Skip to content

Commit 0f4561e

Browse files
paldepindpaldepind
committed
Rust: Add XSS examples
1 parent 43111b8 commit 0f4561e

File tree

10 files changed

+4922
-0
lines changed

10 files changed

+4922
-0
lines changed

‎rust/ql/test/query-tests/security/CWE-079/Cargo.lock‎

Lines changed: 1876 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎rust/ql/test/query-tests/security/CWE-079/actix/Cargo.lock‎

Lines changed: 1555 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎rust/ql/test/query-tests/security/CWE-079/actix/main.rs‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
use actix_web::{
2+
get,
3+
web::{self, Html},
4+
App, HttpServer, Responder,
5+
};
6+
7+
// The "bad" example from the qldoc
8+
#[get("/bad/{a}")]
9+
async fn vulnerable_handler(path: web::Path<String>) -> impl Responder {
10+
let user_input = path.into_inner();
11+
12+
let html = format!(
13+
r#"
14+
<!DOCTYPE html>
15+
<html>
16+
<head><title>Welcome</title></head>
17+
<body>
18+
<h1>Hello, {}!</h1>
19+
</body>
20+
</html>
21+
"#,
22+
user_input
23+
);
24+
25+
Html::new(html) // $ MISSING: Alert[rust/xss]
26+
}
27+
28+
fn html_escape(s: &str) -> String {
29+
s.chars()
30+
.map(|c| match c {
31+
'<' => "&lt;".to_string(),
32+
'>' => "&gt;".to_string(),
33+
'&' => "&amp;".to_string(),
34+
'"' => "&quot;".to_string(),
35+
'\'' => "&#x27;".to_string(),
36+
_ => c.to_string(),
37+
})
38+
.collect()
39+
}
40+
41+
#[get("/good/{a}")]
42+
// The "good" example from the qldoc
43+
async fn safe_handler_with_encoding(path: web::Path<String>) -> impl Responder {
44+
let user_input = path.into_inner();
45+
let escaped_input = html_escape(&user_input);
46+
47+
let html = format!(
48+
r#"
49+
<!DOCTYPE html>
50+
<html>
51+
<head><title>Welcome</title></head>
52+
<body>
53+
<h1>Hello, {}!</h1>
54+
</body>
55+
</html>
56+
"#,
57+
escaped_input
58+
);
59+
60+
Html::new(html) // Safe: user input is HTML-encoded
61+
}
62+
63+
#[actix_web::main]
64+
pub async fn main() -> std::io::Result<()> {
65+
HttpServer::new(|| {
66+
App::new()
67+
.service(vulnerable_handler)
68+
.service(safe_handler_with_encoding)
69+
})
70+
.bind(("127.0.0.1", 3000))?
71+
.run()
72+
.await
73+
}

‎rust/ql/test/query-tests/security/CWE-079/actix/options.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
qltest_use_nightly: true
2+
qltest_dependencies:
3+
- actix-web = { version = "4.12.0" }

0 commit comments

Comments
 (0)