From: Francesco Chemolli <kinkie@squid-cache.org>
Date: Thu, 29 Jan 2009 14:50:26 +0000 (+0100)
Subject: Refactoring: renamed String::buf() to unsafeBuf().
X-Git-Tag: SQUID_3_2_0_1~1212^2~19
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=99524de767643cfa219d1fdcf9981086effac20c;p=thirdparty%2Fsquid.git

Refactoring: renamed String::buf() to unsafeBuf().
Introduced aliases for it named String::rawBuf() and String::termedBuf().
Introduced String::defined() and String::undefined().
---

diff --git a/src/ACLExtUser.cc b/src/ACLExtUser.cc
index f8570809cc..bbdbb08df0 100644
--- a/src/ACLExtUser.cc
+++ b/src/ACLExtUser.cc
@@ -79,7 +79,7 @@ int
 ACLExtUser::match(ACLChecklist *checklist)
 {
     if (checklist->request->extacl_user.size()) {
-        return data->match(checklist->request->extacl_user.buf());
+        return data->match(checklist->request->extacl_user.unsafeBuf());
     } else {
         return -1;
     }
diff --git a/src/ACLHTTPHeaderData.cc b/src/ACLHTTPHeaderData.cc
index ec785606d7..3bfd75d122 100644
--- a/src/ACLHTTPHeaderData.cc
+++ b/src/ACLHTTPHeaderData.cc
@@ -63,18 +63,18 @@ ACLHTTPHeaderData::match(HttpHeader* hdr)
     if (hdr == NULL)
         return false;
 
-    debugs(28, 3, "aclHeaderData::match: checking '" << hdrName.buf() << "'");
+    debugs(28, 3, "aclHeaderData::match: checking '" << hdrName.unsafeBuf() << "'");
 
-    String value = hdrId != HDR_BAD_HDR ? hdr->getStrOrList(hdrId) : hdr->getByName(hdrName.buf());
+    String value = hdrId != HDR_BAD_HDR ? hdr->getStrOrList(hdrId) : hdr->getByName(hdrName.unsafeBuf());
 
-    return regex_rule->match(value.buf());
+    return regex_rule->match(value.unsafeBuf());
 }
 
 wordlist *
 ACLHTTPHeaderData::dump()
 {
     wordlist *W = NULL;
-    wordlistAdd(&W, hdrName.buf());
+    wordlistAdd(&W, hdrName.unsafeBuf());
     wordlist * regex_dump = regex_rule->dump();
     wordlistAddWl(&W, regex_dump);
     wordlistDestroy(&regex_dump);
@@ -87,14 +87,14 @@ ACLHTTPHeaderData::parse()
     char* t = strtokFile();
     assert (t != NULL);
     hdrName = t;
-    hdrId = httpHeaderIdByNameDef(hdrName.buf(), strlen(hdrName.buf()));
+    hdrId = httpHeaderIdByNameDef(hdrName.unsafeBuf(), strlen(hdrName.unsafeBuf()));
     regex_rule->parse();
 }
 
 bool
 ACLHTTPHeaderData::empty() const
 {
-    return (hdrId == HDR_BAD_HDR && !hdrName.buf()) || regex_rule->empty();
+    return (hdrId == HDR_BAD_HDR && !hdrName.unsafeBuf()) || regex_rule->empty();
 }
 
 ACLData<HttpHeader*> *
diff --git a/src/ACLUrlPath.cc b/src/ACLUrlPath.cc
index 7ca0ba1bcc..a712d007b2 100644
--- a/src/ACLUrlPath.cc
+++ b/src/ACLUrlPath.cc
@@ -47,7 +47,7 @@ ACLStrategised<char const *> ACLUrlPath::RegistryEntry_(new ACLRegexData, ACLUrl
 int
 ACLUrlPathStrategy::match (ACLData<char const *> * &data, ACLChecklist *checklist)
 {
-    char *esc_buf = xstrdup(checklist->request->urlpath.buf());
+    char *esc_buf = xstrdup(checklist->request->urlpath.unsafeBuf());
     rfc1738_unescape(esc_buf);
     int result = data->match(esc_buf);
     safe_free(esc_buf);
diff --git a/src/CommonPool.h b/src/CommonPool.h
index 7e763d3723..281025e218 100644
--- a/src/CommonPool.h
+++ b/src/CommonPool.h
@@ -59,7 +59,7 @@ public:
     void *operator new(size_t);
     void operator delete (void *);
     static CommonPool *Factory (unsigned char _class, CompositePoolNode::Pointer&);
-    char const* theClassTypeLabel() const {return typeLabel.buf();}
+    char const* theClassTypeLabel() const {return typeLabel.unsafeBuf();}
 
 protected:
     CommonPool();
diff --git a/src/DelayTagged.cc b/src/DelayTagged.cc
index f922501531..a5c08e6041 100644
--- a/src/DelayTagged.cc
+++ b/src/DelayTagged.cc
@@ -77,7 +77,7 @@ int
 DelayTaggedCmp(DelayTaggedBucket::Pointer const &left, DelayTaggedBucket::Pointer const &right)
 {
     /* for rate limiting, case insensitive */
-    return left->tag.caseCmp(right->tag.buf());
+    return left->tag.caseCmp(right->tag.unsafeBuf());
 }
 
 void
@@ -195,7 +195,7 @@ DelayTaggedBucket::~DelayTaggedBucket()
 void
 DelayTaggedBucket::stats (StoreEntry *entry) const
 {
-    storeAppendPrintf(entry, " %s:", tag.buf());
+    storeAppendPrintf(entry, " %s:", tag.unsafeBuf());
     theBucket.stats (entry);
 }
 
diff --git a/src/DiskIO/AIO/AIODiskFile.cc b/src/DiskIO/AIO/AIODiskFile.cc
index 5d72e7a783..fd31fc1a17 100644
--- a/src/DiskIO/AIO/AIODiskFile.cc
+++ b/src/DiskIO/AIO/AIODiskFile.cc
@@ -87,10 +87,10 @@ AIODiskFile::open(int flags, mode_t mode, RefCount<IORequestor> callback)
 {
     /* Simulate async calls */
 #ifdef _SQUID_WIN32_
-    fd = aio_open(path.buf(), flags);
+    fd = aio_open(path.unsafeBuf(), flags);
 #else
 
-    fd = file_open(path.buf() , flags);
+    fd = file_open(path.unsafeBuf() , flags);
 #endif
 
     ioRequestor = callback;
@@ -130,7 +130,7 @@ AIODiskFile::read(ReadRequest *request)
         fatal("Aiee! out of aiocb slots! - FIXME and wrap file_read\n");
         debugs(79, 1, "WARNING: out of aiocb slots!");
         /* fall back to blocking method */
-        //        file_read(fd, request->buf, request->len, request->offset, callback, data);
+        //        file_read(fd, request->unsafeBuf, request->len, request->offset, callback, data);
         return;
     }
 
@@ -167,7 +167,7 @@ AIODiskFile::read(ReadRequest *request)
         fatalf("Aiee! aio_read() returned error (%d)  FIXME and wrap file_read !\n", errno);
         debugs(79, 1, "WARNING: aio_read() returned error: " << xstrerror());
         /* fall back to blocking method */
-        //        file_read(fd, request->buf, request->len, request->offset, callback, data);
+        //        file_read(fd, request->unsafeBuf, request->len, request->offset, callback, data);
     }
 
 }
@@ -188,7 +188,7 @@ AIODiskFile::write(WriteRequest *request)
         fatal("Aiee! out of aiocb slots FIXME and wrap file_write !\n");
         debugs(79, 1, "WARNING: out of aiocb slots!");
         /* fall back to blocking method */
-        //        file_write(fd, offset, buf, len, callback, data, freefunc);
+        //        file_write(fd, offset, unsafeBuf, len, callback, data, freefunc);
         return;
     }
 
@@ -225,7 +225,7 @@ AIODiskFile::write(WriteRequest *request)
         fatalf("Aiee! aio_write() returned error (%d) FIXME and wrap file_write !\n", errno);
         debugs(79, 1, "WARNING: aio_write() returned error: " << xstrerror());
         /* fall back to blocking method */
-        //       file_write(fd, offset, buf, len, callback, data, freefunc);
+        //       file_write(fd, offset, unsafeBuf, len, callback, data, freefunc);
     }
 }
 
diff --git a/src/ESI.cc b/src/ESI.cc
index 38a9fb58f7..4962d5d85c 100644
--- a/src/ESI.cc
+++ b/src/ESI.cc
@@ -1578,7 +1578,7 @@ esiLiteral::process (int dovars)
         /* Ensure variable state is clean */
 
         while (temp.getRaw()) {
-            varState->feedData(temp->buf,temp->len);
+            varState->feedData(temp->unsafeBuf,temp->len);
             temp = temp->next;
         }
 
diff --git a/src/ESIVarState.cc b/src/ESIVarState.cc
index 1a160e06e3..5d62752d1e 100644
--- a/src/ESIVarState.cc
+++ b/src/ESIVarState.cc
@@ -317,7 +317,7 @@ ESIVarState::ESIVarState (HttpHeader const *aHeader, char const *uri)
 void
 ESIVarState::removeVariable (String const &name)
 {
-    Variable *candidate = static_cast <Variable *>(variables.find (name.buf(), name.size()));
+    Variable *candidate = static_cast <Variable *>(variables.find (name.unsafeBuf(), name.size()));
 
     if (candidate) {
         /* XXX: remove me */
@@ -434,7 +434,7 @@ ESIVariableCookie::eval (ESIVarState &state, char const *subref, char const *fou
             String S = state.header().getListMember (HDR_COOKIE, subref, ';');
 
             if (S.size())
-                ESISegment::ListAppend (state.getOutput(), S.buf(), S.size());
+                ESISegment::ListAppend (state.getOutput(), S.unsafeBuf(), S.size());
             else if (found_default)
                 ESISegment::ListAppend (state.getOutput(), found_default, strlen (found_default));
         }
@@ -468,7 +468,7 @@ ESIVariableLanguage::eval (ESIVarState &state, char const *subref, char const *f
     if (state.header().has(HDR_ACCEPT_LANGUAGE)) {
         if (!subref) {
             String S (state.header().getList (HDR_ACCEPT_LANGUAGE));
-            ESISegment::ListAppend (state.getOutput(), S.buf(), S.size());
+            ESISegment::ListAppend (state.getOutput(), S.unsafeBuf(), S.size());
         } else {
             if (state.header().hasListMember (HDR_ACCEPT_LANGUAGE, subref, ',')) {
                 s = "true";
@@ -884,7 +884,7 @@ ESIVarState::buildVary (HttpReply *rep)
 
     String strVary (rep->header.getList (HDR_VARY));
 
-    if (!strVary.size() || strVary.buf()[0] != '*') {
+    if (!strVary.size() || strVary.unsafeBuf()[0] != '*') {
         rep->header.putStr (HDR_VARY, tempstr);
     }
 }
diff --git a/src/HttpHdrCc.cc b/src/HttpHdrCc.cc
index ceac343453..c489af347e 100644
--- a/src/HttpHdrCc.cc
+++ b/src/HttpHdrCc.cc
@@ -134,13 +134,13 @@ httpHdrCcParseInit(HttpHdrCc * cc, const String * str)
                 CcFieldsInfo, CC_ENUM_END);
 
         if (type < 0) {
-            debugs(65, 2, "hdr cc: unknown cache-directive: near '" << item << "' in '" << str->buf() << "'");
+            debugs(65, 2, "hdr cc: unknown cache-directive: near '" << item << "' in '" << str->unsafeBuf() << "'");
             type = CC_OTHER;
         }
 
         if (EBIT_TEST(cc->mask, type)) {
             if (type != CC_OTHER)
-                debugs(65, 2, "hdr cc: ignoring duplicate cache-directive: near '" << item << "' in '" << str->buf() << "'");
+                debugs(65, 2, "hdr cc: ignoring duplicate cache-directive: near '" << item << "' in '" << str->unsafeBuf() << "'");
 
             CcFieldsInfo[type].stat.repCount++;
 
@@ -205,7 +205,7 @@ httpHdrCcDestroy(HttpHdrCc * cc)
 {
     assert(cc);
 
-    if (cc->other.buf())
+    if (cc->other.unsafeBuf())
         cc->other.clean();
 
     memFree(cc, MEM_HTTP_HDR_CC);
@@ -235,7 +235,7 @@ httpHdrCcPackInto(const HttpHdrCc * cc, Packer * p)
         if (EBIT_TEST(cc->mask, flag) && flag != CC_OTHER) {
 
             /* print option name */
-            packerPrintf(p, (pcount ? ", %s" : "%s"), CcFieldsInfo[flag].name.buf());
+            packerPrintf(p, (pcount ? ", %s" : "%s"), CcFieldsInfo[flag].name.unsafeBuf());
 
             /* handle options with values */
 
@@ -253,7 +253,7 @@ httpHdrCcPackInto(const HttpHdrCc * cc, Packer * p)
     }
 
     if (cc->other.size())
-        packerPrintf(p, (pcount ? ", %s" : "%s"), cc->other.buf());
+        packerPrintf(p, (pcount ? ", %s" : "%s"), cc->other.unsafeBuf());
 }
 
