fix(pass): trim relay password consistently so trailing whitespace doesn't break the handshake (#1153)

determinePass only trimmed the password when it was read from a file; a
password supplied via --pass / CROC_PASS with a trailing newline was left
untrimmed. The relay then trimmed the received password but compared it
against the untrimmed stored password, so 'pass123\n' != 'pass123' and the
handshake failed with 'bad password' / 'password mismatch' (regression from
v10.4.5). Trim in determinePass regardless of source, and trim both sides of
the relay comparison. Adds regression tests for both paths.

Author: CodeBlackwell

src/cli/cli.go

@@ -277,8 +277,9 @@ func determinePass(c *cli.Context) (pass string) {
 	pass = c.String("pass")
 	b, err := os.ReadFile(pass)
 	if err == nil {
-		pass = strings.TrimSpace(string(b))
+		pass = string(b)
 	}
+	pass = strings.TrimSpace(pass)
 	return
 }
 

src/cli/cli_test.go

@@ -1,10 +1,29 @@
 package cli
 
 import (
+	"flag"
 	"reflect"
 	"testing"
+
+	"github.com/schollz/cli/v2"
 )
 
+// determinePass should trim a pass from --pass/CROC_PASS, not just from a file.
+func TestDeterminePassTrimsEnvValue(t *testing.T) {
+	set := flag.NewFlagSet("test", flag.ContinueOnError)
+	set.String("pass", "", "")
+	if err := set.Set("pass", "pass123\n"); err != nil {
+		t.Fatalf("failed to set flag: %v", err)
+	}
+	ctx := cli.NewContext(nil, set, nil)
+
+	got := determinePass(ctx)
+	want := "pass123"
+	if got != want {
+		t.Errorf("determinePass(%q) = %q, want %q", "pass123\\n", got, want)
+	}
+}
+
 func TestParseRelayPorts(t *testing.T) {
 	tests := []struct {
 		name string

src/tcp/tcp.go

@@ -325,7 +325,7 @@ func (s *server) clientCommunication(c *comm.Comm) (room string, err error) {
 	if err != nil {
 		return
 	}
-	if strings.TrimSpace(string(passwordBytes)) != s.password {
+	if strings.TrimSpace(string(passwordBytes)) != strings.TrimSpace(s.password) {
 		err = fmt.Errorf("bad password")
 		enc, _ := crypt.Encrypt([]byte(err.Error()), strongKeyForEncryption)
 		if err = c.Send(enc); err != nil {

src/tcp/tcp_test.go

@@ -170,6 +170,16 @@ func TestWrongPassword(t *testing.T) {
 	assert.Contains(t, err.Error(), "bad password")
 }
 
+// A relay password with trailing whitespace should still accept a trimmed client password.
+func TestPasswordWithTrailingWhitespace(t *testing.T) {
+	log.SetLevel("error")
+	go Run("debug", "127.0.0.1", "8395", "pass123 ", "8396")
+	time.Sleep(100 * time.Millisecond)
+
+	_, _, _, err := ConnectToTCPServer("127.0.0.1:8395", "pass123", "testRoom")
+	assert.Nil(t, err)
+}
+
 func TestRoomIsolation(t *testing.T) {
 	log.SetLevel("error")
 	go Run("debug", "127.0.0.1", "8387", "pass123", "8388")