fix(format/common): validate TOTP secret ahead of time

Fixes #2949

1 files changed, 8 insertions, 0 deletions

diff --git a/format/common/src/test/kotlin/app/passwordstore/data/passfile/PasswordEntryTest.kt b/format/common/src/test/kotlin/app/passwordstore/data/passfile/PasswordEntryTest.kt
index 865a13c1..95fb3e62 100644
--- a/format/common/src/test/kotlin/app/passwordstore/data/passfile/PasswordEntryTest.kt
+++ b/format/common/src/test/kotlin/app/passwordstore/data/passfile/PasswordEntryTest.kt
@@ -13,6 +13,7 @@ import app.passwordstore.util.totp.UriTotpFinder
 import java.util.Locale
 import kotlin.test.Test
 import kotlin.test.assertEquals
+import kotlin.test.assertFalse
 import kotlin.test.assertNotNull
 import kotlin.test.assertNull
 import kotlin.test.assertTrue
@@ -181,6 +182,13 @@ class PasswordEntryTest {
     }
   }
 
+  // https://github.com/android-password-store/Android-Password-Store/issues/2949
+  @Test
+  fun disablesTotpForInvalidUri() = runTest {
+    val entry = makeEntry("password\notpauth://totp/otp-secret?secret=")
+    assertFalse(entry.hasTotp())
+  }
+
   @Test
   fun onlyLooksForUriInFirstLine() {
     val entry = makeEntry("id:\n$TOTP_URI")