fix/2445 HOTP (and 2426 TOTP) type errors (#2620)

src/core/operations/GenerateHOTP.mjs

@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import * as OTPAuth from "otpauth";
 
 /**
@@ -19,7 +20,7 @@ class GenerateHOTP extends Operation {
 
         this.name = "Generate HOTP";
         this.module = "Default";
-        this.description = "The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated.";
+        this.description = "The HMAC-based One-Time Password algorithm (HOTP) is an algorithm that computes a one-time password from a shared secret key and an incrementing counter. It has been adopted as Internet Engineering Task Force standard RFC 4226, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7).";
         this.infoURL = "https://wikipedia.org/wiki/HMAC-based_One-time_Password_algorithm";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";
@@ -53,9 +54,15 @@ class GenerateHOTP extends Operation {
      */
     run(input, args) {
         const secretStr = new TextDecoder("utf-8").decode(input).trim();
-        const secret = secretStr ?
+
+        let secret;
+        try {
+            secret = secretStr ?
                 OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) :
                 new OTPAuth.Secret();
+        } catch {
+            throw new OperationError("Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).");
+        }
 
         const hotp = new OTPAuth.HOTP({
             issuer: "",

src/core/operations/GenerateTOTP.mjs

@@ -5,6 +5,7 @@
  */
 
 import Operation from "../Operation.mjs";
+import OperationError from "../errors/OperationError.mjs";
 import * as OTPAuth from "otpauth";
 
 /**
@@ -18,7 +19,7 @@ class GenerateTOTP extends Operation {
         super();
         this.name = "Generate TOTP";
         this.module = "Default";
-        this.description = "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. T0 and T1 are in seconds.";
+        this.description = "The Time-based One-Time Password algorithm (TOTP) is an algorithm that computes a one-time password from a shared secret key and the current time. It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OAUTH), and is used in a number of two-factor authentication systems. A TOTP is an HOTP where the counter is the current time.<br><br>Enter the secret as the input or leave it blank for a random secret to be generated. The secret must be a valid base32 string (characters A–Z and 2–7). T0 and T1 are in seconds.";
         this.infoURL = "https://wikipedia.org/wiki/Time-based_One-time_Password_algorithm";
         this.inputType = "ArrayBuffer";
         this.outputType = "string";
@@ -59,7 +60,15 @@ class GenerateTOTP extends Operation {
      */
     run(input, args) {
         const secretStr = new TextDecoder("utf-8").decode(input).trim();
-        const secret = secretStr ? secretStr.toUpperCase().replace(/\s+/g, "") : "";
+
+        let secret;
+        try {
+            secret = secretStr ?
+                OTPAuth.Secret.fromBase32(secretStr.toUpperCase().replace(/\s+/g, "")) :
+                new OTPAuth.Secret();
+        } catch {
+            throw new OperationError("Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).");
+        }
 
         const totp = new OTPAuth.TOTP({
             issuer: "",
@@ -68,7 +77,7 @@ class GenerateTOTP extends Operation {
             digits: args[1],
             period: args[3],
             epoch: args[2] * 1000, // Convert seconds to milliseconds
-            secret: OTPAuth.Secret.fromBase32(secret)
+            secret
         });
 
         const uri = totp.toString();

tests/operations/tests/OTP.mjs

@@ -163,4 +163,26 @@ TestRegister.addTests([
             },
         ],
     },
+    {
+        name: "Generate HOTP - invalid base32 secret rejected",
+        input: "not,valid|base32;input",
+        expectedOutput: "Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).",
+        recipeConfig: [
+            {
+                op: "Generate HOTP",
+                args: ["Account", 6, 0],
+            },
+        ],
+    },
+    {
+        name: "Generate TOTP - invalid base32 secret rejected",
+        input: "not,valid|base32;input",
+        expectedOutput: "Invalid secret. The input must be a valid base32 string (characters A–Z and 2–7).",
+        recipeConfig: [
+            {
+                op: "Generate TOTP",
+                args: ["Account", 6, 0, 30],
+            },
+        ],
+    },
 ]);