Rust: Add new query for XSS vulnerabilities #20902

paldepind · 2025-11-24T14:46:05Z

No description provided.

github-actions · 2025-11-24T14:47:31Z

QHelp previews:

rust/ql/src/queries/security/CWE-079/XSS.qhelp

Cross-site scripting

Directly writing user input (for example, an HTTP request parameter) to a web page, without properly sanitizing the input first, allows for a cross-site scripting vulnerability.

Recommendation

To guard against cross-site scripting, consider encoding/escaping the untrusted input before including it in the HTML.

Example

The following example shows a simple web handler that writes a URL path parameter directly to an HTML response, leaving the website vulnerable to cross-site scripting:

use actix_web::{web, HttpResponse, Result};

// BAD: User input is directly included in HTML response without sanitization
async fn vulnerable_handler(path: web::Path<String>) -> impl Responder {
    let user_input = path.into_inner();

    let html = format!(
        r#"
        <!DOCTYPE html>
        <html>
        <head><title>Welcome</title></head>
        <body>
            <h1>Hello, {}!</h1>
        </body>
        </html>
        "#,
        user_input
    );

    Html::new(html) // Unsafe: User input included directly in the response
}

To fix this vulnerability, the user input should be HTML-encoded before being included in the response. In the following example encode_text from the html_escape crate is used:

use actix_web::{web, HttpResponse, Result};

// GOOD: Manual HTML encoding using an `html_escape::encode_text` function
async fn safe_handler_with_encoding(path: web::Path<String>) -> impl Responder {
    let user_input = path.into_inner();
    let escaped_input = html_escape::encode_text(&user_input);
    let html = format!(
        r#"
        <!DOCTYPE html>
        <html>
        <head><title>Welcome</title></head>
        <body>
            <h1>Hello, {}!</h1>
        </body>
        </html>
        "#,
        escaped_input
    );

    Html::new(html) // Safe: user input is HTML-encoded
}

References

OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet.
Wikipedia: Cross-site scripting.
OWASP: Cross-site Scripting (XSS).
Common Weakness Enumeration: CWE-79.
Common Weakness Enumeration: CWE-116.

rust/ql/lib/codeql/rust/security/XssExtensions.qll

rust/ql/src/queries/security/CWE-079/XSS.ql

Copilot

Pull request overview

This PR adds a new security query rust/xss to detect cross-site scripting (XSS) vulnerabilities in Rust web applications. The implementation includes comprehensive test coverage across multiple Rust web frameworks (actix-web, warp, and axum) and follows the established patterns for security queries in the codebase.

New XSS detection query with taint tracking configuration
Framework support for actix-web and warp with sink models for HTML injection
Test cases demonstrating vulnerable and safe patterns across multiple frameworks

Reviewed changes

Copilot reviewed 23 out of 27 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
rust/ql/src/queries/security/CWE-079/XSS.ql	Main query implementation using taint tracking to detect XSS vulnerabilities
rust/ql/src/queries/security/CWE-079/XSS.qhelp	Documentation explaining the vulnerability, recommendations, and examples
rust/ql/src/queries/security/CWE-079/XSSBad.rs	Example demonstrating vulnerable code pattern
rust/ql/src/queries/security/CWE-079/XSSGood.rs	Example demonstrating safe code pattern with HTML escaping
rust/ql/src/change-notes/2025-11-24-xss-query.md	Release notes for the new query
rust/ql/lib/codeql/rust/security/XssExtensions.qll	Core library defining sources, sinks, and barriers for XSS detection
rust/ql/lib/codeql/rust/frameworks/warp.model.yml	Added HTML injection sink model for warp::reply::html
rust/ql/lib/codeql/rust/frameworks/actix-web.model.yml	Added HTML injection sink model for actix_web::types::html::Html::new
rust/ql/test/query-tests/security/CWE-079/warp/*	Test cases for warp framework including main.rs, expected results, and dependencies
rust/ql/test/query-tests/security/CWE-079/axum/*	Test cases for axum framework with MISSING annotation for expected alert
rust/ql/test/query-tests/security/CWE-079/actix/*	Test cases for actix-web framework with both vulnerable and safe handlers
rust/ql/test/query-tests/security/CWE-079/Cargo.lock	Auto-generated consolidated dependency lock file for all test cases
rust/ql/integration-tests/query-suite/*.qls.expected	Updated query suite expectations to include new XSS query

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

rust/ql/src/queries/security/CWE-079/XSS.qhelp

rust/ql/src/change-notes/2025-11-24-xss-query.md

Co-authored-by: Copilot <[email protected]>

rust/ql/lib/codeql/rust/security/XssExtensions.qll

hvitved · 2025-11-25T09:10:20Z

rust/ql/test/query-tests/security/CWE-079/warp/main.rs

+        .map(|name: String| { // $ Source
+            // Vulnerable to XSS because it directly includes user input in the response
+            let body = format!("<h1>Hello, {name}!</h1>");
+            warp::reply::html(body) // $ Alert[rust/xss]


Consider tagging the source as well.

hvitved · 2025-11-25T09:10:34Z

rust/ql/test/query-tests/security/CWE-079/actix/main.rs

+        user_input
+    );
+
+    Html::new(html) // $ Alert[rust/xss]


Consider tagging the source as well.

geoffw0

I've made a good number of comments, but make no mistake - this is great work on a query we really want. Will also need a DCA run + docs review at some stage before merging.

rust/ql/src/queries/security/CWE-079/XSSGood.rs

rust/ql/test/query-tests/security/CWE-079/warp/main.rs

geoffw0 · 2025-11-25T11:59:13Z

rust/ql/test/query-tests/security/CWE-079/axum/main.rs

+
+async fn greet_handler(Query(params): Query<GreetingParams>) -> Html<String> {
+    let html_content = format!("<p>Hello, {}!</p>", params.name);
+    Html(html_content) // $ MISSING: Alert[rust/xss]


Is the plan to add sink models for this one as part of the axum modelling task?

