kha7iq/kc-ssh-pam

bug: password with `/` breaks logic for OTP

txj-xyz opened this issue · 2 comments

Currently this password will break the login system with OTP

echo "90#DqHz3:PO(&2fx+mH/MS%@kF8/088790" | ./kc-ssh-pam

if stdinScanner.Scan() {
pass := strings.Trim(stdinScanner.Text(), "\x00")
// Extract the password and OTP from the input string
if strings.Contains(pass, "/") {
creds := strings.Split(pass, "/")
password = creds[0]
otp = creds[1]
} else {
password = pass
otp = ""
}
}

perhaps, code works, will build on monday for testing etc. need to unit test more edge cases

...
lastIndex := strings.LastIndex(pass, "/")
if lastIndex != -1 {
	password = pass[:lastIndex]
	otp = pass[lastIndex+1:]
} else {
	password = pass
	otp = ""
}
....

Eh I'll leave this alone for a proper implementation, but I decided to not use this package due to this flaw