is being created and returned to the client

• The JSON response contains arguments or data that appear to be sensitive (credentials, tokens, passwords, etc.)

• The endpoint is not specifically a credential issuance endpoint (where returning credentials would be expected behavior)

Vulnerable code example

use actix_web::{get, HttpResponse};

#[get("/profile")]
async fn profile_vulnerable() -> HttpResponse {
    let api_key = std::env::var("SERVICE_API_KEY").unwrap();
    
    // VULNERABLE: Sensitive credential serialized into response
    HttpResponse::Ok().json(api_key)...

✅ Secure code example

use actix_web::{get, HttpResponse};
use serde::Serialize;

#[derive(Serialize)]
struct ProfileData {
    status: String,
    // Include only non-sensitive fields in response
}...