printable_characters - check if it is ascii

Author: Flavio Oliveira

Diff for: Cargo.toml

@@ -1,15 +1,18 @@
 [package]
 name = "yubico"
-version = "0.1.3"
+version = "0.1.4"
 authors = ["Flavio Oliveira <[email protected]>"]
 
 description = "Yubikey client API library"
-license = "MIT"
+license = "MIT OR Apache-2.0"
 keywords = ["HMS", "yubikey", "authentication", "encryption", "OTP"]
-
+categories = ["authentication"]
 repository = "https://github.com/wisespace-io/yubico-rs"
 readme = "README.md"
 
+[badges]
+travis-ci = { repository = "wisespace-io/yubico-rs" }
+
 [lib]
 name = "yubico"
 path = "src/lib.rs"
@@ -19,6 +22,6 @@ url = "1.4"
 hyper = { version = "0.10", default-features = false }
 hyper-native-tls = "0.2.2"
 rand = "0.3.15"
-base64 = "^0.4"
+base64 = "^0.5"
 threadpool = "1.3"
 rust-crypto = "^0.2"

Diff for: LICENSE

@@ -1,21 +1,8 @@
-MIT License
-
 Copyright (c) 2016 Flavio Oliveira
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Licensed under either of
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+ * Apache License, Version 2.0, (http://www.apache.org/licenses/LICENSE-2.0)
+ * MIT license (http://opensource.org/licenses/MIT)
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+at your option.

Diff for: README.md

@@ -36,4 +36,7 @@ fn main() {
 
 ## License
 
+Licensed under either of
+
 * MIT license (see [LICENSE](LICENSE) or <http://opensource.org/licenses/MIT>)
+* Apache License, Version 2.0 (see [LICENSE](LICENSE) or <http://www.apache.org/licenses/LICENSE-2.0>)

Diff for: src/lib.rs

@@ -8,6 +8,7 @@ extern crate threadpool;
 
 pub mod yubicoerror;
 
+use std::ascii::AsciiExt;
 use yubicoerror::YubicoError;
 use hyper::net::HttpsConnector;
 use hyper_native_tls::NativeTlsClient;
@@ -62,15 +63,15 @@ impl Yubico {
     pub fn new(client_id: String, key: String) -> Self {
         Yubico {
             client_id: client_id,
-            key: decode(key.as_ref()).unwrap(),
+            key: decode(&key[..]).unwrap(),
         }
     }
 
     // Verify a provided OTP
     pub fn verify(&self, otp: String) -> Result<String> {
         match self.printable_characters(otp.clone()) {
             false => Err(YubicoError::BadOTP),
-            _ => {
+            _ => {                
                 let nonce: String = self.generate_nonce();
                 let mut query = format!("id={}&nonce={}&otp={}&sl=secure", self.client_id, nonce, otp);
 
@@ -133,7 +134,12 @@ impl Yubico {
 
     // Recommendation is that clients only check that the input consists of 32-48 printable characters
     fn printable_characters(&self, otp: String) -> bool {
-        if otp.len() < 32 || otp.len() > 48 { false } else { true }
+        for c in otp.chars() { 
+            if !c.is_ascii() { 
+                return false; 
+            }    
+        }
+        otp.len() > 32 && otp.len() < 48
     }
 
     fn process(&self, sender: Sender<Response>, api_host: &str, request: Request) {
@@ -146,18 +152,21 @@ impl Yubico {
                 let signature_response : &str = &*response_map.get("h").unwrap();
                 if !self.is_same_signature(signature_response, response_map.clone()) {
                     sender.send(Response::Signal(Err(YubicoError::SignatureMismatch))).unwrap();
+                    return;
                 }
 
                 // Check if "otp" in the response is the same as the "otp" supplied in the request.
                 let otp_response : &str = &*response_map.get("otp").unwrap();
                 if !request.otp.contains(otp_response) {
                     sender.send(Response::Signal(Err(YubicoError::OTPMismatch))).unwrap();
+                    return;
                 }
 
                 // Check if "nonce" in the response is the same as the "nonce" supplied in the request.
                 let nonce_response : &str = &*response_map.get("nonce").unwrap();
                 if !request.nonce.contains(nonce_response) {
                     sender.send(Response::Signal(Err(YubicoError::NonceMismatch))).unwrap();
+                    return;
                 }
 
                 // Check the status of the operation
@@ -195,7 +204,6 @@ impl Yubico {
         query.pop(); // remove last &
 
         let signature = self.build_signature(query.clone());
-
         let decoded_signature = &decode(signature_response).unwrap()[..];
 
         crypto::util::fixed_time_eq(signature.code(), decoded_signature)