Zeroize Secrets (Cursive and Lib)

ApprenticeofEnder commented 7 months ago

Summary of changes:

Added zeroize crate to both library and cursive implementation
Modified secret strings such that they are zeroized after use
Discovered a failing test due to timezones (EST) that should be changed to leverage the current local timestamp
(Only left a TODO comment for the above as fixing it is beyond the scope of this PR)

GTK implementation is left as a TODO because property values could be either secrets or proper values, so handling was arbitrary.

One thing of note, there is a comment asking whether something should be calling password() instead of secret(), this may be me misunderstanding the file structure since I didn't look too closely at it, but my understanding is that the first line of an entry is the password.

Fixes #207 for library and Cursive, GTK is left for later.

alexanderkjall commented 7 months ago

Thanks a lot :)

I'll review and test this in the coming week, I'm at fosdem this weekend and will be quite busy with other things.

ApprenticeofEnder commented 7 months ago

No worries, hope you have a good time! Meantime, I can make sure that this thing is Clippy approved.

cortex / ripasso

Zeroize Secrets (Cursive and Lib) #334