 /* negative max_age will clean old max_Age setting */
@@ -299,7 +299,7 @@ httpHdrCcStatDumper(StoreEntry * sentry, int idx, double val, double size, int c
     extern const HttpHeaderStat *dump_stat;	/* argh! */
     const int id = (int) val;
     const int valid_id = id >= 0 && id < CC_ENUM_END;
-    const char *name = valid_id ? CcFieldsInfo[id].name.buf() : "INVALID";
+    const char *name = valid_id ? CcFieldsInfo[id].name.unsafeBuf() : "INVALID";
 
     if (count || valid_id)
         storeAppendPrintf(sentry, "%2d\t %-20s\t %5d\t %6.2f\n",
diff --git a/src/HttpHdrExtField.cc b/src/HttpHdrExtField.cc
index 04e6708ed1..c4a5678a52 100644
--- a/src/HttpHdrExtField.cc
+++ b/src/HttpHdrExtField.cc
@@ -96,6 +96,6 @@ httpHdrExtFieldDup(HttpHdrExtField * f)
 {
     assert(f);
     return httpHdrExtFieldDoCreate(
-               f->name.buf(), f->name.size(),
-               f->value.buf(), f->value.size());
+               f->name.unsafeBuf(), f->name.size(),
+               f->value.unsafeBuf(), f->value.size());
 }
diff --git a/src/HttpHdrRange.cc b/src/HttpHdrRange.cc
index 78e59bbd0d..6045a996a6 100644
--- a/src/HttpHdrRange.cc
+++ b/src/HttpHdrRange.cc
@@ -251,14 +251,14 @@ HttpHdrRange::parseInit(const String * range_spec)
     int count = 0;
     assert(this && range_spec);
     ++ParsedCount;
-    debugs(64, 8, "parsing range field: '" << range_spec->buf() << "'");
+    debugs(64, 8, "parsing range field: '" << range_spec->unsafeBuf() << "'");
     /* check range type */
 
     if (range_spec->caseCmp("bytes=", 6))
         return 0;
 
     /* skip "bytes="; hack! */
-    pos = range_spec->buf() + 6;
+    pos = range_spec->unsafeBuf() + 6;
 
     /* iterate through comma separated list */
     while (strListGetItem(range_spec, ',', &item, &ilen, &pos)) {
diff --git a/src/HttpHdrSc.cc b/src/HttpHdrSc.cc
index a7adaadd64..537387f0c0 100644
--- a/src/HttpHdrSc.cc
+++ b/src/HttpHdrSc.cc
@@ -138,7 +138,7 @@ httpHdrScParseInit(HttpHdrSc * sc, const String * str)
                                   ScFieldsInfo, SC_ENUM_END);
 
         if (type < 0) {
-            debugs(90, 2, "hdr sc: unknown control-directive: near '" << item << "' in '" << str->buf() << "'");
+            debugs(90, 2, "hdr sc: unknown control-directive: near '" << item << "' in '" << str->unsafeBuf() << "'");
             type = SC_OTHER;
         }
 
@@ -162,7 +162,7 @@ httpHdrScParseInit(HttpHdrSc * sc, const String * str)
 
         if (EBIT_TEST(sct->mask, type)) {
             if (type != SC_OTHER)
-                debugs(90, 2, "hdr sc: ignoring duplicate control-directive: near '" << item << "' in '" << str->buf() << "'");
+                debugs(90, 2, "hdr sc: ignoring duplicate control-directive: near '" << item << "' in '" << str->unsafeBuf() << "'");
 
             ScFieldsInfo[type].stat.repCount++;
 
@@ -257,7 +257,7 @@ httpHdrScTargetPackInto(const HttpHdrScTarget * sc, Packer * p)
         if (EBIT_TEST(sc->mask, flag) && flag != SC_OTHER) {
 
             /* print option name */
-            packerPrintf(p, (pcount ? ", %s" : "%s"), ScFieldsInfo[flag].name.buf());
+            packerPrintf(p, (pcount ? ", %s" : "%s"), ScFieldsInfo[flag].name.unsafeBuf());
 
             /* handle options with values */
 
@@ -265,14 +265,14 @@ httpHdrScTargetPackInto(const HttpHdrScTarget * sc, Packer * p)
                 packerPrintf(p, "=%d", (int) sc->max_age);
 
             if (flag == SC_CONTENT)
-                packerPrintf(p, "=\"%s\"", sc->content.buf());
+                packerPrintf(p, "=\"%s\"", sc->content.unsafeBuf());
 
             pcount++;
         }
     }
 
     if (sc->target.size())
-        packerPrintf (p, ";%s", sc->target.buf());
+        packerPrintf (p, ";%s", sc->target.unsafeBuf());
 }
 
 void
@@ -339,7 +339,7 @@ httpHdrScTargetStatDumper(StoreEntry * sentry, int idx, double val, double size,
     extern const HttpHeaderStat *dump_stat;     /* argh! */
     const int id = (int) val;
     const int valid_id = id >= 0 && id < SC_ENUM_END;
-    const char *name = valid_id ? ScFieldsInfo[id].name.buf() : "INVALID";
+    const char *name = valid_id ? ScFieldsInfo[id].name.unsafeBuf() : "INVALID";
 
     if (count || valid_id)
         storeAppendPrintf(sentry, "%2d\t %-20s\t %5d\t %6.2f\n",
@@ -352,7 +352,7 @@ httpHdrScStatDumper(StoreEntry * sentry, int idx, double val, double size, int c
     extern const HttpHeaderStat *dump_stat;	/* argh! */
     const int id = (int) val;
     const int valid_id = id >= 0 && id < SC_ENUM_END;
-    const char *name = valid_id ? ScFieldsInfo[id].name.buf() : "INVALID";
+    const char *name = valid_id ? ScFieldsInfo[id].name.unsafeBuf() : "INVALID";
 
     if (count || valid_id)
         storeAppendPrintf(sentry, "%2d\t %-20s\t %5d\t %6.2f\n",
@@ -369,9 +369,9 @@ httpHdrScFindTarget (HttpHdrSc *sc, const char *target)
     while (node) {
         HttpHdrScTarget *sct = (HttpHdrScTarget *)node->data;
 
-        if (target && sct->target.buf() && !strcmp (target, sct->target.buf()))
+        if (target && sct->target.unsafeBuf() && !strcmp (target, sct->target.unsafeBuf()))
             return sct;
-        else if (!target && !sct->target.buf())
+        else if (!target && !sct->target.unsafeBuf())
             return sct;
 
         node = node->next;
diff --git a/src/HttpHdrScTarget.cc b/src/HttpHdrScTarget.cc
index b011c47774..5f3906e8d2 100644
--- a/src/HttpHdrScTarget.cc
+++ b/src/HttpHdrScTarget.cc
@@ -68,7 +68,7 @@ httpHdrScTargetDup(const HttpHdrScTarget * sc)
 {
     HttpHdrScTarget *dup;
     assert(sc);
-    dup = httpHdrScTargetCreate(sc->target.buf());
+    dup = httpHdrScTargetCreate(sc->target.unsafeBuf());
     dup->mask = sc->mask;
     dup->max_age = sc->max_age;
     dup->content = sc->content;
diff --git a/src/HttpHeader.cc b/src/HttpHeader.cc
index be38e5b90a..cad06c8f31 100644
--- a/src/HttpHeader.cc
+++ b/src/HttpHeader.cc
@@ -461,7 +461,7 @@ HttpHeader::update (HttpHeader const *fresh, HttpHeaderMask const *denied_mask)
         if (e->id != HDR_OTHER)
             delById(e->id);
         else
-            delByName(e->name.buf());
+            delByName(e->name.unsafeBuf());
     }
 
     pos = HttpHeaderInitPos;
@@ -578,7 +578,7 @@ HttpHeader::parse(const char *header_start, const char *header_end)
         }
 
         if (e->id == HDR_CONTENT_LENGTH && (e2 = findEntry(e->id)) != NULL) {
-            if (e->value.cmp(e2->value.buf()) != 0) {
+            if (e->value.cmp(e2->value.unsafeBuf()) != 0) {
                 int64_t l1, l2;
                 debugs(55, Config.onoff.relaxed_header_parser <= 0 ? 1 : 2,
                        "WARNING: found two conflicting content-length headers in {" << getStringPrefix(header_start, header_end) << "}");
@@ -588,12 +588,12 @@ HttpHeader::parse(const char *header_start, const char *header_end)
                     goto reset;
                 }
 
-                if (!httpHeaderParseOffset(e->value.buf(), &l1)) {
-                    debugs(55, 1, "WARNING: Unparseable content-length '" << e->value.buf() << "'");
+                if (!httpHeaderParseOffset(e->value.unsafeBuf(), &l1)) {
+                    debugs(55, 1, "WARNING: Unparseable content-length '" << e->value.unsafeBuf() << "'");
                     delete e;
                     continue;
-                } else if (!httpHeaderParseOffset(e2->value.buf(), &l2)) {
-                    debugs(55, 1, "WARNING: Unparseable content-length '" << e2->value.buf() << "'");
+                } else if (!httpHeaderParseOffset(e2->value.unsafeBuf(), &l2)) {
+                    debugs(55, 1, "WARNING: Unparseable content-length '" << e2->value.unsafeBuf() << "'");
                     delById(e2->id);
                 } else if (l1 > l2) {
                     delById(e2->id);
@@ -615,7 +615,7 @@ HttpHeader::parse(const char *header_start, const char *header_end)
             }
         }
 
-        if (e->id == HDR_OTHER && stringHasWhitespace(e->name.buf())) {
+        if (e->id == HDR_OTHER && stringHasWhitespace(e->name.unsafeBuf())) {
             debugs(55, Config.onoff.relaxed_header_parser <= 0 ? 1 : 2,
                    "WARNING: found whitespace in HTTP header name {" <<
                    getStringPrefix(field_start, field_end) << "}");
@@ -875,7 +875,7 @@ HttpHeader::getList(http_hdr_type id, String *s) const
 
     while ((e = getEntry(&pos))) {
         if (e->id == id)
-            strListAdd(s, e->value.buf(), ',');
+            strListAdd(s, e->value.unsafeBuf(), ',');
     }
 
     /*
@@ -909,7 +909,7 @@ HttpHeader::getList(http_hdr_type id) const
 
     while ((e = getEntry(&pos))) {
         if (e->id == id)
-            strListAdd(&s, e->value.buf(), ',');
+            strListAdd(&s, e->value.unsafeBuf(), ',');
     }
 
     /*
@@ -964,7 +964,7 @@ HttpHeader::getByName(const char *name) const
     /* Sorry, an unknown header name. Do linear search */
     while ((e = getEntry(&pos))) {
         if (e->id == HDR_OTHER && e->name.caseCmp(name) == 0) {
-            strListAdd(&result, e->value.buf(), ',');
+            strListAdd(&result, e->value.unsafeBuf(), ',');
         }
     }
 
@@ -1209,7 +1209,7 @@ HttpHeader::getTime(http_hdr_type id) const
     assert(Headers[id].type == ftDate_1123);	/* must be of an appropriate type */
 
     if ((e = findEntry(id))) {
-        value = parse_rfc1123(e->value.buf());
+        value = parse_rfc1123(e->value.unsafeBuf());
         httpHeaderNoteParsedEntry(e->id, e->value, value < 0);
     }
 
@@ -1226,7 +1226,7 @@ HttpHeader::getStr(http_hdr_type id) const
 
     if ((e = findEntry(id))) {
         httpHeaderNoteParsedEntry(e->id, e->value, 0);	/* no errors are possible */
-        return e->value.buf();
+        return e->value.unsafeBuf();
     }
 
     return NULL;
@@ -1242,7 +1242,7 @@ HttpHeader::getLastStr(http_hdr_type id) const
 
     if ((e = findLastEntry(id))) {
         httpHeaderNoteParsedEntry(e->id, e->value, 0);	/* no errors are possible */
-        return e->value.buf();
+        return e->value.unsafeBuf();
     }
 
     return NULL;
@@ -1322,7 +1322,7 @@ HttpHeader::getContRange() const
     HttpHeaderEntry *e;
 
     if ((e = findEntry(HDR_CONTENT_RANGE))) {
-        cr = httpHdrContRangeParseCreate(e->value.buf());
+        cr = httpHdrContRangeParseCreate(e->value.unsafeBuf());
         httpHeaderNoteParsedEntry(e->id, e->value, !cr);
     }
 
@@ -1367,7 +1367,7 @@ HttpHeader::getETag(http_hdr_type id) const
     assert(Headers[id].type == ftETag);		/* must be of an appropriate type */
 
     if ((e = findEntry(id)))
-        etagParseInit(&etag, e->value.buf());
+        etagParseInit(&etag, e->value.unsafeBuf());
 
     return etag;
 }
@@ -1381,7 +1381,7 @@ HttpHeader::getTimeOrTag(http_hdr_type id) const
     memset(&tot, 0, sizeof(tot));
 
     if ((e = findEntry(id))) {
-        const char *str = e->value.buf();
+        const char *str = e->value.unsafeBuf();
         /* try as an ETag */
 
         if (etagParseInit(&tot.tag, str)) {
@@ -1417,13 +1417,13 @@ HttpHeaderEntry::HttpHeaderEntry(http_hdr_type anId, const char *aName, const ch
 
     Headers[id].stat.aliveCount++;
 
-    debugs(55, 9, "created HttpHeaderEntry " << this << ": '" << name.buf() << " : " << value.buf());
+    debugs(55, 9, "created HttpHeaderEntry " << this << ": '" << name.unsafeBuf() << " : " << value.unsafeBuf());
 }
 
 HttpHeaderEntry::~HttpHeaderEntry()
 {
     assert_eid(id);
-    debugs(55, 9, "destroying entry " << this << ": '" << name.buf() << ": " << value.buf() << "'");
+    debugs(55, 9, "destroying entry " << this << ": '" << name.unsafeBuf() << ": " << value.unsafeBuf() << "'");
     /* clean name if needed */
 
     if (id == HDR_OTHER)
@@ -1503,7 +1503,7 @@ HttpHeaderEntry::parse(const char *field_start, const char *field_end)
 
     if (field_end - value_start > 65534) {
         /* String must be LESS THAN 64K and it adds a terminating NULL */
-        debugs(55, 1, "WARNING: ignoring '" << name.buf() << "' header of " << (field_end - value_start) << " bytes");
+        debugs(55, 1, "WARNING: ignoring '" << name.unsafeBuf() << "' header of " << (field_end - value_start) << " bytes");
 
         if (id == HDR_OTHER)
             name.clean();
@@ -1518,24 +1518,24 @@ HttpHeaderEntry::parse(const char *field_start, const char *field_end)
 
