SemianiakaVY/elsa-core
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

Clear decoded secret hash buffers

Browse source
This commit is contained in:
Sipke Schoorstra 2026-05-21 01:27:12 +02:00
parent df12667af2
commit b4e6f0f57e
No known key found for this signature in database
GPG key ID: 5C10502B28A4268F
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/modules/Elsa.Identity/Services/DefaultSecretHasher.cs
View file

@ -67,12 +67,13 @@ public class DefaultSecretHasher : ISecretHasher
var storedSecretBytes = hashedSecret.Secret;
var saltBytes = hashedSecret.Salt;
var clearTextBytes = Encoding.UTF8.GetBytes(clearTextSecret);
byte[]? expectedHash = null;
byte[]? providedHash = null;
byte[]? legacyHash = null;
try
{
if (TryReadPbkdf2Hash(storedSecretBytes, out var iterationCount, out var expectedHash))
if (TryReadPbkdf2Hash(storedSecretBytes, out var iterationCount, out expectedHash))
{
providedHash = HashSecret(clearTextBytes, saltBytes, iterationCount);
var matches = CryptographicOperations.FixedTimeEquals(providedHash, expectedHash);
@ -100,6 +101,9 @@ public class DefaultSecretHasher : ISecretHasher
if (legacyHash is not null)
CryptographicOperations.ZeroMemory(legacyHash);
if (expectedHash is not null)
CryptographicOperations.ZeroMemory(expectedHash);
}
}
@ -164,6 +168,7 @@ public class DefaultSecretHasher : ISecretHasher
return true;
iterationCount = 0;
CryptographicOperations.ZeroMemory(hash);
hash = [];
return false;
}