fix: handle invalid character error in Generate HOTP (issue #2445)

src/core/operations/GenerateHOTP.mjs

@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import * as OTPAuth from "otpauth";
 
 /**
@@ -46,6 +47,7 @@ class GenerateHOTP extends Operation {
      *
      */
     run(input, args) {
+        try {
             const secretStr = new TextDecoder("utf-8").decode(input).trim();
             const secret = secretStr ? secretStr.toUpperCase().replace(/\s+/g, "") : "";
 
@@ -62,6 +64,12 @@ class GenerateHOTP extends Operation {
             const code = hotp.generate();
 
             return `URI: ${uri}\n\nPassword: ${code}`;
+        } catch (err) {
+            if (err instanceof TypeError) {
+                throw new OperationError("Invalid character found in input. HOTP secrets must be valid Base32 characters (A-Z, 2-7).");
+            }
+            throw err;
+        }
     }
 }