Comments (3)
I think unique_ptr deleter approach has the same fragile level. We used to have that then it got refactored out.
A dedicated type or template is the way to go.
from brave-browser.
Ah I forgot it was not moved out, it is changed to actually using alias SecureVector
with SecureZeroAllocator
as
using SecureVector = std::vector<uint8_t, SecureZeroAllocator<uint8_t>>
and
// Allocator which will zero out memory when destruct
template <typename T>
struct SecureZeroAllocator {
SecureZeroAllocator() = default;
~SecureZeroAllocator() = default;
SecureZeroAllocator(const SecureZeroAllocator&) = default;
SecureZeroAllocator& operator=(const SecureZeroAllocator&) = default;
SecureZeroAllocator(SecureZeroAllocator&&) = default;
SecureZeroAllocator& operator=(SecureZeroAllocator&&) = default;
using value_type = T;
T* allocate(size_t n) {
return static_cast<T*>(::operator new(n * sizeof(T)));
}
void deallocate(T* p, size_t n) {
SecureZeroData(p, n);
::operator delete(p);
}
};
from brave-browser.
for cases like this where we're calling a third party method I think it would be useful to limit direct access to the third party lib (visibility and DEPS) and wrap it something that enforces zero on deletion
std::unique_ptr<HDKey> HDKey::GenerateFromExtendedKey(const std::string& key) {
std::vector<unsigned char> decoded_key(kSerializationLength);
if (!DecodeBase58Check(key, decoded_key, decoded_key.size())) {
LOG(ERROR) << __func__ << ": DecodeBase58Check failed";
return nullptr;
}
SecureVector buf(decoded_key.begin(), decoded_key.end());
SecureZeroData(decoded_key.data(), decoded_key.size());
from brave-browser.
Related Issues (20)
- Make Enable Night Mode more visible for users HOT 8
- Transaction submitted without internet shows error after with a long delay
- Probe for Brave-owned domains instead of Google ones when user selects custom DoH provider HOT 3
- Manual test run on Win x64 for 1.68.x - Nightly (Checking C126) HOT 1
- Manual test run on Linux x64 for 1.68.x - Nightly (Checking C126) HOT 1
- Manual test run on Android ARM for 1.68.x - Nightly (Checking C126) HOT 1
- Manual test run on ARM Tablet for 1.68.x - Nightly (Checking C126) HOT 1
- Upgrade from Chromium 126 to Chromium 127
- Dialog box disappears if you don't tap the right place
- Leo - Quick actions icon size for android
- Share/Copy/Edit tools not shown in url bar for sites loaded by only typing eTLD HOT 4
- Add a right click menu option when selecting a blank space in the vertical tabs panel HOT 2
- `Assistant`-role instructions bleed into `Claude 3 Haiku` responses, sometimes
- Remove Brave Swap Fee
- Add additional Rewards metrics
- Passwords saved on previous Browser are declined here
- We need a "response query is running" status-indicator icon for desktop `Leo` HOT 1
- Test failure: PersistentBackground/AutomationApiTestWithContextType.ForceLayout/0 HOT 9
- Improve Clarity of Linux/Android Section in README
- Cleanup iOS 16 deprecation warnings and availability checks
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from brave-browser.