otp: add validation of URL-encoded strings in OTP context
What the developer wrote
Authored by Mike Tolkachev
otp: add validation of URL-encoded strings in OTP context
What changed, and why it matters
This commit adds input validation to make sure the text shown in the OTP (one-time password) setup screen is properly URL-encoded and printable. It is likely a hardening fix to prevent malformed or sneaky label/issuer strings from confusing the user or causing unexpected behavior on the hardware wallet's screen, but the commit message does not call it a security fix.
Review the implementation of is_valid_urlencoding() in related commits to confirm it correctly rejects over-long, malformed, or non-printable URL-encoded sequences. Treat this as a defense-in-depth hardening change unless further evidence shows it fixes an exploitable bug.
Security signals we found
Input validation added to URL-encoded OTP fields (label/issuer)
Length limit constant OTP_MAX_LABEL_LEN introduced
Display buffer sized by named constant instead of magic number
No explicit security claim or CVE in commit message
Evidence from the diff
The change introduces a new OTP_MAX_LABEL_LEN constant and calls is_valid_urlencoding() on the otp_ctx->label and otp_ctx->issuer fields inside otp_is_valid(). The validation enforces that these URL-encoded strings decode to printable characters and fit within length limits. A display buffer is also switched from a hardcoded 128 bytes to OTP_MAX_LABEL_LEN. The commit does not show the implementation of is_valid_urlencoding(), so we cannot fully assess the completeness or correctness of the validation. No CVE, advisory, or researcher attribution is present in the supplied materials.
Changed components
main/otpauth.cmain/otpauth.hmain/ui/otpauth.cInspect captured patch +9 / −1
### main/otpauth.c
@@ -15,6 +15,7 @@
#include <mbedtls/md.h>
#include <pb_decode.h>
+#include <ctype.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
@@ -56,7 +57,13 @@ bool otp_is_valid(const otpauth_ctx_t* otp_ctx)
// Optional fields
OTP_CHECK_BOOL_RETURN(!otp_ctx->label_len || otp_ctx->label);
+ if (otp_ctx->label_len) {
+ OTP_CHECK_BOOL_RETURN(is_valid_urlencoding(otp_ctx->label, otp_ctx->label_len, OTP_MAX_LABEL_LEN, isprint));
+ }
OTP_CHECK_BOOL_RETURN(!otp_ctx->issuer_len || otp_ctx->issuer);
+ if (otp_ctx->issuer_len) {
+ OTP_CHECK_BOOL_RETURN(is_valid_urlencoding(otp_ctx->issuer, otp_ctx->issuer_len, OTP_MAX_NAME_LEN, isprint));
+ }
return true;
}
### main/otpauth.h
@@ -10,6 +10,7 @@
#define OTP_MAX_NAME_LEN 16
#define OTP_MAX_URI_LEN 256
#define OTP_MAX_TOKEN_LEN 12
+#define OTP_MAX_LABEL_LEN 128
#define OTP_MAX_RECORDS 16
### main/ui/otpauth.c
@@ -30,7 +30,7 @@ static gui_activity_t* make_otp_details_activities(const otpauth_ctx_t* ctx, con
const char* const title = initial_confirmation ? "Confirm OTP" : "OTP Details";
const bool show_help_btn = false;
- char display_str[128];
+ char display_str[OTP_MAX_LABEL_LEN];
// First row, name
gui_view_node_t* splitname;Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.