Skip to content
Critiq Docs

Search docs

Search documentation pages and rules

security.error-handling

Avoid panicking on request-derived data in Rocket handlers

Rocket route handlers should not `unwrap`, `expect`, or otherwise panic on values derived from the HTTP request.

#Metadata

Rule ID
rust.security.rocket-panic-prone-request-handler
Severity
medium
Confidence
0.74
Languages
rust
Presets
security, strict
Stability
experimental
Applies to
block
Tags
rocket, rules-catalog, rust, security

#Why it matters

Panics become hard failures and can be abused for denial-of-service or to leak error detail; prefer `Result` and typed rejections.

#Remediation

Return `Result`, `Option`, or `status::Custom`, map errors to HTTP responses, and reserve `unwrap` for tests or statically known invariants.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/rust/rust.security.rocket-panic-prone-request-handler.rule.yaml.