     Headers[id].stat.aliveCount++;
 
-    debugs(55, 9, "parsed HttpHeaderEntry: '" << name.buf() << ": " << value.buf() << "'");
+    debugs(55, 9, "parsed HttpHeaderEntry: '" << name.unsafeBuf() << ": " << value.unsafeBuf() << "'");
 
-    return new HttpHeaderEntry(id, name.buf(), value.buf());
+    return new HttpHeaderEntry(id, name.unsafeBuf(), value.unsafeBuf());
 }
 
 HttpHeaderEntry *
 HttpHeaderEntry::clone() const
 {
-    return new HttpHeaderEntry(id, name.buf(), value.buf());
+    return new HttpHeaderEntry(id, name.unsafeBuf(), value.unsafeBuf());
 }
 
 void
 HttpHeaderEntry::packInto(Packer * p) const
 {
     assert(p);
-    packerAppend(p, name.buf(), name.size());
+    packerAppend(p, name.unsafeBuf(), name.size());
     packerAppend(p, ": ", 2);
-    packerAppend(p, value.buf(), value.size());
+    packerAppend(p, value.unsafeBuf(), value.size());
     packerAppend(p, "\r\n", 2);
 }
 
@@ -1545,7 +1545,7 @@ HttpHeaderEntry::getInt() const
     assert_eid (id);
     assert (Headers[id].type == ftInt);
     int val = -1;
-    int ok = httpHeaderParseInt(value.buf(), &val);
+    int ok = httpHeaderParseInt(value.unsafeBuf(), &val);
     httpHeaderNoteParsedEntry(id, value, !ok);
     /* XXX: Should we check ok - ie
      * return ok ? -1 : value;
@@ -1559,7 +1559,7 @@ HttpHeaderEntry::getInt64() const
     assert_eid (id);
     assert (Headers[id].type == ftInt64);
     int64_t val = -1;
-    int ok = httpHeaderParseOffset(value.buf(), &val);
+    int ok = httpHeaderParseOffset(value.unsafeBuf(), &val);
     httpHeaderNoteParsedEntry(id, value, !ok);
     /* XXX: Should we check ok - ie
      * return ok ? -1 : value;
@@ -1574,7 +1574,7 @@ httpHeaderNoteParsedEntry(http_hdr_type id, String const &context, int error)
 
     if (error) {
         Headers[id].stat.errCount++;
-        debugs(55, 2, "cannot parse hdr field: '" << Headers[id].name.buf() << ": " << context.buf() << "'");
+        debugs(55, 2, "cannot parse hdr field: '" << Headers[id].name.unsafeBuf() << ": " << context.unsafeBuf() << "'");
     }
 }
 
@@ -1591,7 +1591,7 @@ httpHeaderFieldStatDumper(StoreEntry * sentry, int idx, double val, double size,
 {
     const int id = (int) val;
     const int valid_id = id >= 0 && id < HDR_ENUM_END;
-    const char *name = valid_id ? Headers[id].name.buf() : "INVALID";
+    const char *name = valid_id ? Headers[id].name.unsafeBuf() : "INVALID";
     int visible = count > 0;
     /* for entries with zero count, list only those that belong to current type of message */
 
@@ -1669,7 +1669,7 @@ httpHeaderStoreReport(StoreEntry * e)
     for (ht = (http_hdr_type)0; ht < HDR_ENUM_END; ++ht) {
         HttpHeaderFieldInfo *f = Headers + ht;
         storeAppendPrintf(e, "%2d\t %-25s\t %5d\t %6.3f\t %6.3f\n",
-                          f->id, f->name.buf(), f->stat.aliveCount,
+                          f->id, f->name.unsafeBuf(), f->stat.aliveCount,
                           xpercent(f->stat.errCount, f->stat.parsCount),
                           xpercent(f->stat.repCount, f->stat.seenCount));
     }
@@ -1690,7 +1690,7 @@ httpHeaderIdByName(const char *name, int name_len, const HttpHeaderFieldInfo * i
         if (name_len >= 0 && name_len != info[i].name.size())
             continue;
 
-        if (!strncasecmp(name, info[i].name.buf(),
+        if (!strncasecmp(name, info[i].name.unsafeBuf(),
                          name_len < 0 ? info[i].name.size() + 1 : name_len))
             return info[i].id;
     }
@@ -1715,7 +1715,7 @@ httpHeaderNameById(int id)
 
     assert(id >= 0 && id < HDR_ENUM_END);
 
-    return Headers[id].name.buf();
+    return Headers[id].name.unsafeBuf();
 }
 
 int
@@ -1804,7 +1804,7 @@ HttpHeader::removeConnectionHeaderEntries()
 
         int headers_deleted = 0;
         while ((e = getEntry(&pos))) {
-            if (strListIsMember(&strConnection, e->name.buf(), ','))
+            if (strListIsMember(&strConnection, e->name.unsafeBuf(), ','))
                 delAt(pos, headers_deleted);
         }
         if (headers_deleted)
diff --git a/src/HttpHeaderTools.cc b/src/HttpHeaderTools.cc
index 289ccc8b89..6776898d8c 100644
--- a/src/HttpHeaderTools.cc
+++ b/src/HttpHeaderTools.cc
@@ -258,7 +258,7 @@ strListGetItem(const String * str, char del, const char **item, int *ilen, const
     delim[2][1] = del;
 
     if (!*pos) {
-        *pos = str->buf();
+        *pos = str->unsafeBuf();
 
         if (!*pos)
             return 0;
diff --git a/src/HttpReply.cc b/src/HttpReply.cc
index f0fabc45f2..ad0f3af82d 100644
--- a/src/HttpReply.cc
+++ b/src/HttpReply.cc
@@ -281,7 +281,7 @@ HttpReply::validatorsMatch(HttpReply const * otherRep) const
 
     two = otherRep->header.getStrOrList(HDR_ETAG);
 
-    if (!one.buf() || !two.buf() || strcasecmp (one.buf(), two.buf())) {
+    if (!one.unsafeBuf() || !two.unsafeBuf() || strcasecmp (one.unsafeBuf(), two.unsafeBuf())) {
         one.clean();
         two.clean();
         return 0;
@@ -295,7 +295,7 @@ HttpReply::validatorsMatch(HttpReply const * otherRep) const
 
     two = otherRep->header.getStrOrList(HDR_CONTENT_MD5);
 
-    if (!one.buf() || !two.buf() || strcasecmp (one.buf(), two.buf())) {
+    if (!one.unsafeBuf() || !two.unsafeBuf() || strcasecmp (one.unsafeBuf(), two.unsafeBuf())) {
         one.clean();
         two.clean();
         return 0;
@@ -440,7 +440,7 @@ HttpReply::bodySize(const HttpRequestMethod& method) const
 bool HttpReply::sanityCheckStartLine(MemBuf *buf, http_status *error)
 {
     if (buf->contentSize() >= protoPrefix.size() && protoPrefix.cmp(buf->content(), protoPrefix.size()) != 0) {
-        debugs(58, 3, "HttpReply::sanityCheckStartLine: missing protocol prefix (" << protoPrefix.buf() << ") in '" << buf->content() << "'");
+        debugs(58, 3, "HttpReply::sanityCheckStartLine: missing protocol prefix (" << protoPrefix.unsafeBuf() << ") in '" << buf->content() << "'");
         *error = HTTP_INVALID_HEADER;
         return false;
     }
diff --git a/src/HttpRequest.cc b/src/HttpRequest.cc
index f4b844ae53..82aeea5cf2 100644
--- a/src/HttpRequest.cc
+++ b/src/HttpRequest.cc
@@ -150,7 +150,7 @@ HttpRequest::reset()
 HttpRequest *
 HttpRequest::clone() const
 {
-    HttpRequest *copy = new HttpRequest(method, protocol, urlpath.buf());
+    HttpRequest *copy = new HttpRequest(method, protocol, urlpath.unsafeBuf());
     // TODO: move common cloning clone to Msg::copyTo() or copy ctor
     copy->header.append(&header);
     copy->hdrCacheInit();
@@ -299,7 +299,7 @@ HttpRequest::pack(Packer * p)
     assert(p);
     /* pack request-line */
     packerPrintf(p, "%s %s HTTP/1.0\r\n",
-                 RequestMethodStr(method), urlpath.buf());
+                 RequestMethodStr(method), urlpath.unsafeBuf());
     /* headers */
     header.packInto(p);
     /* trailer */
@@ -336,7 +336,7 @@ httpRequestHdrAllowed(const HttpHeaderEntry * e, String * strConn)
     assert(e);
     /* check connection header */
 
-    if (strConn && strListIsMember(strConn, e->name.buf(), ','))
+    if (strConn && strListIsMember(strConn, e->name.unsafeBuf(), ','))
         return 0;
 
     return 1;
@@ -411,7 +411,7 @@ const char *HttpRequest::packableURI(bool full_uri) const
         return urlCanonical((HttpRequest*)this);
 
     if (urlpath.size())
-        return urlpath.buf();
+        return urlpath.unsafeBuf();
 
     return "/";
 }
diff --git a/src/HttpRequestMethod.cc b/src/HttpRequestMethod.cc
index 633485efae..02b035f117 100644
--- a/src/HttpRequestMethod.cc
+++ b/src/HttpRequestMethod.cc
@@ -177,7 +177,7 @@ HttpRequestMethod::image() const
         return RequestMethodStr[theMethod];
     } else {
         if (theImage.size()>0) {
-            return theImage.buf();
+            return theImage.unsafeBuf();
         } else {
             return "METHOD_OTHER";
         }
diff --git a/src/ICAP/ICAPModXact.cc b/src/ICAP/ICAPModXact.cc
index 5bb73260e3..e714eaaacb 100644
--- a/src/ICAP/ICAPModXact.cc
+++ b/src/ICAP/ICAPModXact.cc
@@ -1040,11 +1040,11 @@ void ICAPModXact::makeRequestHeaders(MemBuf &buf)
     // as ICAP headers.
     if (virgin.header->header.has(HDR_PROXY_AUTHENTICATE))
         buf.Printf("Proxy-Authenticate: %s\r\n",
-                   virgin.header->header.getByName("Proxy-Authenticate").buf());
+                   virgin.header->header.getByName("Proxy-Authenticate").unsafeBuf());
 
     if (virgin.header->header.has(HDR_PROXY_AUTHORIZATION))
         buf.Printf("Proxy-Authorization: %s\r\n",
-                   virgin.header->header.getByName("Proxy-Authorization").buf());
+                   virgin.header->header.getByName("Proxy-Authorization").unsafeBuf());
 
     buf.Printf("Encapsulated: ");
 
@@ -1107,7 +1107,7 @@ void ICAPModXact::makeRequestHeaders(MemBuf &buf)
     if (TheICAPConfig.send_client_username && request)
         makeUsernameHeader(request, buf);
 
-    // fprintf(stderr, "%s\n", buf.content());
+    // fprintf(stderr, "%s\n", unsafeBuf.content());
 
     buf.append(ICAP::crlf, 2); // terminate ICAP header
 
@@ -1268,7 +1268,7 @@ void ICAPModXact::finishNullOrEmptyBodyPreview(MemBuf &buf)
     Must(!preview.ad());
 
     // do not add last-chunk because our Encapsulated header says null-body
-    // addLastRequestChunk(buf);
+    // addLastRequestChunk(unsafeBuf);
     preview.wrote(0, true);
 
     Must(preview.done());
@@ -1376,7 +1376,7 @@ void ICAPModXact::estimateVirginBody()
         Must(virgin.body_pipe->setConsumerIfNotLate(this));
 
         // make sure TheBackupLimit is in-sync with the buffer size
-        Must(TheBackupLimit <= static_cast<size_t>(msg->body_pipe->buf().max_capacity));
+        Must(TheBackupLimit <= static_cast<size_t>(msg->body_pipe->unsafeBuf().max_capacity));
     } else {
         debugs(93, 6, "ICAPModXact does not expect virgin body");
         Must(msg->body_pipe == NULL);
diff --git a/src/ICAP/ICAPOptions.cc b/src/ICAP/ICAPOptions.cc
index f8e92161d0..5f30c245ee 100644
--- a/src/ICAP/ICAPOptions.cc
+++ b/src/ICAP/ICAPOptions.cc
@@ -124,8 +124,8 @@ void ICAPOptions::cfgIntHeader(const HttpHeader *h, const char *fname, int &valu
 {
     const String s = h->getByName(fname);
 
-    if (s.size() && xisdigit(*s.buf()))
-        value = atoi(s.buf());
+    if (s.size() && xisdigit(*s.unsafeBuf()))
+        value = atoi(s.unsafeBuf());
     else
         value = -1;
 
@@ -176,8 +176,8 @@ bool ICAPOptions::TransferList::matches(const String &urlPath) const
         if (eLen < urlLen) {
             const int eOff = urlLen - eLen;
             // RFC 3507 examples imply that extensions come without leading '.'
-            if (urlPath.buf()[eOff-1] == '.' &&
-                    strcmp(urlPath.buf() + eOff, e->key) == 0) {
+            if (urlPath.unsafeBuf()[eOff-1] == '.' &&
+                    strcmp(urlPath.unsafeBuf() + eOff, e->key) == 0) {
                 debugs(93,7, "ICAPOptions url " << urlPath << " matches " <<
                        name << " extension " << e->key);
                 return true;
diff --git a/src/ICAP/ICAPServiceRep.cc b/src/ICAP/ICAPServiceRep.cc
index bad4929ded..b02276d86e 100644
--- a/src/ICAP/ICAPServiceRep.cc
+++ b/src/ICAP/ICAPServiceRep.cc
@@ -279,8 +279,8 @@ void ICAPServiceRep::checkOptions()
         if (!method_found) {
             debugs(93,1, "WARNING: Squid is configured to use ICAP method " <<
                    cfg().methodStr() <<
-                   " for service " << cfg().uri.buf() <<
-                   " but OPTIONS response declares the methods are " << method_list.buf());
+                   " for service " << cfg().uri.unsafeBuf() <<
+                   " but OPTIONS response declares the methods are " << method_list.unsafeBuf());
         }
     }
 
