Secret validation

[tdelabro]

the proof field secret, defined in crates/nuts/src/nut00/secret.rs is just a random [u8; 32] hex encoded into a string.
Meaning it can only ever be 64 chars long (hex encoding uses 2 chars per bytes), with char in the [0..9], [a..f] and [A..F] range.
Make sure it is not possible to construct one without respecting those conditions.

I believe the functions

    #[inline]
    pub fn new<S>(secret: S) -> Self
    where
        S: Into<String>,
    {
        Self(secret.into())
    }

and

impl FromStr for Secret {
    type Err = Error;

    fn from_str(s: &str) -> Result<Self, Self::Err> {
        Ok(Self(s.to_string()))
    }
}

to be really problematic in this regard

[ftupas]

Hi may I take this?

[tdelabro]

Sure @ftupas