Zero out password on both success and error paths.

diff --git a/src/lib/vault/passkey.ts b/src/lib/vault/passkey.ts
index a3c58061a6d0c3f4b060f8eef8bcab9f54976da3..daf6d874eb5dccf0fa8c5f88cda8e55ca521cd91 100644 (file)
--- a/src/lib/vault/passkey.ts
+++ b/src/lib/vault/passkey.ts
@@ -21,7 +21,6 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
                return crypto.subtle
                        .importKey('raw', password, 'PBKDF2', false, ['deriveKey'])
                        .then(derivationKey => {
-                               new Uint8Array(password).fill(0)
                                const derivationAlgorithm: Pbkdf2Params = {
                                        name: 'PBKDF2',
                                        hash: 'SHA-512',
@@ -39,6 +38,9 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
                                console.error(err)
                                throw new Error('Failed to derive CryptoKey from password', { cause: err })
                        })
+                       .finally(() => {
+                               new Uint8Array(password).fill(0)
+                       })
        } else if (data.password !== undefined) {
                throw new Error('Password is not allowed for this action', { cause: action })
        } else {