Rust XSS: request input in an HTML response unescaped
Rule ID: vetkit.rust.xss.html-response-request-input
Request input is written into an HTML response without escaping (cross-site scripting). A crafted value can inject markup or script that runs in the visitor's browser.
Last updated:
Suite: Security
rust
Request input is written into an HTML response without escaping (cross-site scripting). A crafted value can inject markup or script that runs in the visitor's browser.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Render HTML with an auto-escaping template engine (askama, maud, tera, minijinja) or escape each value with html_escape::encode_text / encode_double_quoted_attribute before formatting it into markup; return plain text or JSON when no markup is needed.
References
Source: packages/engine/rules/sast/rust.yml.
Related checks
- Rust command injection via sh -c with a built command string
- Rust cookie with HttpOnly disabled is readable by scripts
- Rust cookie with Secure flag off is sent over plain HTTP
- Rust CORS allowing any origin with credentials
- Rust block cipher in ECB mode leaks data patterns
- Rust hardcoded encryption key in a byte-string literal
Check your own repository for this
vetkit runs this rule as part of a repository audit, alongside secret scanning, dependency vulnerabilities, code quality and AI code risk checks. It reads a temporary checkout and never executes your code.
Start with the free Security Quick Scan · See how the platform works
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.