logo

Database

Rust Http Response Reflected Xss

Description

This detector identifies reflected Cross-Site Scripting (XSS) vulnerabilities in Rust HTTP responses using the Actix Web framework. Reflected XSS occurs when user input is directly embedded into HTTP response bodies without proper sanitization, allowing attackers to inject malicious scripts that execute in users' browsers when they visit the affected endpoint.

Weakness:

008 - Reflected cross-site scripting (XSS)

Category: Unexpected Injection

Detection Strategy

    • Code must import or use the Actix Web framework (actix_web library)

    • The analyzer examines HTTP response constructions and body assignments

    • A vulnerability is reported when user-controlled data flows directly into HTTP response bodies without proper encoding or sanitization

    • The detector specifically looks for vulnerable sink points where untrusted input could be reflected back to users in web responses

Vulnerable code example

use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;

#[get("/greet")]
async fn greet_vulnerable(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let user = query.get("user").unwrap();
    // VULNERABLE: User input directly interpolated into HTML response without escaping
    let html = format!("<html><body>Hello {}</body></html>", user);...

✅ Secure code example

use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;

trait HtmlEscape {
    fn escape_html(&self) -> String;
}

impl HtmlEscape for str {...