wneessen / go-hibp Goto Github PK

In this code:

        hb, hr, err := p.hibp.HTTPResBody(http.MethodGet, apiURL, nil)
	if err != nil {
		return nil, nil, err
	}

the http response is ignored and nil returned if there is any error. However, the error might come from the API call, in which case there could be a response and should be passed down this method as well. Is nil being returned intentionally?

As noted in #22 the error handling in all APIs are not perfect. This issue is meant to give all of the APIs an overhaul in terms of error handling similar to the fix that was already applied for #22.

HIBP recently added domain search, which should be added to the package: https://www.troyhunt.com/welcome-to-the-new-have-i-been-pwned-domain-search-subscription-service/

Stacktrace piece:

out of range [1] with length 1
goroutine 335253 [running]:
runtime/debug. Stack()
/opt/homebrew/Cellar/go/1.22.2/libexec/src/runtime/debug/stack.go:24 +0x64
/opt/homebrew/Cellar/go/1.22.2/libexec/src/runtime/panic.go:770 +0x124
github.com/wneessen/go-hibp.(*PwnedPassAPI).ListHashesPrefix(0x1400243cdaD, {0x14003450210,
0x5})
/Users/kenji/.go/pkg/mod/github.com/wneessen/[email protected]/password.go:209 +0x664
github.com/wneessen/go-hibp.(*PwnedPassAPI).CheckSHA1(0x105586fbe?,
(0x14003450210, 0x28})
/Users/kenji/.go/pkg/mod/github.com/wneessen/[email protected]/password.go:77 +0x40
github.com/wneessen/go-hibp. (*PwnedPassAPI).CheckPassword(0x1400243cdaD, {0x140022da510?, 0x14001576690?})
/Users/kenji/•go/pkg/mod/github.com/wneessen/[email protected]/password.go:59 +0x1a0

This was caught by our E2Es with random input data, so unfortunately I can't tell if it is some specific input that triggers it or maybe it's a "glitch" in the API output. It did happen on multiple different runs over time, though.
And I'd say it should not panic either way.

HIBP recently introduced NTLM hash support. go-hibp should reflect this.