test.rs

fn sink<T>(_: T) {}

// --- tests ---

mod poem_test {
    use super::sink;
    use poem::{get, handler, listener::TcpListener, web::Path, web::Query, Route, Server};
    use serde::Deserialize;

    #[handler]
    fn my_poem_handler_1(Path(a): Path<String>, // $ Alert[rust/summary/taint-sources]
    ) -> String {
        sink(a.as_str()); // $ hasTaintFlow
        sink(a.as_bytes()); // $ hasTaintFlow
        sink(a); // $ hasTaintFlow

        "".to_string()
    }

    #[handler]
    fn my_poem_handler_2(
        Path((a, b)): Path<(String, String)>, // $ Alert[rust/summary/taint-sources]
    ) -> String {
        sink(a); // $ hasTaintFlow
        sink(b); // $ hasTaintFlow

        "".to_string()
    }

    #[handler]
    fn my_poem_handler_3(
        path: Path<(String, String)>, // $ MISSING: Alert[rust/summary/taint-sources]
    ) -> String {
        sink(&path.0); // $ MISSING: hasTaintFlow
        sink(&path.1); // $ MISSING: hasTaintFlow

        "".to_string()
    }

    #[derive(Deserialize)]
    struct MyStruct {
        a: String,
        b: String,
    }

    #[handler]
    fn my_poem_handler_4(
        Path(MyStruct { a, b }): Path<MyStruct>, // $ Alert[rust/summary/taint-sources]
    ) -> String {
        sink(a); // $ hasTaintFlow
        sink(b); // $ hasTaintFlow

        "".to_string()
    }

    #[handler]
    fn my_poem_handler_5(
        Path(ms): Path<MyStruct>, // $ Alert[rust/summary/taint-sources]
    ) -> String {
        sink(ms.a); // $ hasTaintFlow
        sink(ms.b); // $ hasTaintFlow

        "".to_string()
    }

    #[handler]
    fn my_poem_handler_6(
        Query(a): Query<String>, // $ Alert[rust/summary/taint-sources]
    ) -> String {
        sink(a); // $ hasTaintFlow

        "".to_string()
    }

    async fn test_poem() {
        let app = Route::new()
            .at("/1/:a", get(my_poem_handler_1))
            .at("/2/:a/:b", get(my_poem_handler_2))
            .at("/3/:a/:b", get(my_poem_handler_3))
            .at("/4/:a/:b", get(my_poem_handler_4))
            .at("/5/:a/:b", get(my_poem_handler_5))
            .at("/6/:a/", get(my_poem_handler_6));

        Server::new(TcpListener::bind("0.0.0.0:3000"))
            .run(app)
            .await
            .unwrap();

        // ...
    }
}

mod actix_test {
    use super::sink;
    use actix_web::{get, web, App};

    async fn my_actix_handler_1(path: web::Path<String>) -> String {
        let a = path.into_inner();
        sink(a.as_str()); // $ hasTaintFlow=my_actix_handler_1
        sink(a.as_bytes()); // $ hasTaintFlow=my_actix_handler_1
        sink(a); // $ hasTaintFlow=my_actix_handler_1

        "".to_string()
    }

    async fn my_actix_handler_2(path: web::Path<(String, String)>) -> String {
        let (a, b) = path.into_inner();

        sink(a); // $ hasTaintFlow=my_actix_handler_2
        sink(b); // $ hasTaintFlow=my_actix_handler_2

        "".to_string()
    }

    async fn my_actix_handler_3(web::Query(a): web::Query<String>) -> String {
        sink(a); // $ hasTaintFlow=my_actix_handler_3

        "".to_string()
    }

    #[get("/4/{a}")] // $ Alert[rust/summary/taint-sources]
    async fn my_actix_handler_4(path: web::Path<String>) -> String {
        let a = path.into_inner();
        sink(a); // $ hasTaintFlow=my_actix_handler_4

        "".to_string()
    }

    async fn test_actix() {
        let app = App::new()
            .route("/1/{a}", web::get().to(my_actix_handler_1)) // $ Alert[rust/summary/taint-sources]
            .route("/2/{a}/{b}", web::get().to(my_actix_handler_2)) // $ Alert[rust/summary/taint-sources]
            .route("/3/{a}", web::get().to(my_actix_handler_3)) // $ Alert[rust/summary/taint-sources]
            .service(my_actix_handler_4);

