i'm trying to parse some data from a private GitHub repo using the Github API to connect and download the data as JSON.
Everything works fine but i have one big problem. Being a private repo, i don't want others to access sensitive data like the private repo key or the JSON content parse.
Here is my code:
downloader.cpp
#include "downloader.h"
downloader::downloader()
{
connect(&manager, &QNetworkAccessManager::finished,
this, &downloader::downloadFinished);
}
void downloader::doDownload(const QUrl &url, int mode)
{
download_Mode = mode;
const QString username = "test";
const QString token = "1234567890"
const QByteArray basic_authorization = QByteArray("Basic ") + (username + ":" + token).toUtf8().toBase64();
QNetworkRequest request(url);
request.setRawHeader(QByteArrayLiteral("Authorization"), basic_authorization);
request.setUrl(url);
QNetworkReply *reply = manager.get(request);
QEventLoop loop;
connect(&manager, &QNetworkAccessManager::finished, &loop, &QEventLoop::quit);
#if QT_CONFIG(ssl)
connect(reply, &QNetworkReply::sslErrors, this, &downloader::sslErrors);
#endif
loop.exec();
}
bool downloader::isHttpRedirect(QNetworkReply *reply)
{
int statusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
return statusCode == 301 || statusCode == 302 || statusCode == 303
|| statusCode == 305 || statusCode == 307 || statusCode == 308;
}
void downloader::sslErrors(const QList<QSslError> &sslErrors)
{
#if QT_CONFIG(ssl)
for (const QSslError &error : sslErrors)
fprintf(stderr, "SSL error: %s\n", qPrintable(error.errorString()));
#else
Q_UNUSED(sslErrors);
#endif
}
void downloader::downloadFinished(QNetworkReply *reply)
{
QUrl url = reply->url();
if (reply->error()) {
fprintf(stderr, "Download of %s failed: %s\n",
url.toEncoded().constData(),
qPrintable(reply->errorString()));
} else {
if (isHttpRedirect(reply)) {
fputs("Request was redirected.\n", stderr);
} else {
QJsonDocument doc = QJsonDocument::fromJson(reply->readAll());
QByteArray e_Content = doc.object().value("content").toString().toUtf8();
QByteArray d_Content = QByteArray::fromBase64(e_Content);
}
}
reply->deleteLater();
}
Problem is, when i run my program, if i use something like Process Hacker to inspect my process, i can see every sensitive data in plain text. It's like the username/token/json data/download link/header data never clears from memory.
Is there a way to clear the sensitive data from memory the moment download finished? Or, i can at least hide it somehow?
PS: I've tried encrypting both username/token but
request.setRawHeader(QByteArrayLiteral("Authorization"), basic_authorization);
is revealing my data in memory and never clears.
Thanks in advance.