Fix missing safety consideration

Author: timon-schelling

desktop/src/cef/internal/browser_process_client.rs

@@ -28,7 +28,8 @@ impl<H: CefEventHandler> ImplClient for BrowserProcessClientImpl<H> {
 		_source_process: cef::ProcessId,
 		message: Option<&mut cef::ProcessMessage>,
 	) -> ::std::os::raw::c_int {
-		match message.unpack() {
+		let unpacked_message = unsafe { message.and_then(|m| m.unpack()) };
+		match unpacked_message {
 			Some(UnpackedMessage {
 				message_type: MessageType::SendToNative,
 				data,

desktop/src/cef/internal/render_process_handler.rs

@@ -26,7 +26,8 @@ impl ImplRenderProcessHandler for RenderProcessHandlerImpl {
 		_source_process: cef::ProcessId,
 		message: Option<&mut cef::ProcessMessage>,
 	) -> ::std::os::raw::c_int {
-		match message.unpack() {
+		let unpacked_message = unsafe { message.and_then(|m| m.unpack()) };
+		match unpacked_message {
 			Some(UnpackedMessage {
 				message_type: MessageType::SendToJS,
 				data,

desktop/src/cef/ipc.rs

@@ -94,17 +94,19 @@ pub(crate) struct UnpackedMessage<'a> {
 	pub(crate) message_type: MessageType,
 	pub(crate) data: &'a [u8],
 }
-pub(crate) trait UnpackMessage {
-	fn unpack(&'_ self) -> Option<UnpackedMessage<'_>>;
-}
-impl UnpackMessage for Option<&mut cef::ProcessMessage> {
-	fn unpack(&'_ self) -> Option<UnpackedMessage<'_>> {
-		let Some(message) = self else { return None };
-		message.unpack()
-	}
+
+trait Sealed {}
+impl Sealed for cef::ProcessMessage {}
+#[allow(private_bounds)]
+pub(crate) trait UnpackMessage: Sealed {
+	/// # Safety
+	///
+	/// The caller must ensure that the message is valid.
+	/// Message should come from cef.
+	unsafe fn unpack(&self) -> Option<UnpackedMessage<'_>>;
 }
 impl UnpackMessage for cef::ProcessMessage {
-	fn unpack(&'_ self) -> Option<UnpackedMessage<'_>> {
+	unsafe fn unpack(&self) -> Option<UnpackedMessage<'_>> {
 		let pointer: *mut cef::sys::_cef_string_utf16_t = self.name().into();
 		let message = unsafe { super::utility::pointer_to_string(pointer) };
 		let Ok(message_type) = message.try_into() else {