CodeVetter · Repo Unpack · Risk map
tokio-rs/axum
These findings are source observations and explicitly identified hypotheses, not confirmed vulnerabilities. The main boundaries worth reviewing are request resource limits, example authentication, network integrations, HTML generation, database startup, and upload IO. Framework safeguards have conditions: extractor-local limits do not cover every body consumer, and middleware placement affects which requests receive protection. Example code should be assessed in its deployment context before reuse.
- DefaultBodyLimit bounds cooperating extractors to 2,097,152 bytes by default, but direct body consumption bypasses it; the upload example's Request-based path streams the body without applying that extractor-local limit.
- JWT authorization is demonstration logic with fixed accepted credentials and a fixed expiry; KEYS reads JWT_SECRET lazily with expect, so missing configuration panics when key use first initializes it.
- OAuth explicitly warns against its MemoryStore in production; User extraction panics for unexpected cookie-header errors and unwraps session loading, creating request-path failure points despite normal missing-session redirects.
- The form and validator handlers interpolate user-provided strings directly into Html responses without an escaping transform in those handlers; validation in the latter checks name length.
- Upload IO validates a single normal path component, then joins it beneath a working-directory-relative uploads directory and uses File::create; multipart iteration exits on next_field errors and still returns its normal redirect.
- Database examples require external services: Diesel runs migrations before listening, tokio-postgres uses NoTls, and SQLx/Diesel internal_error expose error strings in 500 responses.
- Middleware placement is a coupling hotspot: Router::layer wraps previously added routes and repeated layers run outermost-last, whereas ServiceBuilder composes a different ordering; the error example depends on TraceLayer enclosing log_app_errors.
- Dependency policy excludes unpublished packages, disables unmaintained-advisory reporting, and permits selected duplicate trees; CI marks the advisories matrix entry continue-on-error, so that job alone does not make advisories a blocking gate.