CodeVetter · Repo Unpack · Risk map
actix/actix-web
These risks are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The most sensitive inspected boundaries are proxy headers, HTTP framing, filesystem paths, upload accounting, error output, and redirected client requests. Compatibility features and older TLS support also affect maintenance and validation scope. Passing CI cannot be inferred from workflow definitions, particularly where checks are disabled or advisory.
- ConnectionInfo prefers Forwarded and X-Forwarded-* values for host, scheme, and client address. realip_remote_addr explicitly warns against security use unless those headers cannot be spoofed.
- Hypothesis: a deployment expecting served roots to prohibit symlink escapes needs explicit policy review. FilesService checks canonicalization success and opens the joined path, while Files::path_filter documents a custom symlink-denial example; the inspected traversal test does not test that deployment policy. (inferred)
- HTTP/1 header construction uses unsafe HeaderValue::from_maybe_shared_unchecked based on httparse validation. The same framing code rejects duplicate lengths/hosts and unsupported transfer encodings, making parser-contract changes a sensitive review boundary.
- Multipart limit enforcement is delegated to field readers: Limits::try_consume_limits must be called for each chunk. TempFile does this before writing, and discard_field also accounts for bytes; custom FieldReader implementations must preserve that contract.
- ResponseError's default response emits the error's Display text as text/plain with a default 500 status. Custom application errors therefore control material sent to clients unless they override error_response.
- Redirects remove Cookie, Authorization, and Proxy-Authorization when host, port, or scheme changes, but a 307/308 request with a non-reusable body is resent with an empty body; streamed mutation requests require attention to this documented implementation branch.
- deny.toml explicitly ignores nine advisory IDs, primarily under an old-Rustls-support comment, with one h2 update FIXME; license clarifications also retain older ring/webpki compatibility. This records exceptions, not a verified assessment of exploitability.
- Validation has explicit gaps: external-type lint CI is disabled for a rustdoc mismatch, semver-checks captures the command status but exits zero, and just test excludes a Rustls case. These configurations do not provide blocking verification for those paths.