OsString / OsStr

Level 1 — Foundations Platform-native string types for data the OS does not guarantee to be valid UTF-8 — filenames, environment variables, and command-line arguments.

1. Prerequisites

• String vs &str — The UTF-8-guaranteed types this pair is the non-UTF-8-safe counterpart to.
• Path / PathBuf — What OsString/OsStr are internally used to build.

2. Term Category

Standard Library Types (the honest-about-reality string): String and &str guarantee valid UTF-8, always. But operating systems make no such guarantee for filenames, environment variables, or command-line arguments — on Unix, a filename can legally be almost any sequence of bytes, UTF-8 or not. OsString/OsStr exist to represent this reality honestly, without forcing (or silently corrupting) a UTF-8 conversion.

3. Explanation

(1) Design Motivation — "Why did we design this?"

If std::env::args() or file-listing functions returned plain String, what should happen when a filename on disk genuinely isn't valid UTF-8 (a legal, if unusual, situation on Unix systems)? The naive options are both bad: silently replacing invalid bytes with a placeholder character (data corruption — you can no longer round-trip back to the real filename) or panicking (a program crash triggered purely by encountering an existing file with an unusual name, wildly disproportionate). Rust's actual solution is OsString/OsStr: types that can represent whatever the OS itself can represent — a superset of valid UTF-8 — without loss. You only pay the cost of dealing with this reality (via a fallible .to_str() -> Option<&str> conversion, or a lossy .to_string_lossy() -> Cow<str>) at the specific moment you actually need a guaranteed-UTF-8 &str, rather than the OS-interop layer silently making unsafe assumptions on your behalf.

(2) Reality Metaphor

Imagine a customs form that must faithfully record a traveler's name exactly as printed on their passport, even if that passport was issued by a country using an entirely different, non-standard character encoding.

• String/&str is a form that only accepts standardized, internationally normalized text (valid UTF-8) — clean and universally readable, but it would have to reject or mangle a name that doesn't fit that standard.
• OsString/OsStr is a special "as-printed" field that faithfully photographs and stores the passport's name exactly as it appears, encoding quirks and all, without demanding it first be translated into the standardized format.
• .to_str()/.to_string_lossy() are the moment you actually need the standardized version for some downstream form — you either get a clean translation if one exists (Some(&str)), or you accept a "best effort, may have replaced some untranslatable characters" version (lossy conversion) when it doesn't.

(3) Rust Code Examples

Short Snippet (Reading Environment Variables Honestly)

use std::env;
use std::ffi::OsString;

fn main() {
    // env::var_os returns OsString — never panics, never corrupts, regardless
    // of what bytes are actually in the environment variable.
    let path: Option<OsString> = env::var_os("PATH");

    match path {
        Some(p) => println!("PATH is set (may or may not be valid UTF-8): {p:?}"),
        None => println!("PATH is not set"),
    }
}

Fuller Example (Converting to &str When You Need It)

use std::ffi::{OsStr, OsString};

fn main() {
    let os_string = OsString::from("hello.txt");

    // Fallible conversion: None if the data ISN'T valid UTF-8.
    match os_string.to_str() {
        Some(s) => println!("Valid UTF-8: {s}"),
        None => println!("Not valid UTF-8 — can't safely represent as &str"),
    }

    // Lossy conversion: ALWAYS succeeds, replacing invalid sequences with U+FFFD.
    let lossy: std::borrow::Cow<str> = os_string.to_string_lossy();
    println!("{lossy}"); // "hello.txt" (identical here, since it WAS valid UTF-8)

    // OsStr is the borrowed counterpart, mirroring &str's relationship to String.
    let borrowed: &OsStr = os_string.as_os_str();
    println!("{}", borrowed.len()); // Length in a platform-specific unit, NOT guaranteed byte count!
}

4. Common Mistakes & Pitfalls

Mistake 1: Misunderstanding Os String Str Scoping and Lifecycle Rules

The mistake: Assuming Os String Str instances remain valid beyond their declaring scope block or across asynchronous boundaries without explicit lifetime tracking.

Why it's wrong: Rust strictly enforces lexical scope boundaries and non-lexical lifetimes (NLL) at compile time. Accessing dropped values or failing to handle variable drop order results in compiler errors such as E0597 or E0382.