@@ -293,7 +293,7 @@ void ICAPServiceRep::checkOptions()
         // TODO: If skew is negative, the option will be considered down
         // because of stale options. We should probably change this.
         debugs(93, 1, "ICAP service's clock is skewed by " << skew <<
-               " seconds: " << cfg().uri.buf());
+               " seconds: " << cfg().uri.unsafeBuf());
     }
 }
 
diff --git a/src/ICAP/ICAPXaction.cc b/src/ICAP/ICAPXaction.cc
index 1be3a0ceb5..45dce4ceb3 100644
--- a/src/ICAP/ICAPXaction.cc
+++ b/src/ICAP/ICAPXaction.cc
@@ -76,7 +76,7 @@ void ICAPXaction::openConnection()
         disableRetries(); // this will also safely drain pconn pool
 
     // TODO: check whether NULL domain is appropriate here
-    connection = icapPconnPool->pop(s.cfg().host.buf(), s.cfg().port, NULL, client_addr, isRetriable);
+    connection = icapPconnPool->pop(s.cfg().host.unsafeBuf(), s.cfg().port, NULL, client_addr, isRetriable);
     if (connection >= 0) {
         debugs(93,3, HERE << "reused pconn FD " << connection);
 
@@ -96,12 +96,12 @@ void ICAPXaction::openConnection()
 
     IpAddress outgoing;
     connection = comm_open(SOCK_STREAM, 0, outgoing,
-                           COMM_NONBLOCKING, s.cfg().uri.buf());
+                           COMM_NONBLOCKING, s.cfg().uri.unsafeBuf());
 
     if (connection < 0)
         dieOnConnectionFailure(); // throws
 
-    debugs(93,3, typeName << " opens connection to " << s.cfg().host.buf() << ":" << s.cfg().port);
+    debugs(93,3, typeName << " opens connection to " << s.cfg().host.unsafeBuf() << ":" << s.cfg().port);
 
     // TODO: service bypass status may differ from that of a transaction
     typedef CommCbMemFunT<ICAPXaction, CommTimeoutCbParams> TimeoutDialer;
@@ -119,7 +119,7 @@ void ICAPXaction::openConnection()
     typedef CommCbMemFunT<ICAPXaction, CommConnectCbParams> ConnectDialer;
     connector = asyncCall(93,3, "ICAPXaction::noteCommConnected",
                           ConnectDialer(this, &ICAPXaction::noteCommConnected));
-    commConnectStart(connection, s.cfg().host.buf(), s.cfg().port, connector);
+    commConnectStart(connection, s.cfg().host.unsafeBuf(), s.cfg().port, connector);
 }
 
 /*
@@ -157,7 +157,7 @@ void ICAPXaction::closeConnection()
             debugs(93,3, HERE << "pushing pconn" << status());
             AsyncCall::Pointer call = NULL;
             commSetTimeout(connection, -1, call);
-            icapPconnPool->push(connection, theService->cfg().host.buf(),
+            icapPconnPool->push(connection, theService->cfg().host.unsafeBuf(),
                                 theService->cfg().port, NULL, client_addr);
             disableRetries();
         } else {
@@ -232,7 +232,7 @@ void ICAPXaction::handleCommTimedout()
 {
     debugs(93, 2, HERE << typeName << " failed: timeout with " <<
            theService->cfg().methodStr() << " " <<
-           theService->cfg().uri.buf() << status());
+           theService->cfg().uri.unsafeBuf() << status());
     reuseConnection = false;
     service().noteFailure();
 
@@ -295,7 +295,7 @@ void ICAPXaction::scheduleRead()
 
     /*
      * See comments in ICAPXaction.h about why we use commBuf
-     * here instead of reading directly into readBuf.buf.
+     * here instead of reading directly into readBuf.unsafeBuf.
      */
     typedef CommCbMemFunT<ICAPXaction, CommIoCbParams> Dialer;
     reader = asyncCall(93,3, "ICAPXaction::noteCommRead",
@@ -320,7 +320,7 @@ void ICAPXaction::noteCommRead(const CommIoCbParams &io)
 
     /*
      * See comments in ICAPXaction.h about why we use commBuf
-     * here instead of reading directly into readBuf.buf.
+     * here instead of reading directly into readBuf.unsafeBuf.
      */
 
     if (io.size > 0) {
diff --git a/src/LoadableModule.cc b/src/LoadableModule.cc
index fe18d8a820..7209771669 100644
--- a/src/LoadableModule.cc
+++ b/src/LoadableModule.cc
@@ -67,7 +67,7 @@ void LoadableModule::unload()
 void *LoadableModule::openModule(int mode)
 {
 #	if XSTD_USE_LIBLTDL
-    return lt_dlopen(theName.buf());
+    return lt_dlopen(theName.unsafeBuf());
 #	else
     return dlopen(theName.c_str(),
                   mode == lmNow ? RTLD_NOW : RTLD_LAZY);
diff --git a/src/SquidString.h b/src/SquidString.h
index da176f000c..c807ecbaf2 100644
--- a/src/SquidString.h
+++ b/src/SquidString.h
@@ -98,7 +98,26 @@ public:
     _SQUID_INLINE_ char &operator [](unsigned int pos);
 
     _SQUID_INLINE_ int size() const;
-    _SQUID_INLINE_ char const * buf() const;
+    _SQUID_INLINE_ char const * unsafeBuf() const;
+
+    /**
+     * \retval true the String has some contents
+     */
+    _SQUID_INLINE_ bool defined() const;
+    /**
+     * \retval true the String does not hold any contents
+     */
+    _SQUID_INLINE_ bool undefined() const;
+    /**
+     * Returns a raw pointer to the underlying backing store. The caller has been
+     * verified not to make any assumptions about null-termination
+     */
+    _SQUID_INLINE_ char const * rawBuf() const;
+    /**
+     * Returns a raw pointer to the underlying backing store.
+     * The caller requires it to be null-terminated.
+     */
+    _SQUID_INLINE_ char const * termedBuf() const;
     void limitInit(const char *str, int len); // TODO: rename to assign()
     void clean();
     void reset(char const *str);
diff --git a/src/String.cc b/src/String.cc
index e083ead75c..b423424b13 100644
--- a/src/String.cc
+++ b/src/String.cc
@@ -81,7 +81,7 @@ String::operator = (String const &old)
 {
     clean(); // TODO: optimize to avoid cleaning the buffer we can use
     if (old.size() > 0)
-        allocAndFill(old.buf(), old.size());
+        allocAndFill(old.unsafeBuf(), old.size());
     return *this;
 }
 
@@ -128,7 +128,7 @@ String::allocAndFill(const char *str, int len)
 String::String (String const &old) : size_(0), len_(0), buf_(NULL)
 {
     if (old.size() > 0)
-        allocAndFill(old.buf(), old.size());
+        allocAndFill(old.unsafeBuf(), old.size());
 #if DEBUGSTRINGS
 
     StringRegistry::Instance().add(this);
@@ -141,7 +141,7 @@ String::clean()
     PROF_start(StringClean);
     assert(this);
 
-    if (buf())
+    if (unsafeBuf())
         memFreeString(size_, buf_);
 
     len_ = 0;
@@ -188,7 +188,7 @@ String::append(const char *str, int len)
         snew.allocBuffer(snew.len_ + 1);
 
         if (len_)
-            xmemcpy(snew.buf_, buf(), len_);
+            xmemcpy(snew.buf_, unsafeBuf(), len_);
 
         if (len)
             xmemcpy(snew.buf_ + len_, str, len);
@@ -219,7 +219,7 @@ String::append (char chr)
 void
 String::append(String const &old)
 {
-    append (old.buf(), old.len_);
+    append (old.unsafeBuf(), old.len_);
 }
 
 void
@@ -237,7 +237,7 @@ String::absorb(String &old)
 void
 String::stat(StoreEntry *entry) const
 {
-    storeAppendPrintf(entry, "%p : %d/%d \"%s\"\n",this,len_, size_, buf());
+    storeAppendPrintf(entry, "%p : %d/%d \"%s\"\n",this,len_, size_, unsafeBuf());
 }
 
 StringRegistry &
diff --git a/src/String.cci b/src/String.cci
index 520f734535..e0f3a90eb8 100644
--- a/src/String.cci
+++ b/src/String.cci
@@ -49,7 +49,29 @@ String::size() const
 }
 
 char const *
-String::buf() const
+String::unsafeBuf() const
+{
+    return buf_;
+}
+
+bool String::defined() const
+{
+    return buf_!=NULL;
+}
+
+bool String::undefined() const
+{
+    return buf_==NULL;
+}
+
+char const *
+String::rawBuf() const
+{
+    return buf_;
+}
+
+char const *
+String::termedBuf() const
 {
     return buf_;
 }
@@ -65,19 +87,19 @@ String::operator [](unsigned int pos)
 const char *
 String::pos(char const *aString) const
 {
-    return strstr(buf(), aString);
+    return strstr(unsafeBuf(), aString);
 }
 
 const char *
 String::pos(char const ch) const
 {
-    return strchr(buf(), ch);
+    return strchr(unsafeBuf(), ch);
 }
 
 const char *
 String::rpos(char const ch) const
 {
-    return strrchr(buf(), (ch));
+    return strrchr(unsafeBuf(), (ch));
 }
 
 int
@@ -94,7 +116,7 @@ String::cmp (char const *aString) const
     if (aString == NULL || aString[0] == '\0')
         return 1;
 
-    return strcmp(buf(), aString);
+    return strcmp(unsafeBuf(), aString);
 }
 
 int
@@ -114,7 +136,7 @@ String::cmp (char const *aString, size_t count) const
     if (aString == NULL || aString[0] == '\0')
         return 1;
 
-    return strncmp(buf(), aString, count);
+    return strncmp(unsafeBuf(), aString, count);
 }
 
 int
@@ -131,19 +153,19 @@ String::cmp (String const &aString) const
     if (aString.size() == 0)
         return 1;
 
-    return strcmp(buf(), aString.buf());
+    return strcmp(unsafeBuf(), aString.unsafeBuf());
 }
 
 int
 String::caseCmp(char const *aString) const
 {
-    return strcasecmp(buf(), aString);
+    return strcasecmp(unsafeBuf(), aString);
 }
 
 int
 String::caseCmp(char const *aString, size_t count) const
 {
-    return strncasecmp(buf(), aString, count);
+    return strncasecmp(unsafeBuf(), aString, count);
 }
 
 void
@@ -179,6 +201,6 @@ String::cutPointer(char const *loc)
 std::ostream &
 operator<<(std::ostream& os, String const &aString)
 {
-    os << aString.buf();
+    os << aString.unsafeBuf();
     return os;
 }
diff --git a/src/access_log.cc b/src/access_log.cc
index 8b0f3dd718..4e95bd8fd9 100644
--- a/src/access_log.cc
+++ b/src/access_log.cc
@@ -625,7 +625,7 @@ accessLogCustom(AccessLogEntry * al, customlog * log)
             if (al->request)
                 sb = al->request->header.getByName(fmt->data.header.header);
 
-            out = sb.buf();
+            out = sb.unsafeBuf();
 
             quote = 1;
 
@@ -635,7 +635,7 @@ accessLogCustom(AccessLogEntry * al, customlog * log)
             if (al->reply)
                 sb = al->reply->header.getByName(fmt->data.header.header);
 
-            out = sb.buf();
+            out = sb.unsafeBuf();
 
             quote = 1;
 
@@ -645,7 +645,7 @@ accessLogCustom(AccessLogEntry * al, customlog * log)
             if (al->request)
                 sb = al->request->header.getByNameListMember(fmt->data.header.header, fmt->data.header.element, fmt->data.header.separator);
 
-            out = sb.buf();
+            out = sb.unsafeBuf();
 
             quote = 1;
 
@@ -655,7 +655,7 @@ accessLogCustom(AccessLogEntry * al, customlog * log)
             if (al->reply)
                 sb = al->reply->header.getByNameListMember(fmt->data.header.header, fmt->data.header.element, fmt->data.header.separator);
 
-            out = sb.buf();
+            out = sb.unsafeBuf();
 
             quote = 1;
 
@@ -764,7 +764,7 @@ accessLogCustom(AccessLogEntry * al, customlog * log)
 
         case LFT_REQUEST_URLPATH:
             if (al->request) {
-                out = al->request->urlpath.buf();
+                out = al->request->urlpath.unsafeBuf();
                 quote = 1;
             }
             break;
@@ -810,7 +810,7 @@ accessLogCustom(AccessLogEntry * al, customlog * log)
 
         case LFT_TAG:
             if (al->request)
-                out = al->request->tag.buf();
+                out = al->request->tag.unsafeBuf();
 
             quote = 1;
 
