`00dce95`

Reduce prompt credential lifetime

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 2 months ago

SHA: 00dce953964d79ea0fad4a00ef61668d52c23a06
Parents: 08a18d9
Tree: 824c362

4 changed files

Status	File	+	-
M	`RELEASE_NOTES.md`	1	0
M	`examples/sprint-04-validation-report-2026-02-20.md`	1	0
M	`garcard/src/prompt.rs`	31	15
M	`garcard/src/prompt_ui.rs`	19	1

RELEASE_NOTES.mdmodified

 . Same-UID enforcement for local IPC control clients.
 . Reduced panic surface in prompt color setup paths.
 . Best-effort scrubbing of helper prompt response buffers after use.
 +4. Reduced prompt credential lifetime by moving submitted input without cloning and scrubbing prompt output buffers.
  ## Validation Coverage
 . Sprint 02 live callback and reconnect validation:

examples/sprint-04-validation-report-2026-02-20.mdmodified

 . IPC control path now validates same-UID peer credentials.
 . Prompt UI runtime path no longer relies on panic/`expect` for color parsing.
 . Helper response buffers are scrubbed after sending to helper socket.
 +4. Prompt input handling now moves submitted secrets without cloning and scrubs prompt/output buffers after use.
  ## Remaining Manual Sprint 04 Checks
 . Optional interactive acceptance pass (enter valid credentials, wrong-then-retry, explicit cancel) in full desktop session.

garcard/src/prompt.rsmodified

  fn run_custom_prompt_command(command: &str, prompt: &str, visible: bool) -> Result<PromptResponse> {
      let mode = if visible { "plain" } else { "secret" };
 -    let output = Command::new("sh")
 +    let mut output = Command::new("sh")
          .arg("-c")
          .arg(command)
          .env("GARCARD_PROMPT", prompt)
          .output()
          .with_context(|| format!("failed to run custom prompt command: {}", command))?;
 -    Ok(map_output_to_prompt_response(
 -        &output.status,
 -        &output.stdout,
 -    ))
 +    let response = map_output_to_prompt_response(&output.status, &output.stdout);
 +    scrub_bytes(&mut output.stdout);
 +    Ok(response)
+ }
  fn run_gartk_prompt_subcommand(
      let mode = if visible { "plain" } else { "secret" };
      let executable =
          std::env::current_exe().context("failed to resolve current executable path")?;
 -    let output = Command::new(executable)
 +    let mut output = Command::new(executable)
          .arg("prompt")
          .arg("--mode")
          .arg(mode)
      if output.status.code() == Some(2) {
          let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
 +        scrub_bytes(&mut output.stdout);
 +        scrub_bytes(&mut output.stderr);
          anyhow::bail!("garcard prompt subcommand unavailable: {}", stderr);
+     }
 -    Ok(map_output_to_prompt_response(
 -        &output.status,
 -        &output.stdout,
 -    ))
 +    let response = map_output_to_prompt_response(&output.status, &output.stdout);
 +    scrub_bytes(&mut output.stdout);
 +    scrub_bytes(&mut output.stderr);
 +    Ok(response)
+ }
  fn run_systemd_ask_password(
+     }
      command.arg(prompt);
 -    let output = command
 +    let mut output = command
          .output()
          .context("failed to run systemd-ask-password")?;
 -    Ok(map_output_to_prompt_response(
 -        &output.status,
 -        &output.stdout,
 -    ))
 +    let response = map_output_to_prompt_response(&output.status, &output.stdout);
 +    scrub_bytes(&mut output.stdout);
 +    scrub_bytes(&mut output.stderr);
 +    Ok(response)
+ }
  fn map_output_to_prompt_response(status: &ExitStatus, stdout: &[u8]) -> PromptResponse {
+     }
+ }
 +fn scrub_bytes(value: &mut Vec<u8>) {
 +    if value.is_empty() {
 +        return;
 +    }
 +    value.fill(0);
 +    value.clear();
 +}
++
  #[cfg(test)]
  mod tests {
      use super::*;
          let mapped = map_output_to_prompt_response(&status, b"");
          assert_eq!(mapped, PromptResponse::TimedOut);
+     }
++
 +    #[test]
 +    fn scrub_bytes_clears_vec() {
 +        let mut value = b"top-secret".to_vec();
 +        scrub_bytes(&mut value);
 +        assert!(value.is_empty());
 +    }
+ }

garcard/src/prompt_ui.rsmodified

                  self.exit = Some(PromptExit::Canceled);
+             }
              Key::Return => {
 -                self.exit = Some(PromptExit::Submitted(self.input.clone()));
 +                let submitted = std::mem::take(&mut self.input);
 +                self.cursor = 0;
 +                self.exit = Some(PromptExit::Submitted(submitted));
+             }
              Key::Left => {
                  if self.cursor > 0 {
  impl Drop for PromptDialog {
      fn drop(&mut self) {
 +        scrub_string(&mut self.input);
          let _ = self.window.connection().inner().free_gc(self.gc);
+     }
+ }
      input.drain(start..end);
+ }
 +fn scrub_string(value: &mut String) {
 +    if value.is_empty() {
 +        return;
 +    }
 +    let mut bytes = std::mem::take(value).into_bytes();
 +    bytes.fill(0);
 +}
++
  #[cfg(test)]
  mod tests {
      use super::*;
          assert_eq!(display_prefix("hello", 2, PromptMode::Plain), "he");
          assert_eq!(display_prefix("hello", 2, PromptMode::Secret), "**");
+     }
++
 +    #[test]
 +    fn scrub_string_clears_input() {
 +        let mut value = "top-secret".to_string();
 +        scrub_string(&mut value);
 +        assert!(value.is_empty());
 +    }
+ }