Module safe_link 

The href type.

This is its own module because of the tuple field. A private field is private to the MODULE, and web.rs is a single ~9,000-line file holding every EntryRow construction — so while the type lived there, SafeLink("javascript:alert(1)") compiled and rendered verbatim into an href. An adversarial review demonstrated exactly that, five different ways. Here the field is unreachable from web.rs, which is what makes “no bypass” structural rather than aspirational.

Structs

SafeLink

A string that is safe to place in an href.