Trivial pincodes are now forbidden

CHANGELOG.md

@@ -23,11 +23,12 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Changed
 
-- Updated hap-nodejs [0.11.1 to 0.12.2](https://github.com/homebridge/HAP-NodeJS/blob/latest/CHANGELOG.md) (features
+- Updated hap-nodejs [0.11.1 to 0.12.3](https://github.com/homebridge/HAP-NodeJS/blob/latest/CHANGELOG.md) (features
  and bug fixes)
 - Dependencies upgrade
-- Node `10`, `12` and `16` no longer supported
+- Node `10`, `12` and `16` no longer supported, use Node 20! Or at least 18
 - Updated GitHub Actions
+- Some trivial PinCodes are no longer allowed
 
 ## [1.6.1] - 2024-02-19
 

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019 Node-RED Contribution - HomeKit Bridged
+Copyright (c) 2024 Node-RED Contribution - HomeKit Bridged
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

SECURITY.md

@@ -11,10 +11,10 @@ If vulnerability is a serious risk then please consider contacting us directly a
 
 ## Supported Versions
 
-| Version | Supported |
-| ------- | ------------------ |
-| > = 1.2.0  | :white_check_mark: |
-| < 1.2.0 | :x: limited  |
+| Version  | Supported |
+|----------|--------------------|
+| >= 1.x.y | :white_check_mark: |
+| < 1.x.y | :x: limited |
 
 ## Reporting a Vulnerability
 
@@ -35,8 +35,10 @@ To use node-red safely you should secure it properly with encryption and passwor
 
 ### Invalid Setup Codes
 
-The following Setup Codes must not be used due to their trivial, insecure nature. In future release (possibly 1.X.Y)
-they will be forbidden programmatically.
+Since 1.3 random Setup Code will be generated for new Host (Bridge or Standalone Accessory) nodes (instead of default 1111-1111)
+
+The following Setup Codes must not be used due to their trivial, insecure nature. 
+Since 1.7.0 they are forbidden programmatically.
 
 - 0000-0000
 - 1111-1111
@@ -51,4 +53,3 @@ they will be forbidden programmatically.
 - 1234-5678
 - 8765-4321
 
-Since 1.3 random Setup Code will be generated for new Bridge nodes (instead of default 1111-1111)

build/nodes/bridge.html

@@ -95,7 +95,7 @@
 
 <script data-help-name="homekit-bridge" type="text/x-red">
  <h3 id="toc_4">Bridge</h3>
- <p>The Bridge node is a configuration node, specifying the <em>bridge</em> that iOS sees, i.e. the device that is manually being added by the user. All accessories behind a bridge noded are then automatically added by iOS.
+ <p>The Bridge node is a configuration node, specifying the <em>bridge</em> that iOS sees, i.e. the device that is manually being added by the user. All accessories behind a bridge node are then automatically added by iOS.
  </p>
  <ul>
  <li><strong>Pin Code</strong>: Specify the Pin for the pairing process.</li>
@@ -107,7 +107,7 @@ <h3 id="toc_4">Bridge</h3>
  <li><strong>Hardware Revision</strong>: Should be a version number string in the form of <em>MAJOR.MINOR.REVISION</em> e.g. <em>1.2.0</em>. Other types of strings are ignored and won't be displayed.</li>
  <li><strong>Software Revision</strong>: Should be a version number string in the form of <em>MAJOR.MINOR.REVISION</em> e.g. <em>1.2.0</em>. Other types of strings are ignored and won't be displayed.</li>
  <li><strong>Name</strong>: If you intend to simulate a rocket, then why don&#39;t you call it <em>Rocket</em>. Name should be maximum 64 chars long and not contain <pre>.</pre></li>
- <li><strong>Allow Message Passthrough</strong>: If you allow then message from node input will be send to node output.</li>
+ <li><strong>Allow Message Passthrough</strong>: If you allow then message from node input will be sent to node output.</li>
  <li><strong>Custom MDNS Configuration</strong>: Check if you would like to use custom mdns configuration.</li>
  <ul>
  <li><strong>Multicast</strong>: Use udp multicasting. Optional. Default true.</li>
@@ -137,7 +137,7 @@ <h3 id="toc_4">Bridge</h3>
  },
  pinCode: {
  required: true,
- validate: pinCodeRegex,
+ validate: validatePinCode,
  },
  port: {
  required: false,
@@ -229,7 +229,7 @@ <h3 id="toc_4">Bridge</h3>
  return this.bridgeName ? 'node_label_italic' : ''
  },
  oneditprepare: function () {
- if (!pinCodeRegex(this.pinCode)) {
+ if (!validatePinCode(this.pinCode)) {
  this.pinCode = generatePinCode()
  $("#node-config-input-pinCode").val(this.pinCode)
  }

