Add validation for two factor codes

src/CONST.js

@@ -760,6 +760,7 @@ const CONST = {
  EMOJI_NAME: /:[\w+-]+:/g,
  EMOJI_SUGGESTIONS: /:[a-zA-Z]{1,20}(\s[a-zA-Z]{0,20})?$/,
  AFTER_FIRST_LINE_BREAK: /\n.*/g,
+ CODE_2FA: /^[\w\d+/]+={0,2}$/, // matches twoFactorAuthCode WAF rule
  },
 
  PRONOUNS: {

src/libs/ValidationUtils.js

@@ -274,6 +274,14 @@ function isValidPassword(password) {
  return password.match(CONST.PASSWORD_COMPLEXITY_REGEX_STRING);
 }
 
+/**
+ * @param {String} code
+ * @returns {Boolean}
+ */
+function isValidTwoFactorCode(code) {
+ return Boolean(code.match(CONST.REGEX.CODE_2FA));
+}
+
 /**
  * @param {String} input
  * @returns {Boolean}
@@ -409,6 +417,7 @@ export {
  isValidURL,
  validateIdentity,
  isValidPassword,
+ isValidTwoFactorCode,
  isPositiveInteger,
  isNumericWithSpecialChars,
  isValidPaypalUsername,

src/pages/signin/PasswordForm.js

@@ -114,31 +114,40 @@ class PasswordForm extends React.Component {
  * Check that all the form fields are valid, then trigger the submit callback
  */
  validateAndSubmitForm() {
- if (!this.state.password.trim() && this.props.account.requiresTwoFactorAuth && !this.state.twoFactorAuthCode.trim()) {
+ const password = this.state.password.trim();
+ const twoFactorCode = this.state.twoFactorAuthCode.trim();
+ const requiresTwoFactorAuth = this.props.account.requiresTwoFactorAuth;
+
+ if (!password && requiresTwoFactorAuth && !twoFactorCode) {
  this.setState({formError: 'passwordForm.pleaseFillOutAllFields'});
  return;
  }
 
- if (!this.state.password.trim()) {
+ if (!password) {
  this.setState({formError: 'passwordForm.pleaseFillPassword'});
  return;
  }
 
- if (!ValidationUtils.isValidPassword(this.state.password)) {
+ if (!ValidationUtils.isValidPassword(password)) {
  this.setState({formError: 'passwordForm.error.incorrectPassword'});
  return;
  }
 
- if (this.props.account.requiresTwoFactorAuth && !this.state.twoFactorAuthCode.trim()) {
+ if (requiresTwoFactorAuth && !twoFactorCode) {
  this.setState({formError: 'passwordForm.pleaseFillTwoFactorAuth'});
  return;
  }
 
+ if (requiresTwoFactorAuth && !ValidationUtils.isValidTwoFactorCode(twoFactorCode)) {
+ this.setState({formError: 'passwordForm.error.incorrect2fa'});
+ return;
+ }
+
  this.setState({
  formError: null,
  });
 
- Session.signIn(this.state.password, this.state.twoFactorAuthCode);
+ Session.signIn(password, twoFactorCode);
  }
 
  render() {

tests/unit/ValidationUtilsTest.js

@@ -0,0 +1,21 @@
+const ValidationUtils = require('../../src/libs/ValidationUtils');
+
+describe('ValidationUtils', () => {
+ describe('isValidTwoFactorCode', () => {
+ test('numeric two factor code', () => {
+ expect(ValidationUtils.isValidTwoFactorCode('123456')).toBe(true);
+ });
+
+ test('alphanumeric two factor code', () => {
+ expect(ValidationUtils.isValidTwoFactorCode('abc123')).toBe(true);
+ });
+
+ test('special characters two factor code', () => {
+ expect(ValidationUtils.isValidTwoFactorCode('!@#$%^')).toBe(false);
+ });
+
+ test('partial special characters two factor code', () => {
+ expect(ValidationUtils.isValidTwoFactorCode('abc!@#')).toBe(false);
+ });
+ });
+});