Replace WipeMode enum with SecretInputArray / SecretOutputArray subclasses - #549
Draft
WillChilds-Klein wants to merge 1 commit into
Draft
Replace WipeMode enum with SecretInputArray / SecretOutputArray subclasses#549WillChilds-Klein wants to merge 1 commit into
WillChilds-Klein wants to merge 1 commit into
Conversation
…asses Per follow-up agreed in PR 547 review. Encode wipe semantics in the type rather than a runtime flag: - JByteArrayCritical (base): non-sensitive critical region. No |len| parameter. Release does mode-0 ReleasePrimitiveArrayCritical. Use for salt, info, ciphertext, etc. - SecretInputArray: sensitive read-only buffer (key, password, plaintext-in). Caller must not write through get(). On release, if the JVM returned a copy, OPENSSL_cleanse the native buffer and discard via JNI_ABORT; the Java array is preserved unchanged. - SecretOutputArray: sensitive caller-writable buffer (derived key, plaintext-out). On release, if the JVM returned a copy, stash the caller's writes (allocation reserved in the ctor), cleanse the native buffer, JNI_ABORT, and SetByteArrayRegion to commit the stashed bytes back to the Java array. SetByteArrayRegion runs only after every critical region on the thread is closed; for multi- output scopes the caller drives release()/commitBack() manually. Implementation uses a virtual doRelease() hook on the base; release() itself stays in the base with idempotency and noexcept guarantees. Subclass dtors run their own release() before chaining to the base dtor so that virtual dispatch resolves to the derived override (the base dtor would otherwise see a sliced vtable). The thread-local debug critical-region counter and the assert in SecretOutputArray::commitBack() are preserved. cleanse_and_stash remains a static member of the base for use by csrc/test_buffer.cpp unit tests. Updates pbkdf2.cpp, hkdf.cpp, and aes_xts.cpp to use the new types. GetArrayLength is no longer called for non-sensitive (base-class) arrays at all; the secret subclasses take a |len| parameter that callers must compute BEFORE constructing any JBAC subclass on the thread.
WillChilds-Klein
force-pushed
the
jbac-secret-array-subclasses
branch
from
June 19, 2026 21:40
b0bf28c to
3e3d7f8
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #549 +/- ##
============================================
- Coverage 78.58% 78.55% -0.04%
Complexity 1211 1211
============================================
Files 127 127
Lines 7734 7737 +3
Branches 981 980 -1
============================================
Hits 6078 6078
- Misses 1126 1130 +4
+ Partials 530 529 -1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status
Draft.
Summary
Follow-up to #547 per prasden's suggestion. Encodes wipe semantics in the type rather than a runtime
WipeModeflag, so callers can't accidentally tag a secret withNO_WIPE.By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.