@@ -247,7 +247,9 @@ username_password_as_base64(const struct http_proxy_info *p,

     struct buffer out = alloc_buf_gc(strlen(p->up.username) + strlen(p->up.password) + 2, gc);

     ASSERT(strlen(p->up.username) > 0);

     buf_printf(&out, "%s:%s", p->up.username, p->up.password);

-    return (const char *)make_base64_string((const uint8_t *)BSTR(&out), gc);

+    char *ret = (char *)make_base64_string((const uint8_t *)BSTR(&out), gc);

+    secure_memzero(BSTR(&out), out.len);

+    return ret;

 }

 static void

@@ -737,6 +739,9 @@ establish_http_proxy_passthru(struct http_proxy_info *p,

                 ASSERT(0);

         }

+        /* clear any sensitive content in buf */

+        secure_memzero(buf, sizeof(buf));

+

         /* send empty CR, LF */

         if (!send_crlf(sd))

         {

@@ -978,6 +983,8 @@ establish_http_proxy_passthru(struct http_proxy_info *p,

                 {

                     goto error;

                 }

+                /* clear any sensitive content in buf */

+                secure_memzero(buf, sizeof(buf));

                 /* receive reply from proxy */

                 if (!recv_line(sd, buf, sizeof(buf), get_server_poll_remaining_time(server_poll_timeout), true, NULL, signal_received))

@@ -1081,10 +1088,12 @@ establish_http_proxy_passthru(struct http_proxy_info *p,

 #endif

 done:

+    purge_user_pass(&p->up, true);

     gc_free(&gc);

     return ret;

 error:

+    purge_user_pass(&p->up, true);

     register_signal(sig_info, SIGUSR1, "HTTP proxy error"); /* SOFT-SIGUSR1 -- HTTP proxy error */

     gc_free(&gc);

     return ret;