        // ...
    }
}

mod axum_test {
    use super::sink;
    use axum::extract::{Json, Path, Query, Request};
    use axum::routing::{get, post, put, MethodFilter};
    use axum::Router;
    use std::collections::HashMap;

    async fn my_axum_handler_1(Path(a): Path<String>) -> &'static str {
        sink(a.as_str()); // $ hasTaintFlow=my_axum_handler_1
        sink(a.as_bytes()); // $ hasTaintFlow=my_axum_handler_1
        sink(a); // $ hasTaintFlow=my_axum_handler_1

        ""
    }

    async fn my_axum_handler_2(Path((a, b)): Path<(String, String)>) -> &'static str {
        sink(a); // $ hasTaintFlow=my_axum_handler_2
        sink(b); // $ hasTaintFlow=my_axum_handler_2

        ""
    }

    async fn my_axum_handler_3(Query(params): Query<HashMap<String, String>>) -> &'static str {
        for (key, value) in params {
            sink(key); // $ hasTaintFlow=my_axum_handler_3
            sink(value); // $ hasTaintFlow=my_axum_handler_3
        }

        ""
    }

    async fn my_axum_handler_4(request: Request) -> &'static str {
        sink(request.body()); // $ MISSING: hasTaintFlow
        request.headers().get("header").unwrap(); // $ MISSING: hasTaintFlow
        sink(request.into_body()); // $ MISSING: hasTaintFlow

        ""
    }

    async fn my_axum_handler_5(Json(payload): Json<serde_json::Value>) -> &'static str {
        sink(payload.as_str()); // $ MISSING: hasTaintFlow
        sink(payload); // $ hasTaintFlow=...::DELETE

        ""
    }

    async fn my_axum_handler_6(body: String) -> &'static str {
        sink(body); // $ hasTaintFlow=my_axum_handler_6

        ""
    }

    async fn my_axum_handler_7(body: String) -> &'static str {
        sink(body); // $ hasTaintFlow=my_axum_handler_7

        ""
    }

    async fn test_axum() {
        let app = Router::<()>::new()
            .route("/1/{a}", get(my_axum_handler_1)) // $ Alert[rust/summary/taint-sources])
            .route("/2/{a}/{b}", post(my_axum_handler_2)) // $ Alert[rust/summary/taint-sources])
            .route("/3/:a", put(my_axum_handler_3)) // $ Alert[rust/summary/taint-sources])
            .route(
                "/4/:a",
                get(my_axum_handler_4).on(MethodFilter::DELETE, my_axum_handler_5), // $ Alert[rust/summary/taint-sources])
            )
            .route("/5/:a", get(my_axum_handler_6).get(my_axum_handler_7)); // $ Alert[rust/summary/taint-sources])

        // ...
    }
}

mod warp_test {
    use super::sink;
    use warp::Filter;

    #[tokio::main]
    #[rustfmt::skip]
    async fn test_warp() {
        // A route with parameter and `map`
        let map_route =
            warp::path::param().map(|a: String| // $ Alert[rust/summary/taint-sources]
            {
            sink(a); // $ hasTaintFlow

            "".to_string()
        });

        // A route with parameter and `then`
        let then_route = warp::path::param().then( // $ Alert[rust/summary/taint-sources]
            async move |a: String| {
                sink(a); // $ hasTaintFlow

                "".to_string()
            },
        );

        // A route with parameter and `and_then`
        let and_then_route = warp::path::param().and_then( // $ Alert[rust/summary/taint-sources] 
            async move | id: u64 |
            {
            if id != 0 {
                sink(id); // $ hasTaintFlow
                Ok("".to_string())
            } else {
                Err(warp::reject::not_found())
            }
        },
        );

        // A route with path, parameter, and `and_then`
        let path_and_map_route = warp::path("1").and(warp::path::param()).map( // $ Alert[rust/summary/taint-sources] 
            | a: String |
            {
                sink(a); // $ hasTaintFlow

                "".to_string()
             },
        );

        let routes = warp::get().and(
            map_route
                .or(then_route)
                .or(and_then_route)
                .or(path_and_map_route),
        );
        warp::serve(routes).run(([127, 0, 0, 1], 3030)).await;
    }
}