Rust's Security Features: Building Robust, Vulnerability-Free Software

fn main() {
    let array = [1, 2, 3, 4, 5];
    
    // Safe access with bounds checking
    for i in 0..array.len() {
        println!("Element at index {}: {}", i, array[i]);
    }
    
    // This would cause a compile-time error
    // let element = array[10];
    
    // This would cause a runtime panic, not a security vulnerability
    // let index = 10;
    // let element = array[index];
}

fn main() {
    // This code will not compile in Rust
    let mut data = vec![1, 2, 3];
    let data_ptr = &data[0];
    
    data.clear(); // This empties the vector
    
    // This line would cause a use-after-free in C/C++
    // But Rust prevents it at compile time
    // println!("Value: {}", *data_ptr);
}

fn string_example() {
    let s1 = String::from("hello");
    let s2 = s1; // Ownership moved here
    
    // This would be a use-after-free in C/C++
    // But Rust prevents it at compile time
    // println!("{}", s1); // Error: value borrowed after move
}

fn main() {
    // In C/C++, this could lead to a double-free
    let s = String::from("hello");
    
    // In Rust, ownership is moved to the function
    takes_ownership(s);
    
    // This would cause a compile-time error
    // takes_ownership(s); // Error: use of moved value
}

fn takes_ownership(s: String) {
    println!("{}", s);
    // `s` is automatically freed when it goes out of scope
}

fn main() {
    // Instead of nullable pointers, Rust uses Option
    let name: Option<String> = Some(String::from("Alice"));
    
    // Safe handling with pattern matching
    match name {
        Some(n) => println!("Name: {}", n),
        None => println!("No name provided"),
    }
    
    // Or with the if let syntax
    if let Some(n) = name {
        println!("Name: {}", n);
    }
    
    // This would cause a compile-time error
    // let force_unwrap = name.unwrap(); // This would panic if name is None
}

// Functions clearly indicate when they might return nothing
fn find_user(id: u64) -> Option<User> {
    if id == 0 {
        None
    } else {
        Some(User { id, name: String::from("User") })
    }
}

struct User {
    id: u64,
    name: String,
}

use std::thread;

// This struct is automatically Send because all its fields are Send
struct Message {
    id: u64,
    content: String,
}

fn main() {
    let message = Message {
        id: 1,
        content: String::from("Hello from another thread!"),
    };
    
    // We can safely send the message to another thread
    let handle = thread::spawn(move || {
        println!("Received message {}: {}", message.id, message.content);
    });
    
    handle.join().unwrap();
}

// Some types are not Send, like Rc<T>
// This would not compile:
/*
use std::rc::Rc;

fn send_rc() {
    let data = Rc::new(42);
    
    thread::spawn(move || {
        println!("Rc in thread: {}", data);
    });
}
*/

use std::sync::{Arc, Mutex};
use std::thread;

fn main() {
    // Arc (Atomic Reference Counting) is a thread-safe version of Rc
    // Mutex provides mutual exclusion
    let counter = Arc::new(Mutex::new(0));
    let mut handles = vec![];
    
    for _ in 0..10 {
        let counter = Arc::clone(&counter);
        let handle = thread::spawn(move || {
            let mut num = counter.lock().unwrap();
            *num += 1;
        });
        handles.push(handle);
    }
    
    for handle in handles {
        handle.join().unwrap();
    }
    
    println!("Result: {}", *counter.lock().unwrap());
}

use std::thread;

fn main() {
    let mut data = vec![1, 2, 3];
    
    // This would cause a data race in C/C++
    // But Rust prevents it at compile time
    /*
    let handle = thread::spawn(|| {
        data.push(4); // Error: cannot move `data` into closure
    });
    
    data.push(5);
    
    handle.join().unwrap();
    */
    
    // Correct way: use move semantics
    let handle = thread::spawn(move || {
        // data is now owned by this thread
        println!("Data in thread: {:?}", data);
    });
    
    // This would cause a compile-time error
    // data.push(5); // Error: use of moved value
    
    handle.join().unwrap();
}

// A safe wrapper around a raw pointer
struct SafeWrapper<T> {
    ptr: *mut T,
    len: usize,
}

impl<T> SafeWrapper<T> {
    // Safe constructor
    fn new(vec: Vec<T>) -> Self {
        let mut vec = std::mem::ManuallyDrop::new(vec);
        SafeWrapper {
            ptr: vec.as_mut_ptr(),
            len: vec.len(),
        }
    }
    
