Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Zeroize Secrets (Cursive and Lib) #334

Merged
merged 4 commits into from Feb 9, 2024

Conversation

ApprenticeofEnder
Copy link
Contributor

Summary of changes:

  • Added zeroize crate to both library and cursive implementation
  • Modified secret strings such that they are zeroized after use
  • Discovered a failing test due to timezones (EST) that should be changed to leverage the current local timestamp
  • (Only left a TODO comment for the above as fixing it is beyond the scope of this PR)

GTK implementation is left as a TODO because property values could be either secrets or proper values, so handling was arbitrary.

One thing of note, there is a comment asking whether something should be calling password() instead of secret(), this may be me misunderstanding the file structure since I didn't look too closely at it, but my understanding is that the first line of an entry is the password.

Fixes #207 for library and Cursive, GTK is left for later.

@alexanderkjall
Copy link
Collaborator

Thanks a lot :)

I'll review and test this in the coming week, I'm at fosdem this weekend and will be quite busy with other things.

@ApprenticeofEnder
Copy link
Contributor Author

No worries, hope you have a good time! Meantime, I can make sure that this thing is Clippy approved.

@alexanderkjall alexanderkjall merged commit 3022067 into cortex:master Feb 9, 2024
6 checks passed
@ApprenticeofEnder ApprenticeofEnder deleted the zeroize_secrets branch February 9, 2024 21:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Handle passwords more securely
2 participants