e6ec210736
Review fix (Important secret-hygiene finding): export_state_bytes built a PersistedDeviceState via state.signing_private.as_str().to_owned(), creating non-zeroized heap copies of the device ed25519 private keys (signing + deploy) that lingered as plaintext residue after the struct dropped. - Cargo.toml: enable zeroize "derive" feature (zeroize_derive already in lock tree) - device.rs: PersistedDeviceState now derives Zeroize + ZeroizeOnDrop, wiping all String fields on every drop path (success, serde_json::to_vec ? error path, panic) - device.rs: import_state_bytes uses std::mem::take per field (ZeroizeOnDrop adds a Drop impl, so fields can no longer be moved out — E0509); mem::take transfers the heap buffers without copying, leaving empty Strings the drop-zeroize no-ops - doc-comments updated to describe the ZeroizeOnDrop / mem::take hygiene Hygiene-only; no behavior change. Gates: cargo test -p relicario-wasm 15/15, clippy -D warnings clean, build --target wasm32-unknown-unknown clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014s527M917W47LDrfQ4t47g
28 lines
717 B
TOML
28 lines
717 B
TOML
[package]
|
|
name = "relicario-wasm"
|
|
version = "0.8.2"
|
|
edition = "2021"
|
|
description = "WASM bindings for relicario password manager"
|
|
license = "GPL-3.0-or-later"
|
|
|
|
[lib]
|
|
crate-type = ["cdylib", "rlib"]
|
|
|
|
[dependencies]
|
|
relicario-core = { path = "../relicario-core" }
|
|
wasm-bindgen = "0.2"
|
|
serde-wasm-bindgen = "0.6"
|
|
serde_json = "1"
|
|
serde = { version = "1", features = ["derive"] }
|
|
zeroize = { version = "1", features = ["derive"] }
|
|
getrandom = { version = "0.2", features = ["js"] }
|
|
ed25519-dalek = { version = "2", features = ["rand_core"] }
|
|
base64 = "0.22"
|
|
hex = "0.4"
|
|
rand = "0.8"
|
|
once_cell = "1"
|
|
|
|
[dev-dependencies]
|
|
wasm-bindgen-test = "0.3"
|
|
image = { version = "0.25", default-features = false, features = ["jpeg"] }
|