Hidden unsafe due to unintentionally abusable macros and include

[kornel]

You can't rely on the unsafe keyword to check safety of crates. There are many other "safe" ways to inject arbitrary code and evade the checks:

About supply-chain attacks

Regarding forbidding unsafe, I think it's commonly overestimated how much it would help, and underestimated how difficult it is to implement and how damaging it would be to the ecosystem. Rust would have to create a new, much bigger concept of "unsafe", because: std::process::Command is safe #[no_mangle] is safe #[link_section] is safe #[export_name] is safe #[link(…)] extern "C" {} is safe println!("cargo:rustc-link-lib=native=…") is safe proc-macros are safe, and turing-complete, and …

This is because unsafe is not a security boundary. It's a lint for double-checking programmer's own assumptions, and not a sandbox.