Zennoxa Shield
Rules / Rust
SHIELD-RUST-001

SQL injection via format! in query

criticalRustCWE-89CVSS 9.8

What it detects

Building a SQL string with format! and passing it to query/execute allows injection.

How to fix

Use parameterized queries with bind parameters instead of building SQL via format!.

Vulnerable — Shield flags thissrc/db.rs
use postgres::{Client, Error};

const USER_QUERY: &str = "SELECT id, email FROM users";

fn find_user(client: &mut Client, name: &str) -> Result<(), Error> {
    let rows = client.query(&format!("{} WHERE name = '{}'", USER_QUERY, name), &[])?;
    println!("{} rows", rows.len());
    Ok(())
}
Fixed — scans cleansrc/db.rs
use postgres::{Client, Error};

fn find_user(client: &mut Client, name: &str) -> Result<(), Error> {
    let rows = client.query("SELECT id, email FROM users WHERE name = $1", &[&name])?;
    println!("{} rows", rows.len());
    Ok(())
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-001: SQL injection via format! in query — Zennoxa Shield