Skip to content

Commit 8eb6278

Browse files
emlunemlun
committed
Release 1.12.3
Fixes: - Fixed `PublicKeyCredential` failing to parse from JSON if an `"authenticatorAttachment"` attribute was present. - Bumped Jackson dependency to version [2.13.2.1,3) in response to CVE-2020-36518 - Fixed bug in `RelyingParty.finishAssertion` that would throw a nondescript `NoSuchElementException` if username and user handle are both absent, instead of an `IllegalArgumentException` with a better error message.
2 parents 5f14dc4 + c81c9a8 commit 8eb6278

File tree

20 files changed

+97
-542
lines changed

20 files changed

+97
-542
lines changed

‎NEWS

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
1+
== Version 1.12.3 ==
2+
3+
Fixes:
4+
5+
* Fixed `PublicKeyCredential` failing to parse from JSON if an
6+
`"authenticatorAttachment"` attribute was present.
7+
* Bumped Jackson dependency to version [2.13.2.1,3) in response to
8+
CVE-2020-36518
9+
* Fixed bug in `RelyingParty.finishAssertion` that would throw a nondescript
10+
`NoSuchElementException` if username and user handle are both absent, instead
11+
of an `IllegalArgumentException` with a better error message.
12+
13+
114
== Version 1.12.2 ==
215

316
Fixes:

‎README

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,15 @@ Maven:
2525
<dependency>
2626
<groupId>com.yubico</groupId>
2727
<artifactId>webauthn-server-core</artifactId>
28-
<version>1.12.2</version>
28+
<version>1.12.3</version>
2929
<scope>compile</scope>
3030
</dependency>
3131
----------
3232

3333
Gradle:
3434

3535
----------
36-
compile 'com.yubico:webauthn-server-core:1.12.2'
36+
compile 'com.yubico:webauthn-server-core:1.12.3'
3737
----------
3838

3939
=== Semantic versioning

‎build.gradle

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ buildscript {
44
}
55
dependencies {
66
classpath 'com.cinnober.gradle:semver-git:2.5.0'
7-
classpath 'com.diffplug.spotless:spotless-plugin-gradle:6.2.0'
7+
classpath 'com.diffplug.spotless:spotless-plugin-gradle:6.3.0'
88
classpath 'io.github.cosmicsilence:gradle-scalafix:0.1.8'
99
}
1010
}
@@ -45,11 +45,17 @@ wrapper {
4545

4646
dependencies {
4747
constraints {
48-
api('ch.qos.logback:logback-classic:[1.2.3,2)')
4948
api('com.augustcellars.cose:cose-java:[1.0.0,2)')
50-
api('com.fasterxml.jackson.core:jackson-databind:[2.11.0,3)')
51-
api('com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:[2.11.0,3)')
52-
api('com.fasterxml.jackson.datatype:jackson-datatype-jdk8:[2.11.0,3)')
49+
api('com.fasterxml.jackson.core:jackson-databind:[2.13.2.1,3)')
50+
api('com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:[2.13.2,3)')
51+
api('com.fasterxml.jackson.datatype:jackson-datatype-jdk8:[2.13.2,3)')
52+
api('com.fasterxml.jackson:jackson-bom') {
53+
version {
54+
strictly '[2.13.2.1,3)'
55+
reject '2.13.2.1'
56+
}
57+
because 'jackson-databind 2.13.2.1 references nonexistent BOM'
58+
}
5359
api('com.google.guava:guava:[24.1.1,31)')
5460
api('com.upokecenter:cbor:[4.5.1,5)')
5561
api('javax.ws.rs:javax.ws.rs-api:[2.1,3)')

‎webauthn-server-attestation/build.gradle

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,17 +40,10 @@ dependencies {
4040
'org.scalatest:scalatest_2.13',
4141
)
4242

