From 0df3a758781d893a2e2607d3219a5667cacc6398 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 04:14:25 +0000 Subject: [PATCH 1/2] perf(secrets): optimize string allocations in obfuscation and env var formatting Replaced unnecessary `format!()` and `.collect::>()` operations with `String::with_capacity()` and direct character iteration to significantly reduce heap allocations during secret configuration parsing. Co-authored-by: ffalcinelli <1167082+ffalcinelli@users.noreply.github.com> --- .Jules/bolt.md | 3 +++ src/utils/secrets/mod.rs | 57 ++++++++++++++++++++++++++-------------- 2 files changed, 40 insertions(+), 20 deletions(-) create mode 100644 .Jules/bolt.md diff --git a/.Jules/bolt.md b/.Jules/bolt.md new file mode 100644 index 0000000..7f34568 --- /dev/null +++ b/.Jules/bolt.md @@ -0,0 +1,3 @@ +## 2026-07-18 - Zero-Cost Abstractions in String Manipulation +**Learning:** Chaining `format!()` macros and `.collect::>` on short configuration strings in hot loops causes massive heap allocation overhead. `Vec` allocates `4 * N` bytes plus structural overhead just to look at the first and last element of a string. +**Action:** When working with strings where capacity can be pre-calculated (like concatenating known lengths) or where parsing bounds is needed (like finding the first and last char), always use `String::with_capacity()` or iterator mapping (`chars()`) directly. This reduces allocations to a single, sized heap structure, making the hot path substantially faster. diff --git a/src/utils/secrets/mod.rs b/src/utils/secrets/mod.rs index c3ef485..c878f25 100644 --- a/src/utils/secrets/mod.rs +++ b/src/utils/secrets/mod.rs @@ -121,21 +121,24 @@ fn get_object_identifier(map: &serde_json::Map) -> Option /// Helper to format environment variable names fn format_env_var_name(prefix: &str, key: &str) -> String { - let env_var_name = if prefix.is_empty() { - format!("KEYCLOAK_{}", key) - } else { - format!("KEYCLOAK_{}_{}", prefix, key) - }; - env_var_name - .chars() - .map(|c| { - if c.is_alphanumeric() { - c.to_ascii_uppercase() - } else { - '_' - } - }) - .collect() + // Pre-calculate capacity to avoid reallocations: "KEYCLOAK_" + prefix + "_" + key + let capacity = "KEYCLOAK_".len() + prefix.len() + if prefix.is_empty() { 0 } else { 1 } + key.len(); + let mut out = String::with_capacity(capacity); + + out.push_str("KEYCLOAK_"); + + if !prefix.is_empty() { + for c in prefix.chars() { + out.push(if c.is_alphanumeric() { c.to_ascii_uppercase() } else { '_' }); + } + out.push('_'); + } + + for c in key.chars() { + out.push(if c.is_alphanumeric() { c.to_ascii_uppercase() } else { '_' }); + } + + out } /// Recursively extract secrets and replace them with ${ENV_VAR} @@ -228,13 +231,27 @@ fn obfuscate_string(s: &str) -> String { return s.to_string(); } - let chars: Vec = s.chars().collect(); - if chars.len() <= 3 { + let mut chars = s.chars(); + // String is not empty, so next() will return Some + let first = chars.next().unwrap(); + + let mut count = 1; + let mut last = first; + + for c in chars { + last = c; + count += 1; + } + + if count <= 3 { return "***".to_string(); } - let first = chars[0]; - let last = chars[chars.len() - 1]; - format!("{}***{}", first, last) + + let mut out = String::with_capacity(first.len_utf8() + 3 + last.len_utf8()); + out.push(first); + out.push_str("***"); + out.push(last); + out } /// Recursively obfuscate known secret fields From e507351ee52bf4d3c797a288a6e884ca805bf6ff Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 18 Jul 2026 04:27:43 +0000 Subject: [PATCH 2/2] style(secrets): run cargo fmt to resolve ci check Ran `cargo fmt` to resolve the GitHub Actions `cargo fmt --all -- --check` workflow failure, aligning the optimized `format_env_var_name` function with the repository's rustfmt guidelines. Co-authored-by: ffalcinelli <1167082+ffalcinelli@users.noreply.github.com> --- src/utils/secrets/mod.rs | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/src/utils/secrets/mod.rs b/src/utils/secrets/mod.rs index c878f25..6cb344d 100644 --- a/src/utils/secrets/mod.rs +++ b/src/utils/secrets/mod.rs @@ -122,20 +122,29 @@ fn get_object_identifier(map: &serde_json::Map) -> Option /// Helper to format environment variable names fn format_env_var_name(prefix: &str, key: &str) -> String { // Pre-calculate capacity to avoid reallocations: "KEYCLOAK_" + prefix + "_" + key - let capacity = "KEYCLOAK_".len() + prefix.len() + if prefix.is_empty() { 0 } else { 1 } + key.len(); + let capacity = + "KEYCLOAK_".len() + prefix.len() + if prefix.is_empty() { 0 } else { 1 } + key.len(); let mut out = String::with_capacity(capacity); out.push_str("KEYCLOAK_"); if !prefix.is_empty() { for c in prefix.chars() { - out.push(if c.is_alphanumeric() { c.to_ascii_uppercase() } else { '_' }); + out.push(if c.is_alphanumeric() { + c.to_ascii_uppercase() + } else { + '_' + }); } out.push('_'); } for c in key.chars() { - out.push(if c.is_alphanumeric() { c.to_ascii_uppercase() } else { '_' }); + out.push(if c.is_alphanumeric() { + c.to_ascii_uppercase() + } else { + '_' + }); } out