Incorrect:

fn get_ref() -> &str {
    let s = String::from("os_string_str_data");
    &s // ❌ Error E0106/E0515: returns a reference to data owned by the current function
}

Fix:

fn get_string() -> String {
    let s = String::from("os_string_str_data");
    s // Ownership of the String is transferred directly to the caller
}

Mistake 2: Mutating Os String Str State Without Exclusive Ownership or mut Borrowing

The mistake: Attempting to mutate data associated with Os String Str through an immutable reference &T or without specifying mut in variable declarations.

Why it's wrong: Rust's aliasing XOR mutability rule (&T for shared immutable access, &mut T for exclusive mutable access) prohibits mutating state through shared references unless interior mutability patterns (e.g. RefCell, Mutex) are explicitly used.

Incorrect:

fn update_val(data: &i32) {
    // *data += 1; // ❌ Error E0594: cannot assign to `*data`, which is behind a `&` reference
}

Fix:

fn update_val(data: &mut i32) {
    *data += 1; // Correct: exclusive mutable reference permits mutation
}

Mistake 3: Concurrent Access to Os String Str Across Threads Without Send / Sync Guards

The mistake: Sharing non-thread-safe Os String Str instances across OS threads via std::thread::spawn.

Why it's wrong: Types that do not implement Send or Sync marker traits cannot safely cross thread boundaries. The compiler prevents data races by raising compile errors E0277 (trait Send is not implemented).

Incorrect:

use std::rc::Rc;
use std::thread;

let rc = Rc::new(42);
// thread::spawn(move || { println!("{}", rc); }); // ❌ Error E0277: `Rc` cannot be sent between threads safely

Fix:

use std::sync::Arc;
use std::thread;

let arc = Arc::new(42);
thread::spawn(move || {
    println!("{}", arc); // Correct: `Arc` implements `Send` and `Sync`
});

5. Practice Exercises

Exercise 1: Cross-Platform Environment Variable Security Audit & Sanitization Engine

Scenario: In production microservices and cloud infrastructure agents, system environment variables are ingested directly from the operating system via raw OS interfaces (std::env::vars_os()). On Unix platforms, environment variable keys and values are arbitrary byte sequences that may not conform to valid UTF-8. On Windows, environment strings can contain unpaired UTF-16 surrogates. Converting environment variables directly into UTF-8 String using std::env::var() causes runtime panics or error returns when encountering legacy or non-UTF-8 values.

Task: Implement an EnvSanitizer module that processes raw (OsString, OsString) key-value pairs without assuming UTF-8 compliance upfront.

1. Define a struct EnvAuditEntry containing:
   • key: OsString
   • value: OsString
   • is_valid_utf8: bool
   • sanitized_display: String
2. Implement EnvSanitizer::audit_entry(key: OsString, value: OsString, secret_substrings: &[&str]) -> EnvAuditEntry:
   • Inspect both key and value using .to_str(). Set is_valid_utf8 to true if both key and value yield Some(&str), otherwise false.
   • If the key (lossily converted to uppercase string) contains any substring in secret_substrings (e.g. "SECRET", "PASSWORD", "TOKEN"), redact the value output in sanitized_display as "[REDACTED]".
   • If non-UTF-8 data is present in either key or value, generate a display string using .to_string_lossy(), prefixed with "[NON_UTF8] " while preserving redaction logic.
3. Implement EnvSanitizer::filter_valid_paths(entries: &[EnvAuditEntry], path_key: &OsStr) -> Vec<OsString>:
   • Accepts a slice of audit entries and a target &OsStr key (e.g., OsStr::new("PATH")), filtering and returning the raw owned OsString values matching the key using direct &OsStr equality comparison.

use std::ffi::{OsStr, OsString};

