safelog: Display trait impl is a nuisance
Proposal
safelog implements Display when the inner type implements display. We recently introduced safelog to a place where it hadn't be used before, and this resulted in a silent bug: the safelog type was formatted to create an HTTP header for a token.
The failure occurred because safelog implement Display. We think it is great that it has a safe Display impl, but annoying that this is present at all.
I'm not sure of the best design here. We discussed a few possibilities:
- don't implement Display and like traits, only Debug
- provide a borrowing struct that implements Display like traits - DisplaySensitive<'a,T> (&'a sensitive: Sensitive,T>) - which can be passed explicitly where such a trait is needed, and avoid this accidental "looks like it works but oh no, it doesn't" situation.
- add separate display-like implementing Sensitive, and tell folk to use the one they prefer
- add a feature to control this aspect
I'm not a fan of the feature approach, because feature unification can make this really fragile.