Merge branch 'security-limit-fscanl-13-8' into '13-15-stable'v13.15.113-15-stable

Read limited input for yes answer

See merge request gitlab-org/security/gitlab-shell!3

4 files changed, 17 insertions, 2 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 2affcdf..7aca58f 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,7 @@
+v13.15.1
+
+- Read limited input when asking to generate new two-factor recovery codes
+
 v13.15.0
 
 - Update httpclient.go with TLS 1.2 as minimum version !435
diff --git a/VERSION b/VERSION
index 04f6473..548118b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-13.15.0
+13.15.1
diff --git a/internal/command/twofactorrecover/twofactorrecover.go b/internal/command/twofactorrecover/twofactorrecover.go
index f0a9e7b..f5a700a 100644
--- a/internal/command/twofactorrecover/twofactorrecover.go
+++ b/internal/command/twofactorrecover/twofactorrecover.go
@@ -3,6 +3,7 @@ package twofactorrecover
 import (
 	"context"
 	"fmt"
+	"io"
 	"strings"
 
 	"gitlab.com/gitlab-org/gitlab-shell/internal/command/commandargs"
@@ -11,6 +12,8 @@ import (
 	"gitlab.com/gitlab-org/gitlab-shell/internal/gitlabnet/twofactorrecover"
 )
 
+const readerLimit = 1024
+
 type Command struct {
 	Config     *config.Config
 	Args       *commandargs.Shell
@@ -34,7 +37,7 @@ func (c *Command) canContinue() bool {
 	fmt.Fprintln(c.ReadWriter.Out, question)
 
 	var answer string
-	fmt.Fscanln(c.ReadWriter.In, &answer)
+	fmt.Fscanln(io.LimitReader(c.ReadWriter.In, readerLimit), &answer)
 
 	return answer == "yes"
 }
diff --git a/internal/command/twofactorrecover/twofactorrecover_test.go b/internal/command/twofactorrecover/twofactorrecover_test.go
index 92e3779..3272061 100644
--- a/internal/command/twofactorrecover/twofactorrecover_test.go
+++ b/internal/command/twofactorrecover/twofactorrecover_test.go
@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"io/ioutil"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -114,6 +115,13 @@ func TestExecute(t *testing.T) {
 			expectedOutput: question +
 				"New recovery codes have *not* been generated. Existing codes will remain valid.\n",
 		},
+		{
+			desc:      "With some other answer",
+			arguments: &commandargs.Shell{},
+			answer:    strings.Repeat("yes, but not really\n", 2048),
+			expectedOutput: question +
+				"New recovery codes have *not* been generated. Existing codes will remain valid.\n",
+		},
 	}
 
 	for _, tc := range testCases {