DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
Rust

Rust

Made by DeepSource
Use Analyzer

Missing regex anchor RS-S1008

Security
Major
 a10 cwe-20 cwe-918 sans top 25 owasp top 10

It is unsafe to match untrusted input against regular expressions without ^ anchor. URLs with missing anchors can prove fatal as malicious inputs bypass the system's security checks.

Bad practice

fn validate_url(s: &str) -> bool {
    let re = Regex::new("https?://www\.deepsource\.com/").unwrap();
    re.is_match(s)
}

// matches:
//   "http://www.deepsource.com/"
//   "http://www.example.com/?x=http://www.deepsource.io/"

Here, the check with the regular expression match (Regex::is_match) is easy to bypass. For example, the string http://deepsource.com/ can be embedded in the query string component: http://<any>/?x=http://deepsource.com/ where (other parts are configurable as well) could be any malicious site that attacker chooses.

Recommended

fn validate_url(s: &str) -> bool {
    let re = Regex::new("^https?://www\.deepsource\.com/").unwrap();
    re.is_match(s)
}

// matches:
//   "http://www.deepsource.com/"
//
// but not:
//   "http://www.example.com/?x=http://www.deepsource.io/"

References