memory cleanse for ClearCommandHistory

Author: kwsantiago

src/qt/rpcconsole.cpp

@@ -24,6 +24,7 @@
 #endif // ENABLE_WALLET
 #include <rpc/client.h>
 #include <rpc/server.h>
+#include <support/cleanse.h>
 #include <util/strencodings.h>
 #include <util/string.h>
 #include <util/time.h>
@@ -693,12 +694,28 @@ void RPCConsole::WriteCommandHistory()
 
 void RPCConsole::ClearCommandHistory()
 {
-    // Overwrite each command in history with dummy data before clearing
-    // This helps ensure the sensitive data is overwritten in memory
+    // Best-effort attempt to securely overwrite command history in memory.
+    // Note: Complete memory sanitization cannot be guaranteed with QString due to
+    // Qt's implicit sharing (copy-on-write) and internal memory management.
     for (QString& cmd : history) {
-        // Overwrite with characters of same length (don't store new length info)
-        cmd.fill('x');  // First pass: fill with 'x'
-        cmd.fill('\0'); // Second pass: fill with null chars
+        if (cmd.isEmpty()) continue;
+
+        // Attempt to cleanse QString's internal buffer using Bitcoin Core's
+        // secure memory_cleanse function (uses platform-specific secure zeroing)
+        QChar* data = cmd.data();  // Get pointer to mutable internal buffer
+        size_t byte_size = cmd.size() * sizeof(QChar);
+
+        // First pass: overwrite with 'x' and cleanse
+        cmd.fill('x');
+        if (data == cmd.data()) {  // Verify we still have the same buffer
+            memory_cleanse(cmd.data(), byte_size);
+        }
+
+        // Second pass: overwrite with null and cleanse
+        cmd.fill('\0');
+        if (data == cmd.data()) {  // Verify we still have the same buffer
+            memory_cleanse(cmd.data(), byte_size);
+        }
     }
 
     // Overwrite saved history in settings with dummy data
@@ -729,6 +746,20 @@ void RPCConsole::ClearCommandHistory()
     // Clear the history list
     history.clear();
     historyPtr = 0;
+
+    // Also cleanse cmdBeforeBrowsing which may contain command data
+    if (!cmdBeforeBrowsing.isEmpty()) {
+        QChar* data = cmdBeforeBrowsing.data();
+        size_t byte_size = cmdBeforeBrowsing.size() * sizeof(QChar);
+        cmdBeforeBrowsing.fill('x');
+        if (data == cmdBeforeBrowsing.data()) {
+            memory_cleanse(cmdBeforeBrowsing.data(), byte_size);
+        }
+        cmdBeforeBrowsing.fill('\0');
+        if (data == cmdBeforeBrowsing.data()) {
+            memory_cleanse(cmdBeforeBrowsing.data(), byte_size);
+        }
+    }
     cmdBeforeBrowsing.clear();
 
     // Second pass: write empty history to settings
@@ -1236,8 +1267,8 @@ void RPCConsole::on_lineEdit_returnPressed()
         QMessageBox::StandardButton reply = QMessageBox::question(this,
             tr("Clear Command History"),
             tr("This will permanently clear your command history and console output.<br><br>"
-               "While this action is irreversible, it cannot be guaranteed to be "
-               "completely irrecoverable from disk.<br><br>"
+               "While this action is irreversible, complete removal from memory and disk "
+               "cannot be guaranteed due to system and Qt framework limitations.<br><br>"
                "Are you sure you want to proceed?"),
             QMessageBox::Yes | QMessageBox::No,
             QMessageBox::No);