Struct Tainted 

pub struct Tainted<T>(/* private fields */);

Caller-controlled value that has not yet crossed a serialization boundary. Deliberately does not implement fmt::Display; the only way to project a Tainted<String> into a serialized surface is Tainted::escape_for.

Implements fmt::Debug (which tracing ?value calls) because Debug quote-wraps and escapes control bytes, so emitting a Tainted<String> via ?value is safe in a way %value is not.

The propagation rule is enforced by visibility, not by the type system: the inner field is pub(crate) so only this crate can build a Tainted<String>. Downstream crates receive Tainted<String> from ConnStringSanitizer::parse and cannot peel it; they must call Tainted::escape_for or Tainted::expose_secret (the latter named loudly to surface in review).

Implementations

impl<T> Tainted<T>

pub fn new(value: T) -> Tainted<T>

Build a Tainted from a caller-supplied value. This is the one place the type system loses ground; every site that calls it should be reviewable.

pub fn expose_secret(&self) -> &T

Escape hatch for callers that need the raw inner. Named loudly so a grep / review / lint flags it. Prefer Tainted::escape_for.

pub fn into_inner(self) -> T

Consuming variant of Tainted::expose_secret.

impl Tainted<String>

pub const MAX_ESCAPED_LEN: usize

Hard cap on the size of any escaped boundary projection. Mirrors the max_uri_bytes default in crate::conn_string (8 KiB) so a tainted value that fits the parser also fits the boundary projection.

pub fn escape_for(&self, boundary: Boundary) -> Result<EscapedFor, EscapeError>

Project the tainted value into the named Boundary’s escape contract. Returns EscapedFor tagged with the boundary, so a header setter can statically refuse a value that was escaped for a log line.

Trait Implementations

impl<T> Clone for Tainted<T>

where T: Clone,

fn clone(&self) -> Tainted<T>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T> Debug for Tainted<T>

where T: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl From<&str> for Tainted<String>

fn from(s: &str) -> Tainted<String>

Converts to this type from the input type.

impl From<String> for Tainted<String>

fn from(s: String) -> Tainted<String>

Converts to this type from the input type.

impl<T> PartialEq for Tainted<T>

where T: PartialEq,

fn eq(&self, other: &Tainted<T>) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl<T> Eq for Tainted<T>

where T: Eq,

impl<T> StructuralPartialEq for Tainted<T>