security

🔐 RUST SECURITY BEST PRACTICES

TL;DR: Security-focused programming patterns for Rust applications, covering input validation, cryptography, secrets management, and secure coding practices.

🔍 SECURITY IMPLEMENTATION STRATEGY

graph TD
    Start["Security Assessment"] --> ThreatModel["Threat Modeling"]

    ThreatModel --> InputSecurity{"Input<br>Validation?"}
    ThreatModel --> AuthSecurity{"Authentication<br>Required?"}
    ThreatModel --> DataSecurity{"Data<br>Protection?"}
    ThreatModel --> AccessSecurity{"Access<br>Control?"}

    InputSecurity -->|Yes| Validation["Input Validation"]
    InputSecurity -->|No| InputDone["✓"]

    AuthSecurity -->|Yes| PasswordHash["Password Hashing"]
    AuthSecurity -->|No| AuthDone["✓"]

    DataSecurity -->|Yes| Encryption["Data Encryption"]
    DataSecurity -->|No| DataDone["✓"]

    AccessSecurity -->|Yes| RBAC["Role-Based Access Control"]
    AccessSecurity -->|No| AccessDone["✓"]

    Validation --> PathTraversal["Path Traversal Prevention"]
    PathTraversal --> SQLInjection["SQL Injection Prevention"]

    PasswordHash --> Argon2["Argon2 Implementation"]
    Argon2 --> JWT["JWT Token Security"]

    Encryption --> SecretsManagement["Secrets Management"]
    SecretsManagement --> AESGCMEncryption["AES-GCM Encryption"]

    RBAC --> RateLimiting["Rate Limiting"]
    RateLimiting --> Audit["Security Audit Logging"]

    SQLInjection --> SecurityDone["Security Verified"]
    JWT --> SecurityDone
    AESGCMEncryption --> SecurityDone
    Audit --> SecurityDone
    InputDone --> SecurityDone
    AuthDone --> SecurityDone
    DataDone --> SecurityDone
    AccessDone --> SecurityDone

    style Start fill:#4da6ff,stroke:#0066cc,color:white
    style ThreatModel fill:#ffa64d,stroke:#cc7a30,color:white
    style Argon2 fill:#4dbb5f,stroke:#36873f,color:white
    style SecurityDone fill:#d94dbb,stroke:#a3378a,color:white

🎯 SECURITY PRINCIPLES

Input Validation and Sanitization

use validator::{Validate, ValidationError};
use regex::Regex;
use std::collections::HashSet;

// ✅ Always validate and sanitize user input
#[derive(Debug, Clone, Validate)]
pub struct UserRegistration {
    #[validate(email, message = "Invalid email format")]
    pub email: String,

    #[validate(length(min = 8, max = 128, message = "Password must be 8-128 characters"))]
    #[validate(custom = "validate_password_strength")]
    pub password: String,

    #[validate(length(min = 2, max = 50, message = "Username must be 2-50 characters"))]
    #[validate(regex = "USERNAME_REGEX", message = "Username contains invalid characters")]
    pub username: String,
}

lazy_static::lazy_static! {
    static ref USERNAME_REGEX: Regex = Regex::new(r"^[a-zA-Z0-9_-]+$").unwrap();
    static ref FORBIDDEN_PASSWORDS: HashSet<&'static str> = {
        let mut set = HashSet::new();
        set.insert("password");
        set.insert("123456");
        set.insert("admin");
        set.insert("qwerty");
        set
    };
}

fn validate_password_strength(password: &str) -> Result<(), ValidationError> {
    // Check for forbidden passwords
    if FORBIDDEN_PASSWORDS.contains(&password.to_lowercase().as_str()) {
        return Err(ValidationError::new("forbidden_password"));
    }

    // Require at least one uppercase, lowercase, digit, and special character
    let has_upper = password.chars().any(|c| c.is_uppercase());
    let has_lower = password.chars().any(|c| c.is_lowercase());
    let has_digit = password.chars().any(|c| c.is_numeric());
    let has_special = password.chars().any(|c| "!@#$%^&*()_+-=[]{}|;:,.<>?".contains(c));

    if !(has_upper && has_lower && has_digit && has_special) {
        return Err(ValidationError::new("weak_password"));
    }

    Ok(())
}

// ✅ SQL injection prevention with parameterized queries
pub async fn find_user_by_email(
    pool: &sqlx::PgPool,
    email: &str,
) -> Result<Option<User>, sqlx::Error> {
    // ✅ Safe: Uses parameterized query
    sqlx::query_as::<_, User>(
        "SELECT id, email, username FROM users WHERE email = $1"
    )
    .bind(email)
    .fetch_optional(pool)
    .await
}

// ❌ NEVER: String interpolation vulnerable to SQL injection
// let query = format!("SELECT * FROM users WHERE email = '{}'", email);