43-
testRuntimeOnly(
44-
'ch.qos.logback:logback-classic',
45-
)
4643
testRuntimeOnly(
4744
// Transitive dependency from :webauthn-server-core:test
4845
'org.bouncycastle:bcpkix-jdk15on',
4946
)
50-
51-
testRuntimeOnly(
52-
'ch.qos.logback:logback-classic',
53-
)
5447
}
5548

5649

‎webauthn-server-attestation/src/test/resources/logback.xml

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎webauthn-server-core/build.gradle

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,6 @@ dependencies {
4646
'org.scalacheck:scalacheck_2.13',
4747
'org.scalatest:scalatest_2.13',
4848
)
49-
50-
testRuntimeOnly(
51-
'ch.qos.logback:logback-classic',
52-
)
5349
}
5450

5551
jar {

‎webauthn-server-core/src/main/java/com/yubico/webauthn/FinishAssertionSteps.java

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -124,16 +124,19 @@ class Step0 implements Step<Step1> {
124124
.getUserHandle()
125125
.map(Optional::of)
126126
.orElseGet(
127-
() -> credentialRepository.getUserHandleForUsername(request.getUsername().get()));
127+
() ->
128+
request.getUsername().flatMap(credentialRepository::getUserHandleForUsername));
128129

129130
private final Optional<String> username =
130131
request
131132
.getUsername()
132133
.map(Optional::of)
133134
.orElseGet(
134135
() ->
135-
credentialRepository.getUsernameForUserHandle(
136-
response.getResponse().getUserHandle().get()));
136+
response
137+
.getResponse()
138+
.getUserHandle()
139+
.flatMap(credentialRepository::getUsernameForUserHandle));
137140

138141
@Override
139142
public Step1 nextStep() {
@@ -147,12 +150,12 @@ public void validate() {
147150
"At least one of username and user handle must be given; none was.");
148151
assure(
149152
userHandle.isPresent(),
150-
"No user found for username: %s, userHandle: %s",
153+
"User handle not found for username: %s",
151154
request.getUsername(),
152155
response.getResponse().getUserHandle());
153156
assure(
154157
username.isPresent(),
155-
"No user found for username: %s, userHandle: %s",
158+
"Username not found for userHandle: %s",
156159
request.getUsername(),
157160
response.getResponse().getUserHandle());
158161
}

‎webauthn-server-core/src/main/java/com/yubico/webauthn/data/PublicKeyCredential.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
package com.yubico.webauthn.data;
2626

2727
import com.fasterxml.jackson.annotation.JsonCreator;
28+
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
2829
import com.fasterxml.jackson.annotation.JsonProperty;
2930
import com.fasterxml.jackson.core.type.TypeReference;
3031
import com.yubico.internal.util.JacksonCodecs;
@@ -45,6 +46,7 @@
4546
*/
4647
@Value
4748
@Builder(toBuilder = true)
49+
@JsonIgnoreProperties({"authenticatorAttachment"})
4850
public class PublicKeyCredential<
4951
A extends AuthenticatorResponse, B extends ClientExtensionOutputs> {
5052

‎webauthn-server-core/src/test/resources/logback.xml

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎webauthn-server-core/src/test/scala/com/yubico/webauthn/OriginMatcherSpec.scala

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,6 @@ class OriginMatcherSpec
101101
it("accepts nothing if no allowed origins are given.") {
102102
forAll(urlOrArbitraryString, arbitrary[Boolean], arbitrary[Boolean]) {
103103
(origin, allowPort, allowSubdomain) =>
104-
println(origin)
105104
OriginMatcher.isAllowed(
106105
origin,
107106
Set.empty[String].asJava,
@@ -114,7 +113,6 @@ class OriginMatcherSpec
114113
it("always accepts string equality even for invalid URLs.") {
115114
forAll(urlOrArbitraryString, arbitrary[Boolean], arbitrary[Boolean]) {
116115
(origin, allowPort, allowSubdomain) =>
117-
println(origin)
118116
OriginMatcher.isAllowed(
119117
origin,
120118
Set(origin).asJava,
@@ -127,7 +125,6 @@ class OriginMatcherSpec
127125
it("does not accept superdomains.") {
128126
forAll(superAndSubdomain) {
129127
case (origin: URL, allowedOrigin: URL) =>
130-
println(allowedOrigin, origin)
131128
OriginMatcher.isAllowed(
132129
origin.toExternalForm,
133130
Set(allowedOrigin.toExternalForm).asJava,
@@ -141,7 +138,6 @@ class OriginMatcherSpec
141138
it("by default.") {
142139
forAll(superAndSubdomain, arbitrary[Boolean]) { (origins, allowPort) =>
143140
val (allowedOrigin: URL, origin: URL) = origins
144-
println(allowedOrigin, origin)
145141

