bug: password with `/` breaks logic for OTP
txj-xyz opened this issue · 2 comments
txj-xyz commented
Currently this password will break the login system with OTP
echo "90#DqHz3:PO(&2fx+mH/MS%@kF8/088790" | ./kc-ssh-pam
kc-ssh-pam/internal/auth/auth.go
Lines 180 to 192 in 7bcf822
txj-xyz commented
perhaps, code works, will build on monday for testing etc. need to unit test more edge cases
...
lastIndex := strings.LastIndex(pass, "/")
if lastIndex != -1 {
password = pass[:lastIndex]
otp = pass[lastIndex+1:]
} else {
password = pass
otp = ""
}
....
txj-xyz commented
Eh I'll leave this alone for a proper implementation, but I decided to not use this package due to this flaw