Handle malformed XDR in the address conversion example

[devtechedge]

Fixes #2768.

Summary

The smart-contract example on the address conversions guide called Address::from_xdr(&env, &bytes).unwrap(), which panics when the bytes do not contain a valid Address value.

This PR changes the example to return the fallible result directly (Result<Address, ConversionError>) and adds a short note in the surrounding prose: contracts that receive XDR bytes from untrusted sources, such as a custom authentication scheme, should handle the error case instead of unwrapping, since malformed input is a normal condition at a trust boundary.

Testing

Docs-only change to one guide page. The Rust snippet mirrors the FromXdr trait signature in soroban-sdk (fn from_xdr(env: &Env, b: &Bytes) -> Result<Self, Self::Error>, with Address's conversion error being ConversionError).

[Copilot]

Pull request overview

Updates the address-conversion guide to promote fallible XDR decoding at trust boundaries.

Changes:

• Returns Result<Address, ConversionError>.
• Adds malformed-input guidance.
• However, FromXdr itself still panics on malformed XDR, so the issue remains unresolved.

Recommendation: NEEDS-CHANGES — provide a genuinely non-panicking decoding path or accurately document the limitation.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

docs/build/guides/conversions/address-conversions.mdx:125

• This still does not handle the malformed-XDR case named in the PR and issue. In the current SDK, from_xdr calls deserialize_from_bytes(...).unwrap_infallible(), so malformed bytes panic before this Result can be returned; only valid ScVal XDR of the wrong type produces ConversionError. Client-side validation also cannot protect a public contract boundary because another caller can bypass it. Please either restrict this helper and its guidance to trusted bytes (requiring a typed Address for caller-controlled input), or show a complete in-contract validation strategy before decoding.

pub fn address_from_xdr_bytes(env: Env, bytes: Bytes) -> Result<Address, ConversionError> {
    Address::from_xdr(&env, &bytes)

[github-actions]

PR Preview: torn down

[devtechedge]

Thanks for merging, @ElliotFriend!
Writing the example properly made the lesson concrete: Address::from_xdr().unwrap() panics on malformed XDR, so a contract consuming XDR from an untrusted source has to handle the error rather than abort.

Returning Result<Address, ConversionError> says that to the reader without a paragraph of warning text.
Appreciate the review :)