@@ -823,7 +823,7 @@ accessLogCustom(AccessLogEntry * al, customlog * log)
 
         case LFT_EXT_LOG:
             if (al->request)
-                out = al->request->extacl_log.buf();
+                out = al->request->extacl_log.unsafeBuf();
 
             quote = 1;
 
diff --git a/src/adaptation/Config.cc b/src/adaptation/Config.cc
index 993978a940..3adaef4cea 100644
--- a/src/adaptation/Config.cc
+++ b/src/adaptation/Config.cc
@@ -68,8 +68,8 @@ Adaptation::Config::dumpService(StoreEntry *entry, const char *name) const
     typedef Services::iterator SCI;
     for (SCI i = AllServices().begin(); i != AllServices().end(); ++i) {
         const ServiceConfig &cfg = (*i)->cfg();
-        storeAppendPrintf(entry, "%s %s_%s %s %d %s\n", name, cfg.key.buf(),
-                          cfg.methodStr(), cfg.vectPointStr(), cfg.bypass, cfg.uri.buf());
+        storeAppendPrintf(entry, "%s %s_%s %s %d %s\n", name, cfg.key.unsafeBuf(),
+                          cfg.methodStr(), cfg.vectPointStr(), cfg.bypass, cfg.uri.unsafeBuf());
     }
 }
 
@@ -141,7 +141,7 @@ Adaptation::Config::DumpServiceSet(StoreEntry *entry, const char *name)
 {
     typedef Groups::iterator GI;
     for (GI i = AllGroups().begin(); i != AllGroups().end(); ++i)
-        storeAppendPrintf(entry, "%s %s\n", name, (*i)->id.buf());
+        storeAppendPrintf(entry, "%s %s\n", name, (*i)->id.unsafeBuf());
 }
 
 void
@@ -168,7 +168,7 @@ Adaptation::Config::DumpAccess(StoreEntry *entry, const char *name)
 
     typedef AccessRules::iterator CI;
     for (CI i = AllRules().begin(); i != AllRules().end(); ++i) {
-        snprintf(nom, 64, "%s %s", name, (*i)->groupId.buf());
+        snprintf(nom, 64, "%s %s", name, (*i)->groupId.unsafeBuf());
         dump_acl_access(entry, nom, (*i)->acl);
     }
 }
diff --git a/src/adaptation/ServiceConfig.cc b/src/adaptation/ServiceConfig.cc
index 6188c30fda..dd8b81ecd8 100644
--- a/src/adaptation/ServiceConfig.cc
+++ b/src/adaptation/ServiceConfig.cc
@@ -63,7 +63,7 @@ Adaptation::ServiceConfig::parse()
     ConfigParser::ParseString(&uri);
 
     debugs(3, 5, HERE << cfg_filename << ':' << config_lineno << ": " <<
-           key.buf() << " " << method_point << " " << bypass);
+           key.unsafeBuf() << " " << method_point << " " << bypass);
 
     method = parseMethod(method_point);
     point = parseVectPoint(method_point);
@@ -76,14 +76,14 @@ Adaptation::ServiceConfig::parse()
     // extract scheme and use it as the service_configConfig protocol
     const char *schemeSuffix = "://";
     if (const char *schemeEnd = uri.pos(schemeSuffix))
-        protocol.limitInit(uri.buf(), schemeEnd - uri.buf());
+        protocol.limitInit(uri.unsafeBuf(), schemeEnd - uri.unsafeBuf());
     debugs(3, 5, HERE << cfg_filename << ':' << config_lineno << ": " <<
            "service protocol is " << protocol);
     if (!protocol.size())
         return false;
 
     // skip scheme
-    const char *s = uri.buf() + protocol.size() + strlen(schemeSuffix);
+    const char *s = uri.unsafeBuf() + protocol.size() + strlen(schemeSuffix);
 
     const char *e;
 
diff --git a/src/client_side.cc b/src/client_side.cc
index 2dd1a45e62..4b3d870dfd 100644
--- a/src/client_side.cc
+++ b/src/client_side.cc
@@ -464,7 +464,7 @@ clientPrepareLogWithRequestDetails(HttpRequest * request, AccessLogEntry * aLogE
     aLogEntry->http.version = request->http_ver;
     aLogEntry->hier = request->hier;
     aLogEntry->cache.requestSize += request->content_length;
-    aLogEntry->cache.extuser = request->extacl_user.buf();
+    aLogEntry->cache.extuser = request->extacl_user.unsafeBuf();
 
     if (request->auth_user_request) {
 
@@ -486,10 +486,10 @@ ClientHttpRequest::logRequest()
 
         if (al.reply) {
             al.http.code = al.reply->sline.status;
-            al.http.content_type = al.reply->content_type.buf();
+            al.http.content_type = al.reply->content_type.unsafeBuf();
         } else if (loggingEntry() && loggingEntry()->mem_obj) {
             al.http.code = loggingEntry()->mem_obj->getReply()->sline.status;
-            al.http.content_type = loggingEntry()->mem_obj->getReply()->content_type.buf();
+            al.http.content_type = loggingEntry()->mem_obj->getReply()->content_type.unsafeBuf();
         }
 
         debugs(33, 9, "clientLogRequest: http.code='" << al.http.code << "'");
@@ -852,7 +852,7 @@ ClientSocketContext::sendBody(HttpReply * rep, StoreIOBuffer bodyData)
 static void
 clientPackTermBound(String boundary, MemBuf * mb)
 {
-    mb->Printf("\r\n--%s--\r\n", boundary.buf());
+    mb->Printf("\r\n--%s--\r\n", boundary.unsafeBuf());
     debugs(33, 6, "clientPackTermBound: buf offset: " << mb->size);
 }
 
@@ -867,9 +867,9 @@ clientPackRangeHdr(const HttpReply * rep, const HttpHdrRangeSpec * spec, String
 
     /* put boundary */
     debugs(33, 5, "clientPackRangeHdr: appending boundary: " <<
-           boundary.buf());
+           boundary.unsafeBuf());
     /* rfc2046 requires to _prepend_ boundary with <crlf>! */
-    mb->Printf("\r\n--%s\r\n", boundary.buf());
+    mb->Printf("\r\n--%s\r\n", boundary.unsafeBuf());
 
     /* stuff the header with required entries and pack it */
 
@@ -891,7 +891,7 @@ clientPackRangeHdr(const HttpReply * rep, const HttpHdrRangeSpec * spec, String
 }
 
 /**
- * extracts a "range" from *buf and appends them to mb, updating
+ * extracts a "range" from *unsafeBuf and appends them to mb, updating
  * all offsets and such.
  */
 void
@@ -1170,7 +1170,7 @@ ClientSocketContext::buildRangeHeader(HttpReply * rep)
             hdr->delById(HDR_CONTENT_TYPE);
             httpHeaderPutStrf(hdr, HDR_CONTENT_TYPE,
                               "multipart/byteranges; boundary=\"%s\"",
-                              http->range_iter.boundary.buf());
+                              http->range_iter.boundary.unsafeBuf());
             /* Content-Length is not required in multipart responses
              * but it is always nice to have one */
             actual_clen = http->mRangeCLen();
@@ -1924,7 +1924,7 @@ parseHttpRequest(ConnStateData *conn, HttpParser *hp, HttpRequestMethod * method
         req_sz = HttpParserReqSz(hp);
     }
 
-    /* We know the whole request is in hp->buf now */
+    /* We know the whole request is in hp->unsafeBuf now */
 
     assert(req_sz <= (size_t) hp->bufsiz);
 
@@ -2271,11 +2271,11 @@ clientProcessRequest(ConnStateData *conn, HttpParser *hp, ClientSocketContext *c
         request->flags.spoof_client_ip = conn->port->spoof_client_ip;
     }
 
-    if (internalCheck(request->urlpath.buf())) {
+    if (internalCheck(request->urlpath.unsafeBuf())) {
         if (internalHostnameIs(request->GetHost()) &&
                 request->port == getMyPort()) {
             http->flags.internal = 1;
-        } else if (Config.onoff.global_internal_static && internalStaticCheck(request->urlpath.buf())) {
+        } else if (Config.onoff.global_internal_static && internalStaticCheck(request->urlpath.unsafeBuf())) {
             request->SetHost(internalHostname());
             request->port = getMyPort();
             http->flags.internal = 1;
@@ -2623,7 +2623,7 @@ ConnStateData::handleReadData(char *buf, size_t size)
 }
 
 /**
- * called when new request body data has been buffered in in.buf
+ * called when new request body data has been buffered in in.unsafeBuf
  * may close the connection if we were closing and piped everything out
  */
 void
diff --git a/src/client_side_reply.cc b/src/client_side_reply.cc
index f166aaa0c4..1d8f9b57f4 100644
--- a/src/client_side_reply.cc
+++ b/src/client_side_reply.cc
@@ -1291,7 +1291,7 @@ clientReplyContext::buildReplyHeader()
         int connection_auth_blocked = 0;
         while ((e = hdr->getEntry(&pos))) {
             if (e->id == HDR_WWW_AUTHENTICATE) {
-                const char *value = e->value.buf();
+                const char *value = e->value.unsafeBuf();
 
                 if ((strncasecmp(value, "NTLM", 4) == 0 &&
                         (value[4] == '\0' || value[4] == ' '))
@@ -1391,7 +1391,7 @@ clientReplyContext::buildReplyHeader()
                  ThisCache);
         strListAdd(&strVia, bbuf, ',');
         hdr->delById(HDR_VIA);
-        hdr->putStr(HDR_VIA, strVia.buf());
+        hdr->putStr(HDR_VIA, strVia.unsafeBuf());
     }
     /* Signal keep-alive if needed */
     hdr->putStr(http->flags.accel ? HDR_CONNECTION : HDR_PROXY_CONNECTION,
@@ -1671,7 +1671,7 @@ clientReplyDetach(clientStreamNode * node, ClientHttpRequest * http)
 }
 
 /*
- * accepts chunk of a http message in buf, parses prefix, filters headers and
+ * accepts chunk of a http message in unsafeBuf, parses prefix, filters headers and
  * such, writes processed message to the message recipient
  */
 void
diff --git a/src/client_side_request.cc b/src/client_side_request.cc
index cf8d0a6847..7b5a8556a3 100644
--- a/src/client_side_request.cc
+++ b/src/client_side_request.cc
@@ -426,7 +426,7 @@ clientFollowXForwardedForCheck(int answer, void *data)
         const char *asciiaddr;
         int l;
         struct in_addr addr;
-        p = request->x_forwarded_for_iterator.buf();
+        p = request->x_forwarded_for_iterator.unsafeBuf();
         l = request->x_forwarded_for_iterator.size();
 
         /*
@@ -851,7 +851,7 @@ clientInterpretRequestHeaders(ClientHttpRequest * http)
             int may_pin = 0;
             while ((e = req_hdr->getEntry(&pos))) {
                 if (e->id == HDR_AUTHORIZATION || e->id == HDR_PROXY_AUTHORIZATION) {
-                    const char *value = e->value.buf();
+                    const char *value = e->value.unsafeBuf();
                     if (strncasecmp(value, "NTLM ", 5) == 0
                             ||
                             strncasecmp(value, "Negotiate ", 10) == 0
@@ -892,7 +892,7 @@ clientInterpretRequestHeaders(ClientHttpRequest * http)
         }
 
 #if FORW_VIA_DB
-        fvdbCountVia(s.buf());
+        fvdbCountVia(s.unsafeBuf());
 
 #endif
 
@@ -918,7 +918,7 @@ clientInterpretRequestHeaders(ClientHttpRequest * http)
 
     if (req_hdr->has(HDR_X_FORWARDED_FOR)) {
         String s = req_hdr->getList(HDR_X_FORWARDED_FOR);
-        fvdbCountForw(s.buf());
+        fvdbCountForw(s.unsafeBuf());
         s.clean();
     }
 
@@ -1387,13 +1387,13 @@ ClientHttpRequest::noteMoreBodyDataAvailable(BodyPipe::Pointer)
     assert(request_satisfaction_mode);
     assert(adaptedBodySource != NULL);
 
-    if (const size_t contentSize = adaptedBodySource->buf().contentSize()) {
+    if (const size_t contentSize = adaptedBodySource->unsafeBuf().contentSize()) {
         BodyPipeCheckout bpc(*adaptedBodySource);
-        const StoreIOBuffer ioBuf(&bpc.buf, request_satisfaction_offset);
+        const StoreIOBuffer ioBuf(&bpc.unsafeBuf, request_satisfaction_offset);
         storeEntry()->write(ioBuf);
         // assume can write everything
         request_satisfaction_offset += contentSize;
-        bpc.buf.consume(contentSize);
+        bpc.unsafeBuf.consume(contentSize);
         bpc.checkIn();
     }
 
diff --git a/src/eCAP/MessageRep.cc b/src/eCAP/MessageRep.cc
index 0f3eaf0abb..67291487ee 100644
--- a/src/eCAP/MessageRep.cc
+++ b/src/eCAP/MessageRep.cc
@@ -39,7 +39,7 @@ Ecap::HeaderRep::value(const Name &name) const
     const String value = squidId == HDR_OTHER ?
                          theHeader.getByName(name.image().c_str()) :
                          theHeader.getStrOrList(squidId);
-    return Value::FromTempString(value.buf());
+    return Value::FromTempString(value.unsafeBuf());
 }
 
 void
@@ -192,7 +192,7 @@ Ecap::RequestLineRep::uri(const Area &aUri)
 Ecap::RequestLineRep::Area
 Ecap::RequestLineRep::uri() const
 {
-    return Area::FromTempBuffer(theMessage.urlpath.buf(),
+    return Area::FromTempBuffer(theMessage.urlpath.unsafeBuf(),
                                 theMessage.urlpath.size());
 }
 
diff --git a/src/eCAP/ServiceRep.cc b/src/eCAP/ServiceRep.cc
index c57c2975b5..7bc0f4a6e3 100644
--- a/src/eCAP/ServiceRep.cc
+++ b/src/eCAP/ServiceRep.cc
@@ -56,7 +56,7 @@ bool Ecap::ServiceRep::up() const
 bool Ecap::ServiceRep::wantsUrl(const String &urlPath) const
 {
     Must(up());
-    return theService->wantsUrl(urlPath.buf());
+    return theService->wantsUrl(urlPath.unsafeBuf());
 }
 
