Repository navigation
Zero an over-limit credential blob in the Windows store [patch] - #181
Merged
Merged
Conversation
WindowsCredentialStore.Save checked the 2560-byte blob limit before its try/finally, so an oversize credential was rejected with its serialized plaintext left on the managed heap unscrubbed. The check now lives in NativeSecretBuffer.CopyWithinLimit, which zeroes the managed copy on every path, rejection included, and runs under test on every operating system. Fixes #165 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018fjR4mduqAKqmuCXhfcCbx
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
|
matt-edmondson
added a commit
that referenced
this pull request
Oct 6, 2026
Keep both wiring tests: #181's Windows blob-limit test and this PR's macOS lookup test landed in the same spot. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018fjR4mduqAKqmuCXhfcCbx
This was referenced Oct 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #165
What changed
WindowsCredentialStore.Savechecked the 2560-byteCredentialBloblimit before entering itstry { … } finally { Zero(blob); }, so an oversize credential (e.g. a long JWT or PAT) was rejected with its serialized plaintext left on the managed heap unscrubbed.Rather than only moving the check inside the store's
try, the check now lives in a shared helper,NativeSecretBuffer.CopyWithinLimit(byte[] source, int maxLength, string storeName). It takes ownership of the serialized bytes, throwsCredentialStoreExceptionwhen they exceed the limit, otherwise copies them into aNativeSecretBuffer, and zeroes the managed copy in afinallyon every path. This follows the patternOfCredentialalready uses: the scrubbing sequence sits where the tests can reach it on every OS, not in a store body that only runs on Windows.The exception message is unchanged ("Credential exceeds the Windows Credential Manager blob size limit of 2560 bytes (was N).") because the store passes its own
Name.Tests
SecretScrubbingTests.CopyWithinLimitRejectsAnOversizeSourceAndStillZeroesItchecks that the throw still happens and that the source buffer is all zeros afterwards. This covers the issue's stronger acceptance criterion: the scrub is observed directly.CopyWithinLimitCopiesASourceAtTheLimitAndZeroesTheManagedCopyandCopyWithinLimitRejectsANullSourcecover the success path and the null-argument path.NativeStoreScrubbingWiringTests.TheWindowsStoreChecksItsBlobLimitInsideTheScrubbingpinsWindowsCredentialStore.Saveto the helper with the existing IL scan.Verified the test catches the bug: with only the
WindowsCredentialStore.cschange reverted,TheWindowsStoreChecksItsBlobLimitInsideTheScrubbingfails. With the change in place, the full suite passes on Linux: 68 passed, 0 failed, 5 skipped. The skips are the existing native-store tests, which report Inconclusive because libsecret is not available in this environment.🤖 Generated with Claude Code
https://claude.ai/code/session_018fjR4mduqAKqmuCXhfcCbx
Generated by Claude Code