Description

This detector identifies path traversal vulnerabilities in Rust applications using the Actix web framework. It finds file write operations that use untrusted user input without proper validation, allowing attackers to write files outside intended directories by using path sequences like "../" to traverse up directory hierarchies.

Detection Strategy

• The code must import or use the actix_web library (checked via library import detection)

• There must be a file write operation (such as File::create, write!, std::fs::write, or similar file writing functions)

• The file path used in the write operation must be derived from user input received through Actix web framework (such as request parameters, form data, or request body)

• The user input must flow to the file write operation without proper sanitization or validation to prevent directory traversal

Vulnerable code example

use actix_web::{get, web};
use std::collections::HashMap;
use std::fs;

#[get("/write")]
async fn write_vulnerable(query: web::Query<HashMap<String, String>>) -> &'static str {
    let filename = query.get("filename").unwrap();
    ...

✅ Secure code example

use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;
use std::fs;
use std::path::Path;

const BASE_DIR: &str = "uploads";

#[get("/write")]...