Is there a way to protect/hide QNetworkAccessManager/QNetworkReply sensitive informations in Qt from a memory viewer?

152 Views Asked by At

i'm trying to parse some data from a private GitHub repo using the Github API to connect and download the data as JSON.

Everything works fine but i have one big problem. Being a private repo, i don't want others to access sensitive data like the private repo key or the JSON content parse.

Here is my code:

downloader.cpp

#include "downloader.h"

downloader::downloader()
{
    connect(&manager, &QNetworkAccessManager::finished,
            this, &downloader::downloadFinished);
}

void downloader::doDownload(const QUrl &url, int mode)
{
    download_Mode = mode;
    const QString username = "test";
    const QString token = "1234567890"
    const QByteArray basic_authorization = QByteArray("Basic ") + (username + ":" + token).toUtf8().toBase64();

    QNetworkRequest request(url);
    request.setRawHeader(QByteArrayLiteral("Authorization"), basic_authorization);
    request.setUrl(url);

    QNetworkReply *reply = manager.get(request);
    QEventLoop loop;
    connect(&manager, &QNetworkAccessManager::finished, &loop, &QEventLoop::quit);

    #if QT_CONFIG(ssl)
    connect(reply, &QNetworkReply::sslErrors, this, &downloader::sslErrors);
    #endif

    loop.exec();
}

bool downloader::isHttpRedirect(QNetworkReply *reply)
{
    int statusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
    return statusCode == 301 || statusCode == 302 || statusCode == 303
           || statusCode == 305 || statusCode == 307 || statusCode == 308;
}

void downloader::sslErrors(const QList<QSslError> &sslErrors)
{
#if QT_CONFIG(ssl)
    for (const QSslError &error : sslErrors)
        fprintf(stderr, "SSL error: %s\n", qPrintable(error.errorString()));
#else
    Q_UNUSED(sslErrors);
#endif
}

void downloader::downloadFinished(QNetworkReply *reply)
{
    QUrl url = reply->url();
    if (reply->error()) {
        fprintf(stderr, "Download of %s failed: %s\n",
                url.toEncoded().constData(),
                qPrintable(reply->errorString()));
    } else {
        if (isHttpRedirect(reply)) {
            fputs("Request was redirected.\n", stderr);
        } else {
            QJsonDocument doc = QJsonDocument::fromJson(reply->readAll());
            QByteArray e_Content = doc.object().value("content").toString().toUtf8();
            QByteArray d_Content = QByteArray::fromBase64(e_Content);
        }
    }
    reply->deleteLater();
}

Problem is, when i run my program, if i use something like Process Hacker to inspect my process, i can see every sensitive data in plain text. It's like the username/token/json data/download link/header data never clears from memory.

Is there a way to clear the sensitive data from memory the moment download finished? Or, i can at least hide it somehow?

PS: I've tried encrypting both username/token but

request.setRawHeader(QByteArrayLiteral("Authorization"), basic_authorization);

is revealing my data in memory and never clears.

Thanks in advance.

0

There are 0 best solutions below