-
-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enable some numeric cast releated clippy lints and fix them in the code base #4170
Enable some numeric cast releated clippy lints and fix them in the code base #4170
Conversation
88b9074
to
a37b7e2
Compare
Bencher
Click to view all benchmark results
Bencher - Continuous Benchmarking View Public Perf Page Docs | Repo | Chat | Help |
Bencher
Click to view all benchmark results
Bencher - Continuous Benchmarking View Public Perf Page Docs | Repo | Chat | Help |
Bencher
Click to view all benchmark results
Bencher - Continuous Benchmarking View Public Perf Page Docs | Repo | Chat | Help |
I double checked the sqlite benchmarks locally and this doesn't seem to have an impact on performance. |
Also for reference, SQLx is also working on it. |
@diesel/core I would like to issue a patch release next Friday (23.8) with this change and a few others (marked as |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That's really nice, thanks a lot for working on this!
I'd like to propose the following additional commit that explicits a few more types to guarantee match between the expects
and the actual target types in case of change of signature of the underlying called functions.
(Arguably most of them are unlikely to change.)
(pushed it, feel free to revert)
column_count: libc::c_int, | ||
row_count: libc::c_int, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks weird to use this in the Rust universe especially if the external APIs are still using usize. How about just returning an error from new
(or panicking) if the conversion fails?
(Ten0@7262cc5)
That's a good idea. Thanks for pushing this change. |
…de base * clippy::cast_possible_wrap * clippy::cast_possible_truncation * clippy::cast_sign_loss These lints can point to serious problems if you hit one of the edge cases in low level unsafe/byte shuffling code This is a reaction to https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf It fixes several places that could be possibly exploited by specially crafted values.
To avoid that a change in the types of the underlying called functions would result not in a compilation error but instead an incorrect `expect`.
62520cb
to
fad6b6d
Compare
…l_size_overflows Enable some numeric cast releated clippy lints and fix them in the code base
…l_size_overflows Enable some numeric cast releated clippy lints and fix them in the code base
This is similar to diesel-rs/diesel#4170, it's just not a serve as the diesel change as we do not found any critical cast here. I also investigated the implementation in the postgres crate and it seems to be fine as well (i.e error on too large buffer sizes instead silently truncating)
@weiznich If you want to add a regression test here is what sqlx did launchbadge/sqlx@f9e5176 |
@Sytten A PR that adds such a test would be very welcome. |
This is similar to diesel-rs/diesel#4170, it's just not a serve as the diesel change as we do not found any critical cast here. I also investigated the implementation in the postgres crate and it seems to be fine as well (i.e error on too large buffer sizes instead silently truncating)
These lints can point to serious problems if you hit one of the edge cases in low level unsafe/byte shuffling code
This is a reaction to
https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
It fixes several places that could be possibly exploited by specially crafted values.