Don't return transports from attestation if unknown or empty

Author: emlun

NEWS

@@ -1,3 +1,11 @@
+== Version 1.9.0 (unreleased) ==
+
+webauthn-server-attestation:
+
+* Fixed that `SimpleAttestationResolver` would return empty transports when
+  transports are unknown.
+
+
 == Version 1.8.0 ==
 
 Changes:

webauthn-server-attestation/src/main/java/com/yubico/webauthn/attestation/resolver/SimpleAttestationResolver.java

@@ -31,6 +31,7 @@
 import com.yubico.internal.util.CertificateParser;
 import com.yubico.internal.util.CollectionUtil;
 import com.yubico.internal.util.ExceptionUtil;
+import com.yubico.internal.util.OptionalUtil;
 import com.yubico.webauthn.attestation.Attestation;
 import com.yubico.webauthn.attestation.AttestationResolver;
 import com.yubico.webauthn.attestation.DeviceMatcher;
@@ -135,9 +136,11 @@ public Optional<Attestation> resolve(
                   .vendorProperties(Optional.of(vendorProperties))
                   .deviceProperties(Optional.ofNullable(deviceProperties))
                   .transports(
-                      Optional.of(
-                          Transport.fromInt(
-                              getTransports(attestationCertificate) | metadataTransports)))
+                      OptionalUtil.zipWith(
+                              getTransports(attestationCertificate),
+                              Optional.of(metadataTransports).filter(t -> t != 0),
+                              (a, b) -> a | b)
+                          .map(Transport::fromInt))
                   .build();
             });
   }
@@ -158,11 +161,11 @@ private boolean deviceMatches(
     }
   }
 
-  private static int getTransports(X509Certificate cert) {
+  private static Optional<Integer> getTransports(X509Certificate cert) {
     byte[] extensionValue = cert.getExtensionValue(TRANSPORTS_EXT_OID);
 
     if (extensionValue == null) {
-      return 0;
+      return Optional.empty();
     }
 
     ExceptionUtil.assure(
@@ -186,14 +189,14 @@ private static int getTransports(X509Certificate cert) {
       }
     }
 
-    return transports;
+    return Optional.of(transports);
   }
 
   @Override
   public Attestation untrustedFromCertificate(X509Certificate attestationCertificate) {
     return Attestation.builder()
         .trusted(false)
-        .transports(Optional.of(Transport.fromInt(getTransports(attestationCertificate))))
+        .transports(getTransports(attestationCertificate).map(Transport::fromInt))
         .build();
   }
 }

yubico-util/src/main/java/com/yubico/internal/util/OptionalUtil.java

@@ -0,0 +1,27 @@
+package com.yubico.internal.util;
+
+import java.util.Optional;
+import java.util.function.BinaryOperator;
+import lombok.experimental.UtilityClass;
+
+/** Utilities for working with {@link Optional} values. */
+@UtilityClass
+public class OptionalUtil {
+
+  /**
+   * If both <code>a</code> and <code>b</code> are present, return <code>f(a, b)</code>.
+   *
+   * <p>If only <code>a</code> is present, return <code>a</code>.
+   *
+   * <p>Otherwise, return <code>b</code>.
+   */
+  public static <T> Optional<T> zipWith(Optional<T> a, Optional<T> b, BinaryOperator<T> f) {
+    if (a.isPresent() && b.isPresent()) {
+      return Optional.of(f.apply(a.get(), b.get()));
+    } else if (a.isPresent()) {
+      return a;
+    } else {
+      return b;
+    }
+  }
+}