{"record":{"id":"cb406b89731e04da","repo":"AlexxIT/go2rtc","slug":"hap-insecure-pin","errorCode":null,"errorMessage":"hap: insecure PIN: ","messagePattern":"hap: insecure PIN: ","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/hap/helpers.go","lineNumber":85,"sourceCode":"\ntype JSONCharacter struct {\n\tAID    uint8  `json:\"aid\"`\n\tIID    uint64 `json:\"iid\"`\n\tStatus any    `json:\"status,omitempty\"`\n\tValue  any    `json:\"value,omitempty\"`\n\tEvent  any    `json:\"ev,omitempty\"`\n}\n\n// 4.2.1.2 Invalid Setup Codes\nconst insecurePINs = \"00000000 11111111 22222222 33333333 44444444 55555555 66666666 77777777 88888888 99999999 12345678 87654321\"\n\nfunc SanitizePin(pin string) (string, error) {\n\ts := strings.ReplaceAll(pin, \"-\", \"\")\n\tif len(s) != 8 {\n\t\treturn \"\", errors.New(\"hap: wrong PIN format: \" + pin)\n\t}\n\tif strings.Contains(insecurePINs, s) {\n\t\treturn \"\", errors.New(\"hap: insecure PIN: \" + pin)\n\t}\n\t// 123-45-678\n\treturn s[:3] + \"-\" + s[3:5] + \"-\" + s[5:], nil\n}\n\nfunc GenerateKey() []byte {\n\t_, key, _ := ed25519.GenerateKey(nil)\n\treturn key\n}\n\nfunc GenerateUUID() string {\n\t//12345678-9012-3456-7890-123456789012\n\tdata := make([]byte, 16)\n\t_, _ = rand.Read(data)\n\ts := hex.EncodeToString(data)\n\treturn s[:8] + \"-\" + s[8:12] + \"-\" + s[12:16] + \"-\" + s[16:20] + \"-\" + s[20:]\n}\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/AlexxIT/go2rtc/blob/c245815e75e2a5fd60b4290f12bfc04e55a984d3/pkg/hap/helpers.go#L67-L103","documentation":"HAP SanitizePin security guard: the (well-formed) 8-digit PIN appears in the hardcoded insecurePINs blocklist from the HAP spec 4.2.1.2 — trivial codes like 00000000, 11111111, 12345678, 87654321. Spec-compliant accessories must reject them, so the client refuses them up front.","triggerScenarios":"Thrown at pkg/hap/helpers.go:85 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the real setup code printed on the accessory or its QR tag","Re-generate pairing credentials if the accessory itself has a trivial code","Reject such PINs in configuration validation before attempting pairing"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"c245815e75e2a5fd60b4290f12bfc04e55a984d3","analyzedAt":"2026-09-07T11:47:02.965Z","contentChangedAt":"2026-09-07T11:47:02.965Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}