Skip to content

Commit 8293a6a

Browse files
emlunemlun
committed
Release 1.7.0
webauthn-server-attestation: - Updated name of AAGUID `2fc0579f811347eab116bb5a8db9202a` to "YubiKey 5/5C NFC" - Changed name of "YubiKey 5 Series security key" to "YubiKey 5 Series" webauthn-server-core: Changes: - Fixed crash on unknown attestation statement formats - Unless `RelyingParty.allowUntrustedAttestation` is set to `false`, unknown attestation statements will now pass as untrusted attestations, instead of throwing an IllegalArgumentException. - Disambiguated Jackson deserialization of class `AuthenticatorTransport` New features: - Class `RegisteredCredential` can now be serialized to and deserialized from JSON.
2 parents a32f39b + 68ecba1 commit 8293a6a

File tree

16 files changed

+320
-48
lines changed

16 files changed

+320
-48
lines changed

‎.github/workflows/codeql-analysis.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: "Code scanning - action"
2+
3+
on:
4+
push:
5+
pull_request:
6+
schedule:
7+
- cron: '0 12 * * 2'
8+
9+
jobs:
10+
CodeQL-Build:
11+
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v2
17+
with:
18+
# We must fetch at least the immediate parents so that if this is
19+
# a pull request then we can checkout the head.
20+
fetch-depth: 2
21+
22+
# If this run was triggered by a pull request event, then checkout
23+
# the head of the pull request instead of the merge commit.
24+
- run: git checkout HEAD^2
25+
if: ${{ github.event_name == 'pull_request' }}
26+
27+
# Initializes the CodeQL tools for scanning.
28+
- name: Initialize CodeQL
29+
uses: github/codeql-action/init@v1
30+
31+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
32+
# If this step fails, then you should remove it and run the build manually (see below)
33+
- name: Autobuild
34+
uses: github/codeql-action/autobuild@v1
35+
36+
- name: Perform CodeQL Analysis
37+
uses: github/codeql-action/analyze@v1

‎.github/workflows/release-verify-signatures.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,9 @@ jobs:
2323
java-version: ${{ matrix.java }}
2424

2525
- name: Build jars
26-
run: ./gradlew jar
26+
run: |
27+
java --version
28+
./gradlew jar
2729
2830
- name: Fetch keys
2931
run: gpg --no-default-keyring --keyring yubico --keyserver hkps://keys.openpgp.org --recv-keys 57A9DEED4C6D962A923BB691816F3ED99921835E

‎.github/workflows/scan.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88

99
env:
1010
SCAN_IMG:
11-
yes-docker-local.artifactory.in.yubico.org/static-code-analysis/java:v1
11+
yubico-yes-docker-local.jfrog.io/static-code-analysis/java:v1
1212
SECRET: ${{ secrets.ARTIFACTORY_READER_TOKEN }}
1313

1414
jobs:
@@ -21,7 +21,7 @@ jobs:
2121
- name: Scan and fail on warnings
2222
run: |
2323
if [ "${SECRET}" != "" ]; then
24-
docker login yes-docker-local.artifactory.in.yubico.org/ \
24+
docker login yubico-yes-docker-local.jfrog.io/ \
2525
-u svc-static-code-analysis-reader -p ${SECRET}
2626
docker pull ${SCAN_IMG}
2727
docker run -v${PWD}:/k \

‎NEWS

Lines changed: 40 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,83 @@
1+
== Version 1.7.0 ==
2+
3+
webauthn-server-attestation:
4+
5+
* Updated name of AAGUID `2fc0579f811347eab116bb5a8db9202a` to "YubiKey 5/5C NFC"
6+
* Changed name of "YubiKey 5 Series security key" to "YubiKey 5 Series"
7+
8+
webauthn-server-core:
9+
10+
Changes:
11+
12+
* Fixed crash on unknown attestation statement formats
13+
** Unless `RelyingParty.allowUntrustedAttestation` is set to `false`, unknown
14+
attestation statements will now pass as untrusted attestations, instead of
15+
throwing an IllegalArgumentException.
16+
* Disambiguated Jackson deserialization of class `AuthenticatorTransport`
17+
18+
New features:
19+
20+
* Class `RegisteredCredential` can now be serialized to and deserialized from
21+
JSON.
22+
23+
124
== Version 1.6.4 ==
225

