What changed, and why it matters
This commit only adds a new automated test that checks the Debug text representation of two public error types is never empty. It does not change any library code, fix a bug, or alter behavior. There is no security issue in the diff itself.
No action required; this is a test-only addition. Continue normal review/CI.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch appends a unit test in hashes/tests/api.rs verifying C-DEBUG-NONEMPTY: it forces HKDF expansion past the 255-block limit and calls sha256::HashEngine::midstate() after input has been supplied, captures the resulting errors, and asserts that their Debug formatting is non-empty. No production code is modified.
Changed components
hashes/tests/api.rsInspect captured patch +16 / −0
diff --git a/hashes/tests/api.rs b/hashes/tests/api.rs
index 2f9ae383..7292c51d 100644
--- a/hashes/tests/api.rs
+++ b/hashes/tests/api.rs
@@ -212,6 +212,22 @@ fn api_all_non_error_types_have_non_empty_debug() {
check_debug!(t; a);
}
+// Public error `Debug` representation is never empty (C-DEBUG-NONEMPTY).
+#[test]
+fn api_all_public_error_types_have_non_empty_debug() {
+ // HKDF is capped at 255 output blocks, so one byte past that limit must error.
+ let mut okm = vec![0_u8; 255 * 32 + 1];
+ let err = Hkdf::<sha256::HashEngine>::new(&[], &[]).expand(&[], &mut okm).unwrap_err();
+ let debug = format!("{:?}", err);
+ assert!(!debug.is_empty());
+
+ let mut engine = sha256::HashEngine::new();
+ engine.input(&[0xab]);
+ let err = engine.midstate().unwrap_err();
+ let debug = format!("{:?}", err);
+ assert!(!debug.is_empty());
+}
+
#[test]
fn all_types_implement_send_sync() {
fn assert_send<T: Send>() {}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.