sneak/secret
1
0
Fork 1
Code Issues 3 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Zero plaintext after copying to memguard in DecryptWithIdentity (closes #5) #10

Merged
sneak merged 1 commits from clawbot/secret:fix/issue-5 into main 2026-02-09 02:18:06 +01:00
Conversation 0 Commits 1 Files Changed 1 +5
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
internal/secret/crypto.go
View File

@ -68,6 +68,11 @@ func DecryptWithIdentity(data []byte, identity age.Identity) (*memguard.LockedBu
// Create a secure buffer for the decrypted data // Create a secure buffer for the decrypted data
resultBuffer := memguard.NewBufferFromBytes(result) resultBuffer := memguard.NewBufferFromBytes(result)
// Zero out the original slice to prevent plaintext from lingering in unprotected memory
for i := range result {
result[i] = 0
}
return resultBuffer, nil return resultBuffer, nil
} }