Description

This detector identifies Rust code that writes sensitive information to temporary files without encryption when using the actix_web framework. Writing sensitive data to unencrypted temporary files can lead to data exposure, as these files may be accessible to other processes or persist on disk longer than expected, potentially allowing unauthorized access to confidential information.

Detection Strategy

• The detector only runs when the actix_web library is imported in the Rust code

• Analyzes function calls and operations that write data to temporary files

• Flags code that writes sensitive information to temporary files without proper encryption or protection mechanisms

• Reports vulnerabilities when unencrypted sensitive data is being stored in temporary file locations

Vulnerable code example

use actix_web::{get, post, web, HttpRequest, HttpResponse};
use std::collections::HashMap;
use std::env;
use std::fs;

#[post("/export")]
async fn export(form: web::Query<HashMap<String, String>>) -> HttpResponse {
    let password = form.get("password").unwrap();...

✅ Secure code example

use actix_web::{get, post, web, HttpResponse};
use std::collections::HashMap;
use std::env;
use std::fs;

#[post("/export")]
async fn export(form: web::Query<HashMap<String, String>>) -> HttpResponse {
    let password = form.get("password").unwrap();...