Password paranoia.

diff --git a/src/lib/vault/passkey.ts b/src/lib/vault/passkey.ts
index 6f82549665b15b0e2bb53d1e5f9e7ca708c4189b..22102e76509b45d13a203a86d467e766b9895a22 100644 (file)
--- a/src/lib/vault/passkey.ts
+++ b/src/lib/vault/passkey.ts
@@ -21,6 +21,7 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
                return crypto.subtle
                        .importKey('raw', password, 'PBKDF2', false, ['deriveKey'])
                        .then(derivationKey => {
+                               new Uint8Array(password).fill(0)
                                const derivationAlgorithm: Pbkdf2Params = {
                                        name: 'PBKDF2',
                                        hash: 'SHA-512',
@@ -35,6 +36,9 @@ export async function passkey (action: string, salt: ArrayBuffer, data: Record<s
                                        .deriveKey(derivationAlgorithm, derivationKey, derivedKeyType, false, keyUsages)
                        })
                        .catch(err => {
+                               // DO NOT LOG ERRORS HERE, avoid leaking the password
+                               new Uint8Array(password).fill(0)
+                               Object.keys(err).forEach(key => delete err[key])
                                throw new Error('Failed to derive CryptoKey from password')
                        })
                        .finally(() => {