feat(security): read login password through SecurePassword with ZeroFreeBSTR

MainWindow no longer materialises _password_PB.Password (which would leak a managed string copy that lives until GC). The PasswordBox.SecurePassword is now bridged through SecureStringExtensions.UseAsString, which marshals the SecureString to an unmanaged BSTR, hands a short-lived managed string to Database.Login, then zero-frees the BSTR with Marshal.ZeroFreeBSTR. PasswordBox.Clear() replaces the previous Password = string.Empty assignments so the underlying SecureString buffer is wiped explicitly.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Yassin Lokhat

GUI/WPF/Helper/SecureStringExtensions.cs

@@ -0,0 +1,56 @@
+using System.Runtime.InteropServices;
+using System.Security;
+
+namespace Upsilon.Apps.Passkey.GUI.WPF.Helper
+{
+   /// <summary>
+   /// Helpers that bridge between WPF's <see cref="SecureString"/> (used by
+   /// <c>PasswordBox.SecurePassword</c>) and the rest of the API surface, while
+   /// keeping the unmanaged BSTR copy alive only for the duration of the
+   /// supplied callback and zero-ing it out afterwards.
+   /// </summary>
+   public static class SecureStringExtensions
+   {
+      /// <summary>
+      /// Pins <paramref name="value"/> as an unmanaged BSTR, invokes
+      /// <paramref name="action"/> with the resulting (managed) string and then
+      /// zeros the unmanaged buffer. The managed string returned to the caller
+      /// still lives in the heap until the GC collects it; callers should keep
+      /// their use of it as short as possible.
+      /// </summary>
+      public static T UseAsString<T>(this SecureString value, Func<string, T> action)
+      {
+         ArgumentNullException.ThrowIfNull(value);
+         ArgumentNullException.ThrowIfNull(action);
+
+         IntPtr bstr = IntPtr.Zero;
+
+         try
+         {
+            bstr = Marshal.SecureStringToBSTR(value);
+            string managed = Marshal.PtrToStringBSTR(bstr);
+            return action(managed);
+         }
+         finally
+         {
+            if (bstr != IntPtr.Zero)
+            {
+               Marshal.ZeroFreeBSTR(bstr);
+            }
+         }
+      }
+
+      /// <summary>
+      /// Same as <see cref="UseAsString{T}"/> but with an <see cref="Action{T}"/>
+      /// callback when no value needs to be returned.
+      /// </summary>
+      public static void UseAsString(this SecureString value, Action<string> action)
+      {
+         _ = value.UseAsString(s =>
+         {
+            action(s);
+            return 0;
+         });
+      }
+   }
+}

GUI/WPF/MainWindow.xaml.cs

@@ -79,7 +79,7 @@ private void _credential_TB_KeyUp(object sender, KeyEventArgs e)
                _submitPassword();
             }
 
-            _password_PB.Password = string.Empty;
+            _password_PB.Clear();
             _timer.Start();
          }
          else if (e.Key == Key.Escape)
@@ -131,14 +131,14 @@ private void _submitUsername()
          _username_TB.Text = string.Empty;
          _username_TB.Visibility = Visibility.Collapsed;
 
-         _password_PB.Password = string.Empty;
+         _password_PB.Clear();
          _password_PB.Visibility = Visibility.Visible;
          _ = _password_PB.Focus();
       }
 
       private void _submitPassword()
       {
-         if (string.IsNullOrEmpty(_password_PB.Password))
+         if (_password_PB.SecurePassword.Length == 0)
          {
             _timer.Start();
             return;
@@ -149,7 +149,14 @@ private void _submitPassword()
             return;
          }
 
-         _ = Session.Database.Login(_password_PB.Password);
+         _password_PB.SecurePassword.UseAsString(passkey =>
+         {
+            _ = Session.Database.Login(passkey);
+         });
+
+         // Erase the PasswordBox buffer right after submitting so the secret
+         // is not kept alive longer than necessary.
+         _password_PB.Clear();
 
          if (Session.Database.User is null)
          {
@@ -211,7 +218,7 @@ private void _resetCredentials()
          _username_TB.Visibility = Visibility.Visible;
          _ = _username_TB.Focus();
 
-         _password_PB.Password = string.Empty;
+         _password_PB.Clear();
          _password_PB.Visibility = Visibility.Collapsed;
 
          _timer.Stop();