Post #1971048

2026-05-02 10:23 UTC

@zeenix If there is a database library with an API based on string manipulation instead of prepared statements, you would never touch the project. You could equally argue that lots of people write software which uses databases but never have to care about malicious inputs. Why would you provide an unsafe API when you could just provide a safe API? Opaque handles to filesystem objects are not particularly hard to abstract in a cross-platform manner. In the worst case that handle is internally just a path. The argument that a crate exists is missing the point. People use what is in the stdlib and they do not even know that they should look for something else. That would be fine if that code is never used by anyone else, but realistically re-using code is a necessity. So if you try to re-use code, you either can't because you notice at the API boundary that e.g. a function call requires a path, or you don't notice that you can't because the security issue is somewhere hidden in the implementation. For example glib uses paths for everything. If you want to trash a file the API requires you to pass a file path. I cannot use the code to trash a file and had to re-implement all of it. glib could have made it secure, we have a library for it: libglnx. It didn't help at all. The issue here is that code does not compose.

Replies (1)

@zeenix@toot.cat 2026-05-02 12:18

@swick Thanks for your detailed response. I appreciate it. > If there is a database library with an API based on string manipulation instead of prepared statements, you would never touch the project. You could equally argue that lots of people write software which uses databases but never have to care about malicious inputs. That's a very incorrect analogy. Not caring about something is very different than not **having** to care about something. The issue is question does not affect the vast majority of the software out there. > Opaque handles to filesystem objects are not particularly hard to abstract in a cross-platform manner. In the worst case that handle is internally just a path. If that's the case, it should be easy for folks who think this is a very serious issue, to create an RFC issue with suggested API instead of complaining endlessly and expecting others (who likely work in spaces this issue doesn't apply to) to do all the work? 😉 --- You didn't address my question about any other security issues in std than this. Talking of which, are there any statistics that back up this claim that this issue is a lot more serious than all the security and safety issues Rust eliminates by its mere presence?

Open ##1971049