diff --git a/src/tests/test_memory_protection.py b/src/tests/test_memory_protection.py index 30fe2784..b2156921 100644 --- a/src/tests/test_memory_protection.py +++ b/src/tests/test_memory_protection.py @@ -27,3 +27,16 @@ def test_inmemory_secret_wipe_clears_attributes(): assert secret._nonce is None assert secret._cipher is None assert secret._encrypted is None + + +def test_access_after_wipe_raises_error(): + secret = InMemorySecret(b"secret data") + secret.wipe() + + with pytest.raises(RuntimeError) as excinfo: + secret.get_bytes() + assert str(excinfo.value) == "Secret has been wiped" + + with pytest.raises(RuntimeError) as excinfo: + secret.get_str() + assert str(excinfo.value) == "Secret has been wiped" diff --git a/src/utils/memory_protection.py b/src/utils/memory_protection.py index cc604c1f..1913cb3c 100644 --- a/src/utils/memory_protection.py +++ b/src/utils/memory_protection.py @@ -17,6 +17,8 @@ class InMemorySecret: def get_bytes(self) -> bytes: """Decrypt and return the plaintext bytes.""" + if self._cipher is None: + raise RuntimeError("Secret has been wiped") return self._cipher.decrypt(self._nonce, self._encrypted, None) def wipe(self) -> None: