Reasoning with Types in Rust
The <i>Secret</i> example is basically just encapsulation. It reminds me of the HTML type used in Go&#x27;s standard library to avoid XSS vulnerabilities in HTML templates due to lack of escaping. [1] Any string that&#x27;s not cast using HTML() is considered unsafe and will automatically be escaped.<p>In practice, this is used to make security audits easier. It&#x27;s not that you can&#x27;t defeat the system, but security review only needs to look at all the places a string is cast to or from the HTML type and verify that they&#x27;re in fact safe. This is considerably easier than it would be with bare strings, though better encapsulation would help. (In Go, this could be done with a struct that has a private field, but that&#x27;s not what they did for some reason.)<p>This is an old trick, also used by GWT [2] and other languages. Language support for zero-overhead, encapsulated wrapper types makes this particularly convenient; otherwise you have to decide if the performance cost is worth it for a widely-used type.<p>[1] <a href="https:&#x2F;&#x2F;golang.org&#x2F;pkg&#x2F;html&#x2F;template&#x2F;#HTML" rel="nofollow">https:&#x2F;&#x2F;golang.org&#x2F;pkg&#x2F;html&#x2F;template&#x2F;#HTML</a>
[2] <a href="http:&#x2F;&#x2F;www.gwtproject.org&#x2F;javadoc&#x2F;latest&#x2F;com&#x2F;google&#x2F;gwt&#x2F;safehtml&#x2F;shared&#x2F;SafeHtml.html" rel="nofollow">http:&#x2F;&#x2F;www.gwtproject.org&#x2F;javadoc&#x2F;latest&#x2F;com&#x2F;google&#x2F;gwt&#x2F;safe...</a>