Description

Detects path traversal vulnerabilities in Rust applications using the Actix web framework where user input from HTTP requests can be used to delete files outside of intended directories. Attackers can exploit this by providing malicious file paths (like "../../../etc/passwd") through HTTP request parameters to delete sensitive system files or application data.

Detection Strategy

• The vulnerability is detected only in Rust code that imports the 'actix_web' library

• The detector looks for HTTP request handlers that accept user input from Actix web requests (such as path parameters, query parameters, or request body data)

• It identifies file deletion operations (like std::fs::remove_file) that use this user-controlled input as the file path

• The vulnerability is reported when user input flows from an Actix HTTP request directly into a file deletion function without proper path sanitization or validation

Vulnerable code example

use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;
use std::fs;

#[get("/delete")]
async fn delete_file(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let filename = query.get("filename").unwrap();
    ...

✅ Secure code example

use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;
use std::fs;
use std::path::Path;

const BASE_DIR: &str = "uploads";

#[get("/delete")]...