Zennoxa Shield
Rules / Rust
SHIELD-RUST-006

Unsafe block requires review

mediumRustCWE-119CVSS 5.3

What it detects

unsafe blocks bypass Rust memory-safety guarantees and must be manually audited.

How to fix

Confirm the unsafe block upholds all invariants; prefer safe abstractions where possible.

Vulnerable — Shield flags thislib.rs
pub fn first_byte(buf: &[u8]) -> u8 {
    // Skips the bounds check "for speed".
    unsafe { *buf.as_ptr() }
}

pub fn checksum(buf: &[u8]) -> u8 {
    buf.iter().fold(first_byte(buf), |acc, b| acc.wrapping_add(*b))
}
Fixed — scans cleanlib.rs
pub fn first_byte(buf: &[u8]) -> u8 {
    // Safe indexing; the bounds check is negligible here.
    buf.first().copied().unwrap_or(0)
}

pub fn checksum(buf: &[u8]) -> u8 {
    buf.iter().fold(first_byte(buf), |acc, b| acc.wrapping_add(*b))
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUST-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUST-006: Unsafe block requires review — Zennoxa Shield