flawopen.com/sql-injection/Rust

इस पेज के मुख्य शब्द

Web Application Security

सुरक्षा अवधारणा (Web Application Security): Core architecture component affected by CWE-89.

CWE-89

सुरक्षा अवधारणा (CWE-89): Standard Common Weakness Enumeration classification for sql-injection-rust.

Defense-in-Depth

सुरक्षा अवधारणा (Defense-in-Depth): Multi-layered engineering verification and runtime boundary isolation.

हमले का चरण-दर-चरण प्रवाह

सोर्स कोड: कमज़ोर बनाम सुरक्षित कार्यान्वयन

// user_id comes straight from the request
let query = format!(
  "SELECT * FROM users WHERE id = {}",
  user_id
);
conn.execute(&query, [])?;

// value bound, never formatted into the query
conn.execute(
  "SELECT * FROM users WHERE id = ?1",
  params![user_id],
)?;

इंजीनियरिंग और सिस्टम सुरक्षा चेकलिस्ट

• ✓अनुशंसित सुरक्षा नियम: Pass values through the crate's parameter binding (params![...] or equivalent) — never build the query with format!।
• ✓अनुशंसित सुरक्षा नियम: Prefer sqlx::query! macros with real placeholders over building strings manually।
• ✓a CI grep or custom lint for format! near query-execution calls जोड़ें।

References

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command
• rusqlite documentation — parameter binding
• sqlx documentation — compile-time checked queries
• OWASP SQL इंजेक्शन रोकथाम चीट शीट