#[derive(Debug, PartialEq, Eq)]
pub struct EnvAuditEntry {
    pub key: OsString,
    pub value: OsString,
    pub is_valid_utf8: bool,
    pub sanitized_display: String,
}

pub struct EnvSanitizer;

impl EnvSanitizer {
    pub fn audit_entry(key: OsString, value: OsString, secret_substrings: &[&str]) -> EnvAuditEntry {
        let key_str_opt = key.to_str();
        let val_str_opt = value.to_str();
        let is_valid_utf8 = key_str_opt.is_some() && val_str_opt.is_some();

        let key_lossy = key.to_string_lossy();
        let key_upper = key_lossy.to_uppercase();

        let is_secret = secret_substrings
            .iter()
            .any(|secret| key_upper.contains(&secret.to_uppercase()));

        let sanitized_display = if is_valid_utf8 {
            let val_str = val_str_opt.unwrap();
            if is_secret {
                format!("{} = [REDACTED]", key_lossy)
            } else {
                format!("{} = {}", key_lossy, val_str)
            }
        } else {
            let val_lossy = value.to_string_lossy();
            if is_secret {
                format!("[NON_UTF8] {} = [REDACTED]", key_lossy)
            } else {
                format!("[NON_UTF8] {} = {}", key_lossy, val_lossy)
            }
        };

        EnvAuditEntry {
            key,
            value,
            is_valid_utf8,
            sanitized_display,
        }
    }

    pub fn filter_valid_paths(entries: &[EnvAuditEntry], path_key: &OsStr) -> Vec<OsString> {
        entries
            .iter()
            .filter(|entry| entry.key.as_os_str() == path_key)
            .map(|entry| entry.value.clone())
            .collect()
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::ffi::{OsStr, OsString};

    #[test]
    fn test_audit_clean_utf8_env_var() {
        let key = OsString::from("LOG_LEVEL");
        let val = OsString::from("INFO");
        let entry = EnvSanitizer::audit_entry(key, val, &["SECRET", "PASSWORD", "TOKEN"]);

        assert!(entry.is_valid_utf8);
        assert!(matches!(entry.is_valid_utf8, true));
        assert_eq!(entry.sanitized_display, "LOG_LEVEL = INFO");
        assert_ne!(entry.sanitized_display, "LOG_LEVEL = [REDACTED]");
    }

    #[test]
    fn test_audit_sensitive_utf8_redaction() {
        let key = OsString::from("DATABASE_PASSWORD");
        let val = OsString::from("SuperSecret123!");
        let entry = EnvSanitizer::audit_entry(key, val, &["SECRET", "PASSWORD", "TOKEN"]);

        assert!(entry.is_valid_utf8);
        assert_eq!(entry.sanitized_display, "DATABASE_PASSWORD = [REDACTED]");
        assert_ne!(entry.sanitized_display, "DATABASE_PASSWORD = SuperSecret123!");
        assert!(!entry.sanitized_display.contains("SuperSecret123!"));
    }

    #[test]
    fn test_audit_non_utf8_environment_variable() {
        #[cfg(unix)]
        use std::os::unix::ffi::OsStringExt;

        #[cfg(unix)]
        let non_utf8_val = OsString::from_vec(vec![0x66, 0x6f, 0x6f, 0x80, 0xff]);

        #[cfg(not(unix))]
        let non_utf8_val = OsString::from("fallback_val");

        let key = OsString::from("CUSTOM_SECRET_DATA");
        let entry = EnvSanitizer::audit_entry(key, non_utf8_val, &["SECRET"]);

        #[cfg(unix)]
        assert!(!entry.is_valid_utf8);
        #[cfg(unix)]
        assert!(matches!(entry.is_valid_utf8, false));

        assert!(entry.sanitized_display.contains("[REDACTED]"));
        assert_ne!(entry.sanitized_display, "CUSTOM_SECRET_DATA = raw");
    }

    #[test]
    fn test_filter_valid_paths() {
        let entry1 = EnvSanitizer::audit_entry(
            OsString::from("PATH"),
            OsString::from("/usr/bin:/bin"),
            &[],
        );
        let entry2 = EnvSanitizer::audit_entry(
            OsString::from("HOME"),
            OsString::from("/home/user"),
            &[],
        );
        let entries = vec![entry1, entry2];

        let path_key = OsStr::new("PATH");
        let paths = EnvSanitizer::filter_valid_paths(&entries, path_key);

        assert_eq!(paths.len(), 1);
        assert_eq!(paths[0], OsString::from("/usr/bin:/bin"));
        assert_ne!(paths[0], OsString::from("/home/user"));
        assert!(matches!(paths.first(), Some(_)));
    }
}

Exercise 2: High-Performance Non-UTF-8 Filesystem Indexer & Path Rule Engine

Scenario: High-performance backup systems and disk indices must crawl millions of filesystem entries across multi-platform storage networks. Legacy mounted filesystems (such as NFS, FAT32, or EXT4) often contain file names with non-UTF-8 byte sequences. Standard path manipulation relying on PathBuf::to_str() fails (None) when encountering these files.

