Significant hardening (always work on bytes; zeroize everything); address JetBrains warnings

wrappers/sanityCheck.go

@@ -1,15 +1,19 @@
 package wrappers
 
 import (
+	"bytes"
 	"errors"
 	"os"
+
+	"github.com/rwinkhart/go-boilerplate/security"
 )
 
-// GenSanityCheck creates an encrypted file containing known plaintext
+// GenSanityCheckAndZeroizePassphrase creates an encrypted file containing known plaintext
 // to later be used for ensuring the user does not encrypt data with
 // an incorrect passphrase.
-func GenSanityCheck(path string, passphrase []byte) error {
-	err := os.WriteFile(path, Encrypt([]byte("thx4usin'rcw"), passphrase), 0600)
+func GenSanityCheckAndZeroizePassphrase(path string, passphrase []byte) error {
+	err := os.WriteFile(path, EncryptAndZeroizeDecBytesAndPassphrase([]byte("thx4usin'rcw"), passphrase), 0600)
+	security.ZeroizeBytes(passphrase)
 	return err
 }
 
@@ -21,9 +25,11 @@ func RunSanityCheck(path string, passphrase []byte) error {
 	if err != nil {
 		return errors.New("Failed to read sanity check file (" + path + ")")
 	}
-	decBytes, _ := Decrypt(encBytes, passphrase)
-	if string(decBytes) == "thx4usin'rcw" {
-		return nil
+	decBytes, err := DecryptAndZeroizePassphrase(encBytes, passphrase)
+	if err == nil {
+		if bytes.Equal(decBytes, []byte("thx4usin'rcw")) {
+			return nil
+		}
 	}
-	return errors.New("Sanity check failed (likely due to inconsistent passphrase)")
+	return errors.New("sanity check failed (likely due to inconsistent passphrase)")
 }