RustSecurityTagger

Rust-specific security tagger.

rust_auth already classifies authentication (request guards, extractors, auth middleware), so this tagger covers the other framework-level security protections that a reviewer wants to know are (or are not) in front of an endpoint. Each protection maps onto a tag whose description says whether the configuration is hardened or a risk:

• cors — CORS middleware. Permissive configs (any origin, wildcard) are flagged as a risk; restricted allow-lists are recorded as informational.
• rate-limit — request throttling (actix-governor / tower_governor / actix-limitation / tower limit).
• security-headers — hardening response headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, …).
• body-limit — request body size cap (DoS mitigation). A disabled limit is flagged as a risk.

Detection is two-pronged:

1. Source middleware — every .rs file is pre-scanned for the builder calls above. The enclosing Actix web::scope("/x") (if any) gives the URL prefix the protection applies to; app-wide middleware (App::new().wrap(..), Router::new().layer(..)) maps to / so it tags every endpoint. Test modules (#[cfg(test)]) and tests//benches//examples/ files are skipped so test-only middleware can't taint real endpoints.

2. Loco config — Loco wires its middleware in config/*.yaml (middlewares: { cors:, limit_payload:, secure_headers: }) rather than in code, so those files are parsed too and applied app-wide.

Scope mapping errs toward false negatives (a too-narrow prefix tags fewer endpoints) rather than false positives, in keeping with the rest of Noir's tagging.