gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362)

@@ -1,6 +1,7 @@
 package model
 
 import (
+	"sync"
 	"time"
 
 	"gorm.io/gorm"
@@ -38,6 +39,58 @@ type Secret2FA struct {
 	Image    string `json:"-"`
 }
 
+// cloneSecret2FA returns a deep copy of a Secret2FA.
+// This prevents external code from mutating the store's data
+// through shared slice backing arrays.
+func cloneSecret2FA(v Secret2FA) Secret2FA {
+	out := Secret2FA{Image: v.Image}
+	if v.PassHash != nil {
+		out.PassHash = append([]byte(nil), v.PassHash...)
+	}
+	if v.KeySalt != nil {
+		out.KeySalt = append([]byte(nil), v.KeySalt...)
+	}
+	if v.Secret != nil {
+		out.Secret = append([]byte(nil), v.Secret...)
+	}
+	return out
+}
+
+// Secret2FAStore provides thread-safe access to in-memory 2FA secrets.
+type Secret2FAStore struct {
+	mu   sync.RWMutex
+	data map[uint64]Secret2FA
+}
+
+// NewSecret2FAStore creates a new Secret2FAStore.
+func NewSecret2FAStore() *Secret2FAStore {
+	return &Secret2FAStore{
+		data: make(map[uint64]Secret2FA),
+	}
+}
+
+// Get retrieves a Secret2FA from the store.
+func (s *Secret2FAStore) Get(key uint64) (Secret2FA, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	v, ok := s.data[key]
+	return cloneSecret2FA(v), ok
+}
+
+// Set stores a Secret2FA in the store.
+func (s *Secret2FAStore) Set(key uint64, value Secret2FA) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.data[key] = cloneSecret2FA(value)
+}
+
+// Delete removes a Secret2FA from the store.
+func (s *Secret2FAStore) Delete(key uint64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.data, key)
+}
+
 // InMemorySecret2FA keeps secrets temporarily
 // in memory to set up 2FA.
-var InMemorySecret2FA = make(map[uint64]Secret2FA)
+var InMemorySecret2FA = NewSecret2FAStore()

@@ -136,7 +136,7 @@ func Login(payload model.AuthPayload) (httpResponse model.HTTPResponse, httpStat
 				// save the hashed pass (key) in memory for OTP validation step
 				data2FA := model.Secret2FA{}
 				data2FA.PassHash = key
-				model.InMemorySecret2FA[claims.AuthID] = data2FA
+				model.InMemorySecret2FA.Set(claims.AuthID, data2FA)
 			}
 		}
 	}

@@ -186,7 +186,7 @@ func Setup2FA(claims middleware.MyCustomClaims, authPayload model.AuthPayload) (
 	key := lib.GetArgon2Key([]byte(authPayload.Password), salt, 32)
 
 	// step 6: check if client secret is available in memory
-	data2FA, ok := model.InMemorySecret2FA[claims.AuthID]
+	data2FA, ok := model.InMemorySecret2FA.Get(claims.AuthID)
 	if ok {
 		// delete old QR image if available
 		if lib.FileExist(configSecurity.TwoFA.PathQR + "/" + data2FA.Image) {
@@ -202,7 +202,7 @@ func Setup2FA(claims middleware.MyCustomClaims, authPayload model.AuthPayload) (
 	data2FA.KeySalt = salt
 	data2FA.Secret = otpByte
 	data2FA.Image = img
-	model.InMemorySecret2FA[claims.AuthID] = data2FA
+	model.InMemorySecret2FA.Set(claims.AuthID, data2FA)
 
 	// serve the QR to the client
 	httpResponse.Message = configSecurity.TwoFA.PathQR + "/" + img
@@ -242,7 +242,7 @@ func Activate2FA(claims middleware.MyCustomClaims, authPayload model.AuthPayload
 	// start 2FA activation procedure
 	//
 	// step 1: check if client secret is available in memory
-	data2FA, ok := model.InMemorySecret2FA[claims.AuthID]
+	data2FA, ok := model.InMemorySecret2FA.Get(claims.AuthID)
 	if !ok {
 		// request user to visit setup endpoint first
 		httpResponse.Message = "request for a new 2-fa secret"
@@ -269,7 +269,7 @@ func Activate2FA(claims middleware.MyCustomClaims, authPayload model.AuthPayload
 		if status == configSecurity.TwoFA.Status.Invalid {
 			// save the secret with failed attempt in memory for future validation procedure
 			data2FA.Secret = otpByte
-			model.InMemorySecret2FA[claims.AuthID] = data2FA
+			model.InMemorySecret2FA.Set(claims.AuthID, data2FA)
 
 			httpResponse.Message = "wrong one-time password"
 			httpStatusCode = http.StatusBadRequest
@@ -488,7 +488,7 @@ func Validate2FA(claims middleware.MyCustomClaims, authPayload model.AuthPayload
 	// start 2FA validation procedure
 	//
 	// step 1: check if client secret is available in memory
-	data2FA, ok := model.InMemorySecret2FA[claims.AuthID]
+	data2FA, ok := model.InMemorySecret2FA.Get(claims.AuthID)
 	if !ok {
 		httpResponse.Message = "log in again"
 		httpStatusCode = http.StatusBadRequest
@@ -572,7 +572,7 @@ func Validate2FA(claims middleware.MyCustomClaims, authPayload model.AuthPayload
 		if status == configSecurity.TwoFA.Status.Invalid {
 			// save the new secret in memory for future validation procedure
 			data2FA.Secret = otpByte
-			model.InMemorySecret2FA[claims.AuthID] = data2FA
+			model.InMemorySecret2FA.Set(claims.AuthID, data2FA)
 
 			// save in DB to protect from accidental data loss
 			//

@@ -76,7 +76,7 @@ func Validate2FA(encryptedMessage []byte, issuer string, userInput string) ([]by
 
 // DelMem2FA deletes 2FA secrets from memory.
 func DelMem2FA(authID uint64) {
-	delete(model.InMemorySecret2FA, authID)
+	model.InMemorySecret2FA.Delete(authID)
 }
 
 // SendEmail sends a verification/password recovery email if