Add Safety comments to unsafe blocks #2319
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
serde::de::format::Buf is a private type, so this makes it explicit by declaring the type `pub(super)`. In addition, it marks the function `Buf::as_str` as unsafe, which lets us document the callsites with `// Safety: ...` comments to explain why it is safe to use.
This changes a comment to be explicit on how it's safe we can avoid validating UTF-8.
dtolnay
reviewed
Nov 11, 2022
| Buf { bytes, offset: 0 } | ||
| } | ||
|
|
||
| pub fn as_str(&self) -> &str { | ||
| pub(super) unsafe fn as_str(&self) -> &str { |
There was a problem hiding this comment.
- It changes
Buf::as_str()to be unsafe, since it relies on the caller to only write UTF-8 into the buffer.
The API enforces that the caller only wrote UTF-8 into the buffer.
dtolnay
approved these changes
Nov 28, 2022
| Buf { bytes, offset: 0 } | ||
| } | ||
|
|
||
| pub fn as_str(&self) -> &str { | ||
| pub(super) unsafe fn as_str(&self) -> &str { |
There was a problem hiding this comment.
I put up #2329 to be able to merge just your Buf visibility change and your // Safety: ... comment change in src/ser/impls.rs, without the as_str() safety change. We can follow up with a separate PR to document the justification for how as_str() is safe.
Thanks!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This makes some small tweaks to the unsafe blocks to make them easier to audit:
serde::de::Format::Bufto be a private type since it's already not publicly exposed.Buf::as_str()to be unsafe, since it relies on the caller to only write UTF-8 into the buffer.// Safety: ...comments to the two callsites inde::Visitorthat usesBufto write an error message withi128andu128types.// Safety: ...comment.