From 45f192de8fef6be18904ce5a59e6a7e29080a745 Mon Sep 17 00:00:00 2001
From: mdecimus <mauro@stalw.art>
Date: Wed, 3 Jul 2024 08:40:13 +0200
Subject: [PATCH] Check TOTP token length

---
 crates/directory/src/core/secret.rs | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/crates/directory/src/core/secret.rs b/crates/directory/src/core/secret.rs
index 09d9c36a..dd12d76a 100644
--- a/crates/directory/src/core/secret.rs
+++ b/crates/directory/src/core/secret.rs
@@ -42,9 +42,12 @@ impl<T: serde::Serialize + serde::de::DeserializeOwned> Principal<T> {
 
                     let totp_token = if let Some(totp_token) = totp_token {
                         totp_token
-                    } else if let Some((_code, _totp_token)) = code
-                        .rsplit_once('$')
-                        .filter(|(c, t)| !c.is_empty() && !t.is_empty())
+                    } else if let Some((_code, _totp_token)) =
+                        code.rsplit_once('$').filter(|(c, t)| {
+                            !c.is_empty()
+                                && (6..=8).contains(&t.len())
+                                && t.as_bytes().iter().all(|b| b.is_ascii_digit())
+                        })
                     {
                         totp_token = Some(_totp_token);
                         code = _code;