rust_str_to_c_str is dangerous

[Stebalien]

It will panic if it hits a null byte. Unfortunately, this is called on a bunch of error messages and error messages are notorious for containing user data. We likely need a "nice" version of this function for errors that just "fixes" the string, and a strict version that returns a Result for anything else.

[Stebalien]

Same with catch_panic_and_response. Unwrapping outside the catch unwind is a bit of a problem.

[Stebalien]

Honestly, we should just not use C strings given that we're not even using C.

[dignifiedquire]

It will panic if it hits a null byte

https://github.com/mozilla/ffi-support/blob/main/src/string.rs#L32-L41

Not sure how much of a real issue this is in practice.

[dignifiedquire]

Not saying we shouldn't fix this, just that it is probably not very likely to be hit.

[Stebalien]

Well, I assume rust only calls this inside a catch_unwind. We call it outside catch_unwind (inside catch_panic_response) so we'll unwind into go.

We also have a tendency to call it on error messages, which can likely include user specified strings.