libnitrokey

libnitrokey copied to clipboard

Do not return local variable address for TargetBufferSmallerThanSource message

2

Use static string object for keeping the c_str message for the caller. Strings collection used as an alternative to memory leaks done via strdup(). To add, TargetBufferSmallerThanSource Exception should never...

szszszsz

Return of address of stack memory associated with local variable

1

https://github.com/Nitrokey/libnitrokey/blob/d22a0d28d29429e4d04765ed6e43515cfcdfd9a8/libnitrokey/LibraryException.h#L49-L54 This code trigger -Wreturn-stack-address since this is not a known at compile time string, and thus the content of the string will be use after free by the caller....

monwarez

Fix SPDX-License-Identifier annotation

1

libnitrokey uses the `SPDX-License-Identifier: LGPL-3.0` annotation, but the `LGPL-3.0` identifier has been deprecated acording to [this list](https://spdx.org/licenses/). The identifier should be `LGPL-3.0-or-later` instead.

robinkrahl

At the moment Travis CI is no longer responding to build requests. To re-connect or migrate to another one (Github?)

szszszsz

Avoid unnecessary commands when querying the retry counts

1

https://github.com/Nitrokey/libnitrokey/blob/d75348816e1254fc0d051e9c454516c32d8d71d7/NitrokeyManager.cc#L788-L802 Isn’t it possible to directly use the response of `GetDeviceStatus` for Storage devices?

robinkrahl

Expose OTP and PWS properties (slot counts, limits)

1

To allow applications to validate user input before sending it to the device (see d-e-s-o/nitrocli#161), it would be nice to be able to access some OTP- and PWS-related properties using...

robinkrahl

Nitrokey Storage-only version

2

Divide implementation in such a way, that would allow to produce library containing only Nitrokey Storage features handling. Target is to decrease the final binary size for the Heads use.

szszszsz

While sending temporary password, the strcpy is used to copy binary buffer, which might result in setting the value shorter than allowed. https://github.com/Nitrokey/libnitrokey/blob/2e38681cd0b34e1ce36a6417445f3a7ca75f246c/NitrokeyManager.cc#L680

szszszsz

LongOperationInProgressException cannot be detected using the C API

2

The C API translates the C++ exceptions to integer values (see `NK_C_API.cc:get_with_status`). For instances of `CommandFailedException`, the `last_command_status` field is used for the conversion. This field is typically set to...

robinkrahl

Consider enforcing a consistent coding style and naming convention

4

Currently, the coding style in the C++ and C source code is often inconsistent (indentation, spacing, brace placement, …). Sometimes this makes it hard to read the code. Would you...

robinkrahl