search

freedomofpress / securedrop

GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!
https://securedrop.org/
Other
3.62k stars 686 forks source link

Remove "Odd-length string" validation for HOTP secrets #5385

Open eloquence opened 4 years ago

eloquence commented 4 years ago

We currently validate that HOTP secrets are 40 characters long, and we also check against "odd length", here: https://github.com/freedomofpress/securedrop/blob/develop/securedrop/journalist_app/utils.py#L137

As far as I can tell, this is the result of an earlier validation codepath added in 4a550304e935d60905002c9c81a92d17100897e9 rendered inaccessible by validation code added in 236f2b72b7aa675149e4b956ebd0db9190f03f80.

This string needs to be translated and maintained, it's also very confusing; if we can avoid this validation step by simply enforcing the required string length (as we appear to already be doing), we should remove it.

prateekj117 commented 4 years ago

@eloquence Will have a look into it.