    // Safe access method
    fn get(&self, index: usize) -> Option<&T> {
        if index < self.len {
            // Safety: We've checked that the index is within bounds
            unsafe { Some(&*self.ptr.add(index)) }
        } else {
            None
        }
    }
}

impl<T> Drop for SafeWrapper<T> {
    fn drop(&mut self) {
        // Safety: We're reconstructing the Vec with the original pointer and length
        unsafe {
            Vec::from_raw_parts(self.ptr, self.len, self.len);
        }
        // The reconstructed Vec will be dropped automatically
    }
}

fn main() {
    let wrapper = SafeWrapper::new(vec![1, 2, 3, 4, 5]);
    
    // Safe access
    if let Some(value) = wrapper.get(2) {
        println!("Value at index 2: {}", value);
    }
    
    // Out-of-bounds access returns None, not undefined behavior
    if let Some(value) = wrapper.get(10) {
        println!("Value at index 10: {}", value);
    } else {
        println!("Index 10 is out of bounds");
    }
}

fn main() {
    let mut num = 5;
    
    // Create a raw pointer
    let ptr = &mut num as *mut i32;
    
    // Dereference a raw pointer
    unsafe {
        *ptr = 10;
    }
    
    println!("num: {}", num);
}

// Example of a safe abstraction with minimal unsafe code
fn copy_memory<T: Copy>(src: &[T], dst: &mut [T]) -> Result<(), &'static str> {
    if src.len() > dst.len() {
        return Err("Source slice is larger than destination");
    }
    
    // Safety: We've verified that dst is large enough to hold all elements from src
    unsafe {
        std::ptr::copy_nonoverlapping(
            src.as_ptr(),
            dst.as_mut_ptr(),
            src.len()
        );
    }
    
    Ok(())
}

use std::fs::File;
use std::io::{self, Read};

fn read_file(path: &str) -> Result<String, io::Error> {
    let mut file = File::open(path)?;
    let mut content = String::new();
    file.read_to_string(&mut content)?;
    Ok(content)
}

fn main() {
    match read_file("config.txt") {
        Ok(content) => println!("File content: {}", content),
        Err(e) => eprintln!("Error reading file: {}", e),
    }
    
    // Using the ? operator in main
    if let Err(e) = read_file_and_process() {
        eprintln!("Application error: {}", e);
        std::process::exit(1);
    }
}

fn read_file_and_process() -> Result<(), io::Error> {
    let content = read_file("data.txt")?;
    // Process content
    println!("Successfully processed file with {} bytes", content.len());
    Ok(())
}

use std::fmt;

// A type for securely handling passwords
struct Password {
    value: String,
}

impl Password {
    fn new(value: String) -> Self {
        Password { value }
    }
    
    fn verify(&self, attempt: &str) -> bool {
        // In a real implementation, you would use a secure comparison
        // to prevent timing attacks
        self.value == attempt
    }
    
    // Securely clear the password when it's no longer needed
    fn clear(&mut self) {
        // Replace with zeros
        self.value.clear();
        self.value.shrink_to_fit();
    }
}

// Prevent accidental logging of passwords
impl fmt::Debug for Password {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "Password([REDACTED])")
    }
}

impl fmt::Display for Password {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        write!(f, "[REDACTED]")
    }
}

// Automatically clear the password when it's dropped
impl Drop for Password {
    fn drop(&mut self) {
        self.clear();
    }
}

fn main() {
    let password = Password::new("secret123".to_string());
    
    // This will not expose the password
    println!("Debug: {:?}", password);
    println!("Display: {}", password);
    
    // Verify a login attempt
    if password.verify("wrong_password") {
        println!("Login successful");
    } else {
        println!("Login failed");
    }
    
