Server Side Template Injection in Actix with Dynamodb

Server Side Template Injection (SSTI) occurs when user-controlled data is embedded into a template and interpreted as code by the rendering engine. In Actix, a Rust web framework, templates are typically rendered using engines like Askama or Tera. If user input is passed directly into a template context and the template interpolates that input into expressions or queries, attackers can inject template logic that reads or manipulates runtime data.

When an Actix application uses DynamoDB as a backend and passes data from DynamoDB records into templates without strict sanitization or schema-based rendering, the combination creates a risk surface. For example, suppose a handler retrieves an item from DynamoDB and places the item’s attributes into a template context. If the template is user-influenced (for instance, selecting a view name or partial based on user input), an attacker may provide a payload that alters control flow within the template, such as accessing other item attributes or invoking filters and functions exposed by the template engine.

Consider an endpoint that takes a user-supplied template_key, retrieves a DynamoDB item, and renders a template named by that key:

async fn render_item(
    query: web::Query<RenderParams>,
    dynamodb_client: &aws_sdk_dynamodb::Client,
) -> Result<impl Responder, Error> {
    let item = dynamodb_client.get_item()
        .table_name("Items")
        .key("id", AttributeValue::S(query.id.clone()).into())
        .send()
        .await?
        .item
        .ok_or_else(|| Error::NotFound)?;

    // user-controlled template selection based on item or query parameters
    let template_name = query.template_key;
    let body = tera::Context::from_serialize(item)?; // item attributes become template context
    let rendered = tera.render(&template_name, &body)?;
    Ok(HttpResponse::Ok().body(rendered))
}

If template_key is not strictly validated, an attacker can supply a payload such as {{ 7 * 7 }} or {{ this['secret_attribute'] }} depending on the template engine. With Tera, which supports filters and object property access, an attacker may attempt to traverse object graphs or invoke unsafe filters if the context includes nested structures derived from DynamoDB’s attribute map. While Tera is generally sandboxed, misconfigurations or overly permissive template functions can expose sensitive item attributes or enable logic injection, leading to information disclosure or unauthorized behavior.

The risk is amplified when the template context mirrors the structure of DynamoDB’s AttributeValue shapes, which can contain nested maps and lists. An attacker may craft input that leverages template logic to recursively traverse these structures, bypassing assumptions that only top-level fields are exposed. Therefore, strict schema validation for template selection and context construction is essential when combining Actix, DynamoDB, and dynamic templates.

To mitigate SSTI in Actix with DynamoDB, ensure that templates are selected through a strict allowlist and that template contexts are derived from controlled, typed structures rather than raw DynamoDB attribute maps. Avoid directly serializing DynamoDB AttributeValue into template contexts. Instead, map items to well-defined data structures that expose only intended fields.

1. Use a strict allowlist for template selection

Do not use user input to determine template filenames or paths. Define a fixed set of valid templates and validate against it:

fn safe_template_key(key: &str) -> Option<&'static str> {
    match key {
        "summary" => Some("summary.html"),
        "details" => Some("details.html"),
        _ => None,
    }
}

async fn render_item(
    query: web::Query<RenderParams>,
    dynamodb_client: &aws_sdk_dynamodb::Client,
) -> Result<impl Responder, Error> {
    let item = dynamodb_client.get_item()
        .table_name("Items")
        .key("id", AttributeValue::S(query.id.clone()).into())
        .send()
        .await?
        .item
        .ok_or_else(|| Error::NotFound)?;

    let template_name = safe_template_key(&query.template_key)
        .ok_or_else(|| Error::BadRequest("invalid template"))?;

    // Convert DynamoDB item to a typed structure
    let model = ItemModel::try_from(&item)?;
    let body = tera::Context::from_serialize(&model)?;
    let rendered = tera.render(template_name, &body)?;
    Ok(HttpResponse::Ok().body(rendered))
}

2. Map DynamoDB items to typed structures

Define a serializable struct that represents only the fields you intend to expose. Use try_from to perform controlled extraction:

#[derive(serde::Serialize)]
struct ItemModel {
    id: String,
    name: String,
    created_at: String,
}

impl TryFrom<&std::collections::HashMap<String, AttributeValue>> for ItemModel {
    type Error = Error;

    fn try_from(map: &std::collections::HashMap<String, AttributeValue>) -> Result<Self, Self::Error> {
        Ok(Self {
            id: map.get("id")
                .and_then(|v| v.as_s().ok())
                .map(|s| s.to_string())
                .ok_or_else(|| Error::InvalidData("missing id"))?,
            name: map.get("name")
                .and_then(|v| v.as_s().ok())
                .map(|s| s.to_string())
                .ok_or_else(|| Error::InvalidData("missing name"))?,
            created_at: map.get("created_at")
                .and_then(|v| v.as_s().ok())
                .map(|s| s.to_string())
                .unwrap_or_else(|| "unknown".to_string()),
        })
    }
}

3. Disable unsafe template features

Configure your template engine to restrict filters and functions. For Tera, avoid enabling auto-escaping bypasses and do not register custom filters that execute logic. Treat template inputs as strictly presentation-layer constructs, never as a query or control mechanism.

4. Validate and sanitize all data from DynamoDB

Even when using typed structures, validate string lengths, character sets, and expected formats. Do not trust DynamoDB data to be well-formed if it originates from external sources. Apply allowlists for enum-like fields and use strict deserialization rules.

By combining these practices—controlled template selection, typed data mapping, and restricted template capabilities—you reduce the attack surface for SSTI while continuing to leverage Actix and DynamoDB effectively.