51. What Rust prevents, and what it does not

The real-world numbers. Google reported that as Android shifted new native code to Rust and other memory-safe languages, memory-safety bugs fell from 76% of Android's vulnerabilities in 2019 to 24% in 2024. Google had reported in 2022 that, by then, no memory-safety vulnerabilities had been found in Android's Rust code. The bugs that remain in Rust codebases are the right-hand column of this table: logic, authorization, injection, and DoS through panics.

51.1 Secrets leaking through Debug

use std::fmt;

#[derive(Debug)]
struct LoginBad { user: String, password: String }

/// A wrapper whose Debug and Display never reveal the value.
#[derive(Clone)]
struct Secret<T>(T);
impl<T> Secret<T> { fn expose(&self) -> &T { &self.0 } }   // the only way in: greppable in review
impl<T> fmt::Debug for Secret<T> {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { f.write_str("Secret([REDACTED])") }
}

#[derive(Debug)]
struct LoginGood { user: String, password: Secret<String> }

fn main() {
    let bad = LoginBad { user: "ada".into(), password: "hunter2".into() };
    let good = LoginGood { user: "ada".into(), password: Secret("hunter2".into()) };
    println!("{bad:?}");   // LoginBad { user: "ada", password: "hunter2" }  <- ends up in your logs
    println!("{good:?}");  // LoginGood { user: "ada", password: Secret([REDACTED]) }
    println!("{}", good.password.expose().len());
}

tracing::info!(?request, "login") debug-prints the whole struct, so one #[derive(Debug)] on a request type can send passwords to your log pipeline. The secrecy crate provides a production version of Secret<T> (SecretString) that also zeroizes the value on drop. Security from Zero Ch 49 covers the operational side.

51.2 Panics are a denial-of-service surface

let n: usize = header.parse().unwrap(), &body[..4], a / b with b == 0, and x + y overflowing in debug builds are all panics an attacker can trigger. Rules for code that handles untrusted input:

• Use get, checked_*, ?, and split_at_checked instead of indexing and unwrap.
• Turn on clippy::unwrap_used, clippy::expect_used, clippy::indexing_slicing, and clippy::arithmetic_side_effects for parser modules (#![deny(...)] at the top of the module).
• Fuzz the parser (Ch 54). Fuzzers find panics within minutes.