Release 1.0.170

Reject suffixed string literals inside serde attrs

serde/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "serde"
-version = "1.0.168" # remember to update html_root_url and serde_derive dependency
+version = "1.0.170" # remember to update html_root_url and serde_derive dependency
 authors = ["Erick Tryzelaar <erick.tryzelaar@gmail.com>", "David Tolnay <dtolnay@gmail.com>"]
 build = "build.rs"
 categories = ["encoding", "no-std", "no-std::no-alloc"]
@@ -15,7 +15,7 @@ repository = "https://github.com/serde-rs/serde"
 rust-version = "1.19"
 
 [dependencies]
-serde_derive = { version = "=1.0.168", optional = true, path = "../serde_derive" }
+serde_derive = { version = "=1.0.170", optional = true, path = "../serde_derive" }
 
 [dev-dependencies]
 serde_derive = { version = "1.0", path = "../serde_derive" }

serde/src/lib.rs

@@ -93,7 +93,7 @@
 ////////////////////////////////////////////////////////////////////////////////
 
 // Serde types in rustdoc of other crates get linked to here.
-#![doc(html_root_url = "https://docs.rs/serde/1.0.168")]
+#![doc(html_root_url = "https://docs.rs/serde/1.0.170")]
 // Support using Serde without the standard library!
 #![cfg_attr(not(feature = "std"), no_std)]
 // Unstable functionality only if the user asks for it. For tracking and

serde/src/private/de.rs

@@ -894,7 +894,7 @@ mod content {
         where
             D: Deserializer<'de>,
         {
-            deserializer.deserialize_str(self)
+            deserializer.deserialize_identifier(self)
         }
     }
 
@@ -905,6 +905,20 @@ mod content {
             write!(formatter, "{:?} or {:?}", self.tag, self.content)
         }
 
+        fn visit_u64<E>(self, field_index: u64) -> Result<Self::Value, E>
+        where
+            E: de::Error,
+        {
+            match field_index {
+                0 => Ok(TagOrContentField::Tag),
+                1 => Ok(TagOrContentField::Content),
+                _ => Err(de::Error::invalid_value(
+                    Unexpected::Unsigned(field_index),
+                    &self,
+                )),
+            }
+        }
+
         fn visit_str<E>(self, field: &str) -> Result<Self::Value, E>
         where
             E: de::Error,
@@ -917,6 +931,19 @@ mod content {
                 Err(de::Error::invalid_value(Unexpected::Str(field), &self))
             }
         }
+
+        fn visit_bytes<E>(self, field: &[u8]) -> Result<Self::Value, E>
+        where
+            E: de::Error,
+        {
+            if field == self.tag.as_bytes() {
+                Ok(TagOrContentField::Tag)
+            } else if field == self.content.as_bytes() {
+                Ok(TagOrContentField::Content)
+            } else {
+                Err(de::Error::invalid_value(Unexpected::Bytes(field), &self))
+            }
+        }
     }
 
     /// Used by generated code to deserialize an adjacently tagged enum when
@@ -942,7 +969,7 @@ mod content {
         where
             D: Deserializer<'de>,
         {
-            deserializer.deserialize_str(self)
+            deserializer.deserialize_identifier(self)
         }
     }
 
@@ -957,6 +984,17 @@ mod content {
             )
         }
 
+        fn visit_u64<E>(self, field_index: u64) -> Result<Self::Value, E>
+        where
+            E: de::Error,
+        {
+            match field_index {
+                0 => Ok(TagContentOtherField::Tag),
+                1 => Ok(TagContentOtherField::Content),
+                _ => Ok(TagContentOtherField::Other),
+            }
+        }
+
         fn visit_str<E>(self, field: &str) -> Result<Self::Value, E>
         where
             E: de::Error,

serde_derive/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "serde_derive"
-version = "1.0.168" # remember to update html_root_url
+version = "1.0.170" # remember to update html_root_url
 authors = ["Erick Tryzelaar <erick.tryzelaar@gmail.com>", "David Tolnay <dtolnay@gmail.com>"]
 categories = ["no-std", "no-std::no-alloc"]
 description = "Macros 1.1 implementation of #[derive(Serialize, Deserialize)]"
@@ -24,7 +24,7 @@ proc-macro = true
 [dependencies]
 proc-macro2 = "1.0"
 quote = "1.0"
-syn = "2.0.21"
+syn = "2.0.25"
 
 [dev-dependencies]
 serde = { version = "1.0", path = "../serde" }

serde_derive/src/internals/attr.rs

@@ -1418,6 +1418,13 @@ fn get_lit_str2(
         ..
     }) = value
     {
+        let suffix = lit.suffix();
+        if !suffix.is_empty() {
+            cx.error_spanned_by(
+                lit,
+                format!("unexpected suffix `{}` on string literal", suffix),
+            );
+        }
         Ok(Some(lit.clone()))
     } else {
         cx.error_spanned_by(

serde_derive/src/lib.rs

@@ -13,7 +13,7 @@
 //!
 //! [https://serde.rs/derive.html]: https://serde.rs/derive.html
 
