contentauth / c2pa-rs

Rust SDK for the core C2PA (Coalition for Content Provenance and Authenticity) specification
Other
99 stars 42 forks source link

Don't take ownership of data when using `AsyncSigner`; use a reference instead #471

Open brogdonm opened 1 month ago

brogdonm commented 1 month ago

Changes in this pull request

Give a narrative description of what has been changed.

During use of the AsyncSigner trait, we noticed the sign method has a different signature than the simple Signer trait. The current implementation passed ownership of the data to the signer instead of passing a reference.

Checklist

brogdonm commented 3 weeks ago

@mauricefisher64 @gpeacock The vulnerability failure appears after merging the latest main into this branch.