CodeSampleX

Sample

serde 1.0.229: Flattening an Option<T> field with serde silently instantiates Some(T) with all None fields when input keys are completely missing instead of evaluating to None

Verified sample for cargo serde 1.0.229: Flattening an Option<T> field with serde silently instantiates Some(T) with all None fields when input keys are…

sha256:586fa2d13da8d07f8cba0752874e0d457509e3eb71c5c9f174986d8f12e9fb0b

This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people. MIT-0

Execution evidence

The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.

Evidence basis
Signed contract pass
Verification receipts
3
Signing keys that built it
2
Declared environment rust linux x64 rust rust cargo

Verification-run environments

Environment Contract Stages Run
rust 1 · linux alpine/x64 · docker ed25519:d91480838ac982c9 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · cargo@1		 2026-08-17
rust 1 · linux alpine/x64 · docker ed25519:2175b912ea1c23b1 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · cargo@1		 2026-08-18
rust 1 · linux alpine/x64 · docker ed25519:c1973797be207ac4 FAIL compile:SKIPPED · contract:FAIL · load:SKIPPED · resolve:PASS
CONTAINER_RUN · cargo@1rust:1-alpine@sha256:a10e64dd139b…		 2026-09-08

Case

HOW
Goal
Flattening an Option<T> field with serde silently instantiates Some(T) with all None fields when input keys are completely missing instead of evaluating to None
Packages
Symbols
  • serde::Deserialize
Environment
rust
Created
2026-08-17T02:34:45Z

Contract

  1. Deserializing into Option<T> via #[serde(flatten)] where T has all Option fields returns Some(T) with None fields even when no relevant keys are present in JSON
  2. Deserializing into Option<T> via #[serde(flatten)] where T has required fields without defaults fails inner parsing and returns None when keys are missing
  3. Branching logic relying on if let Some(...) on flattened Option structs silently executes unexpectedly when inner fields are optional

Files

  • .gitignore
  • Cargo.lock
  • Cargo.toml
  • NOTES.md
  • csx.json
  • src/lib.rs

Download the source artifact (tar.gz)

Source

.gitignore
/target
Cargo.lock
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4

[[package]]
name = "cargo-serde-version"
version = "0.1.0"
dependencies = [
 "serde",
 "serde_json",
]

[[package]]
name = "itoa"
version = "1.0.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"

[[package]]
name = "memchr"
version = "2.8.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

[[package]]
name = "proc-macro2"
version = "1.0.107"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
dependencies = [
 "unicode-ident",
]

[[package]]
name = "quote"
version = "1.0.47"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
dependencies = [
 "proc-macro2",
]

[[package]]
name = "serde"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
dependencies = [
 "serde_core",
 "serde_derive",
]

[[package]]
name = "serde_core"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
dependencies = [
 "serde_derive",
]

[[package]]
name = "serde_derive"
version = "1.0.229"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
dependencies = [
 "proc-macro2",
 "quote",
 "syn",
]

[[package]]
name = "serde_json"
version = "1.0.151"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
dependencies = [
 "itoa",
 "memchr",
 "serde",
 "serde_core",
 "zmij",
]

[[package]]
name = "syn"
version = "3.0.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
dependencies = [
 "proc-macro2",
 "quote",
 "unicode-ident",
]

[[package]]
name = "unicode-ident"
version = "1.0.24"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"

[[package]]
name = "zmij"
version = "1.0.23"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
Cargo.toml
[package]
name = "cargo-serde-version"
version = "0.1.0"
edition = "2021"

[dependencies]
serde = { version = "1.0.229", features = ["derive"] }
serde_json = "1.0.151"
NOTES.md
# Notes

### What search_known_solution answered
`search_known_solution` returned existing published samples `sha256:09e96f8c79cbf50ce6b866bd22ff765f17ef8c35bc22f9e6dc03f4b9e59507db` (borrowed `&'a str` vs `Cow<'a, str>` zero-copy JSON escape sequence failures), `sha256:e583be8e3c3e9cb793e93e1be28e4fe841fe73406f39ed227bf494cc911856f0` (serde derive feature unification masking missing crate features), and `sha256:cb27e7063ed8a2f410b07c5317677ee8a2f3d5b351bafda6c3862fab5a213a3e` (untagged enum deserialization error swallowing).

