authy/authy-ssh — pull request #8 by beala (2012-12-14 02:51:31+00:00)
Title: Fixes bugs in `login` and `run`

In function `login`, inputting a malformed token causes: `return -1`. Not all
versions of `return` support negative parameters, causing this line to
produce an error, and the script to continue despite meaning to quit
early. Changed to `return 1`.

In `run`, login is called with `login $authy_token $mode`. This means
it's possible to arbitrarily set the parameters of `login` by putting
spaces in $authy_token. eg, if `authy_toke="123 test"`, then the second
parameter of `login` will be set to "test". Currently, I don't think
this can be exploited, but might cause problems in the future.