Struct SafeText 

pub struct SafeText(/* private fields */);

Text that is safe to render into a log line or an error message.

Guaranteed to contain no control characters and no bidirectional-formatting overrides, and to be bounded by MAX_SAFE_TEXT_CHARS characters. See the module docs for why this is a type.

use dig_nat::SafeText;

// A stranger's newline cannot become a line break in your log.
let hostile = SafeText::from_untrusted("ok\nERROR forged");
assert_eq!(hostile.as_str(), "ok\\nERROR forged");

// Your own literals pass through untouched.
assert_eq!(SafeText::from_static("no route to peer").as_str(), "no route to peer");

Implementations

impl SafeText

pub fn from_static(literal: &'static str) -> Self

Accept text this crate wrote itself.

The &'static str bound is the check: a message a peer sent arrives in a heap String with a runtime lifetime and cannot be passed here, so this door stays open for source literals without also being open to the wire.

pub fn from_untrusted(text: impl AsRef<str>) -> Self

Accept text of unknown provenance, neutralizing it on the way in.

Control characters and bidi-formatting characters are ESCAPED rather than deleted, so the text stays diagnosable while becoming exactly one line, and the result is truncated to MAX_SAFE_TEXT_CHARS.

This closes log injection. It does NOT make the content trustworthy or non-attacker-chosen — if the text came from a peer, a reader still sees what the peer chose. Where that itself is the problem, do not echo the input at all: see Self::describing_json_error.

pub fn describing_json_error(error: &Error) -> Self

Describe a serde_json decode failure without quoting the input that caused it.

serde_json’s own message embeds the offending value verbatim (invalid type: string "…", expected u64, unknown variant `…` ). That is a gift to a developer and a channel to a stranger, so on a peer wire the message is rebuilt from what the error KNOWS rather than from what it was given: the failure category plus the line and column. A developer still learns whether the frame was malformed JSON or well-formed JSON of the wrong shape, and exactly where — which is what actually helps — while the peer’s bytes never enter the string.

use dig_nat::SafeText;

let err = serde_json::from_str::<u64>("\"secret-from-a-stranger\"").unwrap_err();
let described = SafeText::describing_json_error(&err);

assert!(!described.as_str().contains("secret-from-a-stranger"));
assert!(described.as_str().contains("line 1"));

pub fn as_str(&self) -> &str

The sanitized text.

Trait Implementations

impl Clone for SafeText

fn clone(&self) -> SafeText

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SafeText

Renders exactly like Display, on purpose.

Debug reaches a log at least as often as Display does — {:?} on a Result, an unwrap panic, a tracing field — so a derived Debug that dumped the inner String would reopen the hole a careful Display had just closed. The inner value is already safe, so there is nothing to gain from a second rendering of it and everything to lose from a leaky one.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SafeText

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for SafeText

impl From<&'static str> for SafeText

fn from(literal: &'static str) -> Self

Converts to this type from the input type.

impl Hash for SafeText

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for SafeText

fn cmp(&self, other: &SafeText) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for SafeText

fn eq(&self, other: &SafeText) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for SafeText

fn partial_cmp(&self, other: &SafeText) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl StructuralPartialEq for SafeText