Windows Save leaves the serialized plaintext credential unscrubbed when it exceeds the 2560-byte blob limit

[matt-edmondson]

What's wrong

WindowsCredentialStore.Save (CredentialCache/Storage/WindowsCredentialStore.cs, ~lines 75–108) serializes the credential into byte[] blob and then checks its size before entering the try { … } finally { CredentialSerialization.Zero(blob); } block:

byte[] blob = CredentialSerialization.Serialize(credential);
if (blob.Length > NativeMethods.CRED_MAX_CREDENTIAL_BLOB_SIZE)
{
    throw new CredentialStoreException(...);   // blob is never zeroed on this path
}

try
{
    ...
}
finally
{
    CredentialSerialization.Zero(blob);
}

When the size check throws, the full plaintext JSON (username/password or token) stays on the managed heap until the GC reclaims it, and it is never zeroed.

Why it matters

The recent scrubbing work (e.g. 97a49ab, "scrub Linux Secret Service plaintext like Windows and macOS") commits the library to zeroing every managed plaintext copy on every path, including when an exception is thrown. The macOS Save and the Linux path both honour this. The Windows over-limit path is the only one that doesn't.

Concrete scenario: someone stores a CredentialWithToken holding a long JWT or PAT whose serialized form is over 2560 bytes. Save throws CredentialStoreException as it should, but the serialized secret is left in memory unscrubbed. It is then exposed to memory dumps, crash dumps and swap, which is exactly what the scrubbing is meant to prevent.

Suggested fix

Move the size check inside the try, so the finally covers it:

byte[] blob = CredentialSerialization.Serialize(credential);
try
{
    if (blob.Length > NativeMethods.CRED_MAX_CREDENTIAL_BLOB_SIZE)
    {
        throw new CredentialStoreException(...);
    }
    ...
}
finally
{
    CredentialSerialization.Zero(blob);
}

Acceptance criteria

• blob is zeroed on every exit path of WindowsCredentialStore.Save, including the over-limit throw.
• If the shared-layer tests can observe it, add a test that saves an oversize credential and asserts the buffer was scrubbed. At minimum, add a test asserting the throw still happens.

[matt-edmondson]

Triage

• Category: Bug (security hardening)
• Priority: Medium. The plaintext credential is left unscrubbed on the heap, but only on the error path for credentials whose serialized form exceeds 2560 bytes (for example a long JWT or PAT). The fix is trivial.
• Area / suggested owner: Windows store (WindowsCredentialStore.Save).
• Related: macOS Save and Remove decrypt the existing secret into process memory without using it, and free it unscrubbed #166 (a macOS scrubbing gap on Save and Remove).
• Duplicates / in progress: None found. No open PR covers this.
• Next step: Move the size check inside the try so the finally zeroes blob, and add at least a test that asserts the throw.

---

Generated by Claude Code