    // Password is automatically cleared when it goes out of scope
}

use regex::Regex;

fn validate_username(username: &str) -> bool {
    // Username must be 3-20 characters and contain only alphanumeric characters and underscores
    let re = Regex::new(r"^[a-zA-Z0-9_]{3,20}$").unwrap();
    re.is_match(username)
}

fn validate_email(email: &str) -> bool {
    // Simple email validation
    let re = Regex::new(r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$").unwrap();
    re.is_match(email)
}

fn process_user_registration(username: &str, email: &str) -> Result<(), &'static str> {
    if !validate_username(username) {
        return Err("Invalid username format");
    }
    
    if !validate_email(email) {
        return Err("Invalid email format");
    }
    
    // Process registration
    println!("Registering user: {}, Email: {}", username, email);
    Ok(())
}

fn main() {
    let result = process_user_registration("alice_123", "[email protected]");
    println!("Registration result: {:?}", result);
    
    let result = process_user_registration("bob!", "invalid-email");
    println!("Registration result: {:?}", result);
}

# Install cargo-audit
cargo install cargo-audit

# Check for vulnerabilities
cargo audit

# Example output:
# Scanning Cargo.lock for vulnerabilities...
# Warning: 1 vulnerability found!
# ID:       RUSTSEC-2020-0036
# Crate:    time
# Version:  0.1.42
# Date:     2020-11-18
# Title:    Potential segfault in localtime_r invocations
# Solution: Upgrade to >=0.2.23

// Example of a function that could be fuzzed
fn parse_data(input: &[u8]) -> Result<u32, &'static str> {
    if input.len() < 4 {
        return Err("Input too short");
    }
    
    let value = u32::from_le_bytes([input[0], input[1], input[2], input[3]]);
    
    if value > 10000 {
        return Err("Value too large");
    }
    
    Ok(value)
}

// Using cargo-fuzz (in a separate fuzz crate)
/*
#![no_main]
use libfuzzer_sys::fuzz_target;

fuzz_target!(|data: &[u8]| {
    let _ = my_crate::parse_data(data);
});
*/

# Install clippy
rustup component add clippy

# Run clippy with additional security lints
cargo clippy -- -W clippy::all -W clippy::pedantic -W clippy::nursery

# Example output:
# warning: this creates a temporary which is immediately dropped
#   --> src/main.rs:10:13
#    |
# 10 |     let _ = String::from("hello").len();
#    |             ^^^^^^^^^^^^^^^^^^^^^^^^
#    |
#    = help: consider using a `let` binding to create a longer lived value

// Example inspired by the ring cryptography library
use ring::rand::{SecureRandom, SystemRandom};
use ring::signature::{self, KeyPair, Ed25519KeyPair};

fn generate_key_pair() -> Result<(Vec<u8>, Ed25519KeyPair), &'static str> {
    // Generate a secure random seed
    let rng = SystemRandom::new();
    let mut seed = vec![0u8; 32];
    rng.fill(&mut seed).map_err(|_| "Failed to generate random seed")?;
    
    // Generate a key pair from the seed
    let key_pair = Ed25519KeyPair::from_seed_unchecked(&seed)
        .map_err(|_| "Failed to generate key pair")?;
    
    // Extract the public key
    let public_key = key_pair.public_key().as_ref().to_vec();
    
    Ok((public_key, key_pair))
}

fn sign_message(key_pair: &Ed25519KeyPair, message: &[u8]) -> Vec<u8> {
    key_pair.sign(message).as_ref().to_vec()
}

fn verify_signature(public_key: &[u8], message: &[u8], signature: &[u8]) -> bool {
    let public_key = signature::UnparsedPublicKey::new(
        &signature::ED25519,
        public_key,
    );
    
    public_key.verify(message, signature).is_ok()
}

use std::net::{TcpListener, TcpStream};
use std::io::{Read, Write};
use std::thread;

fn handle_client(mut stream: TcpStream) {
    // Limit the size of the buffer to prevent DoS attacks
    let mut buffer = [0; 1024];
    
    // Read from the stream with proper error handling
    match stream.read(&mut buffer) {
        Ok(size) => {
            // Process the request
            let request = String::from_utf8_lossy(&buffer[..size]);
            println!("Received request: {}", request);
            
