Add field_scoped_visibility_modifiers lint

[kyleoneill]

changelog: [field_scoped_visibility_modifiers]: Add a lint which checks for struct fields using Restricted (not inherited, not public) visibility modifiers.

[rustbot]

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @blyxyas (or someone else) some time within the next two weeks.

Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (S-waiting-on-review and S-waiting-on-author) stays updated, invoking these commands when appropriate:

• @rustbot author: the review is finished, PR author should check the comments and take action accordingly
• @rustbot review: the author is ready for a review, this PR will be queued again in the reviewer's queue

[blyxyas]

Hmmmm... I'm not really understanding the appeal of this lint, could you explain it a little bit more?

[kyleoneill]

The primary goal is to make unsafe code more audit-able, the lint makes it easier to verify that invariants for a struct are upheld. If you opt-in to it then you only have to do local analysis on a struct when auditing it. If a struct has a field with pub(crate) visibility, then that fields usage must be checked across an entire crate. Global analysis like this is a pain once crates get large enough.

As an example, this is a pub(crate) modifier being used on an id field in tokio. Presumably you would have the invariant that an id should never be changed, but that must be verified by checking the entire tokio crate where this struct is used. A better way to access this would be to add a pub(crate) method to the struct which returns the id, effectively making it read only.

[djkoloski]

+1, I'd really like to have this lint available

[blyxyas]

Sorry for the delay, I've been kinda busy these few days. After some thinking, it seems like this lint could be useful in the strictest of codebases, and it doesn't represent much overhead to have a restriction lint.

LGTM, thanks! ❤️

[kyleoneill]

No problem at all, thank you for reviewing 😊

[bors]

☔ The latest upstream changes (presumably #12849) made this pull request unmergeable. Please resolve the merge conflicts.

[blyxyas]

https://rust-lang.zulipchat.com/#narrow/stream/257328-clippy/topic/FCP.20field_scoped_visibility_modifiers

I've opened the Final Comment Period stream here, and we have some feedback:

I think the Use instead in the example could be improved. It suggests to make those fields public, which IMO goes against the original intention of the lint. Maybe it should suggest to remove them and add a method, as the author wrote in a comment.

[bors]

☔ The latest upstream changes (presumably #12937) made this pull request unmergeable. Please resolve the merge conflicts.

[blyxyas]

Okis, now that some time has passed and the FCP seems to be alright, we can now merge it! Could you squash these 3 commits into one?

[kyleoneill]

Sounds good, just squashed them. Thanks again for the review process!

[blyxyas]

@bors r+

[bors]

📌 Commit 3405ce3 has been approved by blyxyas

It is now in the queue for this repository.

[bors]

⌛ Testing commit 3405ce3 with merge 9f5d60f...

[bors]

☀️ Test successful - checks-action_dev_test, checks-action_remark_test, checks-action_test
Approved by: blyxyas
Pushing 9f5d60f to master...