Validate verification code input before sending it

[marlam]

This makes sure that the verification code only contains characters a-z A-Z 0-9, and is of limited length.

Otherwise it is possible for a user to cause arbitrary data to be sent to the server, including invalid JSON. This could be a problem if the JSON parser on the receiving end has bugs.

For example, code input 'A"}BBBBBBBB...' would lead to JSON data '{"session_id":"SESSIONID","pin":"A"}BBBBBBBB..."}' to be sent to the server.

[codecov]

Codecov Report

Attention: Patch coverage is 92.85714% with 1 line in your changes missing coverage. Please review.

Project coverage is 72.87%. Comparing base (0b91f62) to head (7aae388).
Report is 10 commits behind head on main.

Files with missing lines	Patch %	Lines
src/tty.c	91.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #103      +/-   ##
==========================================
+ Coverage   72.51%   72.87%   +0.35%     
==========================================
  Files           6        6              
  Lines         302      306       +4     
  Branches       47       47              
==========================================
+ Hits          219      223       +4     
  Misses         71       71              
  Partials       12       12              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[mrvanes]

When using pamtester to test the PR, I get a segmentation fault on and empty code response:

Enter verification code: <enter>
Segmentation fault

It would be nice if you could extend the validation to the username input and return a permission denied on invalid usernames:

$ sudo pamtester weblogin '"a}aaa"' authenticate
Server error!
pamtester: System error

[marlam]

I fixed the segfault - I overlooked that tty_input() returns NULL on empty input.

This can also bite the group input, I opened PR #104 for this.

I will extent this to cover user names in a separate PR commit, because that requires a small extension of input_is_safe().

[baszoetekouw]

Hi Martin!
Thanks for this PR. Looks good in principle, but I think we should be a bit more careful with the string manipulations (see comments).