AI 中文总结
本文通过对比实验，分析Rust在后端Web开发中的安全态势，发现其编译时保障在系统层占优，而Node.js和Django等托管框架在应用层内置防御更强，建议Web场景采用Rust需补充防御措施。
AI 中文摘要
Rust编程语言被广泛认可能消除整类内存安全和并发漏洞，但在实践中采用它的安全影响远不止内存安全。本文对工业场景下Rust安全态势的现有研究进行批判性综述，并将分析扩展到原始研究未覆盖的后端Web开发方向。我们首先评估了现有Rust与C、C++、Java在SANS Top 25、OWASP Top 10和《软件安全19大罪》框架下的漏洞分类的优势与局限性，发现存在实证验证有限、访谈样本量小、缺乏安全开发生命周期讨论等缺口。随后，我们采用相同的三级分类（罕见且难以利用、受保护、未受保护），对Rust与Node.js和Django进行原创性对比，针对越界写入（CWE-787）、释放后使用（CWE-416）和竞态条件（CWE-362）开展了并排代码实验。结果表明，Rust的编译时保障在系统层占优，而托管后端框架在应用层提供更强的内置防御，这表明在Web场景中采用Rust需要补充防御措施，而非仅依赖语言级安全性。
英文摘要
The Rust programming language is widely credited with eliminating entire classes of memory-safety and concurrency vulnerabilities, but the security implications of adopting it in practice extend well beyond memory safety. This paper presents a critical review of prior work on Rust's security posture in industrial settings, and extends that analysis in a direction the original study did not cover: backend web development. We first assess the strengths and limitations of the existing vulnerability classification of Rust against C, C++, and Java under the SANS Top 25, OWASP Top 10, and the 19 Deadly Sins of Software Security frameworks, identifying gaps including limited empirical validation, a small interview sample, and the absence of a secure development lifecycle discussion. We then contribute an original comparison of Rust against Node.js and Django using the same three-level classification (Rare and Difficult, Safeguarded, Unprotected), supported by side-by-side code experiments for out-of-bounds writes (CWE-787), use-after-free (CWE-416), and race conditions (CWE-362). Our results indicate that Rust's compile-time guarantees dominate at the systems layer, while managed backend frameworks offer stronger built-in defenses at the application layer, suggesting that Rust adoption in web contexts requires complementary safeguards rather than reliance on language-level safety alone.
Comments10 pages, 5 tables. Critically reviews and extends Gasiba and Amburi, "I Think This is the Beginning of a Beautiful Friendship: On the Rust Programming Language and Secure Software Development in the Industry," CYBER 2023, pp. 19-26
