Ensure Safer Decryption Process

[campeon23]

Description: In our decryption routine, decrypted content gets written back to the disk. This approach could expose sensitive plaintext content, even if temporarily.

Recommendation: Refrain from writing decrypted content back to the disk unless there's a compelling requirement. Ideally, handle decrypted content solely in memory.

Example Fix:

func DecryptFileToMemory(filePath string, key []byte) ([]byte, error) {
    encryptedData, err := ioutil.ReadFile(filePath)
    if err != nil {
        return nil, err
    }
    return decryptDataInMemory(encryptedData, key)
}

Acceptance Criteria:

• Modify the decryption process to manage decrypted content in memory by default.
• Implement tests to confirm the safety and functionality of the revised process.
• Update related documentation to reflect this change and the rationale behind it.

Severity Level: Medium

[campeon23]

Changes Implemented:

The decryption process has been overhauled to handle decrypted content in-memory by default. This modification bolsters security by substantially reducing the risk of inadvertent exposure on disk. New tests were introduced to ascertain both the safety and the efficacy of the in-memory decryption method. Pertinent documentation has been refreshed to encompass this change, with a clear exposition on the motivation for this security-centric improvement. Thank you to everyone involved in identifying the potential risk and working collaboratively on this enhancement.