fix(bip39): redact Mnemonic::Debug #93
Conversation
src/lib.rs
Outdated
| fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { | ||
| f.debug_struct("Mnemonic") | ||
| .field("lang", &self.language()) | ||
| .finish_non_exhaustive() |
There was a problem hiding this comment.
Ah, unfortunately this is only available since rustc 1.53 (see https://doc.rust-lang.org/std/fmt/struct.DebugStruct.html#method.finish_non_exhaustive). Given that we currently still support 1.41, we should probably just use finish for the time being (preferably leaving a TODO comment to switch to finish_non_exhaustive once we drop that MSRV requirement.
There was a problem hiding this comment.
Thanks for the review. I change to .finish() and added a TODO to migrate to finish_non_exhaustive() when we bump MSRV
There was a problem hiding this comment.
LGTM, please squash commits and provide a proper commit message (briefly) describing what you did, why it was necessary, and which approach you took.
For guidance on how to write good commit messages, see for example https://cbea.ms/git-commit/
Replace the Debug output with a manual impl that prints only the language and
omits mnemonic words/entropy to avoid secret leakage in logs.
Approach: use `debug_struct("Mnemonic").field("lang", &self.language()).finish()`
to keep MSRV compatibility (no `finish_non_exhaustive`).
Refs:rust-bitcoin#93
caarloshenriq
force-pushed
the
fix/mnemonic-debug
branch
from
1685866 to
0e161ac
Compare
2 participants
finish_non_exhaustive()Consider obscuring seed from Debug implementation of Mnemonic #92lang{:?}never contains mnemonic words