{"id":30219102,"url":"https://github.com/0xccf4/untrustedvalue","last_synced_at":"2026-01-20T18:01:08.654Z","repository":{"id":248428197,"uuid":"828652611","full_name":"0xCCF4/UntrustedValue","owner":"0xCCF4","description":"This crate aim to provide a type-safe way to handle and sanitize potentially untrusted values like user input.","archived":false,"fork":false,"pushed_at":"2025-11-24T21:23:25.000Z","size":185,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-11-28T08:46:38.599Z","etag":null,"topics":["compile-time","rust","sanitize","secure-by-design","static-analysis","taint","taint-analysis","taint-checking","type-safety","untrusted-values"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/0xCCF4.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-07-14T19:37:53.000Z","updated_at":"2025-11-24T21:23:22.000Z","dependencies_parsed_at":"2025-05-12T22:29:59.921Z","dependency_job_id":"faaa3b1f-df05-4a09-b19a-659f7c8aca6f","html_url":"https://github.com/0xCCF4/UntrustedValue","commit_stats":null,"previous_names":["0xccf4/untrustedvalue"],"tags_count":28,"template":false,"template_full_name":null,"purl":"pkg:github/0xCCF4/UntrustedValue","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xCCF4%2FUntrustedValue","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xCCF4%2FUntrustedValue/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xCCF4%2FUntrustedValue/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xCCF4%2FUntrustedValue/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/0xCCF4","download_url":"https://codeload.github.com/0xCCF4/UntrustedValue/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/0xCCF4%2FUntrustedValue/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28607957,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-20T16:10:39.856Z","status":"ssl_error","status_checked_at":"2026-01-20T16:10:39.493Z","response_time":117,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["compile-time","rust","sanitize","secure-by-design","static-analysis","taint","taint-analysis","taint-checking","type-safety","untrusted-values"],"created_at":"2025-08-14T07:47:24.331Z","updated_at":"2026-01-20T18:01:08.608Z","avatar_url":"https://github.com/0xCCF4.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Untrusted Value\nThis crate aim to provide a type-safe way to handle and sanitize potentially untrusted values\nlike user input.\n\nIt aims to provide compile-time [Taint checking](https://en.wikipedia.org/wiki/Taint_checking)\ninto Rust. All user input or in general all input coming from the outside\nworld into the program must be seen as untrusted and potentially malicious (called tainted).\nA tainted value keeps its taint until a proper sanitization function is called\nupon the tainted data, clearing its taint.\n\nThis crate introduces several data types, traits and macros to simplify the process\nof taint tracking.\n\n## What's the goal of this crate?\nThe goal of this crate is to help design more secure applications. By tainting all\nprogram inputs, unsanitized data can not be used by accident. By providing a sanitizing\ninterface to tainted data, security analysis can focus on analysing the implemented sanitizing functions\ninstead of identifying where tainted data is located, and where it is used.\n\n## Example usage\nUser data must be wrapped within the container `UntrustedValue` which\nprovides/marks the contained data as tainted.\n```rust\nuse untrusted_value::{UntrustedValue, SanitizeWith};\n\nlet user_input: i32 = -36;\nlet user_input = UntrustedValue::from(user_input);\n\n// user data cannot be used on accident, since it is contained inside UntrustedValues\n// UntrustedValue does only provide a limited set of implemented traits like Clone\n\nlet user_input = user_input.sanitize_with(...) // removes the taint\n```\n\nWhen user data is a struct of different subtypes:\n\n```rust\npub use untrusted_value::{IntoUntrustedVariant, SanitizeValue};\npub use untrusted_value::derive::UntrustedVariant;\n\n#[derive(UntrustedVariant)]\n#[untrusted_derive(SanitizeValueEnd, Clone)] // tainted variant of NetworkConfig should be Cloneable\npub struct NetworkConfig {\n  pub port: u32,\n  pub listen_address: String,\n}\n\nimpl SanitizeValue\u003cNetworkConfig\u003e for NetworkConfigUntrusted {\n    type Error = // ...\n    fn sanitize_value(self) -\u003e Result\u003cNetworkConfig, Self::Error\u003e { /* ... */ }\n}\n\nlet user_data = load_from_config().to_untrusted_variant();\n\n// user data cannot be used on accident, since it is contained inside UntrustedValues\n\nlet user_data = user_data.sanitize_value();\n```\n\nWhen a function is called by an application framework like Rocket/Poem/...,\nthe macro `untrusted_inputs` may be used to taint the function inputs:\n\n```rust\n#[route(path = \"/\"), method = \"get\"]\n#[untrusted_inputs]\nfn index(name: \u0026str) -\u003e Result\u003cString, ()\u003e {\n    // MACRO inserts the following code:\n        // let name = UntrustedValue::from(name);\n        // let ... = UntrustedValue::from(...);\n    \n    // we can not use \"name\" directly, since it is\n    // wrapped in an UntrustedValue\n\n    // we must explicitly sanitize the value before usage\n    let name = name.sanitize_with(/* func */)?;\n    Ok(format!(\"Hello, {}!\", name))\n}\n```\n\nA library providing a function that returns untrusted data may use the macro `untrusted_output` to conditionally\ntaint the output if the library user desires this:\n\n```rust\n#[cfg_attr(feature = \"some_feature\", untrusted_output)]\npub fn query_database() -\u003e String {\n    // if cfg matches, then use untrusted_output to wrap the\n    // function output in UntrustedValue\n\n    // the macro will wrap the body with:\n        // UntrustedValue::from(\n    \"abcdef\".to_string()\n        // )\n}\n```\n\nSee also the examples in the `examples` directory.\n\n## Installation\nThe library is written in Rust, and can be added using `cargo`:\n```bash\ncargo add untrusted-value\n```\n\n## Runtime overhead\nWhen using compile optimizations there should be no runtime overhead since\nwe are essentially just \"renaming\" data. The `UntrustedValue`\nstruct only contains a single field of the original data type.\nWhen compiling for release the compiler should optimize all usage\nof the `UntrustedValue` struct away.\n\n## Features\nEnabled by default:\n * `derive`: enables the macros to automatically generate code\n\nOptional features:\n * `derive_harden_sanitize`: enables hardening for the derive macro `SanitizeValue`. When this feature is disabled, the\n    implemented `fn sanitize_value(self)` errors-early. Which may be undesired if sanitizing timing side\n    channels are a concern. When enabling this feature, first all sanitizers are run, then\n    the first error is propagated.\n\n## Limitations\nProviding a taint tracking system is nice but still requires the developer to\ntaint the data properly. Currently, we are working on providing a crate level macro\nto automatically check common taint source like input from environment variables, args, and\ncommon frameworks, that will create a compile error if input data has not been tainted.\n\nThis crate does only provide an interface to taint and sanitize data. Using this system, still this does\nnot make an application inherently secure. The developer must still implement\nappropriate sanitizing functions to clear the taint of the data. This unified\ninterface should help to focus security analysis on the sanitizing functions\ninstead of on potentially all places where tainted data might be used.\n\n## Contribution\nContributions to the project are welcome! If you have a feature request,\nbug report, or want to contribute to the code, please open an\nissue or a pull request.\n\n## License\nThis project is licensed under the MIT license. See the LICENSE file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xccf4%2Funtrustedvalue","html_url":"https://awesome.ecosyste.ms/projects/github.com%2F0xccf4%2Funtrustedvalue","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2F0xccf4%2Funtrustedvalue/lists"}