-#![doc(html_root_url = "https://docs.rs/serde_derive/1.0.168")]
+#![doc(html_root_url = "https://docs.rs/serde_derive/1.0.170")]
 #![allow(unknown_lints, bare_trait_objects)]
 // Ignored clippy lints
 #![allow(

serde_derive_internals/Cargo.toml

@@ -17,7 +17,7 @@ path = "lib.rs"
 [dependencies]
 proc-macro2 = "1.0"
 quote = "1.0"
-syn = { version = "2.0.21", default-features = false, features = ["clone-impls", "derive", "parsing", "printing"] }
+syn = { version = "2.0.25", default-features = false, features = ["clone-impls", "derive", "parsing", "printing"] }
 
 [package.metadata.docs.rs]
 targets = ["x86_64-unknown-linux-gnu"]

serde_test/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "serde_test"
-version = "1.0.168" # remember to update html_root_url
+version = "1.0.170" # remember to update html_root_url
 authors = ["Erick Tryzelaar <erick.tryzelaar@gmail.com>", "David Tolnay <dtolnay@gmail.com>"]
 build = "build.rs"
 categories = ["development-tools::testing"]

serde_test/src/lib.rs

@@ -144,7 +144,7 @@
 //! # }
 //! ```
 
-#![doc(html_root_url = "https://docs.rs/serde_test/1.0.168")]
+#![doc(html_root_url = "https://docs.rs/serde_test/1.0.170")]
 #![cfg_attr(feature = "cargo-clippy", allow(renamed_and_removed_lints))]
 // Ignored clippy lints
 #![cfg_attr(feature = "cargo-clippy", allow(float_cmp, needless_doctest_main))]

test_suite/tests/test_macros.rs

@@ -1267,6 +1267,38 @@ fn test_adjacently_tagged_enum() {
             Token::StructEnd,
         ],
     );
+
+    // integer field keys
+    assert_de_tokens(
+        &AdjacentlyTagged::Newtype::<u8>(1),
+        &[
+            Token::Struct {
+                name: "AdjacentlyTagged",
+                len: 2,
+            },
+            Token::U64(1), // content field
+            Token::U8(1),
+            Token::U64(0), // tag field
+            Token::Str("Newtype"),
+            Token::StructEnd,
+        ],
+    );
+
+    // byte-array field keys
+    assert_de_tokens(
+        &AdjacentlyTagged::Newtype::<u8>(1),
+        &[
+            Token::Struct {
+                name: "AdjacentlyTagged",
+                len: 2,
+            },
+            Token::Bytes(b"c"),
+            Token::U8(1),
+            Token::Bytes(b"t"),
+            Token::Str("Newtype"),
+            Token::StructEnd,
+        ],
+    );
 }
 
 #[test]
@@ -1330,6 +1362,32 @@ fn test_adjacently_tagged_enum_deny_unknown_fields() {
         ],
         r#"invalid value: string "h", expected "t" or "c""#,
     );
+
+    assert_de_tokens_error::<AdjacentlyTagged>(
+        &[
+            Token::Struct {
+                name: "AdjacentlyTagged",
+                len: 2,
+            },
+            Token::U64(0), // tag field
+            Token::Str("Unit"),
+            Token::U64(3),
+        ],
+        r#"invalid value: integer `3`, expected "t" or "c""#,
+    );
+
+    assert_de_tokens_error::<AdjacentlyTagged>(
+        &[
+            Token::Struct {
+                name: "AdjacentlyTagged",
+                len: 2,
+            },
+            Token::Bytes(b"c"),
+            Token::Unit,
+            Token::Bytes(b"h"),
+        ],
+        r#"invalid value: byte array, expected "t" or "c""#,
+    );
 }
 
 #[test]

test_suite/tests/ui/malformed/str_suffix.rs

@@ -0,0 +1,10 @@
+use serde::Serialize;
+
+#[derive(Serialize)]
+#[serde(bound = ""huh)]
+pub struct Struct {
+    #[serde(rename = ""what)]
+    pub field: i32,
+}
+
+fn main() {}

test_suite/tests/ui/malformed/str_suffix.stderr

@@ -0,0 +1,11 @@
+error: unexpected suffix `huh` on string literal
+ --> tests/ui/malformed/str_suffix.rs:4:17
+  |
+4 | #[serde(bound = ""huh)]
+  |                 ^^^^^
+
+error: unexpected suffix `what` on string literal
+ --> tests/ui/malformed/str_suffix.rs:6:22
+  |
+6 |     #[serde(rename = ""what)]
+  |                      ^^^^^^