pub fn warn_rejected_value(gate: &str, context: &str, value: &str)Expand description
Logs a tracing::warn! for a value rejected by an is_safe_* predicate (or an
equivalent value-rejecting gate) before it reaches a manifest edit or registry URL.
Deliberately logs only value’s byte length, never its content: value is
registry-controlled and, by construction, already failed an allowlist — logging it
verbatim at warn would let a malicious/compromised registry response inject arbitrary
content into this project’s own log stream (a second-order log-injection concern),
mirroring why deps-pypi’s truncate_for_log bounds a logged excerpt instead of
logging a value verbatim. This is this helper’s own contract, not a claim that every
tracing call site in the workspace avoids logging a raw value — e.g. deps-lsp’s
deps-lsp.updateVersion handler and an OSV malformed-fixed-version warning predate
this helper and log their rejected value directly; they are unrelated call sites, not a
place this helper is used.
gate names the predicate/guard that rejected value (e.g.
"is_safe_maven_coordinate_segment"); context is a short description of the call site
(e.g. "maven groupId completion").
§Examples
use deps_core::lsp_helpers::warn_rejected_value;
warn_rejected_value("is_safe_version_string", "code lens latest version", "1.0.0\"; evil");