|
41 | 41 | //! ``` |
42 | 42 | //! use zeroize::Zeroize; |
43 | 43 | //! |
44 | | -//! fn main() { |
45 | | -//! // Protip: don't embed secrets in your source code. |
46 | | -//! // This is just an example. |
47 | | -//! let mut secret = b"Air shield password: 1,2,3,4,5".to_vec(); |
48 | | -//! // [ ... ] open the air shield here |
49 | | -//! |
50 | | -//! // Now that we're done using the secret, zero it out. |
51 | | -//! secret.zeroize(); |
52 | | -//! } |
| 44 | +//! // Protip: don't embed secrets in your source code. |
| 45 | +//! // This is just an example. |
| 46 | +//! let mut secret = b"Air shield password: 1,2,3,4,5".to_vec(); |
| 47 | +//! // [ ... ] open the air shield here |
| 48 | +//! |
| 49 | +//! // Now that we're done using the secret, zero it out. |
| 50 | +//! secret.zeroize(); |
53 | 51 | //! ``` |
54 | 52 | //! |
55 | 53 | //! The [`Zeroize`] trait is impl'd on all of Rust's core scalar types including |
|
68 | 66 | //! memory is zeroed by converting it to a `Vec<u8>` and back into a `CString`. |
69 | 67 | //! (NOTE: see "Stack/Heap Zeroing Notes" for important `Vec`/`String`/`CString` details) |
70 | 68 | //! |
| 69 | +//! [`CString`]: https://doc.rust-lang.org/std/ffi/struct.CString.html |
71 | 70 | //! |
72 | 71 | //! The [`DefaultIsZeroes`] marker trait can be impl'd on types which also |
73 | 72 | //! impl [`Default`], which implements [`Zeroize`] by overwriting a value with |
|
143 | 142 | //! ``` |
144 | 143 | //! use zeroize::Zeroizing; |
145 | 144 | //! |
146 | | -//! fn main() { |
| 145 | +//! fn use_secret() { |
147 | 146 | //! let mut secret = Zeroizing::new([0u8; 5]); |
148 | 147 | //! |
149 | 148 | //! // Set the air shield password |
|
153 | 152 | //! |
154 | 153 | //! // The contents of `secret` will be automatically zeroized on drop |
155 | 154 | //! } |
| 155 | +//! |
| 156 | +//! # use_secret() |
156 | 157 | //! ``` |
157 | 158 | //! |
158 | 159 | //! ## What guarantees does this crate provide? |
@@ -800,31 +801,21 @@ unsafe fn volatile_set<T: Copy + Sized>(dst: *mut T, src: T, count: usize) { |
800 | 801 | /// type that already implements `ZeroizeOnDrop`. |
801 | 802 | /// |
802 | 803 | /// # Safety |
803 | | -/// - The type must not contain references to outside data or dynamically sized data, such as Vec<X> |
804 | | -/// or String<X>. |
805 | | -/// - This function can invalidate the type if it is used after this function is called on it. It is |
806 | | -/// advisable to call this function in `impl Drop`. |
807 | | -/// - The bit pattern of all zeroes must be valid for the data being zeroized. This may not be true for |
808 | | -/// enums and pointers. |
| 804 | +/// - The type must not contain references to outside data or dynamically sized data, such as |
| 805 | +/// `Vec<T>` or `String`. |
| 806 | +/// - Values stored in the type must not have `Drop` impls. |
| 807 | +/// - This function can invalidate the type if it is used after this function is called on it. |
| 808 | +/// It is advisable to call this function only in `impl Drop`. |
| 809 | +/// - The bit pattern of all zeroes must be valid for the data being zeroized. This may not be |
| 810 | +/// true for enums and pointers. |
809 | 811 | /// |
810 | 812 | /// # Incompatible data types |
811 | | -/// Some data types that cannot be safely zeroized using `zeroize_flat_type` include, but are not |
812 | | -/// limited to: |
813 | | -/// - pointers such as |
814 | | -/// - *const u8 |
815 | | -/// - *mut u8 |
816 | | -/// - references such as |
817 | | -/// - &T |
818 | | -/// - &mut T |
819 | | -/// - smart pointers and collections |
820 | | -/// - Arc<T> |
821 | | -/// - Box<T> |
822 | | -/// - Vec<T> |
823 | | -/// - HashMap<T1, T2> |
824 | | -/// - String |
825 | | -/// |
826 | | -/// Some data types that may be invalid after calling `zeroize_flat_type`: |
827 | | -/// - enums |
| 813 | +/// Some data types that cannot be safely zeroized using `zeroize_flat_type` include, |
| 814 | +/// but are not limited to: |
| 815 | +/// - References: `&T` and `&mut T` |
| 816 | +/// - Non-nullable types: `NonNull<T>`, `NonZeroU32`, etc. |
| 817 | +/// - Enums with explicit non-zero tags. |
| 818 | +/// - Smart pointers and collections: `Arc<T>`, `Box<T>`, `Vec<T>`, `HashMap<K, V>`, `String`, etc. |
828 | 819 | /// |
829 | 820 | /// # Examples |
830 | 821 | /// Safe usage for a struct containing strictly flat data: |
|
0 commit comments