ValidationError leaks password if signup fails about rocket_auth

[tvallotton]

Thanks for bringing this to my attention. This is definitely not intended. I don't think that modifying the Display impl of Error will be sufficient to fix this. Since the validator::ValidationErrors is still accessible from the error and it holds the password.
I don't know what the best aproach to fix this may be, but I will attempt this problem on the weekend.

[ywegel]

I created an issue in the 'validator' repository, but no one answered. Using the ValidatorError directly (not via the derive) it is not possible to set the error message. You can only set the code via the ValidatorError::new(...).
I fixed "this" in my project by dirty matching the error type:
`
#[derive(Error, Debug)]
pub enum ResponseError {
...
//all error types
#[error("{0}")]
RocketAuthError(#[from] rocket_auth::Error),
...
}

impl ResponseError {
pub fn message(&self) -> String {
match self {
ResponseError::RocketAuthError(e) => {
match e {
Error::FormValidationError(validation_error) => {
format!("{}", validation_error.code)
}
Error::FormValidationErrors(validation_errors) => {
let mut buffer = String::new();
let f = validation_errors
.field_errors()
.values()
.map(|x| {
x.iter().map(|y| {
y.code.to_string()
}).collect::()
}).collect();
f
}
... //match rest
}
}
}
`
This is completly stupid, but it does the job. Maybe it can help you

[tvallotton]

I think we'd have to consider to remove the dependency on validator and refactor Error, though that would be a masive breaking change.