 Adaptation::Initiate *
diff --git a/src/errorpage.cc b/src/errorpage.cc
index a9e0522ccc..4d0ec4317b 100644
--- a/src/errorpage.cc
+++ b/src/errorpage.cc
@@ -558,7 +558,7 @@ ErrorState::Dump(MemBuf * mb)
         Packer p;
         str.Printf("%s %s HTTP/%d.%d\n",
                    RequestMethodStr(request->method),
-                   request->urlpath.size() ? request->urlpath.buf() : "/",
+                   request->urlpath.size() ? request->urlpath.unsafeBuf() : "/",
                    request->http_ver.major, request->http_ver.minor);
         packerToMemInit(&p, &str);
         request->header.packInto(&p);
@@ -736,7 +736,7 @@ ErrorState::Convert(char token)
             Packer p;
             mb.Printf("%s %s HTTP/%d.%d\n",
                       RequestMethodStr(request->method),
-                      request->urlpath.size() ? request->urlpath.buf() : "/",
+                      request->urlpath.size() ? request->urlpath.unsafeBuf() : "/",
                       request->http_ver.major, request->http_ver.minor);
             packerToMemInit(&p, &mb);
             request->header.packInto(&p);
@@ -928,7 +928,7 @@ ErrorState::BuildContent()
      */
     if (!Config.errorDirectory && request && request->header.getList(HDR_ACCEPT_LANGUAGE, &hdr) ) {
 
-        const char *buf = hdr.buf(); // raw header string for parsing
+        const char *unsafeBuf = hdr.unsafeBuf(); // raw header string for parsing
         int pos = 0; // current parsing position in header string
         char *reset = NULL; // where to reset the p pointer for each new tag file
         char *dt = NULL;
@@ -950,12 +950,12 @@ ErrorState::BuildContent()
              *  - IFF a tag contains only two characters we can wildcard ANY translations matching: <it> '-'? .*
              *    with preference given to an exact match.
              */
-            while (pos < hdr.size() && buf[pos] != ';' && buf[pos] != ',' && !xisspace(buf[pos]) && dt < (dir+256) ) {
-                *dt++ = xtolower(buf[pos++]);
+            while (pos < hdr.size() && unsafeBuf[pos] != ';' && unsafeBuf[pos] != ',' && !xisspace(unsafeBuf[pos]) && dt < (dir+256) ) {
+                *dt++ = xtolower(unsafeBuf[pos++]);
             }
             *dt++ = '\0'; // nul-terminated the filename content string before system use.
 
-            debugs(4, 9, HERE << "STATE: dt='" << dt << "', reset='" << reset << "', reset[1]='" << reset[1] << "', pos=" << pos << ", buf='" << &buf[pos] << "'");
+            debugs(4, 9, HERE << "STATE: dt='" << dt << "', reset='" << reset << "', reset[1]='" << reset[1] << "', pos=" << pos << ", buf='" << &unsafeBuf[pos] << "'");
 
             /* if we found anything we might use, try it. */
             if (*reset != '\0') {
@@ -983,8 +983,8 @@ ErrorState::BuildContent()
             dt = reset; // reset for next tag testing. we replace the failed name instead of cloning.
 
             // IFF we terminated the tag on ';' we need to skip the 'q=' bit to the next ',' or end.
-            while (pos < hdr.size() && buf[pos] != ',') pos++;
-            if (buf[pos] == ',') pos++;
+            while (pos < hdr.size() && unsafeBuf[pos] != ',') pos++;
+            if (unsafeBuf[pos] == ',') pos++;
         }
     }
 #endif /* USE_ERR_LOCALES */
diff --git a/src/external_acl.cc b/src/external_acl.cc
index 1585ba65f4..d27b551045 100644
--- a/src/external_acl.cc
+++ b/src/external_acl.cc
@@ -757,7 +757,7 @@ aclMatchExternal(external_acl_data *acl, ACLChecklist * ch)
 
     external_acl_cache_touch(acl->def, entry);
     result = entry->result;
-    external_acl_message = entry->message.buf();
+    external_acl_message = entry->message.unsafeBuf();
 
     debugs(82, 2, "aclMatchExternal: " << acl->def->name << " = " << result);
 
@@ -885,7 +885,7 @@ makeExternalAclKey(ACLChecklist * ch, external_acl_data * acl_data)
             break;
 
         case _external_acl_format::EXT_ACL_PATH:
-            str = request->urlpath.buf();
+            str = request->urlpath.unsafeBuf();
             break;
 
         case _external_acl_format::EXT_ACL_METHOD:
@@ -894,49 +894,49 @@ makeExternalAclKey(ACLChecklist * ch, external_acl_data * acl_data)
 
         case _external_acl_format::EXT_ACL_HEADER_REQUEST:
             sb = request->header.getByName(format->header);
-            str = sb.buf();
+            str = sb.unsafeBuf();
             break;
 
         case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID:
             sb = request->header.getStrOrList(format->header_id);
-            str = sb.buf();
+            str = sb.unsafeBuf();
             break;
 
         case _external_acl_format::EXT_ACL_HEADER_REQUEST_MEMBER:
             sb = request->header.getByNameListMember(format->header, format->member, format->separator);
-            str = sb.buf();
+            str = sb.unsafeBuf();
             break;
 
         case _external_acl_format::EXT_ACL_HEADER_REQUEST_ID_MEMBER:
             sb = request->header.getListMember(format->header_id, format->member, format->separator);
-            str = sb.buf();
+            str = sb.unsafeBuf();
             break;
 
         case _external_acl_format::EXT_ACL_HEADER_REPLY:
             if (reply) {
                 sb = reply->header.getByName(format->header);
-                str = sb.buf();
+                str = sb.unsafeBuf();
             }
             break;
 
         case _external_acl_format::EXT_ACL_HEADER_REPLY_ID:
             if (reply) {
                 sb = reply->header.getStrOrList(format->header_id);
-                str = sb.buf();
+                str = sb.unsafeBuf();
             }
             break;
 
         case _external_acl_format::EXT_ACL_HEADER_REPLY_MEMBER:
             if (reply) {
                 sb = reply->header.getByNameListMember(format->header, format->member, format->separator);
-                str = sb.buf();
+                str = sb.unsafeBuf();
             }
             break;
 
         case _external_acl_format::EXT_ACL_HEADER_REPLY_ID_MEMBER:
             if (reply) {
                 sb = reply->header.getListMember(format->header_id, format->member, format->separator);
-                str = sb.buf();
+                str = sb.unsafeBuf();
             }
             break;
 #if USE_SSL
@@ -987,7 +987,7 @@ makeExternalAclKey(ACLChecklist * ch, external_acl_data * acl_data)
 #endif
 
         case _external_acl_format::EXT_ACL_EXT_USER:
-            str = request->extacl_user.buf();
+            str = request->extacl_user.unsafeBuf();
             break;
 
         case _external_acl_format::EXT_ACL_UNKNOWN:
@@ -1336,8 +1336,8 @@ ACLExternal::ExternalAclLookup(ACLChecklist * ch, ACLExternal * me, EAH * callba
         if (entry != NULL) {
             debugs(82, 4, "externalAclLookup: entry = { date=" <<
                    (long unsigned int) entry->date << ", result=" <<
-                   entry->result << ", user=" << entry->user.buf() << " tag=" <<
-                   entry->tag.buf() << " log=" << entry->log.buf() << " }");
+                   entry->result << ", user=" << entry->user.unsafeBuf() << " tag=" <<
+                   entry->tag.unsafeBuf() << " log=" << entry->log.unsafeBuf() << " }");
 
         }
 
diff --git a/src/fs/coss/store_dir_coss.cc b/src/fs/coss/store_dir_coss.cc
index 90b5ff51ce..2f193b5685 100644
--- a/src/fs/coss/store_dir_coss.cc
+++ b/src/fs/coss/store_dir_coss.cc
@@ -1175,7 +1175,7 @@ CossSwapDir::stripePath() const
     if (!stripe_path) {
         String result = path;
         result.append("/stripe");
-        const_cast<CossSwapDir *>(this)->stripe_path = xstrdup(result.buf());
+        const_cast<CossSwapDir *>(this)->stripe_path = xstrdup(result.unsafeBuf());
     }
 
     return stripe_path;
diff --git a/src/ftp.cc b/src/ftp.cc
index cbe509e56a..15131808e7 100644
--- a/src/ftp.cc
+++ b/src/ftp.cc
@@ -567,7 +567,7 @@ FtpStateData::listingStart()
     wordlist *w;
     char *dirup;
     int i, j, k;
-    const char *title = title_url.buf();
+    const char *title = title_url.unsafeBuf();
     flags.listing_started = true;
     printfReplyBody("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01 Transitional//EN\" \"http://www.w3.org/TR/html4/loose.dtd\">\n");
     printfReplyBody("<!-- HTML listing generated by Squid %s -->\n",
@@ -586,7 +586,7 @@ FtpStateData::listingStart()
 
     if (flags.need_base_href)
         printfReplyBody("<BASE HREF=\"%s\">\n",
-                        html_quote(base_href.buf()));
+                        html_quote(base_href.unsafeBuf()));
 
     printfReplyBody("</HEAD><BODY>\n");
 
@@ -1013,7 +1013,7 @@ FtpStateData::htmlifyListEntry(const char *line)
             if (flags.dir_slash) {
                 url = xstrdup("./");
             } else {
-                const char *title = title_url.buf();
+                const char *title = title_url.unsafeBuf();
                 int k = 6 + strcspn(&title[6], "/");
                 char *t;
                 url = xstrdup(title + k);
@@ -1150,7 +1150,7 @@ void
 FtpStateData::parseListing()
 {
     char *buf = data.readBuf->content();
-    char *sbuf;			/* NULL-terminated copy of buf */
+    char *sbuf;			/* NULL-terminated copy of unsafeBuf */
     char *end;
     char *line;
     char *s;
@@ -1485,7 +1485,7 @@ FtpStateData::checkUrlpath()
         /* UNIX root directory */
         flags.isdir = 1;
         flags.root_dir = 1;
-    } else if ((l >= 1) && (*(request->urlpath.buf() + l - 1) == '/')) {
+    } else if ((l >= 1) && (*(request->urlpath.unsafeBuf() + l - 1) == '/')) {
         /* Directory URL, ending in / */
         flags.isdir = 1;
 
@@ -1574,7 +1574,7 @@ FtpStateData::start()
     checkUrlpath();
     buildTitleUrl();
     debugs(9, 5, HERE << "host=" << request->GetHost() << ", path=" <<
-           request->urlpath.buf() << ", user=" << user << ", passwd=" <<
+           request->urlpath.unsafeBuf() << ", user=" << user << ", passwd=" <<
            password);
 
     state = BEGIN;
@@ -2025,7 +2025,7 @@ ftpSendType(FtpStateData * ftpState)
             mode = 'A';
         } else {
             t = ftpState->request->urlpath.rpos('/');
-            filename = t ? t + 1 : ftpState->request->urlpath.buf();
+            filename = t ? t + 1 : ftpState->request->urlpath.unsafeBuf();
             mode = mimeGetTransferMode(filename);
         }
 
@@ -2054,7 +2054,7 @@ ftpReadType(FtpStateData * ftpState)
     debugs(9, 3, HERE);
 
     if (code == 200) {
-        p = path = xstrdup(ftpState->request->urlpath.buf());
+        p = path = xstrdup(ftpState->request->urlpath.unsafeBuf());
 
         if (*p == '/')
             p++;
@@ -2308,7 +2308,7 @@ ftpReadSize(FtpStateData * ftpState)
         if (ftpState->theSize == 0) {
             debugs(9, 2, "SIZE reported " <<
                    ftpState->ctrl.last_reply << " on " <<
-                   ftpState->title_url.buf());
+                   ftpState->title_url.unsafeBuf());
             ftpState->theSize = -1;
         }
     } else if (code < 0) {
@@ -3396,7 +3396,7 @@ ftpTrySlashHack(FtpStateData * ftpState)
     safe_free(ftpState->filepath);
 
     /* Build the new path (urlpath begins with /) */
-    path = xstrdup(ftpState->request->urlpath.buf());
+    path = xstrdup(ftpState->request->urlpath.unsafeBuf());
 
     rfc1738_unescape(path);
 
@@ -3640,7 +3640,7 @@ FtpStateData::appendSuccessHeader()
 
     e->buffer();	/* released when done processing current data payload */
 
-    filename = (t = urlpath.rpos('/')) ? t + 1 : urlpath.buf();
+    filename = (t = urlpath.rpos('/')) ? t + 1 : urlpath.unsafeBuf();
 
     if (flags.isdir) {
         mime_type = "text/html";
@@ -3753,12 +3753,12 @@ ftpUrlWith2f(HttpRequest * request)
     if (request->protocol != PROTO_FTP)
         return NULL;
 
