seaworthycode 1.1.2 → 1.2.3

package/rules/internal/taint/rust.test.yaml

@@ -0,0 +1,585 @@
+language: rust
+cases:
+  # === POSITIVE FLOW TESTS ===
+
+  - name: "Axum Json to sqlx::query via format! (SQL injection)"
+    language: rust
+    code: |
+      async fn handler(Json(payload): Json<UserPayload>) {
+          let query_str = format!("SELECT * FROM users WHERE name = '{}'", payload.name);
+          sqlx::query(&query_str).execute(&pool).await;
+      }
+    expect:
+      count: 2
+      flows:
+        - sourceId: axum.extract.Json
+          sinkId: sqlx.query
+        - sourceId: axum.extract.Json
+          sinkId: format.sql-sqli
+
+  - name: "Axum Query to diesel::sql_query (SQL injection)"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let sql = format!("SELECT * FROM items WHERE query = '{}'", params.q);
+          diesel::sql_query(sql).execute(&conn);
+      }
+    expect:
+      count: 2
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: diesel.sql_query
+        - sourceId: axum.extract.Query
+          sinkId: format.sql-sqli
+
+  - name: "SQL injection via format! SQL pattern"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let query = format!("SELECT * FROM items WHERE query = '{}'", params.q);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: format.sql-sqli
+
+  - name: "Command injection — env var to Command::new"
+    language: rust
+    code: |
+      fn run() {
+          let target = std::env::var("DEPLOY_TARGET").unwrap();
+          std::process::Command::new(target).spawn().unwrap();
+      }
+    expect:
+      count: 2
+      flows:
+        - sourceId: std.env.var
+          sinkId: std.process.Command.new
+        - sourceId: std.env.var
+          sinkId: std.process.Command.code-exec
+
+  - name: "Command injection — CLI args to Command::new"
+    language: rust
+    code: |
+      fn main() {
+          let arg = std::env::args().nth(1).unwrap();
+          std::process::Command::new(arg).output().unwrap();
+      }
+    expect:
+      count: 2
+      flows:
+        - sourceId: std.env.args
+          sinkId: std.process.Command.new
+        - sourceId: std.env.args
+          sinkId: std.process.Command.code-exec
+
+  - name: "Path traversal — Axum Query to fs::File::open"
+    language: rust
+    code: |
+      async fn get_file(Query(params): Query<FileParams>) {
+          std::fs::File::open(params.filename).unwrap();
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: std.fs.File.open
+
+  - name: "Path traversal — env var to fs::read_to_string"
+    language: rust
+    code: |
+      fn main() {
+          let path = std::env::var("CONFIG_PATH").unwrap();
+          std::fs::read_to_string(path).unwrap();
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: std.env.var
+          sinkId: std.fs.File.open
+
+  - name: "XSS — Axum Json to Html response"
+    language: rust
+    code: |
+      async fn render(Json(body): Json<TemplateBody>) {
+          axum::response::Html(body.content);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Json
+          sinkId: axum.response.Html
+
+  - name: "XSS — Actix Json to HttpResponse::body"
+    language: rust
+    code: |
+      async fn render(body: actix_web::web::Json<TemplateBody>) {
+          HttpResponse::Ok().body(body.content);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: actix.web.Json
+          sinkId: actix.HttpResponse.body
+
+  - name: "URL injection — Axum Query to Redirect"
+    language: rust
+    code: |
+      async fn handle(Query(params): Query<RedirectParams>) {
+          axum::response::Redirect::to(&params.next);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: axum.response.Redirect
+
+  - name: "URL injection — Actix Query to redirect"
+    language: rust
+    code: |
+      async fn handle(params: actix_web::web::Query<RedirectParams>) {
+          HttpResponse::Found().insert_header(("Location", params.next.clone()));
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: actix.web.Query
+          sinkId: actix.HttpResponse.redirect
+
+  - name: "Code execution — env var to libloading"
+    language: rust
+    code: |
+      fn load() {
+          let path = std::env::var("LIB_PATH").unwrap();
+          unsafe { libloading::Library::new(path).unwrap() };
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: std.env.var
+          sinkId: libloading.Library.new
+
+  - name: "Network response to SQL injection"
+    language: rust
+    code: |
+      async fn fetch() {
+          let res = reqwest::get("http://example.com").await.unwrap().text().await.unwrap();
+          sqlx::query(&res).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: reqwest.response.text
+          sinkId: sqlx.query
+
+  - name: "Network response to command injection"
+    language: rust
+    code: |
+      async fn run() {
+          let res = reqwest::get("http://example.com").await.unwrap().text().await.unwrap();
