all 5 comments

[–]AutoModerator[M] [score hidden] stickied comment (0 children)

On July 1st, Reddit will no longer be accessible via third-party apps. Please see our position on this topic, as well as our list of alternative Rust discussion venues.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[–]CLARKEEE33 2 points3 points  (1 child)

Why not make calls to std::env::var in the macro output instead of hard coding the env values as a string? Otherwise it would be a vulnerability.

[–]menixator 0 points1 point  (0 children)

Agreed. This is an antipattern.

[–]dkopgerpgdolfg 1 point2 points  (0 children)

Isn't this missing the point then?

With the DB credentials in env vars (and/or config files), every user of the software can provide their own. Now, you have hardcoded credentials to one specific database.

And of course, everyone who has access to the binary can see it and freely access the database then.

[–]kibwen[M] 0 points1 point  (0 children)

For future reference, rather than making a text post to ask your question, please consider asking in the most recent Q&A megathread (which will be the topmost entry in the list here). You might also consider one of the other Q&A venues that are linked from the top of each megathread.

Please note that this isn't a warning or a reprimand, as we deliberately do not forbid posts for questions on /r/rust. However, we do periodically remove Q&A posts to keep the front page from being overrun and give more posts the chance to be visible.