Unicode Normalization in Actix

Unicode normalization attacks in Actix applications typically exploit how the framework handles Unicode input before routing and parameter extraction. Actix uses the actix-web crate's built-in parameter extraction, which relies on Rust's standard library for string handling. This creates specific vulnerability patterns when applications use path parameters or query strings containing Unicode characters.

use actix_web::{web, App, HttpServer, Responder};

async fn get_user(
    web::Path((username,)): web::Path<(String,)>, 
) -> impl Responder {
    // Unicode normalization attack: 
    // é (e + combining acute) vs é (precomposed)
    // Both may resolve to same user ID in database
    format!("User: {}", username)
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .service(web::resource("/users/{username}")
                .route(web::get().to(get_user)))
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

The vulnerability occurs because Actix's path parameter extraction uses Rust's String type, which doesn't automatically normalize Unicode. An attacker can craft requests using different Unicode representations that the application's database or business logic may treat as identical, but Actix's routing treats as distinct paths.

Common attack patterns include:

• Precomposed vs decomposed characters: é vs é
• Full-width vs half-width characters: A vs Ａ
• Mathematical vs standard characters: x vs x
• Zero-width characters for obfuscation

Database queries become vulnerable when the application doesn't normalize before lookup. An attacker can bypass authorization by using Unicode variants that the database normalizes but Actix's routing doesn't:

async fn get_private_data(
    web::Path((id,)): web::Path<(String,)>, 
) -> impl Responder {
    // Vulnerable: ID '1234' vs Unicode variant '1234' 
    // may return different results
    let record = sqlx::query!("SELECT * FROM private_data WHERE id = $1", id)
        .fetch_one(pool)
        .await;
    
    // Authorization bypass possible if database normalizes
    // but Actix routing doesn't
    if record.is_ok() {
        return HttpResponse::Ok().json(record.unwrap());
    }
    
    HttpResponse::NotFound().finish()
}

Detecting Unicode normalization issues in Actix applications requires examining both the application code and runtime behavior. The middleBrick API security scanner includes specific checks for Actix applications by analyzing the unauthenticated attack surface and identifying patterns where Unicode input flows into security-critical operations.

middleBrick's detection methodology for Actix includes:

1. Route pattern analysis to identify path parameters that accept arbitrary strings
2. Parameter extraction code scanning for Unicode handling gaps
3. Database query analysis to detect unnormalized inputs
4. Active probing with Unicode variants to test for normalization inconsistencies

The scanner tests Actix endpoints with Unicode normalization variations:

# Example middleBrick scan targeting Actix Unicode issues
middlebrick scan https://api.example.com/users/
    --tests normalization,bfla,bolas
    --output json

# Results show Unicode variant testing:
{
  "normalization": {
    "status": "vulnerable",
    "description": "Unicode normalization bypass detected",
    "severity": "high",
    "remediation": "Normalize all Unicode input before processing"
  }
}

Manual detection techniques for Actix developers:

use unicode_normalization::UnicodeNormalization;

// Test your Actix endpoints with Unicode variants
fn test_unicode_variants() {
    let variants = vec![
        "useré",           // precomposed
        "usé",           // decomposed
        "user%EF%BC%A1",     // full-width
        "userａ",        // mathematical
    ];
    
    for variant in variants {
        // Send requests to Actix endpoint
        // Check if different variants produce same result
    }
}

middleBrick's LLM security checks are particularly relevant for Actix applications using AI features, as Unicode attacks can also target prompt injection scenarios where Unicode characters might bypass input sanitization.

Remediating Unicode normalization issues in Actix requires implementing consistent normalization at the application layer before any security-sensitive operations. The most effective approach uses Rust's unicode-normalization crate combined with Actix's middleware system.

use actix_web::{dev::ServiceRequest, dev::ServiceResponse, HttpMessage};
use unicode_normalization::UnicodeNormalization;
use actix_web::middleware::NormalizePath;

// Custom middleware for Unicode normalization
pub struct UnicodeNormalizer;

impl actix_web::middleware::Transform for UnicodeNormalizer {
    type Request = ServiceRequest;
    type Response = ServiceResponse;
    type Error = actix_web::Error;
    type InitError = ();
    type Transform = UnicodeNormalizerMiddleware;
    
    fn new_transform(&self, service: actix_web::middleware::Service) -> Self::Transform {
        UnicodeNormalizerMiddleware { service }
    }
}

pub struct UnicodeNormalizerMiddleware {
    service: actix_web::middleware::Service,
}

impl actix_web::middleware::Service for UnicodeNormalizerMiddleware {
    type Response = ServiceResponse;
    type Error = actix_web::Error;
    type Future = actix_web::middleware::ServiceFuture;
    
    actix_web::middleware::forward_ready!();
    
    fn call(&mut self, req: ServiceRequest) -> Self::Future {
        // Normalize path parameters
        let path = req.path().nfc().collect::();
        let query = req.query_string().nfc().collect::();
        
        // Create new request with normalized components
        let new_req = req.into_parts();
        // Reconstruct request (simplified)
        
        // Continue with normalized request
        Box::pin(self.service.call(req))
    }
}

// Apply middleware in main
#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .wrap(UnicodeNormalizer)
            .service(web::resource("/users/{username}")
                .route(web::get().to(get_user)))
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

Database-level normalization ensures consistency across the application stack:

use sqlx::postgres::PgPool;
use unicode_normalization::UnicodeNormalization;

async fn get_user_by_id(
    pool: &PgPool, 
    id: &str
) -> Result {
    // Normalize before database query
    let normalized_id = id.nfc().collect::();
    
    sqlx::query_as!("SELECT * FROM users WHERE id = $1", normalized_id)
        .fetch_one(pool)
        .await
}

For Actix applications using JSON bodies with Unicode fields:

use serde::{Deserialize, Serialize};
use unicode_normalization::UnicodeNormalization;

#[derive(Serialize, Deserialize)]
struct UserData {
    #[serde(default)]
    username: String,
    #[serde(default)]
    email: String,
}

// Normalize before processing
async fn create_user(
    json: web::Json,
) -> impl Responder {
    let normalized = UserData {
        username: json.username.nfc().collect::(),
        email: json.email.nfc().collect::(),
    };
    
    // Process normalized data
    HttpResponse::Created().json(normalized)
}