3-
- Changed dependency declarations to version ranges
4-
- Bumped Guava dependency to version [24.1.1,30) in response to CVE-2018-10237
26+
* Changed dependency declarations to version ranges
27+
* Bumped Guava dependency to version [24.1.1,30) in response to CVE-2018-10237
528

629

730
== Version 1.6.3 ==
831

932
webauthn-server-attestation:
1033

11-
- Added new YubiKey AAGUIDs to metadata.json
34+
* Added new YubiKey AAGUIDs to metadata.json
1235

1336

1437
webauthn-server-core:
1538

16-
- Bumped Jackson dependency to version 2.11.0 in response to CVEs:
17-
- CVE-2020-9546
18-
- CVE-2020-10672
19-
- CVE-2020-10969
20-
- CVE-2020-11620
21-
- Fixed incorrect JavaDoc on AssertionResult.isSignatureCounterValid(): it will
39+
* Bumped Jackson dependency to version 2.11.0 in response to CVEs:
40+
** CVE-2020-9546
41+
** CVE-2020-10672
42+
** CVE-2020-10969
43+
** CVE-2020-11620
44+
* Fixed incorrect JavaDoc on AssertionResult.isSignatureCounterValid(): it will
2245
also return true if both counters are zero.
2346

2447

2548
== Version 1.6.2 ==
2649

27-
- Fixed dependencies missing from release POM metadata
50+
* Fixed dependencies missing from release POM metadata
2851

2952

3053
== Version 1.6.1 ==
3154

3255
Security fixes:
3356

34-
- Bumped Jackson dependency to version 2.9.10.3 in response to CVE-2019-20330
57+
* Bumped Jackson dependency to version 2.9.10.3 in response to CVE-2019-20330
3558
and CVE-2020-8840
3659

3760

3861
== Version 1.6.0 ==
3962

4063
Security fixes:
4164

42-
- Bumped Jackson dependency to version 2.9.10.1 which has patched CVE-2019-16942
65+
* Bumped Jackson dependency to version 2.9.10.1 which has patched CVE-2019-16942
4366

4467
`webauthn-server-core`:
4568

4669
Bug fixes:
4770

48-
- Fixed bug introduced in 1.4.0, which caused
71+
* Fixed bug introduced in 1.4.0, which caused
4972
`RegistrationResult.attestationMetadata` to always be empty.
5073

5174

5275
`webauthn-server-attestation`:
5376

54-
- New enum constant `Transport.LIGHTNING`
55-
- Fixed transports field of YubiKey NEO/NEO-n in `metadata.json`.
56-
- Added YubiKey 5Ci to `metadata.json`.
57-
- Most `deviceUrl` fields in `metadata.json` changed to point to stable
77+
* New enum constant `Transport.LIGHTNING`
78+
* Fixed transports field of YubiKey NEO/NEO-n in `metadata.json`.
79+
* Added YubiKey 5Ci to `metadata.json`.
80+
* Most `deviceUrl` fields in `metadata.json` changed to point to stable
5881
addresses in Yubico knowledge base instead of dead redirects in store.
5982

6083

‎build.gradle

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ buildscript {
77
}
88
}
99
plugins {
10-
id 'com.github.kt3k.coveralls' version '2.10.1'
11-
id 'io.codearte.nexus-staging' version '0.21.2'
10+
id 'com.github.kt3k.coveralls' version '2.10.2'
11+
id 'io.codearte.nexus-staging' version '0.22.0'
1212
id 'io.franzbecker.gradle-lombok' version '4.0.0'
1313
}
1414

