Why in SGX enclave string argument has to be used with [in] attribute

Using OCALL, I want to get a copy of C string that is dynamically created in untrusted memory into my enclave. Thus, I have to use [out, string] attribute.

However, I cannot do that because I have to add [in] attribute as well. The problem is that I really don't know the size of string and I don't want an overhead (that comes with [in]) from unnecessary copying of string from enclave to untrusted memory every time I make OCALL.

My edl file:

enclave {
    trusted {
        public void ecall_open(void);
    };
    untrusted {
        void ocall_get_string([out, string] char* str);
    };
};

error: string/wstring/sizefunc should be used with an 'in' attribute

Why do I have to add [in] attribute?

Is there a way to avoid this overhead?

I guess, one solution would be to pass a pointer to char* with [out] attribute and length:

void ocall_get_string([out] char** str, [out] size_t* length);

And then manually copy C string from untrusted memory to trusted using memcpy().

Inside enclave:

char* untrusted_str; // pointer to string in untrusted memory that we would get form OCALL
size_t length;  // length of string

ocall_get_string(&untrusted_str, &length);

char *trusted_str = new char[length]; // pointer to string in trusted memory 
memcpy(trusted_str, untrusted_str, length);

// delete it later
delete[] trusted_str;