[1.x] Fixes empty issuer

Laragear · Jun 12, 2023 · a9f453b · a9f453b
1 parent 6910f73
commit a9f453b
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 2 deletions.
diff --git a/src/Models/Concerns/SerializesSharedSecret.php b/src/Models/Concerns/SerializesSharedSecret.php
@@ -2,11 +2,12 @@
 
 namespace Laragear\TwoFactor\Models\Concerns;
 
-use function array_values;
 use BaconQrCode\Renderer\Image\SvgImageBackEnd;
 use BaconQrCode\Renderer\ImageRenderer;
 use BaconQrCode\Renderer\RendererStyle\RendererStyle;
 use BaconQrCode\Writer;
+use InvalidArgumentException;
+use function array_values;
 use function chunk_split;
 use function config;
 use function http_build_query;
@@ -23,7 +24,9 @@ trait SerializesSharedSecret
      */
     public function toUri(): string
     {
-        $issuer = config('two-factor.issuer', config('app.name'));
+        $issuer = config('two-factor.issuer')
+                ?: config('app.name')
+                ?: throw new InvalidArgumentException('The TOTP issuer cannot be empty.');
 
         $query = http_build_query([
             'issuer'    => $issuer,

diff --git a/tests/Eloquent/TwoFactorAuthenticationTest.php b/tests/Eloquent/TwoFactorAuthenticationTest.php
@@ -6,6 +6,7 @@
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Date;
+use InvalidArgumentException;
 use Laragear\TwoFactor\Models\TwoFactorAuthentication;
 use ParagonIE\ConstantTime\Base32;
 use Tests\Stubs\UserStub;
@@ -315,6 +316,20 @@ public function test_serializes_uri_to_json(): void
         static::assertEquals($uri, $tfa->toJson());
     }
 
+    public function test_uses_app_name_as_issuer(): void
+    {
+        $tfa = TwoFactorAuthentication::factory()->withRecovery()->withSafeDevices()->make([
+            'label'         => '[email protected]',
+            'shared_secret' => static::SECRET,
+            'algorithm'     => 'sHa256',
+            'digits'        => 14,
+        ]);
+
+        $uri = 'otpauth://totp/Laravel%[email protected]?issuer=Laravel&label=test%40foo.com&secret=KS72XBTN5PEBGX2IWBMVW44LXHPAQ7L3&algorithm=SHA256&digits=14';
+
+        static::assertSame($uri, $tfa->toUri());
+    }
+
     public function test_changes_issuer(): void
     {
         $this->app->make('config')->set('two-factor.issuer', 'foo bar');
@@ -331,6 +346,24 @@ public function test_changes_issuer(): void
         static::assertSame($uri, $tfa->toUri());
     }
 
+    public function test_throws_exception_when_issuer_is_empty(): void
+    {
+        $this->app->make('config')->set('app.name', '');
+        $this->app->make('config')->set('two-factor.issuer', '');
+
+        $tfa = TwoFactorAuthentication::factory()->withRecovery()->withSafeDevices()->make([
+            'label'         => '[email protected]',
+            'shared_secret' => static::SECRET,
+            'algorithm'     => 'sHa256',
+            'digits'        => 14,
+        ]);
+
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('The TOTP issuer cannot be empty.');
+
+        $tfa->toUri();
+    }
+
     public function test_uses_custom_generator(): void
     {
         $i = 0;