‎webauthn-server-attestation/src/main/resources/metadata.json

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"identifier": "2fb54029-7613-4f1d-94f1-fb876c14a6fe",
3-
"version": 12,
3+
"version": 14,
44
"vendorInfo": {
55
"url": "https://yubico.com",
66
"imageUrl": "https://developers.yubico.com/U2F/Images/yubico.png",
@@ -72,6 +72,7 @@
7272
}
7373
]
7474
},
75+
7576
{
7677
"deviceId": "1.3.6.1.4.1.41482.1.2",
7778
"displayName": "YubiKey NEO/NEO-n",
@@ -94,6 +95,7 @@
9495
}
9596
]
9697
},
98+
9799
{
98100
"deviceId": "1.3.6.1.4.1.41482.1.3",
99101
"displayName": "YubiKey Plus",
@@ -116,6 +118,7 @@
116118
}
117119
]
118120
},
121+
119122
{
120123
"deviceId": "1.3.6.1.4.1.41482.1.4",
121124
"displayName": "YubiKey Edge",
@@ -132,6 +135,7 @@
132135
}
133136
]
134137
},
138+
135139
{
136140
"deviceId": "1.3.6.1.4.1.41482.1.5",
137141
"displayName": "YubiKey 4/YubiKey 4 Nano",
@@ -148,6 +152,7 @@
148152
}
149153
]
150154
},
155+
151156
{
152157
"deviceId": "1.3.6.1.4.1.41482.1.7",
153158
"displayName": "YubiKey 5 NFC",
@@ -164,7 +169,17 @@
164169
"value": "fa2b99dc9e3942578f924a30d23c4118"
165170
}
166171
}
167-
},
172+
}
173+
]
174+
},
175+
176+
{
177+
"deviceId": "1.3.6.1.4.1.41482.1.7",
178+
"displayName": "YubiKey 5/5C NFC",
179+
"transports": 12,
180+
"deviceUrl": "https://support.yubico.com/support/solutions/articles/15000014174--yubikey-5-nfc",
181+
"imageUrl": "https://developers.yubico.com/U2F/Images/YK5.png",
182+
"selectors": [
168183
{
169184
"type": "x509Extension",
170185
"parameters": {
@@ -177,9 +192,10 @@
177192
}
178193
]
179194
},
195+
180196
{
181197
"deviceId": "1.3.6.1.4.1.41482.1.7",
182-
"displayName": "YubiKey 5 Series security key",
198+
"displayName": "YubiKey 5 Series",
183199
"transports": 4,
184200
"deviceUrl": "https://support.yubico.com/support/solutions/articles/15000014180-yubikey-5c",
185201
"imageUrl": "https://developers.yubico.com/U2F/Images/YK5-series.png",
@@ -206,6 +222,7 @@
206222
}
207223
]
208224
},
225+
209226
{
210227
"deviceId": "1.3.6.1.4.1.41482.1.7",
211228
"displayName": "YubiKey 5Ci",

‎webauthn-server-attestation/src/test/scala/com/yubico/webauthn/attestation/DeviceIdentificationSpec.scala

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,17 @@ class DeviceIdentificationSpec extends FunSpec with Matchers {
9494
it("a YubiKey 5 NFC.") {
9595
check("YubiKey 5 NFC", RealExamples.YubiKey5, Set(USB, NFC))
9696
}
97+
it("an early YubiKey 5 NFC.") {
98+
check("YubiKey 5 NFC", RealExamples.YubiKey5Nfc, Set(USB, NFC))
99+
}
100+
it("a newer YubiKey 5 NFC.") {
101+
check("YubiKey 5/5C NFC", RealExamples.YubiKey5NfcPost5cNfc, Set(USB, NFC))
102+
}
103+
it("a YubiKey 5C NFC.") {
104+
check("YubiKey 5/5C NFC", RealExamples.YubiKey5cNfc, Set(USB, NFC))
105+
}
97106
it("a YubiKey 5 Nano.") {
98-
check("YubiKey 5 Series security key", RealExamples.YubiKey5Nano, Set(USB))
107+
check("YubiKey 5 Series", RealExamples.YubiKey5Nano, Set(USB))
99108
}
100109
it("a YubiKey 5Ci.") {
101110
check("YubiKey 5Ci", RealExamples.YubiKey5Ci, Set(USB, LIGHTNING))
@@ -133,8 +142,17 @@ class DeviceIdentificationSpec extends FunSpec with Matchers {
133142
it("a YubiKey 5 NFC.") {
134143
check("YubiKey 5 NFC", RealExamples.YubiKey5, Set(USB, NFC))
135144
}
145+
it("an early YubiKey 5 NFC.") {
146+
check("YubiKey 5 NFC", RealExamples.YubiKey5Nfc, Set(USB, NFC))
147+
}
148+
it("a newer YubiKey 5 NFC.") {
149+
check("YubiKey 5/5C NFC", RealExamples.YubiKey5NfcPost5cNfc, Set(USB, NFC))
150+
}
151+
it("a YubiKey 5C NFC.") {
152+
check("YubiKey 5/5C NFC", RealExamples.YubiKey5cNfc, Set(USB, NFC))
153+
}
136154
it("a YubiKey 5 Nano.") {
137-
check("YubiKey 5 Series security key", RealExamples.YubiKey5Nano, Set(USB))
155+
check("YubiKey 5 Series", RealExamples.YubiKey5Nano, Set(USB))
138156
}
139157
it("a YubiKey 5Ci.") {
140158
check("YubiKey 5Ci", RealExamples.YubiKey5Ci, Set(USB, LIGHTNING))

