search

simbaja / ha_gehome

GE Home Appliances (SmartHQ) for Home Assistant
MIT License
322 stars 75 forks source link

Broken Authentication with symbols in passwords #134

Open NickStallman opened 1 year ago

NickStallman commented 1 year ago

I've just tried adding ha_gehome and it added just fine with the username and password, however no devices showed up and nothing appeared in logs.

Doing some further digging, I tried logging in with the gehome-appliance-data app and it also failed with output like this:

2023-01-07 10:32:16,102 DEBUG    Using selector: EpollSelector
2023-01-07 10:32:16,102 DEBUG    Getting OAuth2 token
2023-01-07 10:32:16,104 DEBUG    Client changed state: GeClientState.INITIALIZING to GeClientState.AUTHORIZING_OAUTH
2023-01-07 10:32:17,992 ERROR    There was a problem getting the authorization code, response details: {'method': 'POST', 'cookies': <SimpleCookie: abgea_region='eu-west-1'>, '_real_url': URL('https://accounts.brillion.geappliances.com/oauth2/g_authenticate'), '_url': URL('https://accounts.brillion.geappliances.com/oauth2/g_authenticate'), '_body': b'\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n<!DOCTYPE html>\n<html>\n<head>\n<title> OAuth Login</title>

The full HTML login page is shown.

After some further poking around it seems it's because I used a Google generated password containing a $. The password was being truncated at the $. Another attempt included a ! and it seems it might have gotten double escaped and also didn't work.

So it seems there are a few issues here:

  1. Passwords with special characters are getting mangled.
  2. It seems the error handling isn't catching it for some reason. An incorrect password is being handled as an incorrect password perfeclty, but a mangled password throws no error in Home Assistant and appears to work.
  3. I'm not sure why the Home Assistant logs are entirely empty when this is occurring. It made it rather confusing to know what was going on.
caliKev commented 1 year ago

I’ve been having the same issue with an ! Password.

never mind latest dev seems to fix everything.

samuelfurman commented 1 year ago

I am having the exact same issue as you. Using the latest version.

simbaja commented 1 year ago

If you go to the actual login page, does it work for you with the special characters? I don't see anything in the code where it's mangling it, but perhaps it's in there somewhere.

NickStallman commented 1 year ago

Yep @simbaja the real login page works fine with special characters.

Doing my poke around in the code, it looked like Python was interpreting the string at some stage which changed the password's value. I didn't identify where it got interpreted, just that what was sent to the server did not match what was entered in to the UI. The $ causes the password to truncate at that point - "abc$def" would be sent as "abc") and ! got escaped so "abc!def" got sent as "abc\!def".

simbaja commented 1 year ago

Can you check the gehomesdk and run the included app? If it works there, it's something that perhaps home assistant is doing. If it doesn't then it's being mangled in there somewhere.

NickStallman commented 1 year ago

Looks like the issue is in gehomesdk too.

Modifying async_login_flows.py async_get_authorization_code

    logging.debug("datastructure: %r", post_data)

With this test sample login:

gehome-appliance-data -u test@test.com -p "a$bc\!de"

Results in:

2023-01-23 12:43:58,570 DEBUG    datastructure: {'signature': 'vVLoPdzS24__snipped out___', 'username': 'test@test.com', '_csrf': '943f0795-d62e-4772-b3a0-a4f8164e5d9f', 'password': 'a\\!de'}

So the password being sent isn't correct from the command line. This can be verified without logging in to a real account.

simbaja commented 1 year ago

Ok, let me see if I can figure out where it's getting mangled, I don't see anything obvious, it's probably doing something in the background that I'm not aware of.

finalsabbath commented 1 year ago

Confirmed same with * and - in password. Changed password to same length but no special characters and it worked fine

simbaja commented 1 year ago

@NickStallman, sorry for the delay. Still not sure why HA isn't showing any devices, but at least figured out why your command line isn't working... there's a difference between single and double quotes (no idea why) try:

gehome-appliance-data -u 'test@test.com' -p 'a$bc\!de'

I noticed in VS.Code it actually turns different colors depending on the quotes used.

If that fixes your issue, can you try turning on debug logging in Home Assistant and see if anything pops up? And you were using the latest dev version, correct?

sanghviharshit commented 1 year ago

I think I had the same issue, changing the password without * fixed login.

NickStallman commented 4 months ago

I actually got my account booted out, and can't log in to the web interface at all no matter what. No error, just gives me the login screen again.

The app still works, but https://geapp.my.site.com/smarthq/s/login/ appears quite unusable.

NickStallman commented 4 months ago

I just tried again to re-authenticate and it seems to be working now. The web interface still seems dead to me.

My password uses some safer symbols like * and ^ which aren't part of escape sequences and should work fine.