Rust: Add tests for web frameworks as taint sources #19466
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds dataflow tests for Rust web frameworks (Poem, Actix, Axum) as taint sources, updates test dependencies, and extends the expected taint source outputs.
- Introduce
web_frameworks.rswith handler functions for Poem, Actix, and Axum to verify taint flows. - Update
options.ymlto include the new framework dependencies. - Extend
TaintSources.expectedwith expected taint-source entries for Poem (but currently missing Actix and Axum).
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| rust/ql/test/library-tests/dataflow/sources/web_frameworks.rs | Add handler-based taint-source tests for Poem, Actix, and Axum |
| rust/ql/test/library-tests/dataflow/sources/options.yml | Add poem, serde, actix-web, axum, and serde_json to deps |
| rust/ql/test/library-tests/dataflow/sources/TaintSources.expected | Extend expected results with Poem entries (Actix/Axum entries missing) |
| @@ -0,0 +1,199 @@ | |||
| #![allow(deprecated)] | |||
There was a problem hiding this comment.
Do we need this? I tried deleting it, and it didn't seem to cause any warnings?
| #![allow(deprecated)] |
| .at("/5/:a/:b", get(my_poem_handler_5)) | ||
| .at("/6/:a/", get(my_poem_handler_6)); | ||
|
|
||
| _ = Server::new(TcpListener::bind("0.0.0.0:3000")).run(app).await.unwrap(); |
There was a problem hiding this comment.
| _ = Server::new(TcpListener::bind("0.0.0.0:3000")).run(app).await.unwrap(); | |
| Server::new(TcpListener::bind("0.0.0.0:3000")).run(app).await.unwrap(); |
Clippy complains about this as the unwrap returns unit.
|
|
||
| mod actix_test { | ||
| use actix_web::{get, web, App, HttpServer}; | ||
| use crate::web_frameworks::sink; |
There was a problem hiding this comment.
| use crate::web_frameworks::sink; | |
| use super::sink; |
| } | ||
|
|
||
| mod actix_test { | ||
| use actix_web::{get, web, App, HttpServer}; |
There was a problem hiding this comment.
| use actix_web::{get, web, App, HttpServer}; | |
| use actix_web::{get, web, App}; |
| mod poem_test { | ||
| use poem::{get, handler, web::Path, web::Query, Route, Server, listener::TcpListener}; | ||
| use serde::Deserialize; | ||
| use crate::web_frameworks::sink; |
There was a problem hiding this comment.
| use crate::web_frameworks::sink; | |
| use super::sink; |
This has the same meaning but is a bit easier to read and write IMO.
| "" | ||
| } | ||
|
|
||
| async fn my_axum_handler_7(body: String) -> &'static str { // $ MISSING: Alert[rust/summary/taint-sources] |
There was a problem hiding this comment.
For these Axum handlers that are just functions without any attributes I guess we'll have to find the get call where they are used? Could it make sense to have the path start at the get call?
Add tests for web frameworks as taint sources:
Poem(which we have simple models for, but only a narrow query test).Actix(which we have a proposed model for, but no tests at all).Axum(which also appears to be popular).I think these are valuable libraries to model and improve our models for. Alternatively, we might develop a robust heuristic model that covers all three (and potentially others) in one go.
@coadaflorin the tests in
mod actix_testbelow are relevant for #19461 . We could move forward by merging this PR, then merging main into your PR, then reviewing and accepting any difference in test results, then finally merging your PR.