Use cargo-check-external-types to control type leakage in public API

.github/workflows/ci.yml

@@ -268,6 +268,26 @@ jobs:
       - name: Check semver
         uses: obi1kenobi/cargo-semver-checks-action@v2
 
+  check-external-types:
+    name: Validate external types appearing in public API
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: nightly-2023-10-10
+          # ^ sync with https://github.com/awslabs/cargo-check-external-types/blob/main/rust-toolchain.toml
+
+      - run: cargo install --locked cargo-check-external-types
+
+      - name: run cargo-check-external-types
+        run: cargo check-external-types
+
   coverage:
     name: Measure coverage
     runs-on: ubuntu-20.04

Cargo.toml

@@ -62,6 +62,12 @@ include = [
 all-features = true
 rustdoc-args = ["--cfg", "docsrs"]
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "rustls_pki_types::*",
+    "rustls_pki_types", # To allow re-export.
+]
+
 [lib]
 name = "webpki"
 

src/crl/types.rs

@@ -406,7 +406,7 @@ impl<'a> IssuingDistributionPoint<'a> {
         //       to unwrap a Tag::Boolean constructed value.
         fn decode_bool(value: untrusted::Input) -> Result<bool, Error> {
             let mut reader = untrusted::Reader::new(value);
-            let value = reader.read_byte()?;
+            let value = reader.read_byte().map_err(der::end_of_input_err)?;
             if !reader.at_end() {
                 return Err(Error::BadDer);
             }

src/der.rs

@@ -149,47 +149,47 @@ pub(crate) fn read_tag_and_get_value_limited<'a>(
     input: &mut untrusted::Reader<'a>,
     size_limit: usize,
 ) -> Result<(u8, untrusted::Input<'a>), Error> {
-    let tag = input.read_byte()?;
+    let tag = input.read_byte().map_err(end_of_input_err)?;
     if (tag & HIGH_TAG_RANGE_START) == HIGH_TAG_RANGE_START {
         return Err(Error::BadDer); // High tag number form is not allowed.
     }
 
     // If the high order bit of the first byte is set to zero then the length
     // is encoded in the seven remaining bits of that byte. Otherwise, those
     // seven bits represent the number of bytes used to encode the length.
-    let length = match input.read_byte()? {
+    let length = match input.read_byte().map_err(end_of_input_err)? {
         n if (n & SHORT_FORM_LEN_MAX) == 0 => usize::from(n),
         LONG_FORM_LEN_ONE_BYTE => {
-            let length_byte = input.read_byte()?;
+            let length_byte = input.read_byte().map_err(end_of_input_err)?;
             if length_byte < SHORT_FORM_LEN_MAX {
                 return Err(Error::BadDer); // Not the canonical encoding.
             }
             usize::from(length_byte)
         }
         LONG_FORM_LEN_TWO_BYTES => {
-            let length_byte_one = usize::from(input.read_byte()?);
-            let length_byte_two = usize::from(input.read_byte()?);
+            let length_byte_one = usize::from(input.read_byte().map_err(end_of_input_err)?);
+            let length_byte_two = usize::from(input.read_byte().map_err(end_of_input_err)?);
             let combined = (length_byte_one << 8) | length_byte_two;
             if combined <= LONG_FORM_LEN_ONE_BYTE_MAX {
                 return Err(Error::BadDer); // Not the canonical encoding.
             }
             combined
         }
         LONG_FORM_LEN_THREE_BYTES => {
-            let length_byte_one = usize::from(input.read_byte()?);
-            let length_byte_two = usize::from(input.read_byte()?);
-            let length_byte_three = usize::from(input.read_byte()?);
+            let length_byte_one = usize::from(input.read_byte().map_err(end_of_input_err)?);
+            let length_byte_two = usize::from(input.read_byte().map_err(end_of_input_err)?);
+            let length_byte_three = usize::from(input.read_byte().map_err(end_of_input_err)?);
             let combined = (length_byte_one << 16) | (length_byte_two << 8) | length_byte_three;
             if combined <= LONG_FORM_LEN_TWO_BYTES_MAX {
                 return Err(Error::BadDer); // Not the canonical encoding.
             }
             combined
         }
         LONG_FORM_LEN_FOUR_BYTES => {
-            let length_byte_one = usize::from(input.read_byte()?);
-            let length_byte_two = usize::from(input.read_byte()?);
-            let length_byte_three = usize::from(input.read_byte()?);
-            let length_byte_four = usize::from(input.read_byte()?);
+            let length_byte_one = usize::from(input.read_byte().map_err(end_of_input_err)?);
+            let length_byte_two = usize::from(input.read_byte().map_err(end_of_input_err)?);
+            let length_byte_three = usize::from(input.read_byte().map_err(end_of_input_err)?);
+            let length_byte_four = usize::from(input.read_byte().map_err(end_of_input_err)?);
             let combined = (length_byte_one << 24)
                 | (length_byte_two << 16)
                 | (length_byte_three << 8)
@@ -208,7 +208,7 @@ pub(crate) fn read_tag_and_get_value_limited<'a>(
         return Err(Error::BadDer); // The length is larger than the caller accepts.
     }
 
-    let inner = input.read_bytes(length)?;
+    let inner = input.read_bytes(length).map_err(end_of_input_err)?;
     Ok((tag, inner))
 }
 
@@ -386,6 +386,10 @@ pub(crate) fn nonnegative_integer<'a>(
     }
 }
 
+pub(crate) fn end_of_input_err(_: untrusted::EndOfInput) -> Error {
+    Error::BadDer
+}
+
 // Like mozilla::pkix, we accept the nonconformant explicit encoding of
 // the default value (false) for compatibility with real-world certificates.
 impl<'a> FromDer<'a> for bool {

src/error.rs

@@ -292,12 +292,6 @@ impl fmt::Display for Error {
 #[cfg(feature = "std")]
 impl ::std::error::Error for Error {}
 
-impl From<untrusted::EndOfInput> for Error {
-    fn from(_: untrusted::EndOfInput) -> Self {
-        Error::BadDer
-    }
-}
-
 /// Trailing data was found while parsing DER-encoded input for the named type.
 #[allow(missing_docs)]
 #[non_exhaustive]