            // Send a response
            let response = "HTTP/1.1 200 OK\r\n\r\nHello, World!";
            if let Err(e) = stream.write(response.as_bytes()) {
                eprintln!("Failed to send response: {}", e);
            }
        }
        Err(e) => {
            eprintln!("Failed to read from connection: {}", e);
        }
    }
}

fn main() -> std::io::Result<()> {
    let listener = TcpListener::bind("127.0.0.1:8080")?;
    println!("Server listening on port 8080");
    
    for stream in listener.incoming() {
        match stream {
            Ok(stream) => {
                // Spawn a new thread for each connection
                thread::spawn(|| {
                    handle_client(stream);
                });
            }
            Err(e) => {
                eprintln!("Connection failed: {}", e);
            }
        }
    }
    
    Ok(())
}

// Bad: Large unsafe block with mixed concerns
unsafe fn process_data(ptr: *mut u8, len: usize) {
    // Lots of code that doesn't all need to be unsafe
    let slice = std::slice::from_raw_parts_mut(ptr, len);
    for item in slice {
        *item += 1;
    }
}

// Good: Minimal unsafe block with clear documentation
/// Creates a mutable slice from a raw pointer and length.
///
/// # Safety
///
/// The caller must ensure that:
/// - `ptr` points to a valid memory region of at least `len` bytes
/// - The memory region is properly aligned for `u8`
/// - The memory region is not accessed by other code while this slice exists
unsafe fn create_slice<'a>(ptr: *mut u8, len: usize) -> &'a mut [u8] {
    std::slice::from_raw_parts_mut(ptr, len)
}

fn process_data(ptr: *mut u8, len: usize) {
    // Only the slice creation is unsafe
    let slice = unsafe { create_slice(ptr, len) };
    
    // The rest is safe code
    for item in slice {
        *item += 1;
    }
}

// Using newtype pattern for type safety
#[derive(Debug, Clone, PartialEq, Eq)]
struct SanitizedHtml(String);

impl SanitizedHtml {
    fn new(input: &str) -> Result<Self, &'static str> {
        // Perform HTML sanitization
        let sanitized = sanitize_html(input)?;
        Ok(SanitizedHtml(sanitized))
    }
    
    fn as_str(&self) -> &str {
        &self.0
    }
}

// Function that only accepts sanitized HTML
fn render_html(html: SanitizedHtml) {
    println!("Rendering HTML: {}", html.as_str());
}

fn sanitize_html(input: &str) -> Result<String, &'static str> {
    // In a real implementation, this would use a proper HTML sanitizer
    if input.contains("<script>") {
        return Err("HTML contains script tag");
    }
    Ok(input.replace("<", "&lt;").replace(">", "&gt;"))
}

fn main() {
    // This will fail sanitization
    let result = SanitizedHtml::new("<script>alert('XSS')</script>");
    println!("Sanitization result: {:?}", result);
    
    // This will pass sanitization
    let safe_html = SanitizedHtml::new("<p>Hello, World!</p>").unwrap();
    render_html(safe_html);
    
    // This would not compile:
    // render_html(String::from("<p>Unsafe</p>"));
}

use serde::{Deserialize, Serialize};
use validator::{Validate, ValidationError};

#[derive(Debug, Serialize, Deserialize, Validate)]
struct User {
    #[validate(length(min = 3, max = 20, message = "Username must be 3-20 characters"))]
    username: String,
    
    #[validate(email(message = "Invalid email address"))]
    email: String,
    
    #[validate(length(min = 8, message = "Password must be at least 8 characters"))]
    #[validate(custom = "validate_password_strength")]
    password: String,
}

fn validate_password_strength(password: &str) -> Result<(), ValidationError> {
    let has_uppercase = password.chars().any(|c| c.is_uppercase());
    let has_lowercase = password.chars().any(|c| c.is_lowercase());
    let has_digit = password.chars().any(|c| c.is_digit(10));
    let has_special = password.chars().any(|c| !c.is_alphanumeric());
    
    if has_uppercase && has_lowercase && has_digit && has_special {
        Ok(())
    } else {
        Err(ValidationError::new(
            "Password must contain uppercase, lowercase, digit, and special characters"
        ))
    }
}

fn process_registration(json: &str) -> Result<(), String> {
    // Parse JSON
    let user: User = serde_json::from_str(json)
        .map_err(|e| format!("Invalid JSON: {}", e))?;
    
    // Validate the user data
    user.validate()
        .map_err(|e| format!("Validation error: {}", e))?;
    
    // Process the registration
    println!("User registered: {}", user.username);
    Ok(())
}