Make WriteToStdin input zeroization optional

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Randall Winkhart
+Copyright (c) 2025-2026 Randall Winkhart
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

back/1globals.go

@@ -5,9 +5,12 @@ import "os"
 var Home, _ = os.UserHomeDir()
 
 const (
-	AnsiBold  = "\033[1m"
-	AnsiError = "\033[38;5;9m"
-	AnsiReset = "\033[0m"
+	AnsiBold    = "\033[1m"
+	AnsiError   = "\033[38;5;9m"
+	AnsiWarning = "\033[38;5;3m"
+	AnsiBlue    = "\033[38;5;4m"
+	AnsiGreen   = "\033[38;5;2m"
+	AnsiReset   = "\033[0m"
 
 	ErrorRead           = 101
 	ErrorWrite          = 102

back/cmd.go

@@ -6,10 +6,12 @@ import (
 	"io"
 	"os"
 	"os/exec"
+
+	"github.com/rwinkhart/go-boilerplate/security"
 )
 
-// WriteToStdin is a utility function that writes a string to a command's stdin.
-func WriteToStdin(cmd *exec.Cmd, input string) error {
+// WriteToStdin is a utility function that writes a byte slice to a command's stdin.
+func WriteToStdin(cmd *exec.Cmd, input []byte, zeroizeInput bool) error {
 	stdin, err := cmd.StdinPipe()
 	if err != nil {
 		return errors.New("unable to access stdin for system command: " + err.Error())
@@ -18,16 +20,19 @@ func WriteToStdin(cmd *exec.Cmd, input string) error {
 		defer func(stdin io.WriteCloser) {
 			_ = stdin.Close() // error ignored; if stdin could be accessed, it can probably be closed
 		}(stdin)
-		_, _ = io.WriteString(stdin, input)
+		_, _ = stdin.Write(input)
+		if zeroizeInput {
+			security.ZeroizeBytes(input)
+		}
 	}()
 	return nil
 }
 
-// ReadFromStdin is a utility function that reads a string from stdin.
-func ReadFromStdin() string {
+// ReadFromStdin is a utility function that reads a byte slice from stdin.
+func ReadFromStdin() []byte {
 	scanner := bufio.NewScanner(os.Stdin)
 	if scanner.Scan() {
-		return scanner.Text()
+		return scanner.Bytes()
 	}
-	return ""
+	return nil
 }

front/input.go

@@ -1,58 +0,0 @@
-package front
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"strings"
-
-	"golang.org/x/term"
-)
-
-// Input prompts the user for input and returns the input as a string.
-func Input(prompt string) string {
-	fmt.Print("\n" + prompt + " ")
-	reader := bufio.NewReader(os.Stdin)
-	userInput, _ := reader.ReadString('\n')
-	return strings.TrimRight(userInput, "\n\r ") // remove trailing newlines, carriage returns, and spaces
-}
-
-// InputHidden prompts the user for input and returns the input as a byte array, hiding the input from the terminal.
-func InputHidden(prompt string) []byte {
-	fmt.Print("\n" + prompt + " ")
-	byteInput, _ := term.ReadPassword(int(os.Stdin.Fd()))
-	fmt.Println()
-	return byteInput
-}
-
-// InputBinary prompts the user with a yes/no question and returns the response as a boolean.
-func InputBinary(prompt string) bool {
-	reader := bufio.NewReader(os.Stdin)
-	fmt.Print("\n" + prompt + " (y/N) ")
-	char, _, _ := reader.ReadRune()
-	if char == 'y' || char == 'Y' {
-		return true
-	}
-	return false
-}
-
-// InputInt prompts the user for input and returns the input as an integer.
-// A negative min/max value will disable the respective limit.
-func InputInt(prompt string, min, max int) int {
-	for {
-		fmt.Print("\n" + prompt + " ")
-		var userInput int
-		_, err := fmt.Scanln(&userInput)
-		if err == nil && (userInput >= min || min < 0) && (userInput <= max || max < 0) {
-			return userInput
-		}
-	}
-}
-
-// InputMenuGen prompts the user with a menu and returns the user's choice as an integer.
-func InputMenuGen(prompt string, options []string) int {
-	for i, option := range options {
-		fmt.Printf("%d. %s\n", i+1, option)
-	}
-	return InputInt(prompt, 1, len(options))
-}

