Cursor rule

1---
2paths:
3  - "**/*.rs"
4---
5# Rust Security
6 
7> This file extends [common/security.md](../common/security.md) with Rust-specific content.
8 
9## Secrets Management
10 
11- Never hardcode API keys, tokens, or credentials in source code
12- Use environment variables: `std::env::var("API_KEY")`
13- Fail fast if required secrets are missing at startup
14- Keep `.env` files in `.gitignore`
15 
16```rust
17// BAD
18const API_KEY: &str = "sk-abc123...";
19 
20// GOOD — environment variable with early validation
21fn load_api_key() -> anyhow::Result<String> {
22    std::env::var("PAYMENT_API_KEY")
23        .context("PAYMENT_API_KEY must be set")
24}
25```
26 
27## SQL Injection Prevention
28 
29- Always use parameterized queries — never format user input into SQL strings
30- Use query builder or ORM (sqlx, diesel, sea-orm) with bind parameters
31 
32```rust
33// BAD — SQL injection via format string
34let query = format!("SELECT * FROM users WHERE name = '{name}'");
35sqlx::query(&query).fetch_one(&pool).await?;
36 
37// GOOD — parameterized query with sqlx
38// Placeholder syntax varies by backend: Postgres: $1  |  MySQL: ?  |  SQLite: $1
39sqlx::query("SELECT * FROM users WHERE name = $1")
40    .bind(&name)
41    .fetch_one(&pool)
42    .await?;
43```
44 
45## Input Validation
46 
47- Validate all user input at system boundaries before processing
48- Use the type system to enforce invariants (newtype pattern)
49- Parse, don't validate — convert unstructured data to typed structs at the boundary
50- Reject invalid input with clear error messages
51 
52```rust
53// Parse, don't validate — invalid states are unrepresentable
54pub struct Email(String);
55 
56impl Email {
57    pub fn parse(input: &str) -> Result<Self, ValidationError> {
58        let trimmed = input.trim();
59        let at_pos = trimmed.find('@')
60            .filter(|&p| p > 0 && p < trimmed.len() - 1)
61            .ok_or_else(|| ValidationError::InvalidEmail(input.to_string()))?;
62        let domain = &trimmed[at_pos + 1..];
63        if trimmed.len() > 254 || !domain.contains('.') {
64            return Err(ValidationError::InvalidEmail(input.to_string()));
65        }
66        // For production use, prefer a validated email crate (e.g., `email_address`)
67        Ok(Self(trimmed.to_string()))
68    }
69 
70    pub fn as_str(&self) -> &str {
71        &self.0
72    }
73}
74```
75 
76## Unsafe Code
77 
78- Minimize `unsafe` blocks — prefer safe abstractions
79- Every `unsafe` block must have a `// SAFETY:` comment explaining the invariant
80- Never use `unsafe` to bypass the borrow checker for convenience
81- Audit all `unsafe` code during review — it is a red flag without justification
82- Prefer `safe` FFI wrappers around C libraries
83 
84```rust
85// GOOD — safety comment documents ALL required invariants
86let widget: &Widget = {
87    // SAFETY: `ptr` is non-null, aligned, points to an initialized Widget,
88    // and no mutable references or mutations exist for its lifetime.
89    unsafe { &*ptr }
90};
91 
92// BAD — no safety justification
93unsafe { &*ptr }
94```
95 
96## Dependency Security
97 
98- Run `cargo audit` to scan for known CVEs in dependencies
99- Run `cargo deny check` for license and advisory compliance
100- Use `cargo tree` to audit transitive dependencies
101- Keep dependencies updated — set up Dependabot or Renovate
102- Minimize dependency count — evaluate before adding new crates
103 
104```bash
105# Security audit
106cargo audit
107 
108# Deny advisories, duplicate versions, and restricted licenses
109cargo deny check
110 
111# Inspect dependency tree
112cargo tree
113cargo tree -d  # Show duplicates only
114```
115 
116## Error Messages
117 
118- Never expose internal paths, stack traces, or database errors in API responses
119- Log detailed errors server-side; return generic messages to clients
120- Use `tracing` or `log` for structured server-side logging
121 
122```rust
123// Map errors to appropriate status codes and generic messages
124// (Example uses axum; adapt the response type to your framework)
125match order_service.find_by_id(id) {
126    Ok(order) => Ok((StatusCode::OK, Json(order))),
127    Err(ServiceError::NotFound(_)) => {
128        tracing::info!(order_id = id, "order not found");
129        Err((StatusCode::NOT_FOUND, "Resource not found"))
130    }
131    Err(e) => {
132        tracing::error!(order_id = id, error = %e, "unexpected error");
133        Err((StatusCode::INTERNAL_SERVER_ERROR, "Internal server error"))
134    }
135}
136```
137 
138## References
139 
140See skill: `rust-patterns` for unsafe code guidelines and ownership patterns.
141See skill: `security-review` for general security checklists.
142