fix: wipe the exported private key from the DOM on any view leave (closes #221)

src/popup/views/deleteWallet.js

@@ -1,4 +1,11 @@
-const { $, showView, showFlash, goBack, clearViewStack } = require("./helpers");
+const {
+    $,
+    showView,
+    showFlash,
+    goBack,
+    clearViewStack,
+    onViewLeave,
+} = require("./helpers");
 const { state, saveState } = require("../../shared/state");
 const { decryptWithPassword } = require("../../shared/vault");
 const {
@@ -9,22 +16,34 @@ const {
 let deleteWalletIndex = null;
 let ctx = null;
 
+// Drop the password from the DOM and the wallet selection from the
+// closure. Registered as the view-leave handler as well as run on entry,
+// so the typed password does not sit in the hidden view after the user
+// navigates away by any route, including the Settings gear.
+function clear() {
+    deleteWalletIndex = null;
+    $("delete-wallet-password").value = "";
+    $("delete-wallet-flash").textContent = "";
+    $("delete-wallet-flash").style.visibility = "hidden";
+}
+
 function show(walletIdx) {
+    clear();
     deleteWalletIndex = walletIdx;
     const wallet = state.wallets[walletIdx];
     $("delete-wallet-name").textContent =
         wallet.name || "Wallet " + (walletIdx + 1);
-    $("delete-wallet-password").value = "";
-    $("delete-wallet-flash").textContent = "";
-    $("delete-wallet-flash").style.visibility = "hidden";
     showView("delete-wallet-confirm");
 }
 
 function init(_ctx) {
     ctx = _ctx;
 
+    onViewLeave("delete-wallet-confirm", clear);
+
+    // No wipe here: goBack() routes through showView(), which runs the
+    // leave hook.
     $("btn-delete-wallet-back").addEventListener("click", () => {
-        deleteWalletIndex = null;
         goBack();
     });