Untrusted input used in security decision
ID |
rust.untrusted_input.untrusted_input_in_security_decision |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Untrusted Input |
Language |
Rust |
Description
Untrusted input flows into security-sensitive operation '$SINK'. Values from std::env functions (args, current_exe, temp_dir) can be manipulated by users and should not be trusted for security-critical decisions. Validate against an allowlist or use a safer alternative.
Rationale
Untrusted input flows into security-sensitive operation '$SINK'. Values from std::env functions (args, current_exe, temp_dir) can be manipulated by users and should not be trusted for security-critical decisions. Validate against an allowlist or use a safer alternative.
The following code illustrates a vulnerable pattern detected by this rule:
// Test cases for untrusted-input-in-security-decision rule
use std::env;
use std::fs;
use std::path::Path;
use std::process::Command;
// ============================================
// POSITIVE CASES (should trigger findings)
// ============================================
// --- Process Execution ---
fn bad_command_from_args() {
// VULNERABLE: Untrusted input used in security decision
let args: Vec<String> = std::env::args().collect();
let program = &args[1];
Command::new(program).spawn().unwrap();
}