exlim/cyberchef
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix/2445 HOTP (and TOTP) type error

Browse Source
This commit is contained in:
Allan Leary 2026-07-01 07:51:22 +01:00
parent eccaf723f5
commit 7726c3aa7d
3 changed files with 45 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/core/operations/GenerateHOTP.mjs
View File

@ -5,6 +5,7 @@
*/
import Operation from "../Operation.mjs";
import OperationError from "../errors/OperationError.mjs";
import * as OTPAuth from "otpauth";
/**
@ -19,7 +20,7 @@ class GenerateHOTP extends Operation {
this.name = "Generate HOTP";
this.module = "Default";
this.description = "The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated.";
this.description = "The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7).";
this.infoURL = "https://wikipedia.org/wiki/HMAC-based_One-time_Password_algorithm";
this.inputType = "ArrayBuffer";
this.outputType = "string";
@ -53,9 +54,15 @@ class GenerateHOTP extends Operation {
*/
run(input, args) {
const secretStr = new TextDecoder("utf-8").decode(input).trim();
const secret = secretStr ?
OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) :
new OTPAuth.Secret();
let secret;
try {
secret = secretStr ?
OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) :
new OTPAuth.Secret();
} catch {
throw new OperationError("Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).");
}
const hotp = new OTPAuth.HOTP({
issuer: "",

15
src/core/operations/GenerateTOTP.mjs
View File

@ -5,6 +5,7 @@
*/
import Operation from "../Operation.mjs";
import OperationError from "../errors/OperationError.mjs";
import * as OTPAuth from "otpauth";
/**
@ -18,7 +19,7 @@ class GenerateTOTP extends Operation {
super();
this.name = "Generate TOTP";
this.module = "Default";
this.description = "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. T0 and T1 are in seconds.";
this.description = "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7). T0 and T1 are in seconds.";
this.infoURL = "https://wikipedia.org/wiki/Time-based_One-time_Password_algorithm";
this.inputType = "ArrayBuffer";
this.outputType = "string";
@ -59,7 +60,15 @@ class GenerateTOTP extends Operation {
*/
run(input, args) {
const secretStr = new TextDecoder("utf-8").decode(input).trim();
const secret = secretStr ? secretStr.toUpperCase().replace(/\s+/g, "") : "";
let secret;
try {
secret = secretStr ?
OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) :
new OTPAuth.Secret();
} catch {
throw new OperationError("Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).");
}
const totp = new OTPAuth.TOTP({
issuer: "",
@ -68,7 +77,7 @@ class GenerateTOTP extends Operation {
digits: args[1],
period: args[3],
epoch: args[2] * 1000, // Convert seconds to milliseconds
secret: OTPAuth.Secret.fromBase32(secret)
secret
});
const uri = totp.toString();

22
tests/operations/tests/OTP.mjs
View File

@ -163,4 +163,26 @@ TestRegister.addTests([
},
],
},
{
name: "Generate HOTP - invalid base32 secret rejected",
input: "not,valid|base32;input",
expectedOutput: "Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).",
recipeConfig: [
{
op: "Generate HOTP",
args: ["Account", 6, 0],
},
],
},
{
name: "Generate TOTP - invalid base32 secret rejected",
input: "not,valid|base32;input",
expectedOutput: "Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).",
recipeConfig: [
{
op: "Generate TOTP",
args: ["Account", 6, 0, 30],
},
],
},
]);