sneak/secret
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: sneak:128c53a11d054622173bb764b7e126e5b63ba60d
Branches Tags
sneak:main sneak:fix-memory-security
..
compare: sneak:6ffb24b544ca610a5f0931c332c290a8162eca40
Branches Tags
sneak:main sneak:fix-memory-security

2 Commits
128c53a11d ... 6ffb24b544

Author SHA1 Message Date
Jeffrey Paul
6ffb24b544 Merge pull request 'Zero plaintext after copying to memguard in DecryptWithIdentity (closes #5)' (#10) from clawbot/secret:fix/issue-5 into main 
Reviewed-on: #10
 2026-02-09 02:18:06 +01:00
clawbot
fd77a047f9 security: zero plaintext after copying to memguard in DecryptWithIdentity 
The decrypted data from io.ReadAll was copied into a memguard
LockedBuffer but the original byte slice was never zeroed, leaving
plaintext in swappable, dumpable heap memory.
 2026-02-08 12:04:38 -08:00
1 changed files with 5 additions and 0 deletions
Expand all files Collapse all files

5
internal/secret/crypto.go
View File

@@ -68,6 +68,11 @@ func DecryptWithIdentity(data []byte, identity age.Identity) (*memguard.LockedBu
// Create a secure buffer for the decrypted data // Create a secure buffer for the decrypted data
resultBuffer := memguard.NewBufferFromBytes(result) resultBuffer := memguard.NewBufferFromBytes(result)
// Zero out the original slice to prevent plaintext from lingering in unprotected memory
for i := range result {
result[i] = 0
}
return resultBuffer, nil return resultBuffer, nil
} }