Task: Implement an OsPathIndexer utility:

1. OsPathIndexer::extract_extension(path: &OsStr) -> Option<&OsStr>:
   • Converts &OsStr into &Path zero-cost and extracts file extension as &OsStr.
2. OsPathIndexer::filter_by_extension<'a>(paths: &'a [OsString], target_ext: &OsStr) -> Vec<&'a OsStr>:
   • Filters a slice of OsString paths, returning borrowed &'a OsStr references for paths matching target_ext.
3. OsPathIndexer::build_backup_filename(original: &OsStr, prefix: &OsStr, timestamp_sec: u64) -> OsString:
   • Pre-allocates buffer capacity using OsString::with_capacity and appends components via OsString::push(&OsStr) to format <prefix>_<original>_<timestamp>.bak without UTF-8 lossy conversion of original.
4. OsPathIndexer::partition_utf8_compliance(paths: &[OsString]) -> (Vec<String>, Vec<OsString>):
   • Partitions a slice of OsString paths into valid UTF-8 strings (Vec<String>) and non-UTF-8 raw OS strings (Vec<OsString>).

use std::ffi::{OsStr, OsString};
use std::path::Path;

pub struct OsPathIndexer;

impl OsPathIndexer {
    pub fn extract_extension(path: &OsStr) -> Option<&OsStr> {
        Path::new(path).extension()
    }

    pub fn filter_by_extension<'a>(paths: &'a [OsString], target_ext: &OsStr) -> Vec<&'a OsStr> {
        paths
            .iter()
            .map(|p| p.as_os_str())
            .filter(|p| Self::extract_extension(p) == Some(target_ext))
            .collect()
    }

    pub fn build_backup_filename(original: &OsStr, prefix: &OsStr, timestamp_sec: u64) -> OsString {
        let ts_str = timestamp_sec.to_string();
        let capacity = prefix.len() + original.len() + ts_str.len() + 6;
        let mut result = OsString::with_capacity(capacity);
        result.push(prefix);
        result.push("_");
        result.push(original);
        result.push("_");
        result.push(&ts_str);
        result.push(".bak");
        result
    }

    pub fn partition_utf8_compliance(paths: &[OsString]) -> (Vec<String>, Vec<OsString>) {
        let mut valid_utf8 = Vec::new();
        let mut invalid_utf8 = Vec::new();

        for path in paths {
            match path.to_str() {
                Some(valid_str) => valid_utf8.push(valid_str.to_string()),
                None => invalid_utf8.push(path.clone()),
            }
        }

        (valid_utf8, invalid_utf8)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::ffi::{OsStr, OsString};

    #[test]
    fn test_extract_extension_valid_and_missing() {
        let p1 = OsStr::new("server_config.toml");
        let p2 = OsStr::new("Makefile");
        let p3 = OsStr::new("archive.tar.gz");

        assert_eq!(OsPathIndexer::extract_extension(p1), Some(OsStr::new("toml")));
        assert_eq!(OsPathIndexer::extract_extension(p2), None);
        assert_ne!(OsPathIndexer::extract_extension(p1), Some(OsStr::new("txt")));
        assert!(matches!(OsPathIndexer::extract_extension(p3), Some(_)));
    }

    #[test]
    fn test_filter_by_extension_os_str() {
        let paths = vec![
            OsString::from("app.log"),
            OsString::from("data.csv"),
            OsString::from("error.log"),
            OsString::from("binary_exec"),
        ];
        let target_ext = OsStr::new("log");

        let matched = OsPathIndexer::filter_by_extension(&paths, target_ext);
        assert_eq!(matched.len(), 2);
        assert_eq!(matched[0], OsStr::new("app.log"));
        assert_eq!(matched[1], OsStr::new("error.log"));
        assert_ne!(matched[0], OsStr::new("data.csv"));
        assert!(matches!(matched.as_slice(), [_, _]));
    }

