Merge pull request #1067 from jagerman/secure-auth-construction

Fix sensitive data leaking in Authentication

cpr/auth.cpp

@@ -1,7 +1,17 @@
 #include "cpr/auth.h"
 #include "cpr/util.h"
 
+#include <string_view>
+
 namespace cpr {
+
+Authentication::Authentication(std::string_view username, std::string_view password, AuthMode auth_mode) : auth_mode_{auth_mode} {
+    auth_string_.reserve(username.size() + 1 + password.size());
+    auth_string_ += username;
+    auth_string_ += ':';
+    auth_string_ += password;
+}
+
 Authentication::~Authentication() noexcept {
     util::secureStringClear(auth_string_);
 }

include/cpr/auth.h

@@ -2,21 +2,18 @@
 #define CPR_AUTH_H
 
 #include <string>
-
-#include <utility>
+#include <string_view>
 
 namespace cpr {
 
 enum class AuthMode { BASIC, DIGEST, NTLM, NEGOTIATE };
 
 class Authentication {
   public:
-    Authentication(std::string username, std::string password, AuthMode auth_mode) : auth_string_{std::move(username) + ":" + std::move(password)}, auth_mode_{std::move(auth_mode)} {}
+    Authentication(std::string_view username, std::string_view password, AuthMode auth_mode);
     Authentication(const Authentication& other) = default;
-    Authentication(Authentication&& old) noexcept = default;
     ~Authentication() noexcept;
 
-    Authentication& operator=(Authentication&& old) noexcept = default;
     Authentication& operator=(const Authentication& other) = default;
 
     const char* GetAuthString() const noexcept;