E0351

A Secret compared with == or !=, on either side. Spans the comparison. Also reported, without a fix, where a Secret must be Eq: an Eq bound, or a call to .eq.

Machine-applicable fix: Rewrite a == b to a.constant_time_eq(b) and a != b to !a.constant_time_eq(b), with the secret as the receiver (parenthesized when needed). When both sides are secrets, it rewrites to a.constant_time_eq_secret(b) instead, so nothing is exposed.

Example

This program fails with E0351.

fn main(env: Env) {
    let key = env.secret("API_KEY")
    let ok = key == "hunter2"
}

Fixed

The same program, fixed.

fn main(env: Env) {
    let key = env.secret("API_KEY")
    let ok = key.constant_time_eq("hunter2")
}

Listed in the checker notes. oskac explain E0351 prints this entry offline.

All error codes