fix: wipe the exported private key from the DOM on any view leave (closes #221)

src/popup/views/addWallet.js

@@ -1,4 +1,11 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const {
+    $,
+    showView,
+    showFlash,
+    goBack,
+    clearViewStack,
+    onViewLeave,
+} = require("./helpers");
 const {
     generateMnemonic,
     hdWalletFromMnemonic,
@@ -66,13 +73,23 @@ function switchMode(mode) {
     $("add-wallet-password-hint").textContent = PASSWORD_HINTS[mode];
 }
 
-function show() {
+// Wipe the secret material this screen holds in the DOM: a generated or
+// pasted recovery phrase, an imported private key or extended private key,
+// and the password that would encrypt them. Registered as the view-leave
+// handler as well as run on entry, so none of it survives in the hidden
+// view after the user navigates away by any route, including the Settings
+// gear and the import itself.
+function clear() {
     $("wallet-mnemonic").value = "";
     $("import-private-key").value = "";
     $("import-xprv-key").value = "";
     $("add-wallet-password").value = "";
     $("add-wallet-password-confirm").value = "";
     $("add-wallet-phrase-warning").style.visibility = "hidden";
+}
+
+function show() {
+    clear();
     switchMode("mnemonic");
     showView("add-wallet");
 }
@@ -288,6 +305,8 @@ async function importXprvKey(ctx) {
 }
 
 function init(ctx) {
+    onViewLeave("add-wallet", clear);
+
     // Tab click handlers
     $("tab-mnemonic").addEventListener("click", () => switchMode("mnemonic"));
     $("tab-privkey").addEventListener("click", () => switchMode("privkey"));