-    if ( !strncmp(request->urlpath.buf(), "/", 1) ) {
+    if ( !strncmp(request->urlpath.unsafeBuf(), "/", 1) ) {
         newbuf.append(request->urlpath);
         request->urlpath.absorb(newbuf);
         safe_free(request->canonical);
-    } else if ( !strncmp(request->urlpath.buf(), "%2f", 3) ) {
-        newbuf.append(request->urlpath.buf() +1);
+    } else if ( !strncmp(request->urlpath.unsafeBuf(), "%2f", 3) ) {
+        newbuf.append(request->urlpath.unsafeBuf() +1);
         request->urlpath.absorb(newbuf);
         safe_free(request->canonical);
     }
diff --git a/src/gopher.cc b/src/gopher.cc
index 0ad9540ddd..bc6ae88688 100644
--- a/src/gopher.cc
+++ b/src/gopher.cc
@@ -277,7 +277,7 @@ gopherMimeCreate(GopherStateData * gopherState)
 static void
 gopher_request_parse(const HttpRequest * req, char *type_id, char *request)
 {
-    const char *path = req->urlpath.buf();
+    const char *path = req->urlpath.unsafeBuf();
 
     if (request)
         request[0] = '\0';
@@ -751,7 +751,7 @@ gopherToHTML(GopherStateData * gopherState, char *inbuf, int len)
     }				/* while loop */
 
     if (outbuf.size() > 0) {
-        entry->append(outbuf.buf(), outbuf.size());
+        entry->append(outbuf.unsafeBuf(), outbuf.size());
         /* now let start sending stuff to client */
         entry->flush();
     }
@@ -853,7 +853,7 @@ gopherReadReply(int fd, char *buf, size_t len, comm_err_t flag, int xerrno, void
         do_next_read = 0;
     } else if (len == 0) {
         /* Connection closed; retrieval done. */
-        /* flush the rest of data in temp buf if there is one. */
+        /* flush the rest of data in temp unsafeBuf if there is one. */
 
         if (gopherState->conversion != gopher_ds::NORMAL)
             gopherEndHTML(gopherState);
diff --git a/src/http.cc b/src/http.cc
index 721ebd289c..87bd35a95a 100644
--- a/src/http.cc
+++ b/src/http.cc
@@ -93,7 +93,7 @@ HttpStateData::HttpStateData(FwdState *theFwdState) : AsyncJob("HttpStateData"),
         const char *url;
 
         if (_peer->options.originserver)
-            url = orig_request->urlpath.buf();
+            url = orig_request->urlpath.unsafeBuf();
         else
             url = entry->url();
 
@@ -578,7 +578,7 @@ httpMakeVaryMark(HttpRequest * request, HttpReply const * reply)
         strListAdd(&vstr, name, ',');
         hdr = request->header.getByName(name);
         safe_free(name);
-        value = hdr.buf();
+        value = hdr.unsafeBuf();
 
         if (value) {
             value = rfc1738_escape_part(value);
@@ -603,7 +603,7 @@ httpMakeVaryMark(HttpRequest * request, HttpReply const * reply)
         strListAdd(&vstr, name, ',');
         hdr = request->header.getByName(name);
         safe_free(name);
-        value = hdr.buf();
+        value = hdr.unsafeBuf();
 
         if (value) {
             value = rfc1738_escape_part(value);
@@ -618,8 +618,8 @@ httpMakeVaryMark(HttpRequest * request, HttpReply const * reply)
     vary.clean();
 #endif
 
-    debugs(11, 3, "httpMakeVaryMark: " << vstr.buf());
-    return vstr.buf();
+    debugs(11, 3, "httpMakeVaryMark: " << vstr.unsafeBuf());
+    return vstr.unsafeBuf();
 }
 
 void
@@ -791,7 +791,7 @@ bool HttpStateData::peerSupportsConnectionPinning() const
 
     header = hdr->getStrOrList(HDR_PROXY_SUPPORT);
     /* XXX This ought to be done in a case-insensitive manner */
-    rc = (strstr(header.buf(), "Session-Based-Authentication") != NULL);
+    rc = (strstr(header.unsafeBuf(), "Session-Based-Authentication") != NULL);
 
     return rc;
 }
@@ -988,11 +988,11 @@ HttpStateData::persistentConnStatus() const
  */
 /*
 void
-HttpStateData::ReadReplyWrapper(int fd, char *buf, size_t len, comm_err_t flag, int xerrno, void *data)
+HttpStateData::ReadReplyWrapper(int fd, char *unsafeBuf, size_t len, comm_err_t flag, int xerrno, void *data)
 {
     HttpStateData *httpState = static_cast<HttpStateData *>(data);
     assert (fd == httpState->fd);
-    // assert(buf == readBuf->content());
+    // assert(unsafeBuf == readBuf->content());
     PROF_start(HttpStateData_readReply);
     httpState->readReply (len, flag, xerrno);
     PROF_stop(HttpStateData_readReply);
@@ -1072,8 +1072,8 @@ HttpStateData::readReply (const CommIoCbParams &io)
     if (!flags.headers_parsed && len > 0 && fd_table[fd].uses > 1) {
         /* Skip whitespace between replies */
 
-        while (len > 0 && xisspace(*buf))
-            xmemmove(buf, buf + 1, len--);
+        while (len > 0 && xisspace(*unsafeBuf))
+            xmemmove(unsafeBuf, unsafeBuf + 1, len--);
 
         if (len == 0) {
             /* Continue to read... */
@@ -1454,7 +1454,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
                  orig_request->http_ver.major,
                  orig_request->http_ver.minor, ThisCache);
         strListAdd(&strVia, bbuf, ',');
-        hdr_out->putStr(HDR_VIA, strVia.buf());
+        hdr_out->putStr(HDR_VIA, strVia.unsafeBuf());
         strVia.clean();
     }
 
@@ -1465,7 +1465,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
         snprintf(bbuf, BBUF_SZ, "%s=\"Surrogate/1.0 ESI/1.0\"",
                  Config.Accel.surrogate_id);
         strListAdd(&strSurrogate, bbuf, ',');
-        hdr_out->putStr(HDR_SURROGATE_CAPABILITY, strSurrogate.buf());
+        hdr_out->putStr(HDR_SURROGATE_CAPABILITY, strSurrogate.unsafeBuf());
     }
 #endif
 
@@ -1495,7 +1495,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
                 strFwd = orig_request->client_addr.NtoA(ntoabuf, MAX_IPSTRLEN);
         }
         if (strFwd.size() > 0)
-            hdr_out->putStr(HDR_X_FORWARDED_FOR, strFwd.buf());
+            hdr_out->putStr(HDR_X_FORWARDED_FOR, strFwd.unsafeBuf());
     }
     /** If set to DELETE - do not copy through. */
     strFwd.clean();
@@ -1531,7 +1531,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
             const char *username = "-";
 
             if (orig_request->extacl_user.size())
-                username = orig_request->extacl_user.buf();
+                username = orig_request->extacl_user.unsafeBuf();
             else if (orig_request->auth_user_request)
                 username = orig_request->auth_user_request->username();
 
@@ -1542,7 +1542,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
         } else if (strcmp(orig_request->peer_login, "PASS") == 0) {
             if (orig_request->extacl_user.size() && orig_request->extacl_passwd.size()) {
                 char loginbuf[256];
-                snprintf(loginbuf, sizeof(loginbuf), "%s:%s", orig_request->extacl_user.buf(), orig_request->extacl_passwd.buf());
+                snprintf(loginbuf, sizeof(loginbuf), "%s:%s", orig_request->extacl_user.unsafeBuf(), orig_request->extacl_passwd.unsafeBuf());
                 httpHeaderPutStrf(hdr_out, HDR_PROXY_AUTHORIZATION, "Basic %s",
                                   base64_encode(loginbuf));
             }
@@ -1569,7 +1569,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
                 hdr_out->putStr(HDR_AUTHORIZATION, auth);
             } else if (orig_request->extacl_user.size() && orig_request->extacl_passwd.size()) {
                 char loginbuf[256];
-                snprintf(loginbuf, sizeof(loginbuf), "%s:%s", orig_request->extacl_user.buf(), orig_request->extacl_passwd.buf());
+                snprintf(loginbuf, sizeof(loginbuf), "%s:%s", orig_request->extacl_user.unsafeBuf(), orig_request->extacl_passwd.unsafeBuf());
                 httpHeaderPutStrf(hdr_out, HDR_AUTHORIZATION, "Basic %s",
                                   base64_encode(loginbuf));
             }
@@ -1581,7 +1581,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
             if (orig_request->auth_user_request)
                 username = orig_request->auth_user_request->username();
             else if (orig_request->extacl_user.size())
-                username = orig_request->extacl_user.buf();
+                username = orig_request->extacl_user.unsafeBuf();
 
             snprintf(loginbuf, sizeof(loginbuf), "%s%s", username, orig_request->peer_login + 1);
 
@@ -1613,7 +1613,7 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
             httpHdrCcSetMaxAge(cc, getMaxAge(url));
 
             if (request->urlpath.size())
-                assert(strstr(url, request->urlpath.buf()));
+                assert(strstr(url, request->urlpath.unsafeBuf()));
         }
 
         /* Enforce sibling relations */
@@ -1650,10 +1650,10 @@ HttpStateData::httpBuildRequestHeader(HttpRequest * request,
 void
 copyOneHeaderFromClientsideRequestToUpstreamRequest(const HttpHeaderEntry *e, String strConnection, HttpRequest * request, HttpRequest * orig_request, HttpHeader * hdr_out, int we_do_ranges, http_state_flags flags)
 {
-    debugs(11, 5, "httpBuildRequestHeader: " << e->name.buf() << ": " << e->value.buf());
+    debugs(11, 5, "httpBuildRequestHeader: " << e->name.unsafeBuf() << ": " << e->value.unsafeBuf());
 
     if (!httpRequestHdrAllowed(e, &strConnection)) {
-        debugs(11, 2, "'" << e->name.buf() << "' header denied by anonymize_headers configuration");
+        debugs(11, 2, "'" << e->name.unsafeBuf() << "' header denied by anonymize_headers configuration");
         return;
     }
 
@@ -1814,7 +1814,7 @@ HttpStateData::buildRequestPrefix(HttpRequest * request,
     HttpVersion httpver(1, 0);
     mb->Printf("%s %s HTTP/%d.%d\r\n",
                RequestMethodStr(request->method),
-               request->urlpath.size() ? request->urlpath.buf() : "/",
+               request->urlpath.size() ? request->urlpath.unsafeBuf() : "/",
                httpver.major,httpver.minor);
     /* build and pack headers */
     {
diff --git a/src/internal.cc b/src/internal.cc
index 5ddd9c65b5..e3aec551df 100644
--- a/src/internal.cc
+++ b/src/internal.cc
@@ -51,7 +51,7 @@ void
 internalStart(HttpRequest * request, StoreEntry * entry)
 {
     ErrorState *err;
-    const char *upath = request->urlpath.buf();
+    const char *upath = request->urlpath.unsafeBuf();
     debugs(76, 3, "internalStart: " << request->client_addr << " requesting '" << upath << "'");
 
     if (0 == strcmp(upath, "/squid-internal-dynamic/netdb")) {
diff --git a/src/peer_digest.cc b/src/peer_digest.cc
index 4a259bccf7..450a0bff91 100644
--- a/src/peer_digest.cc
+++ b/src/peer_digest.cc
@@ -231,7 +231,7 @@ peerDigestSetCheck(PeerDigest * pd, time_t delay)
 {
     eventAdd("peerDigestCheck", peerDigestCheck, pd, (double) delay, 1);
     pd->times.next_check = squid_curtime + delay;
-    debugs(72, 3, "peerDigestSetCheck: will check peer " << pd->host.buf() << " in " << delay << " secs");
+    debugs(72, 3, "peerDigestSetCheck: will check peer " << pd->host.unsafeBuf() << " in " << delay << " secs");
 }
 
 /*
@@ -241,10 +241,10 @@ void
 peerDigestNotePeerGone(PeerDigest * pd)
 {
     if (pd->flags.requested) {
-        debugs(72, 2, "peerDigest: peer " << pd->host.buf() << " gone, will destroy after fetch.");
+        debugs(72, 2, "peerDigest: peer " << pd->host.unsafeBuf() << " gone, will destroy after fetch.");
         /* do nothing now, the fetching chain will notice and take action */
     } else {
-        debugs(72, 2, "peerDigest: peer " << pd->host.buf() << " is gone, destroying now.");
+        debugs(72, 2, "peerDigest: peer " << pd->host.unsafeBuf() << " is gone, destroying now.");
         peerDigestDestroy(pd);
     }
 }
@@ -279,7 +279,7 @@ peerDigestCheck(void *data)
     /* per-peer limit */
 
     if (req_time - pd->times.received < PeerDigestReqMinGap) {
-        debugs(72, 2, "peerDigestCheck: " << pd->host.buf() <<
+        debugs(72, 2, "peerDigestCheck: " << pd->host.unsafeBuf() <<
                ", avoiding close peer requests (" <<
                (int) (req_time - pd->times.received) << " < " <<
                (int) PeerDigestReqMinGap << " secs).");
@@ -289,7 +289,7 @@ peerDigestCheck(void *data)
 
     /* global limit */
     if (req_time - pd_last_req_time < GlobDigestReqMinGap) {
-        debugs(72, 2, "peerDigestCheck: " << pd->host.buf() <<
+        debugs(72, 2, "peerDigestCheck: " << pd->host.unsafeBuf() <<
                ", avoiding close requests (" <<
                (int) (req_time - pd_last_req_time) << " < " <<
                (int) GlobDigestReqMinGap << " secs).");
@@ -544,7 +544,7 @@ peerDigestFetchReply(void *data, char *buf, ssize_t size)
         assert(reply);
         assert (reply->sline.status != 0);
         status = reply->sline.status;
-        debugs(72, 3, "peerDigestFetchReply: " << pd->host.buf() << " status: " << status <<
+        debugs(72, 3, "peerDigestFetchReply: " << pd->host.unsafeBuf() << " status: " << status <<
                ", expires: " << (long int) reply->expires << " (" << std::showpos <<
                (int) (reply->expires - squid_curtime) << ")");
 
@@ -634,7 +634,7 @@ peerDigestSwapInHeaders(void *data, char *buf, ssize_t size)
         assert (fetch->entry->getReply()->sline.status != 0);
 
         if (fetch->entry->getReply()->sline.status != HTTP_OK) {
-            debugs(72, 1, "peerDigestSwapInHeaders: " << fetch->pd->host.buf() <<
+            debugs(72, 1, "peerDigestSwapInHeaders: " << fetch->pd->host.unsafeBuf() <<
                    " status " << fetch->entry->getReply()->sline.status <<
                    " got cached!");
 
