From adbe7b30c5cf56e2446691b3d4dba4a0cdb0de2a Mon Sep 17 00:00:00 2001
From: Igor Drozdov <idrozdov@gitlab.com>
Date: Tue, 8 Dec 2020 13:02:01 +0300
Subject: Read limited input for yes answer

---
 internal/command/twofactorrecover/twofactorrecover.go      | 5 ++++-
 internal/command/twofactorrecover/twofactorrecover_test.go | 8 ++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/internal/command/twofactorrecover/twofactorrecover.go b/internal/command/twofactorrecover/twofactorrecover.go
index f0a9e7b..f5a700a 100644
--- a/internal/command/twofactorrecover/twofactorrecover.go
+++ b/internal/command/twofactorrecover/twofactorrecover.go
@@ -3,6 +3,7 @@ package twofactorrecover
 import (
 	"context"
 	"fmt"
+	"io"
 	"strings"
 
 	"gitlab.com/gitlab-org/gitlab-shell/internal/command/commandargs"
@@ -11,6 +12,8 @@ import (
 	"gitlab.com/gitlab-org/gitlab-shell/internal/gitlabnet/twofactorrecover"
 )
 
+const readerLimit = 1024
+
 type Command struct {
 	Config     *config.Config
 	Args       *commandargs.Shell
@@ -34,7 +37,7 @@ func (c *Command) canContinue() bool {
 	fmt.Fprintln(c.ReadWriter.Out, question)
 
 	var answer string
-	fmt.Fscanln(c.ReadWriter.In, &answer)
+	fmt.Fscanln(io.LimitReader(c.ReadWriter.In, readerLimit), &answer)
 
 	return answer == "yes"
 }
diff --git a/internal/command/twofactorrecover/twofactorrecover_test.go b/internal/command/twofactorrecover/twofactorrecover_test.go
index 92e3779..a53e055 100644
--- a/internal/command/twofactorrecover/twofactorrecover_test.go
+++ b/internal/command/twofactorrecover/twofactorrecover_test.go
@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"io/ioutil"
 	"net/http"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/require"
@@ -114,6 +115,13 @@ func TestExecute(t *testing.T) {
 			expectedOutput: question +
 				"New recovery codes have *not* been generated. Existing codes will remain valid.\n",
 		},
+		{
+			desc:      "With some other answer",
+			arguments: &commandargs.Shell{},
+			answer:    strings.Repeat("yes", 1024),
+			expectedOutput: question +
+				"New recovery codes have *not* been generated. Existing codes will remain valid.\n",
+		},
 	}
 
 	for _, tc := range testCases {
-- 
cgit v1.2.1


From 205e0a87e9fc79ad2e46c92f58079f7fa356c151 Mon Sep 17 00:00:00 2001
From: Nick Thomas <nick@gitlab.com>
Date: Thu, 4 Feb 2021 14:56:48 +0000
Subject: Update CHANGELOG and VERSION

---
 CHANGELOG | 4 ++++
 VERSION   | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 432cc93..fe6d1a0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,7 @@
+v13.16.1
+
+- Read limited input for yes answer
+
 v13.16.0
 
 - RFC: Simple built-in SSH server !394
diff --git a/VERSION b/VERSION
index 3da8501..592a1a8 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-13.16.0
+13.16.1
-- 
cgit v1.2.1