security: implement credential masking via XOR to protect sensitive user data in RAM.

src/lib/auth.js

@@ -1,4 +1,5 @@
 import config from "./config";
+import { maskCredential, unmaskCredential } from "../security/security";
 
 /**
  * @typedef {object} User
@@ -43,6 +44,52 @@ const loginEvents = {
 	},
 };
 
+/** 
+ * Clones the user object structure and masks sensitive string properties
+ * to protect them in memory.
+ */
+function secureUserObject(user) {
+	if (!user) return null;
+
+	const secured = { ...user }; 
+
+	// Array with String Properties of Object
+    const textProperties = [
+		"name", "role", "email", "github", "website",
+		"avatar_url", "pro_purchased_at", "created_at", "updated_at"
+	];
+
+	// Apply the Mask
+	textProperties.forEach(prop => {
+		if (typeof secured[prop] === "string") {
+			secured[prop] = maskCredential(secured[prop]);
+		}
+	});
+
+	return secured;
+}
+
+/** Function to unmask the user object properties
+ * so the interface can read them safely without crashing.
+ */
+export function getDecryptedUser(user) {
+	if (!user) return null;
+	const decrypted = { ...user };
+
+	const textProperties = [
+		"name", "role", "email", "github", "website",
+		"avatar_url", "pro_purchased_at", "created_at", "updated_at"
+	];
+
+	textProperties.forEach(prop => {
+		if (Array.isArray(decrypted[prop])) {
+			decrypted[prop] = unmaskCredential(decrypted[prop]);
+		}
+	});
+
+	return decrypted;
+}
+
 class AuthService {
 	#loginCallbacks = new Set();
 	#loginTimeout = null;
@@ -105,17 +152,18 @@ class AuthService {
 	 * @returns {Promise<User>}
 	 */
 	async getLoggedInUser(forceFetch = false) {
-		if (loggedInUser && !forceFetch) return loggedInUser;
+		if (loggedInUser && !forceFetch) return getDecryptedUser(loggedInUser);
 
 		try {
 			const res = await fetch(`${config.API_BASE}/login`);
 
 			if (res.ok) {
-				loggedInUser = await res.json();
-				localStorage.setItem(CACHE_USER_KEY, JSON.stringify(loggedInUser));
-				clearTimeout(cacheTimeout);
-				cacheTimeout = setTimeout(() => (loggedInUser = null), 600_000);
-				return loggedInUser;
+		       const rawuser = await res.json();
+			   loggedInUser = secureUserObject(rawuser);
+			   localStorage.setItem(CACHE_USER_KEY, JSON.stringify(loggedInUser));
+			   clearTimeout(cacheTimeout);
+			   cacheTimeout = setTimeout(() => (loggedInUser = null), 600_000);
+			   return getDecryptedUser(loggedInUser);
 			}
 
 			if (res.status === 401) {

src/security/security.js

@@ -0,0 +1,30 @@
+/**
+ * Copyright (C) dev12124 (dev brazilian, João Guilherme da Silva Freitas Lima), 
+ * License: MIT license.
+ */
+
+/** 
+ * Mask key used to obfuscate sensitive Acode credentials.
+ * In JavaScript, plain text variables (e.g., let key = "secret password") 
+ * reside in the RAM unprotected, making them vulnerable to access or modification 
+ * by malicious installed plugins.
+ */
+const MASK_KEY = 0x5A;
+
+// Applies a XOR mask to secure sensitive strings
+export function maskCredential(secretString) {
+    if (!secretString) return [];
+
+    // Transforms the string into a masked array of bytes (numbers)
+    return Array.from(secretString).map(char => char.charCodeAt(0) ^ MASK_KEY);
+}
+
+// Removes the XOR mask to restore the original string
+export function unmaskCredential(maskedArray) {
+    if (!Array.isArray(maskedArray)) return " ";
+
+    // Removes the mask
+    return maskedArray
+        .map(byte => String.fromCharCode(byte ^ MASK_KEY))
+        .join("");
+}