Sample: Rust — see SquidGate detect findings

[DotNetRussell]

SquidGate language sample — Rust

This PR intentionally introduces insecure patterns so you can see SquidGate work on Rust:

• Hardcoded secret / credential
• Injection and/or dangerous API usage

File

examples/rust/demo.rs

What to look for

1. Check run named SquidGate
2. Line annotations on the sample file
3. PR comment summarizing findings
4. Check failure when severity ≥ block_on (default high)

Demo only. Do not merge these patterns into production apps.

All language samples · Setup SquidGate on your repo

[github-actions]

🛡️ Security Scan Results

The diff adds a new demo file containing multiple high-severity injection vulnerabilities and a hardcoded secret.

⛔ 3 finding(s) block merge.

HIGH — Hardcoded Credential

File: examples/rust/demo.rs:4 | Confidence: high

A secret API key is hardcoded directly in the source code as a constant, exposing it to anyone with access to the repository or compiled binary.

CWE: CWE-798 | OWASP: A07:2021

Recommendation: Remove the hardcoded value and load secrets from environment variables or a secure secrets manager (e.g., using std::env::var).

---

HIGH — SQL Injection via String Formatting

File: examples/rust/demo.rs:6 | Confidence: high

User-controlled input 'id' is directly interpolated into a SQL query string using format!, enabling SQL injection attacks if this string is executed against a database.

CWE: CWE-89 | OWASP: A03:2021

Recommendation: Use parameterized queries or prepared statements from the database driver (e.g., sqlx or diesel) instead of manual string concatenation.

---

HIGH — OS Command Injection

File: examples/rust/demo.rs:11 | Confidence: high

User input is concatenated into a shell command using format! and executed via sh -c, allowing arbitrary command execution.

CWE: CWE-78 | OWASP: A03:2021

Recommendation: Avoid spawning shells with user input. Use Command::new with separate arguments (no -c) or validate/sanitize input if shell is unavoidable.

---