ADR-365: Standard Input and Every File Read While the Program Runs Are Untrusted Unless Marked trusted: true; Only the Project’s Own Assets Are Trusted

Status: Accepted Date: October 18, 2026 Answers: who chose the bytes of standard input and of a file, which ADR-010 D2 answered the operator; whether an assert about them is checked or refused Related: ADR-010 D2, D3, D5 (the sources, the marker at the source, the hasher); ADR-269 D6 (NK1202); ADR-360 (main’s parameters); ADR-310 (asset("…") read while building); Part III 14.2, 17.1

1. Question

let n = text::parse_i64(io::read_to_string().trim()) ?? 0
assert(n > 0)

The same assert about a number read from a socket is refused (NK1202): its being wrong is a case the program handles, so a guard checks it where it arrives. Read from standard input or from a file, it was a check that stops the program when it fails, because ADR-010 D2 took the operator to have chosen those bytes. A filter in a pipe, a CGI program, a service reading uploads reads bytes a stranger chose, through the same calls.

2. Options

Option	Why it lost	See
Keep both trusted; trusted: false at the source	the unsafe answer when the marker is forgotten: an analysis that fails open (ADR-010 D2’s own rule)	D1
Standard input untrusted, files trusted	a path says nothing about who wrote the file; an upload directory is a path	D1

3. Decision

D1 — Standard input and every file read while the program runs are untrusted.

io::read, io::read_to_string, io::lines and every fs read (fs::read, fs::read_to_string, fs::map, fs::walk’s and fs::read_dir’s names) hand back untrusted bytes. An assert about them is NK1202, and the guard the help writes proves it; a map keyed by them gets the keyed hash (ADR-010 D5).

D2 — trusted: true at the source says the program’s operator chose them.

fs::map(path, root; trusted: true), io::read_to_string(; trusted: true): the bytes are trusted, an assert about them is checked as any claim is, and their maps may take the fast hash. The marker is recorded in the ledger with its place, so a review finds every one (ADR-010 D3).

D3 — The project’s own assets are trusted.

asset("…"), read while the program is built from a file the project holds and the lockfile hashes, is trusted without a marker.

4. Reasons

• Fail closed. A forgotten marker costs a guard or a slower hash, never a claim about bytes a stranger chose; the other default costs the reverse.
• The call does not know the writer. Standard input and a path are the ways a stranger’s bytes reach a local program; only the program’s author knows otherwise, and says so at the place the data enters.
• An asset is part of the program. It is read while building, hashed, and reviewed with the source.

5. Consequences

• Part III 17.1 names standard input and files untrusted and trusted: true the marker; ADR-010 D2’s table and D3’s example change with it.
• What it costs. std’s provenance for io and fs, the trusted: option on each source, --trust’s report, tests; programs that read their own data write trusted: true (benches/brc, the toolchain’s own reads of source files where a claim or a map needs it).
• What it risks. A program that reads its own fixture without the marker meets NK1202 or a keyed hash; both name the marker.

Not decided here: cli::args and the environment, trusted as ADR-010 D2 has them; main’s parameters are checked where they arrive (ADR-360).

Decided October 18, 2026.

This site is open source. Improve this page.