rust.lang.security.reqwest-set-sensitive.reqwest-set-sensitive

profile photo of returntocorpreturntocorp
Author
unknown
Download Count*
LGPL Commons Clause
License

Set sensitive flag on security headers with 'set_sensitive' to treat data with special care

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: reqwest-set-sensitive
    message: Set sensitive flag on security headers with 'set_sensitive' to treat
      data with special care
    patterns:
      - pattern: |
          let mut $HEADERS = header::HeaderMap::new();
          ...
          let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>;
          ...
          $HEADERS.insert($HEADER, $HEADER_VALUE);
      - pattern-not: |
          let mut $HEADERS = header::HeaderMap::new();
          ...
          let $HEADER_VALUE = <... header::HeaderValue::$FROM_FUNC(...) ...>;
          ...
          $HEADER_VALUE.set_sensitive(true);
          ...
          $HEADERS.insert($HEADER, $HEADER_VALUE);
      - metavariable-pattern:
          metavariable: $FROM_FUNC
          pattern-either:
            - pattern: from_static
            - pattern: from_str
            - pattern: from_name
            - pattern: from_bytes
            - pattern: from_maybe_shared
      - metavariable-pattern:
          metavariable: $HEADER
          pattern-either:
            - pattern: header::AUTHORIZATION
            - pattern: '"Authorization"'
    metadata:
      references:
        - https://docs.rs/reqwest/latest/reqwest/header/struct.HeaderValue.html#method.set_sensitive
      technology:
        - reqwest
      category: security
      cwe: "CWE-921: Storage of Sensitive Data in a Mechanism without Access Control"
      confidence: MEDIUM
      likelihood: LOW
      impact: LOW
      subcategory: audit
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - rust
    severity: INFO

Examples

reqwest-set-sensitive.rs

use reqwest::header;
use reqwest::{blocking::Client, header::HeaderMap, header::HeaderValue, Url};

// ruleid: reqwest-set-sensitive
let mut headers = header::HeaderMap::new();
let header = header::HeaderValue::from_static("secret");
headers.insert(header::AUTHORIZATION, header);

// ruleid: reqwest-set-sensitive
let mut headers = header::HeaderMap::new();
let header = header::HeaderValue::from_static("secret");
headers.insert("Authorization", header);

// ruleid: reqwest-set-sensitive
let mut headers = header::HeaderMap::new();
let header = header::HeaderValue::from_static("secret").map_err(|e| {
    Error::Generic(format!(
        "Error"
    ))
});
headers.insert(header::AUTHORIZATION, header);

// Remove todo when Rust supports import equivalence
// todoruleid: reqwest-set-sensitive
let mut headers = HeaderMap::new();
let header = HeaderValue::from_static("secret");
headers.insert(header::AUTHORIZATION, header);

// ok: reqwest-set-sensitive
let mut headers = header::HeaderMap::new();
let header = header::HeaderValue::from_static("secret");
header.set_sensitive(true);
headers.insert(header::AUTHORIZATION, header);