Rust: Add tests for web frameworks as taint sources #19466
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds dataflow tests for Rust web frameworks (Poem, Actix, Axum) as taint sources, updates test dependencies, and extends the expected taint source outputs.
- Introduce
web_frameworks.rswith handler functions for Poem, Actix, and Axum to verify taint flows. - Update
options.ymlto include the new framework dependencies. - Extend
TaintSources.expectedwith expected taint-source entries for Poem (but currently missing Actix and Axum).
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| rust/ql/test/library-tests/dataflow/sources/web_frameworks.rs | Add handler-based taint-source tests for Poem, Actix, and Axum |
| rust/ql/test/library-tests/dataflow/sources/options.yml | Add poem, serde, actix-web, axum, and serde_json to deps |
| rust/ql/test/library-tests/dataflow/sources/TaintSources.expected | Extend expected results with Poem entries (Actix/Axum entries missing) |
rust/ql/test/library-tests/dataflow/sources/TaintSources.expected
Outdated
Show resolved
Hide resolved
| "" | ||
| } | ||
|
|
||
| async fn my_axum_handler_7(body: String) -> &'static str { // $ MISSING: Alert[rust/summary/taint-sources] |
There was a problem hiding this comment.
For these Axum handlers that are just functions without any attributes I guess we'll have to find the get call where they are used? Could it make sense to have the path start at the get call?
There was a problem hiding this comment.
I think we have the choice to match either the #[] attributes, the function arguments / types, or the way they're used in router setup (the get call). We also have the choice of making three library specific models or one heuristic model (I'd prefer the latter, as there are probably more than three web libraries for Rust, but lets wait and see what works best). In any case the goal here is just for the tests to be realistic enough to serve whichever approach to modelling we settle on.
There was a problem hiding this comment.
Thanks. Though in this particular case it seems that we only have the get call to go by. Nothing else about the function stands out as a handler. Anyway, I was just curious, agree that we'll see later and that the test is good as-is :)
There was a problem hiding this comment.
Yep, I think you might be right it'll be the trickiest one to model for that reason. Even if we don't succeed, the test serves to document that gap and potential for future improvement.
Co-authored-by: Simon Friis Vindum <paldepind@github.com>
Co-authored-by: Simon Friis Vindum <paldepind@github.com>
Co-authored-by: Simon Friis Vindum <paldepind@github.com>
Add tests for web frameworks as taint sources:
Poem(which we have simple models for, but only a narrow query test).Actix(which we have a proposed model for, but no tests at all).Axum(which also appears to be popular).I think these are valuable libraries to model and improve our models for. Alternatively, we might develop a robust heuristic model that covers all three (and potentially others) in one go.
@coadaflorin the tests in
mod actix_testbelow are relevant for #19461 . We could move forward by merging this PR, then merging main into your PR, then reviewing and accepting any difference in test results, then finally merging your PR.