CVE-2022-39397: Other (NVD-CWE-Other)
value: aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 4.3
Published: 2022-11-22T21:15Z
Repository: https://github.com/tu6ge/oss-rs
Language: Rust
Files changed: src/auth.rs
Commit date: 2022-11-08 17:16:41 +0800
Commit message: fix(auth): Prevent secret exposure

Diff: diff --git a/src/auth.rs b/src/auth.rs
index 9afc3cf..be814c5 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -175,11 +175,11 @@ impl Default for VERB {
         Self::GET
     }
 }
 
 #[cfg_attr(test, automock)]
-pub trait AuthToHeaderMap {
+pub(crate) trait AuthToHeaderMap {
     fn get_original_header(&self) -> HeaderMap;
     fn get_header_key(&self) -> OssResult<HeaderValue>;
     fn get_header_secret(&self) -> OssResult<HeaderValue>;
     fn get_header_verb(&self) -> OssResult<HeaderValue>;
     fn get_header_md5(&self) -> OssResult<Option<HeaderValue>>;
@@ -253,11 +253,11 @@ impl AuthToOssHeader for Auth {
         Ok(OssHeader(Some(header_vec.join("\n"))))
     }
 }
 
 /// 从 auth 中提取各个字段，用于计算签名的原始字符串
-pub trait AuthSignString {
+pub(crate) trait AuthSignString {
     fn key(&self) -> Cow<'_, KeyId>;
     fn secret(&self) -> Cow<'_, KeySecret>;
     fn verb(&self) -> String;
     fn content_md5(&self) -> Cow<'_, ContentMd5>;
     fn content_type(&self) -> Cow<'_, ContentType>;
@@ -310,11 +310,11 @@ impl AuthGetHeader for Auth {
 
         Ok(map)
     }
 }
 
-pub trait AuthHeader {
+pub(crate) trait AuthHeader {
     fn from_auth(auth: &impl AuthToHeaderMap) -> OssResult<Self>
     where
         Self: Sized;
     fn append_sign<S: TryInto<HeaderValue, Error = OssError>>(
         &mut self,
@@ -397,11 +397,12 @@ pub struct SignString {
 
 impl SignString {
     pub fn new(data: String, key: KeyId, secret: KeySecret) -> SignString {
         SignString { data, key, secret }
     }
-    pub fn from_auth(
+
+    pub(crate) fn from_auth(
         auth: &impl AuthSignString,
         header: impl HeaderToSign,
     ) -> OssResult<SignString> {
         let method = auth.verb();
 
@@ -425,15 +426,17 @@ impl SignString {
 
     pub fn data(&self) -> String {
         self.data.clone()
     }
 
-    pub fn key_string(&self) -> String {
+    #[cfg(test)]
+    pub(crate) fn key_string(&self) -> String {
         self.key.to_string()
     }
 
-    pub fn secret_string(&self) -> String {
+    #[cfg(test)]
+    pub(crate) fn secret_string(&self) -> String {
         self.secret.to_string()
     }
 
     // 转化成签名
     pub fn to_sign(self) -> OssResult<Sign> {
@@ -497,13 +500,14 @@ pub struct AuthBuilder {
 impl AuthBuilder {
     /// 给 key 赋值
     ///
     /// ```
     /// # use aliyun_oss_client::auth::AuthBuilder;
-    /// let auth = AuthBuilder::default()
+    /// use aliyun_oss_client::auth::AuthGetHeader;
+    /// let headers = AuthBuilder::default()
     ///     .key("bar".into())
-    ///     .build();
+    ///     .get_headers();
     /// ```
     pub fn key(mut self, key: KeyId) -> Self {
         self.auth.set_key(key);
         self
     }
@@ -572,11 +576,12 @@ impl AuthBuilder {
     pub fn header_clear(mut self) -> Self {
         self.auth.headers_clear();
         self
     }
 
-    pub fn build(self) -> Auth {
+    #[allow(dead_code)]
+    pub(crate) fn build(self) -> Auth {
         self.auth
     }
 }
 
 impl AuthGetHeader for AuthBuilder {

Vulnerable code: pub trait AuthToHeaderMap {
pub trait AuthSignString {
pub trait AuthHeader {
    pub fn from_auth(
    pub fn key_string(&self) -> String {
    pub fn secret_string(&self) -> String {
    /// let auth = AuthBuilder::default()
    ///     .build();
    pub fn build(self) -> Auth {
Fixed code: pub(crate) trait AuthToHeaderMap {
pub(crate) trait AuthSignString {
pub(crate) trait AuthHeader {

    pub(crate) fn from_auth(
    #[cfg(test)]
    pub(crate) fn key_string(&self) -> String {
    #[cfg(test)]
    pub(crate) fn secret_string(&self) -> String {
    /// use aliyun_oss_client::auth::AuthGetHeader;
    /// let headers = AuthBuilder::default()
    ///     .get_headers();
    #[allow(dead_code)]
    pub(crate) fn build(self) -> Auth {