VivoKey/otp-import
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Validate cell characters and digit/period sanity

Browse Source 
Halt import on control characters or a ':'/'/' inside an issuer or
account (they collide with the OATH issuer:account separator and period/
prefix), on a composed name over 64 bytes with a clearer per-field
message, and on a digit count outside 6-8 or a non-positive period.
This commit is contained in:
Amal Graafstra
2026-07-08 13:49:48 -07:00
parent 88a600ba66
commit cd705a446b
4 changed files with 73 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@@ -58,9 +58,11 @@ Authenticating to a password-protected applet uses the standard YKOATH scheme
challenge-response). `--set-password` only sets a password on an applet that has
none; it does not change or remove an existing one. `--reset` clears everything.
The input is validated before any reader is touched. Duplicate credential names,
invalid Base32, over-long names/keys, and unsupported algorithms halt the run
with a report so they can be fixed in the source data.
The input is validated before any reader is touched. The run halts with a
per-row report if it finds: duplicate credential names; invalid Base32;
over-long names or keys; an unsupported algorithm; control characters or a
`:`/`/` inside an issuer or account (they break the OATH name convention); or a
digit count outside 6-8 / a non-positive period. Fix the source data and re-run.
## Tests