Deserialization on entity ID / secret / salt bypasses length check

// STENT TODO this is not enforced on deserialization, do that
pub const ENTITY_ID_MAX_BYTES: usize = 32;

/// Abstract representation of an entity ID.
#[derive(PartialEq, Eq, Hash, Clone, Debug, Deserialize, Serialize)]
pub struct EntityId(String);

impl FromStr for EntityId {
    type Err = EntitiesParserError;

    /// Constructor that takes in a string slice.
    /// If the length of the str is greater than the max then Err is returned.
    fn from_str(s: &str) -> Result<Self, Self::Err> {
        if s.len() > ENTITY_ID_MAX_BYTES {
            Err(EntitiesParserError::EntityIdTooLongError { id: s.into() })
        } else {
            Ok(EntityId(s.into()))
        }
    }
}

Same for Secret & Salt

silversixpence-crypto / dapol

Deserialization on entity ID / secret / salt bypasses length check #145