From 58aa9eabf07c15e188a016c6bde5d8fa5c5414fc Mon Sep 17 00:00:00 2001
From: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
Date: Tue, 13 Oct 2026 15:07:09 +0200
Subject: [PATCH] fix(pass): return a copy from PassValue.Marshal

Store backends zero the bytes Marshal returns once they have written them. PassValue returned its own backing buffer, so saving a PassValue wiped the caller's secret.

Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>
---
 plugins/pass/store/store.go      |  2 +-
 plugins/pass/store/store_test.go | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/plugins/pass/store/store.go b/plugins/pass/store/store.go
index fc79fa75..2726ef0a 100644
--- a/plugins/pass/store/store.go
+++ b/plugins/pass/store/store.go
@@ -33,7 +33,7 @@ func NewPassValue(value []byte) *PassValue {
 }
 
 func (m *PassValue) Marshal() ([]byte, error) {
-	return m.value, nil
+	return append([]byte(nil), m.value...), nil
 }
 
 func (m *PassValue) Unmarshal(data []byte) error {
diff --git a/plugins/pass/store/store_test.go b/plugins/pass/store/store_test.go
index 4c53c217..60e3e9fd 100644
--- a/plugins/pass/store/store_test.go
+++ b/plugins/pass/store/store_test.go
@@ -34,3 +34,15 @@ func TestPassValueUnmarshalCopies(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, []byte("hunter2"), out)
 }
+
+func TestPassValueMarshalCopies(t *testing.T) {
+	pv := NewPassValue([]byte("hunter2"))
+
+	out, err := pv.Marshal()
+	require.NoError(t, err)
+	clear(out)
+
+	again, err := pv.Marshal()
+	require.NoError(t, err)
+	assert.Equal(t, []byte("hunter2"), again)
+}