+          std::process::Command::new(res).spawn().unwrap();
+      }
+    expect:
+      count: 2
+      flows:
+        - sourceId: reqwest.response.text
+          sinkId: std.process.Command.new
+        - sourceId: reqwest.response.text
+          sinkId: std.process.Command.code-exec
+
+  - name: "Cookie to SQL injection"
+    language: rust
+    code: |
+      async fn handle(cookie: axum::extract::CookieJar) {
+          let val = cookie.get("session").unwrap().value();
+          sqlx::query(val).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.CookieJar
+          sinkId: sqlx.query
+
+  - name: "Actix Form to path traversal"
+    language: rust
+    code: |
+      async fn handle(form: actix_web::web::Form<UploadForm>) {
+          std::fs::File::open(&form.path).unwrap();
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: actix.web.Form
+          sinkId: std.fs.File.open
+
+  - name: "stdin to command injection"
+    language: rust
+    code: |
+      fn main() {
+          let mut input = String::new();
+          std::io::stdin().read_line(&mut input).unwrap();
+          std::process::Command::new(input).spawn().unwrap();
+      }
+    expect:
+      count: 2
+      flows:
+        - sourceId: std.io.stdin
+          sinkId: std.process.Command.new
+        - sourceId: std.io.stdin
+          sinkId: std.process.Command.code-exec
+
+  # === SANITISED PATH TESTS ===
+
+  - name: "SQL injection sanitised by parameterised query"
+    language: rust
+    code: |
+      async fn handler(Json(payload): Json<UserPayload>) {
+          sqlx::query("SELECT * FROM users WHERE name = ?").bind(payload.name).execute(&pool).await;
+      }
+    expect:
+      count: 0
+
+  - name: "SQL injection sanitised by parse::<i32>()"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<UserParams>) {
+          let id = params.id.parse::<i32>().unwrap();
+          let sql = format!("SELECT * FROM users WHERE id = {}", id);
+          sqlx::query(&sql).execute(&pool).await;
+      }
+    expect:
+      count: 0
+
+  - name: "XSS sanitised by html_escape::encode_safe"
+    language: rust
+    code: |
+      async fn render(Json(body): Json<TemplateBody>) {
+          let escaped = html_escape::encode_safe(&body.content);
+          axum::response::Html(escaped);
+      }
+    expect:
+      count: 0
+
+  - name: "Path traversal sanitised by Path::canonicalize"
+    language: rust
+    code: |
+      async fn get_file(Query(params): Query<FileParams>) {
+          let path = std::path::Path::new(&params.filename).canonicalize().unwrap();
+          std::fs::File::open(path).unwrap();
+      }
+    expect:
+      count: 0
+
+  - name: "Command injection sanitised by shell_words::join"
+    language: rust
+    code: |
+      fn run() {
+          let arg = std::env::var("CMD_ARG").unwrap();
+          let safe_arg = shell_words::join(vec![arg]);
+          std::process::Command::new("ls").arg(safe_arg).spawn().unwrap();
+      }
+    expect:
+      count: 0
+
+  - name: "URL injection sanitised by url::Url::parse"
+    language: rust
+    code: |
+      async fn handle(Query(params): Query<RedirectParams>) {
+          let safe_url = url::Url::parse(&params.next).unwrap();
+          axum::response::Redirect::to(safe_url.as_str());
+      }
+    expect:
+      count: 0
+
+  # === SANITISER CROSS-CLASS TESTS ===
+
+  - name: "html_escape does not cover sql-injection"
+    language: rust
+    code: |
+      async fn render(Json(body): Json<TemplateBody>) {
+          let escaped = html_escape::encode_safe(&body.content);
+          sqlx::query(&escaped).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Json
+          sinkId: sqlx.query
+
+  - name: "parse::<i32>() then to_string() — taint engine still tracks flow"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<UserParams>) {
+          let id = params.id.parse::<i32>().unwrap().to_string();
+          axum::response::Html(id);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: axum.response.Html
+
+  # === BFS PROPAGATION TESTS ===
+
+  - name: "format! interpolation propagates taint to sink"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let query = format!("{}", params.q);
+          sqlx::query(&query).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "String concatenation (+) propagates taint"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let query = "SELECT * FROM items WHERE query = ".to_string() + &params.q;
+          sqlx::query(&query).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "let binding propagation"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let tainted = params.q;
+          sqlx::query(&tainted).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "Struct destructuring propagation"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let SearchParams { q: query_val } = params;
