From b4e6f0f57edbb02148aa3abb34160d967470cd33 Mon Sep 17 00:00:00 2001 From: Sipke Schoorstra Date: Thu, 21 May 2026 01:27:12 +0200 Subject: [PATCH] Clear decoded secret hash buffers --- src/modules/Elsa.Identity/Services/DefaultSecretHasher.cs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/modules/Elsa.Identity/Services/DefaultSecretHasher.cs b/src/modules/Elsa.Identity/Services/DefaultSecretHasher.cs index 3a1a1dbd7..e91d4688a 100644 --- a/src/modules/Elsa.Identity/Services/DefaultSecretHasher.cs +++ b/src/modules/Elsa.Identity/Services/DefaultSecretHasher.cs @@ -67,12 +67,13 @@ public class DefaultSecretHasher : ISecretHasher var storedSecretBytes = hashedSecret.Secret; var saltBytes = hashedSecret.Salt; var clearTextBytes = Encoding.UTF8.GetBytes(clearTextSecret); + byte[]? expectedHash = null; byte[]? providedHash = null; byte[]? legacyHash = null; try { - if (TryReadPbkdf2Hash(storedSecretBytes, out var iterationCount, out var expectedHash)) + if (TryReadPbkdf2Hash(storedSecretBytes, out var iterationCount, out expectedHash)) { providedHash = HashSecret(clearTextBytes, saltBytes, iterationCount); var matches = CryptographicOperations.FixedTimeEquals(providedHash, expectedHash); @@ -100,6 +101,9 @@ public class DefaultSecretHasher : ISecretHasher if (legacyHash is not null) CryptographicOperations.ZeroMemory(legacyHash); + + if (expectedHash is not null) + CryptographicOperations.ZeroMemory(expectedHash); } } @@ -164,6 +168,7 @@ public class DefaultSecretHasher : ISecretHasher return true; iterationCount = 0; + CryptographicOperations.ZeroMemory(hash); hash = []; return false; }