build/nodes/nrchkb.html

@@ -414,12 +414,38 @@
  return Math.floor(Math.random() * (max - min + 1) + min);
  }
 
+ const forbiddenPinCodes = [
+ '00000000',
+ '11111111',
+ '22222222',
+ '33333333',
+ '44444444',
+ '55555555',
+ '66666666',
+ '77777777',
+ '88888888',
+ '99999999',
+ '12345678',
+ '87654321'
+ ]
+
  const generatePinCode = function () {
  const [a, b, c, d, e, f, g, h] = Array.from({length: 9}, () => getRandomIntInclusive(0, 9));
+
+ if (forbiddenPinCodes.includes(`${a}${b}${c}${d}${e}${f}${g}${h}`)) {
+ return generatePinCode()
+ }
+
  return `${a}${b}${c}${d}-${e}${f}${g}${h}`
  }
 
- const pinCodeRegex = RED.validators.regex(/([0-9]{3}-[0-9]{2}-[0-9]{3}|[0-9]{4}-[0-9]{4})/)
+ const validatePinCode = function (value) {
+ if (!RED.validators.regex(/([0-9]{3}-[0-9]{2}-[0-9]{3}|[0-9]{4}-[0-9]{4})/)) {
+ return false
+ }
+
+ return !forbiddenPinCodes.includes(value.replaceAll("-", ""));
+ }
 </script>
 
 <script data-template-name="nrchkb" type="text/x-red">

build/nodes/standalone.html

@@ -114,7 +114,7 @@ <h3 id="toc_4">Bridge</h3>
  <li><strong>Hardware Revision</strong>: Should be a version number string in the form of <em>MAJOR.MINOR.REVISION</em> e.g. <em>1.2.0</em>. Other types of strings are ignored and won't be displayed.</li>
  <li><strong>Software Revision</strong>: Should be a version number string in the form of <em>MAJOR.MINOR.REVISION</em> e.g. <em>1.2.0</em>. Other types of strings are ignored and won't be displayed.</li>
  <li><strong>Name</strong>: If you intend to simulate a rocket, then why don&#39;t you call it <em>Rocket</em>. Name should be maximum 64 chars long and not contain <pre>.</pre></li>
- <li><strong>Allow Message Passthrough</strong>: If you allow then message from node input will be send to node output.</li>
+ <li><strong>Allow Message Passthrough</strong>: If you allow then message from node input will be sent to node output.</li>
  <li><strong>Custom MDNS Configuration</strong>: Check if you would like to use custom mdns configuration.</li>
  <ul>
  <li><strong>Multicast</strong>: Use udp multicasting. Optional. Default true.</li>
@@ -146,7 +146,7 @@ <h3 id="toc_4">Bridge</h3>
  },
  pinCode: {
  required: true,
- validate: pinCodeRegex,
+ validate: validatePinCode,
  },
  port: {
  required: false,
@@ -240,7 +240,7 @@ <h3 id="toc_4">Bridge</h3>
  oneditprepare: function () {
  const node = this
 
- if (!pinCodeRegex(node.pinCode)) {
+ if (!validatePinCode(node.pinCode)) {
  node.pinCode = generatePinCode()
  $("#node-config-input-pinCode").val(node.pinCode)
  }