Limit Passkey name length.

Syfaro · Feb 29, 2024 · 7ce65b0 · 7ce65b0
1 parent 7152e4a
commit 7ce65b0
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/auth.rs b/src/auth.rs
@@ -715,6 +715,10 @@ async fn verify_registration(
         .and_then(|name| name.to_str().ok())
         .ok_or(Error::Missing)?;
 
+    if passkey_name.is_empty() || passkey_name.len() > 128 {
+        return Err(Error::user_error("Passkey name is empty or too long."));
+    }
+
     let reg_state = session
         .remove_as("reg_state")
         .ok_or(Error::Missing)?