fix: bound REST TOTP confirmation codes

Author: chubes4

providers/class-two-factor-totp.php

@@ -283,7 +283,7 @@ public function rest_setup_totp( $request ) {
 			return new WP_Error( 'invalid_key', __( 'Invalid Two Factor Authentication secret key.', 'two-factor' ), array( 'status' => 400 ) );
 		}
 
-		if ( ! $this->is_valid_authcode( $key, $code ) ) {
+		if ( ! preg_match( '/^[0-9]{' . self::DEFAULT_DIGIT_COUNT . '}$/', $code ) || ! $this->is_valid_authcode( $key, $code ) ) {
 			return new WP_Error( 'invalid_key_code', __( 'Invalid Two Factor Authentication code.', 'two-factor' ), array( 'status' => 400 ) );
 		}
 

tests/providers/class-two-factor-totp-rest-api.php

@@ -142,6 +142,30 @@ public function test_user_two_factor_rest_set_key_bad_auth_code() {
 		$this->assertFalse( self::$provider->is_available_for_user( wp_get_current_user() ) );
 	}
 
+	/**
+	 * Verify oversized auth codes are rejected before TOTP calculation.
+	 *
+	 * @ticket 936
+	 * @covers Two_Factor_Totp::rest_setup_totp
+	 */
+	public function test_user_two_factor_rest_rejects_oversized_auth_code() {
+		wp_set_current_user( self::$admin_id );
+
+		$request = new WP_REST_Request( 'POST', '/' . Two_Factor_Core::REST_NAMESPACE . '/totp' );
+		$request->set_body_params(
+			array(
+				'user_id' => self::$admin_id,
+				'key'     => self::$provider->generate_key(),
+				'code'    => str_repeat( '1', 1000 ),
+			)
+		);
+
+		$response = rest_do_request( $request );
+
+		$this->assertErrorResponse( 'invalid_key_code', $response, 400 );
+		$this->assertFalse( self::$provider->is_available_for_user( wp_get_current_user() ) );
+	}
+
 	/**
 	 * Verify setting up TOTP with an authcode.
 	 *