From: Chris Duncan <chris@codecow.com>
Date: Thu, 6 Aug 2026 05:43:05 +0000 (-0700)
Subject: Clear data transferred to and parsed within vault.
X-Git-Url: https://git.codecow.com/?a=commitdiff_plain;h=57eba1ec4ba0b9c41a906a8ef2c7e608d4639a3a;p=libnemo.git

Clear data transferred to and parsed within vault.
---

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index 7ad63f1..c976ea5 100644
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -36,12 +36,13 @@ const listener = (event: MessageEvent<any>): void => {
 	NODE: if (parentPort == null) setTimeout(() => listener(event), 0)
 	const action = parseAction(data)
 	const keySalt = parseKeySalt(action, data)
+	const type = parseType(action, data)
+	const id = parseId(action, data)
+	const iv = parseIv(action, data)
+	const parsed = parseData(action, data)
+	const { seed, mnemonicPhrase, mnemonicSalt, index, encrypted, message, timeout } = parsed
 	passkey(action, keySalt, data)
 		.then((key: CryptoKey | undefined): Promise<Record<string, boolean | number | ArrayBuffer> | void> => {
-			const type = parseType(action, data)
-			const id = parseId(action, data)
-			const iv = parseIv(action, data)
-			const { seed, mnemonicPhrase, mnemonicSalt, index, encrypted, message, timeout } = parseData(action, data)
 			switch (action) {
 				case 'STOP': {
 					BROWSER: close()
@@ -97,15 +98,14 @@ const listener = (event: MessageEvent<any>): void => {
 			NODE: parentPort?.postMessage({ data: result }, transfer)
 		})
 		.catch((err: any) => {
-			for (let data of Object.values(event.data)) {
-				if (data instanceof ArrayBuffer && data.byteLength !== 0) {
-					new Uint8Array(data).fill(0)
-				}
-				data = undefined
-			}
 			BROWSER: self.postMessage({ taskUrl, taskId, error: 'Failed to process Vault request', cause: err })
 			NODE: parentPort?.postMessage({ data: { taskUrl, taskId, error: 'Failed to process Vault request', cause: err } })
 		})
+		.finally(() => {
+			new Uint8Array(seed ?? []).fill(0)
+			new Uint8Array(encrypted ?? []).fill(0)
+			new Uint8Array(message ?? []).fill(0)
+		})
 }
 BROWSER: self.addEventListener('message', listener)
 NODE: parentPort?.on('message', listener)