Harden functions that potentially deal with sensitive information

back/cmd.go

@@ -6,10 +6,12 @@ import (
 	"io"
 	"os"
 	"os/exec"
+
+	"github.com/rwinkhart/go-boilerplate/security"
 )
 
-// WriteToStdin is a utility function that writes a string to a command's stdin.
-func WriteToStdin(cmd *exec.Cmd, input string) error {
+// WriteToStdin is a utility function that writes a byte slice to a command's stdin.
+func WriteToStdinAndZeroizeInput(cmd *exec.Cmd, input []byte) error {
 	stdin, err := cmd.StdinPipe()
 	if err != nil {
 		return errors.New("unable to access stdin for system command: " + err.Error())
@@ -18,16 +20,17 @@ func WriteToStdin(cmd *exec.Cmd, input string) error {
 		defer func(stdin io.WriteCloser) {
 			_ = stdin.Close() // error ignored; if stdin could be accessed, it can probably be closed
 		}(stdin)
-		_, _ = io.WriteString(stdin, input)
+		_, _ = stdin.Write(input)
+		security.ZeroizeBytes(input)
 	}()
 	return nil
 }
 
-// ReadFromStdin is a utility function that reads a string from stdin.
-func ReadFromStdin() string {
+// ReadFromStdin is a utility function that reads a byte slice from stdin.
+func ReadFromStdin() []byte {
 	scanner := bufio.NewScanner(os.Stdin)
 	if scanner.Scan() {
-		return scanner.Text()
+		return scanner.Bytes()
 	}
-	return ""
+	return nil
 }

back/security.go

@@ -1,9 +0,0 @@
-package back
-
-// EraseBytesSecurely overwrites all
-// bytes in a slice with zeros.
-func EraseBytesSecurely(input []byte) {
-	for i := range input {
-		input[i] = 0
-	}
-}