Proton Pass importer fails to import with certain TOTP secrets

[wwboyer]

Steps To Reproduce

1. Sign in to the Bitwarden Web Vault
2. Click on 'Tools'
3. Click on 'Import Data'
4. Select 'ProtonPass (zip/json)' as the file format, and paste the following into the 'import file contents' textbox. It will fail with a different error depending on which browser is used:

{"version":"1.8.0","userId":"[REDACTED]","encrypted":false,"vaults":{"O9eOFeZSGP9w7o4Dh7P3tplO_AzlHTp14y5Bzo594CeBUhH8tZo69jzVuM0F4ESxgpKcNV6ThoOf0QRVKe3uJA==":{"name":"Example","description":"","display":{"color":4,"icon":2},"items":[{"itemId":"9Fn8edMdpSwmII2ZxUOKBcAngwiCp4CB2VfjdpXutkN-b2oqBfWxdJhbDoQmBgEfAN6Yh8xw92-HPqxGYhqAxw==","shareId":"O9eOFeZSGP9w7o4Dh7P3tplO_AzlHTp14y5Bzo594CeBUhH8tZo69jzVuM0F4ESxgpKcNV6ThoOf0QRVKe3uJA==","data":{"metadata":{"name":"Test","note":"","itemUuid":"8ca96897"},"extraFields":[],"type":"login","content":{"username":"test_user","password":"test_password","urls":["https://example.com/"],"totpUri":"JBSWY3DPEHPK3PXP"}},"state":1,"aliasEmail":null,"contentFormatVersion":1,"createTime":1696888230,"modifyTime":1696888230}]}}}

5. Attempt to import again with the same settings, but using the following. It will now successfully import:

{"version":"1.8.0","userId":"[REDACTED]","encrypted":false,"vaults":{"O9eOFeZSGP9w7o4Dh7P3tplO_AzlHTp14y5Bzo594CeBUhH8tZo69jzVuM0F4ESxgpKcNV6ThoOf0QRVKe3uJA==":{"name":"Example","description":"","display":{"color":4,"icon":2},"items":[{"itemId":"9Fn8edMdpSwmII2ZxUOKBcAngwiCp4CB2VfjdpXutkN-b2oqBfWxdJhbDoQmBgEfAN6Yh8xw92-HPqxGYhqAxw==","shareId":"O9eOFeZSGP9w7o4Dh7P3tplO_AzlHTp14y5Bzo594CeBUhH8tZo69jzVuM0F4ESxgpKcNV6ThoOf0QRVKe3uJA==","data":{"metadata":{"name":"Test","note":"","itemUuid":"8ca96897"},"extraFields":[],"type":"login","content":{"username":"test_user","password":"test_password","urls":["https://example.com/"],"totpUri":"otpauth://totp/Test:test_user?issuer=Test&secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&period=30"}},"state":1,"aliasEmail":null,"contentFormatVersion":1,"createTime":1696888230,"modifyTime":1696888230}]}}}

Please note that the TOTP secret in this file is not an actual secret. It is an example from the wiki of the google-authenticator GitHub repo (https://github.com/google/google-authenticator/wiki/Key-Uri-Format)

Expected Result

The importer successfully imports the item from the Proton Pass entry.

Actual Result

The import fails with an error message that differs depending on which browser the user is using. On the chromium-based browsers I tested (Chrome and Vivaldi), the error simply states Failed to construct 'URL': Invalid URL, while on Firefox the error more clearly states what the actual problem is: URL constructor: [insert secret here] is not a valid URL. This happened regardless of which operating system I tried on (Windows 11, Mac OS Sonoma, Fedora 39).

Screenshots or Videos

Error displayed on chromium-based browsers (Chrome, Vivaldi, etc.)

Error displayed on Firefox

Additional Context

It seems like the ProtonPass importer assumes that all TOTP secrets are in the following URI format: otpauth://totp/Test:test_user?issuer=Test&secret=JBSWY3DPEHPK3PXP&algorithm=SHA1&digits=6&period=30, tries to get the secret from the secret URI param, and fails if the user simply typed in the secret or pasted it from another TOTP application. This personally caused me to need to manually back up and delete every TOTP secret before importing, which was definitely a pain. I have also seen another user on Reddit have what appears to be the same issue.

Operating System

Windows, macOS, Linux

Operating System Version

No response

Web Browser

Chrome, Firefox, Vivaldi

Browser Version

No response

Build Version

2023.9.1

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.