Also we model poem for some similar queries, should we model (and optionally test) that here as well? (or just create an issue to add this extension)

Exactly. From the stats on crates.rs it's the most popular web framework and it's also the one used in the example that motivated the XSS query. So the goal is that these tests should work once we model Axum.

Poem isn't really on my mind so I didn't add tests for it. We could create an issue. But if we don't plan to actually work on it then maybe it's not worth it?

I've created an improvements issue for this query containing this idea - but I've not prioritized it for now. We can do that later if the query performs well enough we want to expand it.

rust/ql/lib/codeql/rust/security/XssExtensions.qll

rust/ql/src/change-notes/2025-11-24-xss-query.md

paldepind · 2025-11-25T13:26:55Z

Thanks for the reviews! I should have addressed the comments now :)

rust/ql/src/change-notes/2025-11-24-xss-query.md

rust/ql/test/query-tests/security/CWE-079/actix/main.rs

geoffw0 · 2025-11-25T14:32:55Z

rust/ql/test/query-tests/security/CWE-079/axum/main.rs

+
+async fn greet_handler(Query(params): Query<GreetingParams>) -> Html<String> {
+    let html_content = format!("<p>Hello, {}!</p>", params.name);
+    Html(html_content) // $ MISSING: Alert[rust/xss]


I've created an improvements issue for this query containing this idea - but I've not prioritized it for now. We can do that later if the query performs well enough we want to expand it.

geoffw0 · 2025-11-25T14:44:40Z

I've added the ready-for-doc-review tag so that the docs team will take a look.

Co-authored-by: Geoffrey White <[email protected]>

isaacmbrown · 2025-11-25T16:42:52Z

I've added this to the Docs review board, our normal turnaround time is around two days

github-actions bot added documentation Rust Pull requests that update Rust code labels Nov 24, 2025

paldepind added 5 commits November 24, 2025 15:46

Rust: Add XSS examples

0f4561e

Rust: Add XSS query

ae9c753

Rust: Add XSS sinks for Actix and Warp

9e2bf76

Rust: Add qhelp for XSS query

9c2858d

Rust: Add change note for XSS query

597c81d

paldepind force-pushed the rust/xss-query branch from fab3ea5 to 597c81d Compare November 24, 2025 14:46

github-advanced-security bot found potential problems Nov 24, 2025

View reviewed changes

rust/ql/lib/codeql/rust/security/XssExtensions.qll Fixed Show fixed Hide fixed

rust/ql/src/queries/security/CWE-079/XSS.ql Show resolved Hide resolved

Rust: Update integration test expected files

ce25def

paldepind force-pushed the rust/xss-query branch from 9fdbf16 to ce25def Compare November 25, 2025 07:24

paldepind marked this pull request as ready for review November 25, 2025 08:20

paldepind requested a review from a team as a code owner November 25, 2025 08:20

Copilot AI review requested due to automatic review settings November 25, 2025 08:20

Copilot started reviewing on behalf of paldepind November 25, 2025 08:21 View session

Copilot finished reviewing on behalf of paldepind November 25, 2025 08:21

Copilot AI reviewed Nov 25, 2025

View reviewed changes

rust/ql/src/queries/security/CWE-079/XSS.qhelp Outdated Show resolved Hide resolved

rust/ql/src/change-notes/2025-11-24-xss-query.md Outdated Show resolved Hide resolved

Rust: Fix grammar and typos

411d1fa

Co-authored-by: Copilot <[email protected]>

hvitved reviewed Nov 25, 2025

View reviewed changes

paldepind self-assigned this Nov 25, 2025

geoffw0 reviewed Nov 25, 2025

View reviewed changes

Rust: Address PR feedback

9ae4c14

geoffw0 reviewed Nov 25, 2025

View reviewed changes

geoffw0 added the ready-for-doc-review This PR requires and is ready for review from the GitHub docs team. label Nov 25, 2025

Rust: Fix typo in change note for XSS query

7c76636

Co-authored-by: Geoffrey White <[email protected]>

Rust: Remove unused function in XSS tests

7278bc7

Rust: Add new query for XSS vulnerabilities #20902

Are you sure you want to change the base?

Rust: Add new query for XSS vulnerabilities #20902

Conversation

paldepind commented Nov 24, 2025

Uh oh!

github-actions bot commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Cross-site scripting

Recommendation

Example

References

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hvitved Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

hvitved Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

geoffw0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geoffw0 Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

paldepind Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

geoffw0 Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

paldepind commented Nov 25, 2025

Uh oh!

Uh oh!

Uh oh!

geoffw0 Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

geoffw0 commented Nov 25, 2025

Uh oh!

isaacmbrown commented Nov 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Nov 24, 2025 •

edited

Loading