front/input_UNIX.go

@@ -0,0 +1,43 @@
+package front
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"strings"
+)
+
+// Input prompts the user for input and
+// returns the input as a string.
+func Input(prompt string) string {
+	fmt.Print(prompt + " ")
+	reader := bufio.NewReader(os.Stdin)
+	userInput, _ := reader.ReadString('\n')
+	return strings.TrimRight(userInput, "\n\r ") // remove trailing newlines, carriage returns, and spaces
+}
+
+// InputBinary prompts the user with a yes/no
+// question and returns the response as a boolean.
+func InputBinary(prompt string) bool {
+	reader := bufio.NewReader(os.Stdin)
+	fmt.Print(prompt + " (y/N) ")
+	char, _, _ := reader.ReadRune()
+	if char == 'y' || char == 'Y' {
+		return true
+	}
+	return false
+}
+
+// InputInt prompts the user for input and returns the input as an integer.
+// A negative min/max value will disable the respective limit.
+func InputInt(prompt string, min, max int) int {
+	for {
+		fmt.Print(prompt + " ")
+		var userInput int
+		_, err := fmt.Scanln(&userInput)
+		if err == nil && (userInput >= min || min < 0) && (userInput <= max || max < 0) {
+			return userInput
+		}
+		fmt.Println()
+	}
+}

front/input_common.go

@@ -0,0 +1,26 @@
+package front
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/term"
+)
+
+// InputMenuGen prompts the user with a menu
+// and returns the user's choice as an integer.
+func InputMenuGen(prompt string, options []string) int {
+	for i, option := range options {
+		fmt.Printf("%d. %s\n", i+1, option)
+	}
+	return InputInt("\n"+prompt, 1, len(options))
+}
+
+// InputSecret prompts the user for input and returns the
+// input as a byte array, hiding the input from the terminal.
+func InputSecret(prompt string) []byte {
+	fmt.Print(prompt + " ")
+	byteInput, _ := term.ReadPassword(int(os.Stdin.Fd()))
+	fmt.Println()
+	return byteInput
+}

go.mod

@@ -1,7 +1,7 @@
 module github.com/rwinkhart/go-boilerplate
 
-go 1.24.3
+go 1.25.7
 
-require golang.org/x/term v0.32.0
+require golang.org/x/term v0.40.0
 
-require golang.org/x/sys v0.33.0 // indirect
+require golang.org/x/sys v0.41.0 // indirect

go.sum

@@ -1,4 +1,4 @@
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
-golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=

security/gen.go

@@ -0,0 +1,67 @@
+package security
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"math"
+	"math/big"
+)
+
+// BytesGen generates a random byte slice of a specified length and complexity.
+// Requires: complexity (minimum percentage of special characters to be returned in the generated output; set to 0 for a "simple" result),
+// complexCharsetLevel (1 = safe for filenames, 2 = safe for most password entries, 3 = safe only for well-made password entries)
+func BytesGen(length int, complexity float64, complexCharsetLevel uint8) []byte {
+	var actualSpecialChars int // track the number of special characters in the generated output
+	var minSpecialChars int    // track the minimum number of special characters to accept
+	var extendedCharset string // additions to character set used for complex outputs
+
+	charset := "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" // default character set used for all strings
+	const extendedCharsetFiles = "!#$%&+,-.;=@_~^()[]{}`'"                      // additional special characters for complex strings (safe in file names)
+	const extendedCharsetMostPassword = "*:><?|"                                // additional special characters for complex strings (NOT safe in file names)
+	const extendedCharsetSpecialPassword = "\"/\\"                              // additional special characters for complex strings (NOT safe in file names)
+
+	if complexity > 0 {
+		minSpecialChars = int(math.Round(float64(length) * complexity)) // determine minimum number of special characters to accept
+		switch complexCharsetLevel {
+		case 1:
+			extendedCharset = extendedCharsetFiles
+		case 2:
+			extendedCharset = extendedCharsetMostPassword + extendedCharsetFiles[:len(extendedCharsetFiles)-9]
+		case 3:
+			extendedCharset = extendedCharsetFiles + extendedCharsetMostPassword + extendedCharsetSpecialPassword
+		}
+		charset += extendedCharset
+	}
+
+	// loop until a byte slice of the desired complexity is generated
+	for {
+		// generate a random output
+		result := make([]byte, length)
+		for i := range result {
+			val, _ := rand.Int(rand.Reader, big.NewInt(int64(len(charset))))
+			result[i] = charset[val.Int64()]
+		}
+
+		// return early if the desired output is not complex
+		if complexity <= 0 {
+			return result
+		}
+
+		// count the number of special characters in the generated output
+		for i := range result {
+			if bytes.Contains([]byte(extendedCharset), []byte{result[i]}) {
+				actualSpecialChars++
+			}
+		}
+
+		// return the generated output if it contains enough special characters
+		if actualSpecialChars >= minSpecialChars {
+			return result
+		}
+
+		// reset special character counter
+		fmt.Println("Regenerating output until desired complexity is achieved...")
+		actualSpecialChars = 0
+	}
+}

security/security.go

@@ -0,0 +1,11 @@
+package security
+
+// ZeroizeBytes overwrites all
+// bytes in a slice with zeros.
+//
+//go:noinline
+func ZeroizeBytes(input []byte) {
+	for i := range input {
+		input[i] = 0
+	}
+}