From 3a8bf46c2e2a554cb3d411c7d6c17c18a33b242b Mon Sep 17 00:00:00 2001 From: Chanel Young Date: Tue, 16 Jun 2026 10:49:54 -0700 Subject: [PATCH] rust: Exclude environment variables as XSS taint sources Instead of a name-based barrier on config-looking struct fields, stop treating the `environment` threat model (e.g. std::env::var) as a source for the XSS query. Environment variables hold trusted deployment configuration set at startup, not per-request attacker input. This fixes the false positive where opts.server.external_domain (loaded from the EXTERNAL_DOMAIN env var) was flagged as XSS in an HTML response, without the fragility of matching on field names. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: bf9c111e-51cd-4c12-aeaa-cdcf1592f0f7 --- .../2026-06-16-xss-exclude-environment-sources.md | 4 ++++ rust/ql/lib/codeql/rust/security/XssExtensions.qll | 9 ++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 rust/ql/lib/change-notes/2026-06-16-xss-exclude-environment-sources.md diff --git a/rust/ql/lib/change-notes/2026-06-16-xss-exclude-environment-sources.md b/rust/ql/lib/change-notes/2026-06-16-xss-exclude-environment-sources.md new file mode 100644 index 000000000000..37988c96d1ec --- /dev/null +++ b/rust/ql/lib/change-notes/2026-06-16-xss-exclude-environment-sources.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* The cross-site scripting (XSS) query no longer treats environment variables (the `environment` threat model, e.g. `std::env::var`) as a taint source. These values are trusted deployment configuration set at startup rather than per-request attacker-controlled input, so excluding them removes a class of false positives. diff --git a/rust/ql/lib/codeql/rust/security/XssExtensions.qll b/rust/ql/lib/codeql/rust/security/XssExtensions.qll index 74ed161acb09..79aa7346bac2 100644 --- a/rust/ql/lib/codeql/rust/security/XssExtensions.qll +++ b/rust/ql/lib/codeql/rust/security/XssExtensions.qll @@ -35,8 +35,15 @@ module Xss { /** * An active threat-model source, considered as a flow source. + * + * Environment variables are excluded: they hold trusted deployment + * configuration (for example the service's own hostname or public base URL, + * set from an environment variable at startup) rather than per-request, + * attacker-controlled input, so they are not a meaningful source for XSS. */ - private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { } + private class ActiveThreatModelSourceAsSource extends Source, ActiveThreatModelSource { + ActiveThreatModelSourceAsSource() { not this.getThreatModel() = "environment" } + } /** * A sink for XSS from model data.