+          sqlx::query(&query_val).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "match arm merging — taint in one arm reaches sink"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let query = match Some(&params.q) {
+              Some(val) => val.clone(),
+              None => "safe".to_string()
+          };
+          sqlx::query(&query).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "if let branch merging"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let mut query = String::new();
+          if let Some(val) = Some(&params.q) {
+              query = val.clone();
+          } else {
+              query = "safe".to_string();
+          }
+          sqlx::query(&query).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "if/else branch merging"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let mut query = String::new();
+          if true {
+              query = params.q.clone();
+          } else {
+              query = "safe".to_string();
+          }
+          sqlx::query(&query).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "for loop fixpoint iteration"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let mut query = String::new();
+          for item in vec![params.q] {
+              query = item;
+          }
+          sqlx::query(&query).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "Reference propagation (&tainted)"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let ref_val = &params.q;
+          sqlx::query(ref_val).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "Dereference propagation (*tainted)"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let ref_val = &params.q;
+          let deref_val = *ref_val;
+          sqlx::query(deref_val).execute(&pool).await;
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "Type cast propagation (as)"
+    language: rust
+    code: |
+      fn main() {
+          let path = std::env::var("LIB_PATH").unwrap();
+          let cast_val = path as *const u8;
+          unsafe { libloading::Library::new(cast_val).unwrap() };
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: std.env.var
+          sinkId: libloading.Library.new
+
+  - name: "Closure parameter propagation"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<SearchParams>) {
+          let closure = |x| {
+              sqlx::query(x).execute(&pool);
+          };
+          closure(&params.q);
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: axum.extract.Query
+          sinkId: sqlx.query
+
+  - name: "Mutator method — vec.push(tainted)"
+    language: rust
+    code: |
+      fn run() {
+          let mut args = vec![];
+          let tainted = std::env::var("CMD_ARG").unwrap();
+          args.push(tainted);
+          std::process::Command::new("ls").arg(&args[0]).spawn().unwrap();
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: std.env.var
+          sinkId: std.process.Command.arg
+
+  - name: "Inter-function propagation"
+    language: rust
+    code: |
+      fn helper(x: String) -> String {
+          x
+      }
+      fn main() {
+          let tainted = std::env::var("CMD").unwrap();
+          let propagated = helper(tainted);
+          std::process::Command::new(propagated).spawn().unwrap();
+      }
+    expect:
+      count: 2
+      flows:
+        - sourceId: std.env.var
+          sinkId: std.process.Command.new
+        - sourceId: std.env.var
+          sinkId: std.process.Command.code-exec
+
+  - name: "Attribute assignment — obj.field = tainted"
+    language: rust
+    code: |
+      struct Config {
+          path: String,
+      }
+      fn main() {
+          let mut cfg = Config { path: "safe".to_string() };
+          let tainted = std::env::var("PATH").unwrap();
+          cfg.path = tainted;
+          std::fs::File::open(cfg.path).unwrap();
+      }
+    expect:
+      count: 1
+      flows:
+        - sourceId: std.env.var
+          sinkId: std.fs.File.open
+
+  - name: "Subscript assignment — map[key] = tainted"
+    language: rust
+    code: |
+      use std::collections::HashMap;
+      fn main() {
+          let mut map: HashMap<String, String> = HashMap::new();
+          let tainted = std::env::var("KEY").unwrap();
+          map.insert("key".to_string(), tainted);
+      }
+    expect:
+      count: 0
+
+  # === NO-SOURCE-MATCH AND ANTI-FIXTURE TESTS ===
+
+  - name: "No source match — plain code"
+    language: rust
+    code: |
+      fn main() {
+          let path = "/etc/passwd";
+          std::fs::File::open(path).unwrap();
+      }
+    expect:
+      count: 0
+
+  - name: "Safe anti-fixture"
+    language: rust
+    code: |
+      async fn handler(Query(params): Query<UserParams>) {
+          let id = params.id.parse::<i32>().unwrap();
+          sqlx::query("SELECT * FROM users WHERE id = ?").bind(id).execute(&pool).await;
+      }
+    expect:
+      count: 0