{"record":{"id":"a7d80c67788f4100","repo":"schollz/croc","slug":"code-must-be-at-least-6-characters","errorCode":null,"errorMessage":"Code must be at least 6 characters","messagePattern":"Code must be at least 6 characters","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"web/src/protocol/client.ts","lineNumber":63,"sourceCode":"\nfunction abortError() {\n  return new DOMException(\"Transfer cancelled\", \"AbortError\");\n}\n\nfunction checkAbort(signal?: AbortSignal) {\n  if (signal?.aborted) throw abortError();\n}\n\nfunction requirePakeVersion(version: number | undefined) {\n  if (version !== PAKE_PROTOCOL_VERSION) {\n    throw new Error(\n      `Peer uses unsupported PAKE protocol version ${version ?? 0}; upgrade both croc clients`,\n    );\n  }\n}\n\nfunction validateSecret(secret: string) {\n  if (secret.length < 6) throw new Error(\"Code must be at least 6 characters\");\n  if (!/^[\\x20-\\x7e]+$/.test(secret)) {\n    throw new Error(\"Custom codes must use printable ASCII characters\");\n  }\n}\n\nfunction controlPort(relayAddress: string) {\n  try {\n    const parsed = new URL(\n      relayAddress.includes(\"://\") ? relayAddress : `tcp://${relayAddress}`,\n    );\n    return parsed.port || CONTROL_PORT;\n  } catch {\n    return CONTROL_PORT;\n  }\n}\n\nfunction dataPorts(banner: string) {\n  const ports = banner","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/schollz/croc/blob/e25f1bdc04f07f094d50b0a1bf67e2563944b57a/web/src/protocol/client.ts#L45-L81","documentation":"validateSecret rejects transfer codes shorter than 6 characters before any network activity starts. croc requires a minimum code entropy so the PAKE passphrase cannot be trivially brute-forced. It is called at the top of sendFiles and receive entry points, so it fails fast on user input.","triggerScenarios":"Calling sendFiles with a user-typed custom code like 'abc'; receiving with a mistyped or truncated code phrase; an empty string passed programmatically.","commonSituations":"Users typing a short custom phrase instead of accepting the generated code; UI input that trims or drops characters (e.g. an autocomplete bug); test fixtures using placeholder secrets.","solutions":["Use a code of at least 6 characters, e.g. the generated 4-word croc code","Add a minlength/pattern check in the UI input so the user cannot submit early","Generate codes via wasm().codeComponents output rather than hand-writing them"],"exampleFix":"// before\nawait sendFiles({ files, secret: \"abc\", settings });\n\n// after\nawait sendFiles({ files, secret: \"sun-moth-table-7\", settings });\n\n// or guard in the UI:\n// <input minlength={6} pattern=\"[ -~]{6,}\" required />","handlingStrategy":"validation","validationCode":"function validSecret(s) {\n  return typeof s === \"string\" && s.length >= 6;\n}\nif (!validSecret(secret)) throw new Error(\"Code must be at least 6 characters\");","typeGuard":null,"tryCatchPattern":"try { await sendFiles(opts); } catch (e) {\n  if (e.message === \"Code must be at least 6 characters\") { setCodeError(e.message); return; }\n  throw e;\n}","preventionTips":["Set minlength=6 on the code input and disable submit until satisfied","Prefer generated code phrases over user-invented short codes","Validate before any connect UI so no network round trip is wasted"],"tags":["validation","user-input","passphrase"],"backgroundTag":null,"analyzedSha":"e25f1bdc04f07f094d50b0a1bf67e2563944b57a","analyzedAt":"2026-08-15T12:53:39.096Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}