Zennoxa Shield
Rules / Rust
SHIELD-RUST-002

SQL injection via diesel sql_query with format!

criticalRustCWE-89CVSS 9.8

What it detects

diesel::sql_query built from format! interpolates untrusted values into raw SQL.

How to fix

Bind parameters with .bind() rather than interpolating into the SQL string.

Vulnerable — Shield flags thissrc/report.rs
use diesel::prelude::*;
use diesel::sql_query;

const USER_QUERY: &str = "SELECT * FROM users";

fn find_user(conn: &mut PgConnection, name: &str) -> QueryResult<usize> {
    sql_query(format!("{} WHERE name = '{}'", USER_QUERY, name)).execute(conn)
}
Fixed — scans cleansrc/report.rs
use diesel::prelude::*;
use diesel::sql_query;
use diesel::sql_types::Text;

fn find_user(conn: &mut PgConnection, name: &str) -> QueryResult<usize> {
    sql_query("SELECT * FROM users WHERE name = $1")
        .bind::<Text, _>(name)
        .execute(conn)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-002: SQL injection via diesel sql_query with format! — Zennoxa Shield