fix(security): implement P1 loopback session token, P2 AAD filename binding, and P4 memory zeroization

src/carrier.rs

@@ -19,7 +19,7 @@ use rand::rngs::OsRng;
 use rand::RngCore;
 use serde::{Deserialize, Serialize};
 use tracing::error;
-use zeroize::Zeroizing;
+use zeroize::{Zeroize, Zeroizing};
 
 use crate::crypto::{decrypt_chunk, encrypt_chunk, CHUNK_SIZE};
 use crate::storage::Database;
@@ -825,6 +825,9 @@ impl CarrierFile {
         }
 
         self.flush_cached_block()?;
+        if let Some((_, ref mut data, _)) = self.cached_block {
+            data.zeroize();
+        }
 
         let data = if block_idx_in_file < self.blocks.len() {
             let carrier_block_idx = self.blocks[block_idx_in_file];
@@ -999,6 +1002,9 @@ impl Drop for CarrierFile {
         if let Err(e) = self.flush_cached_block() {
             tracing::warn!("Fehler beim automatischen Flush im CarrierFile::drop: {:?}", e);
         }
+        if let Some((_, ref mut data, _)) = self.cached_block {
+            data.zeroize();
+        }
         let now = SystemTime::now()
             .duration_since(UNIX_EPOCH)
             .map(|d| d.as_secs())