Skip to content

Rust: Add tests for web frameworks as taint sources #19466

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

geoffw0
Copy link
Contributor

@geoffw0 geoffw0 commented May 7, 2025

Add tests for web frameworks as taint sources:

  • Poem (which we have simple models for, but only a narrow query test).
  • Actix (which we have a proposed model for, but no tests at all).
  • Axum (which also appears to be popular).

I think these are valuable libraries to model and improve our models for. Alternatively, we might develop a robust heuristic model that covers all three (and potentially others) in one go.

@coadaflorin the tests in mod actix_test below are relevant for #19461 . We could move forward by merging this PR, then merging main into your PR, then reviewing and accepting any difference in test results, then finally merging your PR.

@Copilot Copilot AI review requested due to automatic review settings May 7, 2025 09:40
@geoffw0 geoffw0 requested a review from a team as a code owner May 7, 2025 09:40
@geoffw0 geoffw0 added the Rust Pull requests that update Rust code label May 7, 2025
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds dataflow tests for Rust web frameworks (Poem, Actix, Axum) as taint sources, updates test dependencies, and extends the expected taint source outputs.

  • Introduce web_frameworks.rs with handler functions for Poem, Actix, and Axum to verify taint flows.
  • Update options.yml to include the new framework dependencies.
  • Extend TaintSources.expected with expected taint-source entries for Poem (but currently missing Actix and Axum).

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
rust/ql/test/library-tests/dataflow/sources/web_frameworks.rs Add handler-based taint-source tests for Poem, Actix, and Axum
rust/ql/test/library-tests/dataflow/sources/options.yml Add poem, serde, actix-web, axum, and serde_json to deps
rust/ql/test/library-tests/dataflow/sources/TaintSources.expected Extend expected results with Poem entries (Actix/Axum entries missing)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Rust Pull requests that update Rust code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant