search

Keats / jsonwebtoken

JWT lib in rust
MIT License
1.69k stars 271 forks source link

Consider renaming dangerous_unsafe_decode #130

Closed LegNeato closed 2 years ago

LegNeato commented 4 years ago

Thank you for this library! Would you consider renaming dangerous_unsafe_decode to dangerous_insecure_decode? "unsafe" has a specific meaning in Rust and it might be best not to overload it (it doesn't look like the implementation uses unsafe at a quick glance).

If you are interested, happy to put up a patch. If not, feel free to close!

Keats commented 4 years ago

It's unsafe because it doesn't verify the signature. Renaming it would be a breaking change though and unlikely to happen anytime soon. If you have a better name for it though, I can change it when the next major version happens.

LegNeato commented 4 years ago

Totally get it, but it isn't unsafe in the traditional Rust memory-safety sense. My suggestion as stated above to to replace "unsafe" with "insecure". If you agree it is a change you want, I can add a function named dangerous_insecure_decode and make the existing dangerous_unsafe_decode function #[deprecated(note = "Please use the dangerous_insecure_decode function instead"].

Then you can remove at the next major rev / at your leisure.

Keats commented 4 years ago

I like insecure!

Keats commented 4 years ago

If anyone is up for a PR, I'll merge it otherwise that will be in a few days.