Check maximum OTP secret size in new authorization style commands

Authenticate before testing invalid hex strings
Remove invalid test for empty string for writing otp slot (empty string allows editing)

Signed-off-by: Szczepan Zalega <szczepan@nitrokey.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/NitrokeyManager.cc b/NitrokeyManager.cc
index da31c8d..a15b9c8 100644
--- a/NitrokeyManager.cc
+++ b/NitrokeyManager.cc
@@ -302,6 +302,10 @@ namespace nitrokey{
       payload2.id = 0;
       auto secret_bin = misc::hex_string_to_byte(secret);
       auto remaining_secret_length = secret_bin.size();
+      const auto maximum_OTP_secret_size = 40;
+      if(remaining_secret_length > maximum_OTP_secret_size){
+        throw TargetBufferSmallerThanSource(remaining_secret_length, maximum_OTP_secret_size);
+      }
 
       while (remaining_secret_length>0){
         const auto bytesToCopy = std::min(sizeof(payload2.data), remaining_secret_length);