sc-lang-rust

SC: Rust Security Deep Scan

Purpose

Detects Rust-specific security anti-patterns focusing on unsafe code, FFI boundaries, concurrency pitfalls, and areas where Rust's safety guarantees can be circumvented. Despite Rust's strong type system, vulnerabilities exist in unsafe blocks, integer overflow behavior, and third-party crate misuse.

Activation

Activates when Rust is detected in security-report/architecture.md.

Checklist Reference

References references/rust-security-checklist.md.

Rust-Specific Vulnerability Patterns

Category 1: Unsafe Block Audit

// VULNERABLE: Raw pointer dereference without validation
unsafe {
    let ptr = addr as *const u8;
    let value = *ptr; // Segfault or arbitrary memory read!
}

// VULNERABLE: transmute between incompatible types
let x: u64 = unsafe { std::mem::transmute(user_input_f64) }; // UB if NaN

// SAFE: Minimize unsafe scope, document invariants, validate inputs
unsafe {
    assert!(!ptr.is_null(), "null pointer");
    let value = *ptr;
}

Category 2: FFI Boundary Validation

// VULNERABLE: Trusting C string without validation
extern "C" fn process(input: *const c_char) {
    let s = unsafe { CStr::from_ptr(input) }; // Null ptr → UB!

// SAFE: Validate before dereferencing
extern "C" fn process(input: *const c_char) {
    if input.is_null() { return; }
    let s = unsafe { CStr::from_ptr(input) };
    let s = s.to_str().unwrap_or_default(); // Handle invalid UTF-8
}

Category 3: Command Injection

// VULNERABLE: User input in shell command
use std::process::Command;
Command::new("sh").arg("-c").arg(format!("echo {}", user_input)).output();

// SAFE: Direct execution without shell
Command::new("echo").arg(user_input).output();

Category 4: Path Traversal

// VULNERABLE: Path join with user input
let path = PathBuf::from("/uploads").join(user_filename);
std::fs::read(path)?; // ../../../etc/passwd

// SAFE: Canonicalize and verify
let base = PathBuf::from("/uploads").canonicalize()?;
let target = base.join(user_filename).canonicalize()?;
if !target.starts_with(&base) { return Err("path traversal"); }