    #[test]
    fn test_build_backup_filename_preserves_raw_bytes() {
        let original = OsStr::new("database.db");
        let prefix = OsStr::new("snapshot");
        let timestamp = 1700000000;

        let backup_name = OsPathIndexer::build_backup_filename(original, prefix, timestamp);
        assert_eq!(backup_name, OsString::from("snapshot_database.db_1700000000.bak"));
        assert_ne!(backup_name, OsString::from("snapshot_database.db"));
        assert!(backup_name.to_str().is_some());
        assert!(matches!(backup_name.to_str(), Some(_)));
    }

    #[test]
    fn test_partition_utf8_compliance() {
        let paths = vec![
            OsString::from("valid_path_1.txt"),
            OsString::from("valid_path_2.json"),
        ];

        let (valid, invalid) = OsPathIndexer::partition_utf8_compliance(&paths);
        assert_eq!(valid.len(), 2);
        assert!(invalid.is_empty());
        assert_ne!(valid.len(), 0);
        assert_eq!(valid[0], "valid_path_1.txt");
        assert!(matches!(invalid.as_slice(), []));
    }
}

Exercise 3: Cross-Platform Subprocess CLI Command Argument Pipeline & Guardrail Validator

Scenario: When building systems management CLI applications, command execution wrappers (like std::process::Command) pass command line arguments directly to kernel system calls (execve on Unix, CreateProcessW on Windows). Passing arguments as UTF-8 &str forces conversion failures when handling arbitrary file paths or raw binary parameters. Security policy engines must inspect and validate raw &OsStr command arguments against prohibited security flags (e.g. --eval, -c, --exec) before launching subprocesses.

Task: Implement a subprocess argument pipeline OsCommandPipeline:

1. Define error type SecurityError with variants:
   • ForbiddenFlag(OsString)
   • EmptyCommand
2. Implement OsCommandPipeline::new<P: Into<OsString>>(program: P) -> Self.
3. Implement OsCommandPipeline::arg<A: AsRef<OsStr>>(&mut self, arg: A) -> &mut Self and args<I, A>(&mut self, args: I) -> &mut Self to support flexible generic argument pushing (&str, String, &OsStr, OsString, PathBuf, &Path).
4. Implement OsCommandPipeline::validate_security(&self, forbidden_flags: &[&OsStr]) -> Result<(), SecurityError>:
   • Validates that program is non-empty.
   • Iterates through args, returning Err(SecurityError::ForbiddenFlag) if any argument matches or starts with a forbidden flag followed by =.
5. Implement OsCommandPipeline::to_display_cmd(&self) -> String:
   • Formats a shell-style log string using .to_string_lossy(), enclosing arguments containing spaces in double quotes ("...").

use std::ffi::{OsStr, OsString};
use std::fmt;

#[derive(Debug, PartialEq, Eq)]
pub enum SecurityError {
    ForbiddenFlag(OsString),
    EmptyCommand,
}

impl fmt::Display for SecurityError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            SecurityError::ForbiddenFlag(flag) => write!(f, "Security policy violation: forbidden flag '{:?}'", flag),
            SecurityError::EmptyCommand => write!(f, "Command binary cannot be empty"),
        }
    }
}

impl std::error::Error for SecurityError {}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct OsCommandPipeline {
    program: OsString,
    args: Vec<OsString>,
}

impl OsCommandPipeline {
    pub fn new<P: Into<OsString>>(program: P) -> Self {
        Self {
            program: program.into(),
            args: Vec::new(),
        }
    }

    pub fn arg<A: AsRef<OsStr>>(&mut self, arg: A) -> &mut Self {
        self.args.push(arg.as_ref().to_os_string());
        self
    }

    pub fn args<I, A>(&mut self, args: I) -> &mut Self
    where
        I: IntoIterator<Item = A>,
        A: AsRef<OsStr>,
    {
        for arg in args {
            self.arg(arg);
        }
        self
    }

    pub fn validate_security(&self, forbidden_flags: &[&OsStr]) -> Result<(), SecurityError> {
        if self.program.is_empty() {
            return Err(SecurityError::EmptyCommand);
        }

        for arg in &self.args {
            let arg_os = arg.as_os_str();

            for &forbidden in forbidden_flags {
                if arg_os == forbidden {
                    return Err(SecurityError::ForbiddenFlag(arg.clone()));
                }

                if let (Some(arg_str), Some(forb_str)) = (arg_os.to_str(), forbidden.to_str()) {
                    let prefix_eq = format!("{}=", forb_str);
                    if arg_str.starts_with(&prefix_eq) {
                        return Err(SecurityError::ForbiddenFlag(arg.clone()));
                    }
                }
            }
        }

