> it was a hassle to track down because Rust itself didn't complain and the panic message during serialization wouldn't tell me which file of the hundreds of thousands was causing it to die. For lack of a purpose-built tool, I had to manually bisect it until I narrowed it down.
> That said, definitely a footgun in the standard library to be remedied.
> My main concern here is getting rid of the footgun if at all possible. I really don't want to have to maintain a special "Never allow these types to creep into structs I'm deriving Serialize/Deserialize on, because the compiler certainly won't warn you" audit list.
If that's considered safe in Rust's standards then I rest my case.
Yes, things can still be improved, but this is nowhere near as bad as many parsing bugs.
https://github.com/serde-rs/json/blob/master/README.md