146142
OriginMatcher.isAllowed(
147143
origin.toExternalForm,
@@ -156,8 +152,6 @@ class OriginMatcherSpec
156152
forAll(superAndSubdomain) {
157153
case (allowedOrigin: URL, origin: URL) =>
158154
val invalidAllowedOrigin = invalidize(allowedOrigin)
159-
println(allowedOrigin, origin, invalidAllowedOrigin)
160-
161155
OriginMatcher.isAllowed(
162156
origin.toExternalForm,
163157
Set(invalidAllowedOrigin).asJava,
@@ -171,8 +165,6 @@ class OriginMatcherSpec
171165
forAll(superAndSubdomain) {
172166
case (allowedOrigin: URL, origin: URL) =>
173167
val invalidOrigin = invalidize(origin)
174-
println(allowedOrigin, origin, invalidOrigin)
175-
176168
OriginMatcher.isAllowed(
177169
invalidOrigin,
178170
Set(allowedOrigin.toExternalForm).asJava,
@@ -185,8 +177,6 @@ class OriginMatcherSpec
185177
it("unless configured to.") {
186178
forAll(superAndSubdomain, arbitrary[Boolean]) { (origins, allowPort) =>
187179
val (allowedOrigin: URL, origin: URL) = origins
188-
println(allowedOrigin, origin)
189-
190180
OriginMatcher.isAllowed(
191181
origin.toExternalForm,
192182
Set(allowedOrigin.toExternalForm).asJava,
@@ -203,8 +193,6 @@ class OriginMatcherSpec
203193
(allowedOrigin, port, allowSubdomain) =>
204194
whenever(port > 0) {
205195
val origin = replacePort(allowedOrigin, port)
206-
println(allowedOrigin, origin)
207-
208196
OriginMatcher.isAllowed(
209197
origin.toExternalForm,
210198
Set(allowedOrigin.toExternalForm).asJava,
@@ -218,8 +206,6 @@ class OriginMatcherSpec
218206
it("unless the same port is specified in an allowed origin.") {
219207
forAll(urlWithPort, arbitrary[Boolean]) {
220208
(origin: URL, allowSubdomain: Boolean) =>
221-
println(origin)
222-
223209
OriginMatcher.isAllowed(
224210
origin.toExternalForm,
225211
Set(origin.toExternalForm).asJava,
@@ -242,8 +228,6 @@ class OriginMatcherSpec
242228
port,
243229
allowedOrigin.getFile,
244230
)
245-
println(allowedOrigin, origin)
246-
247231
OriginMatcher.isAllowed(
248232
origin.toExternalForm,
249233
Set(allowedOrigin.toExternalForm).asJava,
@@ -258,8 +242,6 @@ class OriginMatcherSpec
258242
it("accepts subdomains and arbitrary ports when configured to.") {
259243
forAll(superAndSubdomainWithPorts) {
260244
case (allowedOrigin, origin) =>
261-
println(allowedOrigin, origin)
262-
263245
OriginMatcher.isAllowed(
264246
origin.toExternalForm,
265247
Set(allowedOrigin.toExternalForm).asJava,

0 commit comments

Comments
 (0)