CodeQL fails to detect rust/insecure-cookie in Rust code #3915

Activity

1. hvitved commented on May 19, 2026

   

   hvitved

   on May 19, 2026

   More actions

   Hi 👋

   I tried to replicate, but it works fine on my end (on macOS). Here is the cargo.toml file I use

   [package]
   name = "cookie-test"
   version = "0.1.0"
   edition = "2024"
   
   [dependencies]
   cookie = { version = "0.18.1", features = ["percent-encode", "signed", "private"] }
   biscotti = { version = "0.4.3" }
   actix-web = { version = "4", features = ["cookies"] }
   poem = { version = "3", features = ["cookie", "session"] }
   http-types = { version = "2", features = ["cookies"] }
   

   and the main.rs file:

   use cookie::Cookie;
   
   fn main() {
       println!("Hello, world!");
   
       // BAD: creating a cookie without specifying the `secure` attribute
       let cookie = Cookie::build(("session", "abcd1234")).build();
       let mut jar = cookie::CookieJar::new();
       jar.add(cookie.clone());
   }

   Which version of Rust/cargo are you using, and in which environment?
2. fabasoad commented on May 19, 2026

   

   fabasoad

   on May 19, 2026

   Author

   More actions

   Hey! Thank you for looking into this. Here is the information you asked:

   cargo.toml

   [package]
   name = "test-project"
   version = "0.1.0"
   edition = "2024"
   
   [dependencies]
   cookie = "0.18.1"

   main.rs

   use cookie::Cookie;
   
   fn main() {
     let cookie = Cookie::build(("session", "abcd1234")).build();
     let mut jar = cookie::CookieJar::new();
     jar.add(cookie.clone());
   }

   cargo --version
   cargo 1.95.0 (f2d3ce0bd 2026-03-21)
   

   My local environment: macOS Tahoe 26.4.1 arm64
   But the same behavior reproduces in GitHub Actions ubuntu envrironment

   ---

   Just tested once again:

   $ codeql database create --build-mode=none --language=rust .codeql-db
   Initializing database at.......
   
   $ codeql database analyze --format=sarifv2.1.0 --output=codeql.sarif .codeql-db
   Running queries....
   ................
   |                            Metric                            | Value |
   +--------------------------------------------------------------+-------+
   | Total number of Rust files that were extracted with errors   |     0 |
   | Total number of Rust files that were extracted without error |     1 |
   
   $ jq '.runs[].results' codeql.sarif
   []
   
3. hvitved commented on May 21, 2026

   

   hvitved

   on May 21, 2026

   More actions

   Thanks. I believe this is a (known) issue with Rust 1.95.0; as a workaround, if you use 1.94.0, things should work again.
4. fabasoad commented on May 22, 2026

   

   fabasoad

   on May 22, 2026

   Author

   More actions

   @hvitved Thanks for the reply! Do you have an estimate for when it will be fixed for Rust 1.95.0?
5. hvitved commented on May 26, 2026

   

   hvitved

   on May 26, 2026

   More actions

   It should be fixed as soon as github/codeql#21714 is merged; not sure about the timeline, but I would hope it gets included with the next release.
6. fabasoad commented on May 26, 2026

   

   fabasoad

   on May 26, 2026

   Author

   More actions

   Thank you. Subscribed.