Abstract
The Rust programming language has gained rapid adoption in systems programming because it delivers memory safety, type safety, and thread safety without relying on a garbage collector. Despite these guarantees, Rust exposes a small but important subset known as unsafe Rust, which permits developers to bypass several of the compiler's safety checks in order to perform low-level operations. When used incorrectly, unsafe Rust can reintroduce the very classes of defects that safe Rust was designed to prevent, including memory-safety violations, undefined behavior, and exploitable security vulnerabilities. This dissertation addresses a gap in the literature: although prior work has measured the prevalence of unsafe Rust and verified the soundness of selected unsafe idioms, no systematic study has classified the unsafe functions of the Rust standard library by necessity. We begin by reviewing the empirical literature to identify the five principal motivations programmers cite for using unsafe Rust, and we show that most of these motivations reflect legitimate engineering concerns, such as performance tuning, foreign function interface (FFI) interoperation, and reuse of legacy code. Building on this foundation, we conduct a systematic classification of the unsafe functions exposed by the std crate. Across 84 modules of the standard library, we identify 48 explicitly unsafe functions. Applying a classification framework that distinguishes necessary unsafe functions (those whose semantics genuinely require unchecked operations) from unnecessary unsafe functions (those for which modern, zero-cost safe alternatives already exist), we determine that 30 of the 48 functions are unnecessary and provide a one-to-one mapping of each to its safer replacement. The remaining 18 functions are justifiably unsafe because they interact with FFI boundaries, custom allocators, raw pointer provenance, or other low-level primitives for which no safe abstraction exists. Building upon these findings, we design and implement a lightweight static-analysis tool that detects the use of unsafe standard-library functions in Rust source code. For each detection, the tool reports the exact location in the source, the safety invariants the caller must uphold, the categories of undefined behavior that may arise from misuse, and--when the function is classified as unnecessary--a concrete safe alternative. Reports are emitted in both machine-readable (JSON) and human-readable (Markdown) formats to support both developer workflows and CI/CD integration. By providing a structured taxonomy, a detailed analysis of safe alternatives, and an open, extensible static-analysis tool, this dissertation strengthens Rust's safety ecosystem, helps practitioners reason about the unsafe constructs they encounter, and offers actionable guidance for writing safer Rust programs at scale.