logo

Database

Rust Axum Reflected Xss

Description

This vulnerability detector identifies reflected Cross-Site Scripting (XSS) vulnerabilities in Rust applications using the Axum web framework. Reflected XSS occurs when user input is directly included in HTTP responses without proper sanitization or escaping, allowing attackers to inject malicious scripts that execute in victims' browsers.

Weakness:

008 - Reflected cross-site scripting (XSS)

Category: Unexpected Injection

Detection Strategy

    • The detector only analyzes Rust code that imports the Axum web framework library (imports with 'axum' prefix)

    • It examines HTTP response body generation code to identify locations where data is written to response bodies

    • A vulnerability is reported when user-controlled input flows directly into an HTTP response body without proper HTML encoding or sanitization

    • The detector specifically looks for Axum response handlers that construct response bodies using potentially untrusted data sources

Vulnerable code example

use axum::extract::{Json, Query};
use axum::http::{Response, HeaderMap};
use std::collections::HashMap;

// VULNERABLE: User input from query parameter flows unescaped into HTML response
async fn greet_vulnerable(query: Query<HashMap<String, String>>) -> Response<String> {
    let user = query.get("user").unwrap();
    let html = format!("<html><body>Hello {}</body></html>", user);...

✅ Secure code example

use axum::extract::{Json, Query};
use axum::http::{Response, HeaderMap};
use std::collections::HashMap;

trait EscapeHtml {
    fn escape_html(&self) -> String;
}
...