Hi, and thanks for the great library!
I've noticed that when using:
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct Foo { ... }
the generated code from prost-derive causes both the message name and
its field names to be embedded as plaintext in the compiled binary.
Looking at prost-derive (currently 0.14.1), in try_message the
derive macro generates:
const STRUCT_NAME: &'static str = stringify!(#ident);
and later in merge_field:
error.push(STRUCT_NAME, stringify!(#field_ident));
All stringify!(...) calls produce &'static str constants, which end
up in the final binary.
- It leaks internal schema names such as
user_password,
internal_token, etc.
- It eases reverse engineering.