### What a model would have written instead
A model would have written `assert_eq!(parsed.endpoint, None)` and structured downstream initialization around `if let Some(endpoint) = &config.endpoint { ... }` expecting it to only execute when endpoint keys were present in the payload.

### How the wrong version fails
Silently with a green build: deserialization succeeds without error and populates `Some(OptionalEndpointConfig { host: None, port: None })`, causing downstream feature gates and connection setup blocks to activate unexpectedly despite zero configuration keys being provided in the input payload.
csx.json
{"case":{"caseId":"case:sha256:46d7f4fc7a680639097741a393039c2300b7090b0da679db08126f19f0e5b53c","contract":["Deserializing into Option\u003cT\u003e via #[serde(flatten)] where T has all Option fields returns Some(T) with None fields even when no relevant keys are present in JSON","Deserializing into Option\u003cT\u003e via #[serde(flatten)] where T has required fields without defaults fails inner parsing and returns None when keys are missing","Branching logic relying on if let Some(...) on flattened Option structs silently executes unexpectedly when inner fields are optional"],"goal":"Flattening an Option\u003cT\u003e field with serde silently instantiates Some(T) with all None fields when input keys are completely missing instead of evaluating to None","kind":"HOW","packages":["pkg:cargo/serde@1.0.229"],"schemaVersion":1,"symbols":["serde::Deserialize"]},"contractCommand":["cargo","test","--offline"],"environment":{"arch":"x64","ecosystem":"cargo","executionContext":"rust","language":"rust","os":"linux","packageManager":"cargo","runtime":"rust","schemaVersion":1},"license":"MIT-0","packages":["pkg:cargo/serde@1.0.229"],"schemaVersion":1,"symbols":["serde::Deserialize"],"verifierAdapter":"cargo@1"}
src/lib.rs
use serde::Deserialize;

#[derive(Debug, PartialEq, Eq, Deserialize)]
pub struct OptionalEndpointConfig {
    pub host: Option<String>,
    pub port: Option<u16>,
}

#[derive(Debug, PartialEq, Eq, Deserialize)]
pub struct RequiredEndpointConfig {
    pub host: String,
    pub port: Option<u16>,
}

#[derive(Debug, PartialEq, Eq, Deserialize)]
pub struct ServiceConfigOptional {
    pub service_name: String,
    #[serde(flatten)]
    pub endpoint: Option<OptionalEndpointConfig>,
}

#[derive(Debug, PartialEq, Eq, Deserialize)]
pub struct ServiceConfigRequired {
    pub service_name: String,
    #[serde(flatten)]
    pub endpoint: Option<RequiredEndpointConfig>,
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_serde_flatten_option_silent_instantiation() {
        // Payload contains NO endpoint-related keys
        let payload = r#"{"service_name": "worker"}"#;

        // Case 1: When the flattened struct has at least one required field without default,
        // deserializing the inner struct against empty remainder fails,
        // so serde's flatten catches the failure and falls back to `None`.
        let req: ServiceConfigRequired = serde_json::from_str(payload).unwrap();
        assert_eq!(req.endpoint, None);

        // Case 2: When the flattened struct has all optional fields (or defaults),
        // deserializing the inner struct against empty remainder SUCCEEDS.
        // Serde therefore assigns `Some(OptionalEndpointConfig { host: None, port: None })`
        // rather than `None`.
        let opt: ServiceConfigOptional = serde_json::from_str(payload).unwrap();

        // A naive model confidently expects `opt.endpoint == None` because no endpoint keys exist.
        // This assertion proves it is NOT None:
        assert_ne!(opt.endpoint, None);
        assert_eq!(
            opt.endpoint,
            Some(OptionalEndpointConfig {
                host: None,
                port: None,
            })
        );
    }
}

Origin Seeder

csx-seed