# \`unsafe\_code\` lint and unsafe method

**URL:** <https://internals.rust-lang.org/t/unsafe-code-lint-and-unsafe-method/21826>\
**Category:** Uncategorized\
**Created:** [November 5, 2024, 9:55pm UTC](https://internals.rust-lang.org/t/unsafe-code-lint-and-unsafe-method/21826 "2024-11-05T21:55:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wyfo](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/wyfo/32/10031_2.png) [@wyfo](https://internals.rust-lang.org/u/wyfo)\
**Post date:** [November 5, 2024, 9:55pm UTC](https://internals.rust-lang.org/t/unsafe-code-lint-and-unsafe-method/21826/1 "2024-11-05T21:55:29Z")

</div>

`unsafe_code` [documentation](https://doc.rust-lang.org/beta/nightly-rustc/rustc_lint/builtin/static.UNSAFE_CODE.html) states:

> This lint is intended to restrict the usage of `unsafe` blocks and other constructs (including, but not limited to `no_mangle` , `link_section` and `export_name` attributes) wrong usage of which causes undefined behavior.

However, defining/implementing an unsafe function/method without using any unsafe operation should not cause any undefined behavior. Could we relax the lint to authorize it?

Take the example of this trait:

```rust
trait WriteSlot {
    fn slot_size(&self) -> usize;
    /// # Safety
    /// `slot` slice's length must be equal to the result of [`Self::slot_size`]
    unsafe fn write_slot(self, slot: &mut [u8]);
}

```

Implementor of this trait could choose to use the precondition to do some unsafe optimization, e.g. `core::ptr::copy_non_overlapping` without checking the size, but he can also choose to ignore the precondition and simply use safe code like `<[u8]>::copy_from_slice`. In this case, I find quite unfair to have the lint triggered while I'm just using an API safely.

---

<div class="post-metadata">

**Author:** ![kpreid](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/kpreid/32/8484_2.png) [@kpreid](https://internals.rust-lang.org/u/kpreid)\
**Post date:** [November 5, 2024, 10:11pm UTC](https://internals.rust-lang.org/t/unsafe-code-lint-and-unsafe-method/21826/2 "2024-11-05T22:11:58Z")

</div>

There are things in the works that will address this.

- Once [RFC 2316](https://rust-lang.github.io/rfcs/2316-safe-unsafe-trait-methods.html) or its successor [RFC 3245 refined impls](https://rust-lang.github.io/rfcs/3245-refined-impls.html) is implemented, it will be possible to implement the trait without using the `unsafe` keyword at all.
- Once `unsafe` blocks and `unsafe fn`s are separated, which is [in progress](https://doc.rust-lang.org/nightly/edition-guide/rust-2024/unsafe-op-in-unsafe-fn.html), it should be possible to write an `unsafe fn` without triggering the `unsafe_code` lint, because `unsafe fn` will mean _only_ “unsafe to call”, not “unsafe operations may be in here”.
  - However, [the compiler doesn’t currently allow that](https://github.com/rust-lang/rust/issues/108926); probably it will be difficult until a future edition in which `unsafe_op_in_unsafe_fn` is an actual hard language rule and not just a lint.

---

<div class="post-metadata">

**Author:** ![steffahn](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/steffahn/32/13288_2.png) [@steffahn](https://internals.rust-lang.org/u/steffahn)\
**Post date:** [April 29, 2026, 10:12pm UTC](https://internals.rust-lang.org/t/unsafe-code-lint-and-unsafe-method/21826/3 "2026-04-29T22:12:16Z")

</div>

This topic was automatically closed 540 days after the last reply. New replies are no longer allowed.