@@ -762,7 +762,7 @@ peerDigestFetchedEnough(DigestFetchState * fetch, char *buf, ssize_t size, const
 #endif
 
         else
-            host = pd->host.buf();
+            host = pd->host.unsafeBuf();
     }
 
     debugs(72, 6, step_name << ": peer " << host << ", offset: " <<
@@ -813,7 +813,7 @@ static void
 peerDigestFetchStop(DigestFetchState * fetch, char *buf, const char *reason)
 {
     assert(reason);
-    debugs(72, 2, "peerDigestFetchStop: peer " << fetch->pd->host.buf() << ", reason: " << reason);
+    debugs(72, 2, "peerDigestFetchStop: peer " << fetch->pd->host.unsafeBuf() << ", reason: " << reason);
     peerDigestReqFinish(fetch, buf, 1, 1, 1, reason, 0);
 }
 
@@ -822,7 +822,7 @@ static void
 peerDigestFetchAbort(DigestFetchState * fetch, char *buf, const char *reason)
 {
     assert(reason);
-    debugs(72, 2, "peerDigestFetchAbort: peer " << fetch->pd->host.buf() << ", reason: " << reason);
+    debugs(72, 2, "peerDigestFetchAbort: peer " << fetch->pd->host.unsafeBuf() << ", reason: " << reason);
     peerDigestReqFinish(fetch, buf, 1, 1, 1, reason, 1);
 }
 
@@ -872,7 +872,7 @@ static void
 peerDigestPDFinish(DigestFetchState * fetch, int pcb_valid, int err)
 {
     PeerDigest *pd = fetch->pd;
-    const char *host = pd->host.buf();
+    const char *host = pd->host.unsafeBuf();
 
     pd->times.received = squid_curtime;
     pd->times.req_delay = fetch->resp_time;
@@ -986,7 +986,7 @@ peerDigestSetCBlock(PeerDigest * pd, const char *buf)
 {
     StoreDigestCBlock cblock;
     int freed_size = 0;
-    const char *host = pd->host.buf();
+    const char *host = pd->host.unsafeBuf();
 
     xmemcpy(&cblock, buf, sizeof(cblock));
     /* network -> host conversions */
@@ -1080,7 +1080,7 @@ peerDigestUseful(const PeerDigest * pd)
     const int bit_util = cacheDigestBitUtil(pd->cd);
 
     if (bit_util > 65) {
-        debugs(72, 0, "Warning: " << pd->host.buf() <<
+        debugs(72, 0, "Warning: " << pd->host.unsafeBuf() <<
                " peer digest has too many bits on (" << bit_util << "%%).");
 
         return 0;
@@ -1106,7 +1106,7 @@ peerDigestStatsReport(const PeerDigest * pd, StoreEntry * e)
 
     assert(pd);
 
-    const char *host = pd->host.buf();
+    const char *host = pd->host.unsafeBuf();
     storeAppendPrintf(e, "\npeer digest from %s\n", host);
 
     cacheDigestGuessStatsReport(&pd->stats.guess, e, host);
diff --git a/src/redirect.cc b/src/redirect.cc
index 7de349e4b2..ab9e6a65eb 100644
--- a/src/redirect.cc
+++ b/src/redirect.cc
@@ -137,8 +137,8 @@ redirectStart(ClientHttpRequest * http, RH * handler, void *data)
 
     if (http->request->auth_user_request)
         r->client_ident = http->request->auth_user_request->username();
-    else if (http->request->extacl_user.buf() != NULL) {
-        r->client_ident = http->request->extacl_user.buf();
+    else if (http->request->extacl_user.unsafeBuf() != NULL) {
+        r->client_ident = http->request->extacl_user.unsafeBuf();
     }
 
     if (!r->client_ident && (conn != NULL && conn->rfc931[0]))
diff --git a/src/stat.cc b/src/stat.cc
index 4c9e2a69c6..ef423864d4 100644
--- a/src/stat.cc
+++ b/src/stat.cc
@@ -1653,8 +1653,8 @@ statClientRequests(StoreEntry * s)
 
         if (http->request->auth_user_request)
             p = http->request->auth_user_request->username();
-        else if (http->request->extacl_user.buf() != NULL) {
-            p = http->request->extacl_user.buf();
+        else if (http->request->extacl_user.unsafeBuf() != NULL) {
+            p = http->request->extacl_user.unsafeBuf();
         }
 
         if (!p && (conn != NULL && conn->rfc931[0]))
diff --git a/src/store.cc b/src/store.cc
index 70ebeb4424..7317376273 100644
--- a/src/store.cc
+++ b/src/store.cc
@@ -689,7 +689,7 @@ StoreEntry::setPublicKey()
 
             if (vary.size()) {
                 /* Again, we own this structure layout */
-                rep->header.putStr(HDR_VARY, vary.buf());
+                rep->header.putStr(HDR_VARY, vary.unsafeBuf());
                 vary.clean();
             }
 
diff --git a/src/store_log.cc b/src/store_log.cc
index 7392a1c448..2ab3acd584 100644
--- a/src/store_log.cc
+++ b/src/store_log.cc
@@ -86,7 +86,7 @@ storeLog(int tag, const StoreEntry * e)
                       (int) reply->date,
                       (int) reply->last_modified,
                       (int) reply->expires,
-                      reply->content_type.size() ? reply->content_type.buf() : "unknown",
+                      reply->content_type.size() ? reply->content_type.unsafeBuf() : "unknown",
                       reply->content_length,
                       e->contentLen(),
                       RequestMethodStr(mem->method),
diff --git a/src/tests/testEvent.cc b/src/tests/testEvent.cc
index f59994dbe1..1305a84ebe 100644
--- a/src/tests/testEvent.cc
+++ b/src/tests/testEvent.cc
@@ -98,19 +98,19 @@ testEvent::testDump()
     printf("Actual Text:\n");
     /* TODO: these should really be just [] lookups, but String doesn't have those here yet. */
     for ( int i = 0; i < anEntry->_appended_text.size(); i++) {
-        CPPUNIT_ASSERT( expect.buf()[i] );
-        CPPUNIT_ASSERT( anEntry->_appended_text.buf()[i] );
+        CPPUNIT_ASSERT( expect.unsafeBuf()[i] );
+        CPPUNIT_ASSERT( anEntry->_appended_text.unsafeBuf()[i] );
 
         /* slight hack to make special chars visible */
-        switch (anEntry->_appended_text.buf()[i]) {
+        switch (anEntry->_appended_text.unsafeBuf()[i]) {
         case '\t':
             printf("\\t");
             break;
         default:
-            printf("%c", anEntry->_appended_text.buf()[i] );
+            printf("%c", anEntry->_appended_text.unsafeBuf()[i] );
         }
         /* make this an int comparison, so that we can see the ASCII code at failure */
-        CPPUNIT_ASSERT_EQUAL( (int)expect.buf()[i], (int)anEntry->_appended_text.buf()[i] );
+        CPPUNIT_ASSERT_EQUAL( (int)expect.unsafeBuf()[i], (int)anEntry->_appended_text.unsafeBuf()[i] );
     }
     printf("\n");
     CPPUNIT_ASSERT_EQUAL( expect, anEntry->_appended_text);
diff --git a/src/tests/testStoreController.cc b/src/tests/testStoreController.cc
index e5ebd66053..d9eb41f106 100644
--- a/src/tests/testStoreController.cc
+++ b/src/tests/testStoreController.cc
@@ -111,7 +111,7 @@ addedEntry(StorePointer hashStore,
     EBIT_CLR(e->flags, KEY_PRIVATE);
     e->ping_status = PING_NONE;
     EBIT_CLR(e->flags, ENTRY_VALIDATED);
-    e->hashInsert((const cache_key *)name.buf());	/* do it after we clear KEY_PRIVATE */
+    e->hashInsert((const cache_key *)name.unsafeBuf());	/* do it after we clear KEY_PRIVATE */
     return e;
 }
 
diff --git a/src/tests/testStoreHashIndex.cc b/src/tests/testStoreHashIndex.cc
index 44437a0cf3..9ab7597999 100644
--- a/src/tests/testStoreHashIndex.cc
+++ b/src/tests/testStoreHashIndex.cc
@@ -92,7 +92,7 @@ addedEntry(StorePointer hashStore,
     EBIT_CLR(e->flags, KEY_PRIVATE);
     e->ping_status = PING_NONE;
     EBIT_CLR(e->flags, ENTRY_VALIDATED);
-    e->hashInsert((const cache_key *)name.buf());	/* do it after we clear KEY_PRIVATE */
+    e->hashInsert((const cache_key *)name.unsafeBuf());	/* do it after we clear KEY_PRIVATE */
     return e;
 }
 
diff --git a/src/url.cc b/src/url.cc
index e78e4baf7f..dccad18851 100644
--- a/src/url.cc
+++ b/src/url.cc
@@ -439,7 +439,7 @@ urlCanonical(HttpRequest * request)
         return request->canonical;
 
     if (request->protocol == PROTO_URN) {
-        snprintf(urlbuf, MAX_URL, "urn:%s", request->urlpath.buf());
+        snprintf(urlbuf, MAX_URL, "urn:%s", request->urlpath.unsafeBuf());
     } else {
 /// \todo AYJ: this could use "if..else and method == METHOD_CONNECT" easier.
         switch (request->method.id()) {
@@ -460,7 +460,7 @@ urlCanonical(HttpRequest * request)
                      *request->login ? "@" : null_string,
                      request->GetHost(),
                      portbuf,
-                     request->urlpath.buf());
+                     request->urlpath.unsafeBuf());
 
             break;
         }
@@ -482,7 +482,7 @@ urlCanonicalClean(const HttpRequest * request)
     char *t;
 
     if (request->protocol == PROTO_URN) {
-        snprintf(buf, MAX_URL, "urn:%s", request->urlpath.buf());
+        snprintf(buf, MAX_URL, "urn:%s", request->urlpath.unsafeBuf());
     } else {
 /// \todo AYJ: this could use "if..else and method == METHOD_CONNECT" easier.
         switch (request->method.id()) {
@@ -515,7 +515,7 @@ urlCanonicalClean(const HttpRequest * request)
                      loginbuf,
                      request->GetHost(),
                      portbuf,
-                     request->urlpath.buf());
+                     request->urlpath.unsafeBuf());
             /*
              * strip arguments AFTER a question-mark
              */
@@ -584,7 +584,7 @@ urlMakeAbsolute(const HttpRequest * req, const char *relUrl)
     char *urlbuf = (char *)xmalloc(MAX_URL * sizeof(char));
 
     if (req->protocol == PROTO_URN) {
-        snprintf(urlbuf, MAX_URL, "urn:%s", req->urlpath.buf());
+        snprintf(urlbuf, MAX_URL, "urn:%s", req->urlpath.unsafeBuf());
         return (urlbuf);
     }
 
@@ -610,7 +610,7 @@ urlMakeAbsolute(const HttpRequest * req, const char *relUrl)
     if (relUrl[0] == '/') {
         strncpy(&urlbuf[urllen], relUrl, MAX_URL - urllen - 1);
     } else {
-        const char *path = req->urlpath.buf();
+        const char *path = req->urlpath.unsafeBuf();
         const char *last_slash = strrchr(path, '/');
 
         if (last_slash == NULL) {
diff --git a/src/urn.cc b/src/urn.cc
index 08d99ccc47..55f113113e 100644
--- a/src/urn.cc
+++ b/src/urn.cc
@@ -174,10 +174,10 @@ UrnState::getHost (String &urlpath)
 
     if ((t = urlpath.pos(':')) != NULL) {
         urlpath.set(t, '\0');
-        result = xstrdup(urlpath.buf());
+        result = xstrdup(urlpath.unsafeBuf());
         urlpath.set(t, ':');
     } else {
-        result = xstrdup(urlpath.buf());
+        result = xstrdup(urlpath.unsafeBuf());
     }
 
     return result;
@@ -186,7 +186,7 @@ UrnState::getHost (String &urlpath)
 bool
 UrnState::RequestNeedsMenu(HttpRequest *r)
 {
-    return strncasecmp(r->urlpath.buf(), "menu.", 5) == 0;
+    return strncasecmp(r->urlpath.unsafeBuf(), "menu.", 5) == 0;
 }
 
 void
@@ -202,7 +202,7 @@ UrnState::createUriResRequest (String &uri)
 {
     LOCAL_ARRAY(char, local_urlres, 4096);
     char *host = getHost (uri);
-    snprintf(local_urlres, 4096, "http://%s/uri-res/N2L?urn:%s", host, uri.buf());
+    snprintf(local_urlres, 4096, "http://%s/uri-res/N2L?urn:%s", host, uri.unsafeBuf());
     safe_free (host);
     safe_free (urlres);
     urlres = xstrdup (local_urlres);
@@ -213,7 +213,7 @@ void
 UrnState::setUriResFromRequest(HttpRequest *r)
 {
     if (RequestNeedsMenu(r)) {
-        updateRequestURL(r, r->urlpath.buf() + 5);
+        updateRequestURL(r, r->urlpath.unsafeBuf() + 5);
         flags.force_menu = 1;
     }
 
diff --git a/src/whois.cc b/src/whois.cc
index ff27261090..3eb3cfc3b3 100644
--- a/src/whois.cc
+++ b/src/whois.cc
@@ -98,7 +98,7 @@ whoisStart(FwdState * fwd)
 
     buf = (char *)xmalloc(l);
 
-    snprintf(buf, l, "%s\r\n", p->request->urlpath.buf() + 1);
+    snprintf(buf, l, "%s\r\n", p->request->urlpath.unsafeBuf() + 1);
 
     comm_write(fd, buf, strlen(buf), whoisWriteComplete, p, NULL);
     comm_read(fd, p->buf, BUFSIZ, whoisReadReply, p);