Merge branch 'jens/fix-crash-in-oath-url-parser'

Yubico · Dec 3, 2024 · 786a732 · 786a732
2 parents 5516907 + ef7f26e
commit 786a732
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/YubiKit/YubiKit/Connections/Shared/Sessions/OATH/YKFOATHCredentialTemplate.m b/YubiKit/YubiKit/Connections/Shared/Sessions/OATH/YKFOATHCredentialTemplate.m
@@ -115,6 +115,12 @@ - (instancetype)initWithURL:(NSURL *)url skipValidation:(YKFOATHCredentialTempla
         *error = [YKFOATHCredentialTemplateError ykfErrorWithCode:YKFOATHCredentialTemplateErrorCodeLabel];
         return nil;
     }
+
+    if (urlComponents.path.length < 1) {
+        *error = [YKFOATHCredentialTemplateError ykfErrorWithCode:YKFOATHCredentialTemplateErrorCodeLabel];
+        return nil;
+    }
+
     NSString *name = [urlComponents.path substringFromIndex:1];
     NSString *issuer = [urlComponents queryParameterValueForName:YKFOATHCredentialURLParameterIssuer];
     if ([name containsString:@":"]) {

diff --git a/YubiKit/YubiKitTests/Tests/YKFOATHCredentialTemplateTests.m b/YubiKit/YubiKitTests/Tests/YKFOATHCredentialTemplateTests.m
@@ -371,6 +371,14 @@ - (void)test_WhenValidatorIsRequestedToValidateWithoutSecret_SecretIsNotValidate
     XCTAssertNil(error);
 }
 
+- (void)test_WhenNoPathIsSet_ErrorIsReturned {
+    NSError *error = nil;
+    NSString *url = @"otpauth://totp?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME&algorithm=SHA1&digits=6&period=30";
+    YKFOATHCredentialTemplate *credential = [[YKFOATHCredentialTemplate alloc] initWithURL:[NSURL URLWithString:url] skipValidation:YKFOATHCredentialTemplateValidationLabel error:&error];
+    XCTAssertNotNil(error);
+    XCTAssertNil(credential);
+}
+
 #pragma mark - Large Key Tests
 
 - (void)test_WhenValidatorReceivesInvalidCredentialKey_ErrorIsReturnedBack {