‎webauthn-server-core/src/main/java/com/yubico/webauthn/FinishRegistrationSteps.java

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -463,7 +463,7 @@ public AttestationType attestationType() {
463463
return AttestationType.ECDAA;
464464
}
465465
default:
466-
throw new IllegalArgumentException("Failed to resolve attestation type; unknown attestation statement format: " + attestation.getFormat());
466+
return AttestationType.UNKNOWN;
467467
}
468468
}
469469
} catch (IOException | CoseException | CertificateException e) {
@@ -509,6 +509,7 @@ public Optional<AttestationTrustResolver> trustResolver() {
509509
switch (attestationType) {
510510
case NONE:
511511
case SELF_ATTESTATION:
512+
case UNKNOWN:
512513
return Optional.empty();
513514

514515
case ATTESTATION_CA:
@@ -562,6 +563,10 @@ public void validate() {
562563
assure(allowUntrustedAttestation, "No attestation is not allowed.");
563564
break;
564565

566+
case UNKNOWN:
567+
assure(allowUntrustedAttestation, "Unknown attestation statement formats are not allowed.");
568+
break;
569+
565570
default:
566571
throw new UnsupportedOperationException("Attestation type not implemented: " + attestationType);
567572
}
@@ -574,8 +579,9 @@ public Step17 nextStep() {
574579

575580
public boolean attestationTrusted() {
576581
switch (attestationType) {
577-
case SELF_ATTESTATION:
578582
case NONE:
583+
case SELF_ATTESTATION:
584+
case UNKNOWN:
579585
return false;
580586

581587
case ATTESTATION_CA:

‎webauthn-server-core/src/main/java/com/yubico/webauthn/RegisteredCredential.java

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,14 +24,14 @@
2424

2525
package com.yubico.webauthn;
2626

27+
import com.fasterxml.jackson.annotation.JsonCreator;
28+
import com.fasterxml.jackson.annotation.JsonProperty;
2729
import com.yubico.webauthn.data.AttestedCredentialData;
2830
import com.yubico.webauthn.data.AuthenticatorAssertionResponse;
2931
import com.yubico.webauthn.data.AuthenticatorData;
3032
import com.yubico.webauthn.data.ByteArray;
3133
import com.yubico.webauthn.data.PublicKeyCredentialDescriptor;
3234
import com.yubico.webauthn.data.UserIdentity;
33-
import lombok.AccessLevel;
34-
import lombok.AllArgsConstructor;
3535
import lombok.Builder;
3636
import lombok.NonNull;
3737
import lombok.Value;
@@ -46,9 +46,8 @@
4646
* </p>
4747
*/
4848
@Value
49-
@AllArgsConstructor(access = AccessLevel.PRIVATE)
5049
@Builder(toBuilder = true)
51-
public class RegisteredCredential {
50+
public final class RegisteredCredential {
5251

5352
/**
5453
* The <a href="https://www.w3.org/TR/2019/PR-webauthn-20190117/#credential-id">credential ID</a> of the
@@ -103,6 +102,19 @@ public class RegisteredCredential {
103102
@Builder.Default
104103
private final long signatureCount = 0;
105104

105+
@JsonCreator
106+
private RegisteredCredential(
107+
@NonNull @JsonProperty("credentialId") ByteArray credentialId,
108+
@NonNull @JsonProperty("userHandle") ByteArray userHandle,
109+
@NonNull @JsonProperty("publicKeyCose") ByteArray publicKeyCose,
110+
@JsonProperty("signatureCount") long signatureCount
111+
) {
112+
this.credentialId = credentialId;
113+
this.userHandle = userHandle;
114+
this.publicKeyCose = publicKeyCose;
115+
this.signatureCount = signatureCount;
116+
}
117+
106118
public static RegisteredCredentialBuilder.MandatoryStages builder() {
107119
return new RegisteredCredentialBuilder.MandatoryStages();
108120
}

0 commit comments

Comments
 (0)