Trail of Bits 发布 Rust 安全测试手册章节及 rust-review 插件
Rust-proof your code with our new Testing Handbook chapter - The Trail of Bits Blog
Trail of Bits 为 Testing Handbook 新增 Rust 安全测试章节，涵盖 Rust 安全保证边界、Miri 检测未定义行为、proptest 属性测试、Clippy 静态分析、Kani 模型检查及依赖供应链审查。同时联合 Aptos Labs 发布 Claude Code 插件 rust-review，针对内存安全、并发隐患、FFI 陷阱和异步取消等十余类 bug 实现自动化 Rust 安全审查。
正文
Paweł Płatek July 13, 2026 testing-handbook , rust , application-security Page content What’s in the chapter Still oxidizing We’ve added a new chapter to our Testing Handbook : a comprehensive guide to security testing Rust programs. This chapter covers the tools and techniques we use at Trail of Bits to validate the security of Rust programs and systems.
fn main () {( | f: & dyn Fn ( u128 )-> Box + 'static >| f( * [ & ( 0x7B736D70683F73 u128 > 63 ) as usize ]) .for_each( | c | print! ( " {c} " )))( Box ::leak( Box ::new( | n: u128 | Box ::new(std::iter::successors( Some (n), |& n | Some (n >> 8 ) ).take_while( |& n | n > 0 ).map( | n | ((n as u8 ) ^ 0x1F ) as char )) as _)))} What’s in the chapter The chapter starts with a security overview of what Rust’s guarantees do and don’t cover, including underappreciated issues like unwind safety, nondeterminism, and arithmetic errors. This leads into an overview of dynamic analysis, which covers a range of boosters for unit tests, how to use Miri to detect undefined behavior, property testing with proptest , coverage measurement, and mutation testing. The static analysis section then covers Clippy in depth, including a list of our favorite lints.
Beyond tooling, the chapter also covers what we’ve learned from auditing Rust codebases directly. Our gotchas and footguns checklist is a great reference for manual code reviews, and will help you find subtle issues like a & b == c having different operator precedence than in C. The memory zeroization section offers three solutions to the tricky problem of guaranteeing that secrets are erased from memory.
Finally, the specialized testing sections cover tools like Kani (a model checker), and the supply chain section covers the full toolchain for vetting dependencies.
We’ve also released rust-review , a Claude Code plugin for automated Rust security reviews. Co-built with Aptos Labs, it targets over a dozen bug classes, from memory safety and concurrency hazards to FFI pitfalls and async cancellation issues. It’s a fast way to catch security issues in a Rust codebase before they make it to audit.
X LinkedIn GitHub Mastodon Hacker News Related Posts Master fuzzing with our new Testing Handbook chapter February 9, 2024 Our latest addition to the Trail of Bits Testing Handbook is a comprehensive guide to fuzzing: an essential, effective, …