Summary
The Rust Axum model marks every handler parameter as a remote source. This includes State<T>, causing trusted application state and startup configuration paths to be reported as user-controlled.
The current model applies remote to Argument[0].Parameter[0..7] for each routing method:
https://github.com/github/codeql/blob/1d123a2caa0e4e6256a49d963bfcbd51a01617e8/rust/ql/lib/codeql/rust/frameworks/axum.model.yml
Reproduction
OperaLibre registers an owner-only metrics handler here:
https://github.com/DonovanMontoya/OperaLibre/blob/54ec6f7ccf02d526c7622b8c521a0572e6826f6c/apps/server/src/app.rs#L112-L117
The handler receives State(state): State<AppState> and calculates the size of state.covers_dir:
https://github.com/DonovanMontoya/OperaLibre/blob/54ec6f7ccf02d526c7622b8c521a0572e6826f6c/apps/server/src/app.rs#L490-L552
That directory is initialized from local startup configuration as config.data_dir.join("covers"):
https://github.com/DonovanMontoya/OperaLibre/blob/54ec6f7ccf02d526c7622b8c521a0572e6826f6c/apps/server/src/main.rs#L243-L269
Nevertheless, rust/path-injection reports this flow:
metrics @ app.rs:116
state.covers_dir @ app.rs:532
path @ app.rs:551
std::fs::read_dir(path)
The same behavior generated 54 path-injection alerts across storage, upload, update, library, and Libation code. Every flow begins at an Axum handler registration and then passes through state or an object obtained from it. None begins at the actual path-bearing request extractors.
This appeared with CodeQL 2.26.4 / codeql/rust-queries 0.1.41. The immediately preceding analysis used CodeQL 2.26.3 / pack 0.1.40 and returned no Rust results; the intervening repository changes only touched web files.
Expected behavior
Request-controlled extractors such as Path, Query, form, JSON, headers, and multipart data should remain remote sources. State<T> should not be treated as remotely controlled merely because it is a handler parameter.
Summary
The Rust Axum model marks every handler parameter as a remote source. This includes
State<T>, causing trusted application state and startup configuration paths to be reported as user-controlled.The current model applies
remotetoArgument[0].Parameter[0..7]for each routing method:https://github.com/github/codeql/blob/1d123a2caa0e4e6256a49d963bfcbd51a01617e8/rust/ql/lib/codeql/rust/frameworks/axum.model.yml
Reproduction
OperaLibre registers an owner-only metrics handler here:
https://github.com/DonovanMontoya/OperaLibre/blob/54ec6f7ccf02d526c7622b8c521a0572e6826f6c/apps/server/src/app.rs#L112-L117
The handler receives
State(state): State<AppState>and calculates the size ofstate.covers_dir:https://github.com/DonovanMontoya/OperaLibre/blob/54ec6f7ccf02d526c7622b8c521a0572e6826f6c/apps/server/src/app.rs#L490-L552
That directory is initialized from local startup configuration as
config.data_dir.join("covers"):https://github.com/DonovanMontoya/OperaLibre/blob/54ec6f7ccf02d526c7622b8c521a0572e6826f6c/apps/server/src/main.rs#L243-L269
Nevertheless,
rust/path-injectionreports this flow:The same behavior generated 54 path-injection alerts across storage, upload, update, library, and Libation code. Every flow begins at an Axum handler registration and then passes through
stateor an object obtained from it. None begins at the actual path-bearing request extractors.This appeared with CodeQL 2.26.4 /
codeql/rust-queries0.1.41. The immediately preceding analysis used CodeQL 2.26.3 / pack 0.1.40 and returned no Rust results; the intervening repository changes only touched web files.Expected behavior
Request-controlled extractors such as
Path,Query, form, JSON, headers, and multipart data should remain remote sources.State<T>should not be treated as remotely controlled merely because it is a handler parameter.