{"record":{"id":"66090c2c0a00cff8","repo":"beemdevelopment/Aegis","slug":"bad-period-d","errorCode":null,"errorMessage":"bad period: %d","messagePattern":"bad period: (.+?)","errorType":"validation","errorClass":"OtpInfoException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/com/beemdevelopment/aegis/otp/TotpInfo.java","lineNumber":75,"sourceCode":"        return obj;\n    }\n\n    public int getPeriod() {\n        return _period;\n    }\n\n    public static boolean isPeriodValid(int period) {\n        if (period <= 0) {\n            return false;\n        }\n\n        // check for the possibility of an overflow when converting to milliseconds\n        return period <= Integer.MAX_VALUE / 1000;\n    }\n\n    public void setPeriod(int period) throws OtpInfoException {\n        if (!isPeriodValid(period)) {\n            throw new OtpInfoException(String.format(\"bad period: %d\", period));\n        }\n        _period = period;\n    }\n\n    public long getMillisTillNextRotation() {\n        return TotpInfo.getMillisTillNextRotation(_period);\n    }\n\n    public static long getMillisTillNextRotation(int period) {\n        long p = period * 1000;\n        return p - (System.currentTimeMillis() % p);\n    }\n\n    @Override\n    public boolean equals(Object o) {\n        if (!(o instanceof TotpInfo)) {\n            return false;\n        }","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/beemdevelopment/Aegis/blob/d6f4e5925a97e4e91593f1542085eae03432a759/app/src/main/java/com/beemdevelopment/aegis/otp/TotpInfo.java#L57-L93","documentation":"TotpInfo.setPeriod validates the TOTP period: it must be > 0 (checked in isPeriodValid) and small enough that converting seconds to milliseconds cannot overflow int (period <= Integer.MAX_VALUE/1000). Otherwise it throws OtpInfoException('bad period: %d').","triggerScenarios":"Calling TotpInfo.setPeriod(int) with period <= 0 or period > 2147483 (Integer.MAX_VALUE/1000), directly or via parseUri when an otpauth URI carries an invalid period parameter.","commonSituations":"Hand-edited or third-party otpauth:// URIs with period=0, negative, or absurdly large values (e.g. period=3153600000), importing entries from other authenticator apps that permit unusual periods.","solutions":["Check TotpInfo.isPeriodValid(period) before calling setPeriod","Fix the period parameter in the otpauth URI/import data (typical valid value is 30)","Clamp the period to a sane range and warn instead of propagating the exception","Catch OtpInfoException around parseUri/setPeriod and reject the malformed entry"],"exampleFix":"// before\ntotp.setPeriod(uriInfo.getPeriod()); // throws for period=0\n// after\nint period = uriInfo.getPeriod();\nif (!TotpInfo.isPeriodValid(period)) {\n    period = 30; // safe default\n}\ntotp.setPeriod(period);","handlingStrategy":"validation","validationCode":"if (!TotpInfo.isPeriodValid(period)) {\n    throw new IllegalArgumentException(\"period must be > 0 and <= \" + (Integer.MAX_VALUE / 1000));\n}\ntotp.setPeriod(period);","typeGuard":"boolean validPeriod(int p) { return p > 0 && p <= Integer.MAX_VALUE / 1000; }","tryCatchPattern":"try {\n    totp.setPeriod(period);\n} catch (OtpInfoException e) {\n    Log.w(TAG, \"Bad period \" + period + \", falling back to 30s\", e);\n    totp.setPeriod(30);\n}","preventionTips":["Validate period with TotpInfo.isPeriodValid before calling setPeriod","Reject or normalize otpauth URIs with period <= 0 or > 2147483","Default to the standard 30-second period when a URI omits or misstates it","Test URI parsers against overflow-inducing periods"],"tags":["totp","validation","otp","android"],"backgroundTag":"invalid-config-value","analyzedSha":"d6f4e5925a97e4e91593f1542085eae03432a759","analyzedAt":"2026-09-08T00:46:31.111Z","contentChangedAt":"2026-09-08T00:46:31.111Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}