fix(candid_parser): escape service type method names in the Rust binding + release candid_parser 0.4.1

[lwshang]

Patch release. The Rust binding emitted the method names of a service type into a string literal without escaping them, so a name containing characters that are legal in Candid text but significant in Rust produced incorrect output. They now go through escape_debug, matching pp_function and the #[serde(rename)] attributes, which already escaped. See CHANGELOG.

Output is byte-identical for names that are ordinary identifiers, so no existing goldenfile changed.

Tests: a new service_method_escape.did asset covers the characters that need escaping across all backends, and tests/test_rust_bindings.rs asserts the generated Rust has the same item structure as an equivalent service with plain names. Both fail on master.

The JS/TS bindings needed no change — they route names through candid::pretty::utils::quote_ident, which already escapes.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR addresses a Rust-binding code generation correctness/security issue by properly escaping service type method names before emitting them into Rust string literals, and ships it as a candid_parser patch release.

Changes:

• Escape service type method names in the Rust binding via escape_debug() so generated Rust stays syntactically valid and non-injectable.
• Add a dedicated .did asset plus structural Rust tests (via syn) to ensure escaping happens and output shape is unaffected.
• Release bump to candid_parser 0.4.1 with corresponding lockfile and changelog updates.

Reviewed changes

Copilot reviewed 9 out of 12 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
rust/candid_parser/src/bindings/rust.rs	Escapes service type method names before embedding them into Rust string literals.
rust/candid_parser/tests/test_rust_bindings.rs	New structural tests validating generated Rust remains well-formed and escaped names are preserved.
rust/candid_parser/tests/parse_type.rs	Adds the new escape-focused asset to the Motoko-backend “expected error” list.
rust/candid_parser/tests/assets/service_method_escape.did	New test asset covering method names requiring escaping (quotes, backslashes, control chars, comment markers).
rust/candid_parser/tests/assets/ok/service_method_escape.rs	New golden output for Rust backend demonstrating correct escaping in define_service!.
rust/candid_parser/tests/assets/ok/service_method_escape.js	New golden output for JS backend for the same asset.
rust/candid_parser/tests/assets/ok/service_method_escape.did	New golden pretty-printed .did output for the asset.
rust/candid_parser/tests/assets/ok/service_method_escape.d.ts	New golden output for TS declarations backend for the asset.
rust/candid_parser/Cargo.toml	Bumps version to 0.4.1 and adds syn as a dev-dependency for the new tests.
CHANGELOG.md	Documents the candid_parser 0.4.1 fix and its security implications.
Cargo.lock	Updates lockfile entries for candid_parser 0.4.1 and adds syn to the dependency graph.
rust/bench/Cargo.lock	Updates bench lockfile to use candid_parser 0.4.1.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 8b85aa3.

Security Overview

• 🔎 Scanned files: 12 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/7ddf29dd-76dc-4f78-adfa-47ac8f4643e7?scanId=38ba1a41-9399-4621-9dad-b15708d65766&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► rust/candid_parser/src/bindings/rust.rs      Implement escaping of method names in Rust bindings ► rust/candid_parser/Cargo.toml      Update version and dependencies for new escaping feature ► rust/candid_parser/tests/assets/ok/service_method_escape.did      Add test service with escaped method names ► rust/candid_parser/tests/assets/ok/service_method_escape.js      Add JS binding for escaped method names ► rust/candid_parser/tests/assets/ok/service_method_escape.rs      Add Rust binding for escaped method names ► rust/candid_parser/tests/assets/ok/service_method_escape.d.ts      Add TypeScript declarations for escaped method names ► rust/candid_parser/tests/assets/service_method_escape.did      Add DID for escaped method names ► rust/candid_parser/tests/assets/service_method_escape.js      Add JavaScript test asset for escaped names ► rust/candid_parser/tests/parse_type.rs      Include service_method_escape.did in error checks ► rust/candid_parser/tests/test_rust_bindings.rs      Add tests validating escaped method names do not change item structure