1+ use std:: env;
2+ use log:: { info, warn, error, debug, trace} ;
3+
4+ fn main ( ) {
5+ env_logger:: init ( ) ;
6+
7+ // Sources of user input
8+ let args: Vec < String > = env:: args ( ) . collect ( ) ;
9+ let username = args. get ( 1 ) . unwrap_or ( & String :: from ( "Guest" ) ) . clone ( ) ; // $ Source=commandargs
10+ let user_input = std:: env:: var ( "USER_INPUT" ) . unwrap_or ( "default" . to_string ( ) ) ; // $ Source=environment
11+ let remote_data = reqwest:: blocking:: get ( "http://example.com/user" )
12+ . unwrap ( ) . text ( ) . unwrap_or ( "remote_user" . to_string ( ) ) ; // $ Source=remote
13+
14+ // BAD: Direct logging of user input
15+ info ! ( "User login: {}" , username) ; // $ Alert[rust/log-injection]
16+ warn ! ( "Warning for user: {}" , user_input) ; // $ Alert[rust/log-injection]
17+ error ! ( "Error processing: {}" , remote_data) ; // $ Alert[rust/log-injection]
18+ debug ! ( "Debug info: {}" , username) ; // $ Alert[rust/log-injection]
19+ trace ! ( "Trace data: {}" , user_input) ; // $ Alert[rust/log-injection]
20+
21+ // BAD: Formatted strings with user input
22+ let formatted_msg = format ! ( "Processing user: {}" , username) ;
23+ info ! ( "{}" , formatted_msg) ; // $ Alert[rust/log-injection]
24+
25+ // BAD: String concatenation with user input
26+ let concat_msg = "User activity: " . to_string ( ) + & username;
27+ info ! ( "{}" , concat_msg) ; // $ Alert[rust/log-injection]
28+
29+ // BAD: Complex formatting
30+ info ! ( "User {} accessed resource at {}" , username, remote_data) ; // $ Alert[rust/log-injection]
31+
32+ // GOOD: Sanitized input
33+ let sanitized_username = username. replace ( '\n' , "" ) . replace ( '\r' , "" ) ;
34+ info ! ( "Sanitized user login: {}" , sanitized_username) ;
35+
36+ // GOOD: Constant strings
37+ info ! ( "System startup complete" ) ;
38+
39+ // GOOD: Non-user-controlled data
40+ let system_time = std:: time:: SystemTime :: now ( ) ;
41+ info ! ( "Current time: {:?}" , system_time) ;
42+
43+ // GOOD: Numeric data derived from user input (not directly logged)
44+ let user_id = username. len ( ) ;
45+ info ! ( "User ID length: {}" , user_id) ;
46+
47+ // More complex test cases
48+ test_complex_scenarios ( & username, & user_input) ;
49+ test_indirect_flows ( & remote_data) ;
50+ }
51+
52+ fn test_complex_scenarios ( username : & str , user_input : & str ) {
53+ // BAD: Indirect logging through variables
54+ let log_message = format ! ( "Activity for {}" , username) ;
55+ info ! ( "{}" , log_message) ; // $ Alert[rust/log-injection]
56+
57+ // BAD: Through function parameters
58+ log_user_activity ( username) ; // Function call - should be tracked
59+
60+ // BAD: Through struct fields
61+ let user_info = UserInfo { name : username. to_string ( ) } ;
62+ info ! ( "User info: {}" , user_info. name) ; // $ Alert[rust/log-injection]
63+
64+ // GOOD: After sanitization
65+ let clean_input = sanitize_input ( user_input) ;
66+ info ! ( "Clean input: {}" , clean_input) ;
67+ }
68+
69+ fn log_user_activity ( user : & str ) {
70+ info ! ( "User activity: {}" , user) ; // $ Alert[rust/log-injection]
71+ }
72+
73+ fn sanitize_input ( input : & str ) -> String {
74+ input. replace ( '\n' , "" ) . replace ( '\r' , "" ) . replace ( '\t' , " " )
75+ }
76+
77+ struct UserInfo {
78+ name : String ,
79+ }
80+
81+ fn test_indirect_flows ( data : & str ) {
82+ // BAD: Flow through intermediate variables
83+ let temp_var = data;
84+ let another_var = temp_var;
85+ info ! ( "Indirect flow: {}" , another_var) ; // $ Alert[rust/log-injection]
86+
87+ // BAD: Flow through collections
88+ let data_vec = vec ! [ data] ;
89+ if let Some ( item) = data_vec. first ( ) {
90+ info ! ( "Vector item: {}" , item) ; // $ Alert[rust/log-injection]
91+ }
92+
93+ // BAD: Flow through Option/Result
94+ let optional_data = Some ( data) ;
95+ if let Some ( unwrapped) = optional_data {
96+ info ! ( "Unwrapped data: {}" , unwrapped) ; // $ Alert[rust/log-injection]
97+ }
98+ }
99+
100+ // Additional test patterns for different logging scenarios
101+ mod additional_tests {
102+ use log:: * ;
103+
104+ pub fn test_macro_variations ( ) {
105+ let user_data = std:: env:: args ( ) . nth ( 1 ) . unwrap_or_default ( ) ; // $ Source=commandargs
106+
107+ // BAD: Different log macro variations
108+ info ! ( "Info: {}" , user_data) ; // $ Alert[rust/log-injection]
109+ warn ! ( "Warning: {}" , user_data) ; // $ Alert[rust/log-injection]
110+ error ! ( "Error: {}" , user_data) ; // $ Alert[rust/log-injection]
111+ debug ! ( "Debug: {}" , user_data) ; // $ Alert[rust/log-injection]
112+ trace ! ( "Trace: {}" , user_data) ; // $ Alert[rust/log-injection]
113+
114+ // BAD: Complex format strings
115+ info ! ( "User {} did action {} at time {}" , user_data, "login" , "now" ) ; // $ Alert[rust/log-injection]
116+ }
117+
118+ pub fn test_println_patterns ( ) {
119+ let user_data = std:: env:: var ( "USER" ) . unwrap_or_default ( ) ; // $ Source=environment
120+
121+ // These might not be caught depending on model coverage, but are potential logging sinks
122+ println ! ( "User: {}" , user_data) ;
123+ eprintln ! ( "Error for user: {}" , user_data) ;
124+ }
125+ }
0 commit comments