        Ok(())
    }

    pub fn to_display_cmd(&self) -> String {
        let mut components = Vec::with_capacity(1 + self.args.len());

        let prog_lossy = self.program.to_string_lossy();
        components.push(if prog_lossy.contains(' ') {
            format!("\"{}\"", prog_lossy)
        } else {
            prog_lossy.into_owned()
        });

        for arg in &self.args {
            let arg_lossy = arg.to_string_lossy();
            if arg_lossy.contains(' ') {
                components.push(format!("\"{}\"", arg_lossy));
            } else {
                components.push(arg_lossy.into_owned());
            }
        }

        components.join(" ")
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::ffi::{OsStr, OsString};
    use std::path::PathBuf;

    #[test]
    fn test_command_pipeline_builder_generics() {
        let mut cmd = OsCommandPipeline::new("tar");
        cmd.arg("-czf")
           .arg(OsString::from("archive.tar.gz"))
           .arg(PathBuf::from("/var/log/syslog"));

        let display = cmd.to_display_cmd();
        assert_eq!(display, "tar -czf archive.tar.gz /var/log/syslog");
        assert_ne!(display, "tar -czf archive.tar.gz");
        assert!(display.contains("syslog"));
        assert!(matches!(cmd.args.len(), 3));
    }

    #[test]
    fn test_security_validation_catches_forbidden_flag() {
        let mut cmd = OsCommandPipeline::new("python3");
        cmd.arg("-c").arg("import os; os.system('clear')");

        let forbidden = vec![OsStr::new("--eval"), OsStr::new("-c"), OsStr::new("--exec")];
        let result = cmd.validate_security(&forbidden);

        assert!(result.is_err());
        assert_ne!(result, Ok(()));
        assert!(matches!(result, Err(SecurityError::ForbiddenFlag(ref flag)) if flag == "-c"));
    }

    #[test]
    fn test_security_validation_passes_clean_args() {
        let mut cmd = OsCommandPipeline::new("cargo");
        cmd.arg("build").arg("--release");

        let forbidden = vec![OsStr::new("--eval"), OsStr::new("-c")];
        let result = cmd.validate_security(&forbidden);

        assert!(result.is_ok());
        assert_ne!(result, Err(SecurityError::EmptyCommand));
        assert!(matches!(result, Ok(())));
    }

    #[test]
    fn test_display_cmd_formatting() {
        let mut cmd = OsCommandPipeline::new("/usr/bin/custom tool");
        cmd.arg("--output dir").arg("file.txt");

        let display = cmd.to_display_cmd();
        assert_eq!(display, "\"/usr/bin/custom tool\" \"--output dir\" file.txt");
        assert_ne!(display, "/usr/bin/custom tool --output dir file.txt");
        assert!(display.contains("\"--output dir\""));
        assert!(matches!(display.as_str(), s if s.starts_with('"')));
    }
}

6. Related Terms

• String vs &str — The UTF-8-guaranteed pair OsString/OsStr mirrors in structure (owned/borrowed) but relaxes in guarantee.
• Path / PathBuf — Built directly on top of OsString/OsStr internally, since filenames share the same "might not be UTF-8" reality.
• Cow<'a, T> — The return type of .to_string_lossy(), since it only allocates a new owned String when a lossy replacement was actually needed.

7. Key Takeaways

• OsString (owned) / OsStr (borrowed) represent text exactly as the operating system provides it — a superset of valid UTF-8, with no guarantee of it.
• They exist specifically for filenames, environment variables, and command-line arguments, where the OS itself makes no UTF-8 guarantee.
• .to_str() -> Option<&str> is the fallible, lossless conversion; .to_string_lossy() -> Cow<str> is the infallible, potentially-lossy one.
• Avoid .unwrap()ing .to_str() on OS-sourced data — real, if rare, non-UTF-8 filenames and environment values do exist.