AttestationObject.java

// Copyright (c) 2018, Yubico AB
// All rights reserved.
//
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are met:
//
// 1. Redistributions of source code must retain the above copyright notice, this
//    list of conditions and the following disclaimer.
//
// 2. Redistributions in binary form must reproduce the above copyright notice,
//    this list of conditions and the following disclaimer in the documentation
//    and/or other materials provided with the distribution.
//
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package com.yubico.webauthn.data;

import com.fasterxml.jackson.annotation.JsonCreator;
import com.fasterxml.jackson.core.JsonGenerator;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.SerializerProvider;
import com.fasterxml.jackson.databind.annotation.JsonSerialize;
import com.fasterxml.jackson.databind.node.ObjectNode;
import com.yubico.internal.util.JacksonCodecs;
import java.io.IOException;
import lombok.NonNull;
import lombok.Value;

/**
 * Authenticators MUST provide some form of attestation. The basic requirement is that the
 * authenticator can produce, for each credential public key, an attestation statement verifiable by
 * the WebAuthn Relying Party. Typically, this attestation statement contains a signature by an
 * attestation private key over the attested credential public key and a challenge, as well as a
 * certificate or similar data providing provenance information for the attestation public key,
 * enabling the Relying Party to make a trust decision. However, if an attestation key pair is not
 * available, then the authenticator MUST perform <a
 * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#self-attestation">self attestation</a>
 * of the credential public key with the corresponding credential private key. All this information
 * is returned by authenticators any time a new public key credential is generated, in the overall
 * form of an attestation object. The relationship of the attestation object with authenticator data
 * (containing attested credential data) and the attestation statement is illustrated in <a
 * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#fig-attStructs">figure 5</a>.
 *
 * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-attestation">§6.4.
 *     Attestation</a>
 */
@Value
@JsonSerialize(using = AttestationObject.JsonSerializer.class)
public class AttestationObject {

  /**
   * The original raw byte array that this object is decoded from.
   *
   * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-attestation">§6.4.
   *     Attestation</a>
   */
  @NonNull private final ByteArray bytes;

  /**
   * The authenticator data embedded inside this attestation object. This is one part of the signed
   * data that the signature in the attestation statement (if any) is computed over.
   */
  @NonNull private final transient AuthenticatorData authenticatorData;

  /**
   * The attestation statement format identifier of this attestation object.
   *
   * @see <a
   *     href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-defined-attestation-formats">§8.
   *     Defined Attestation Statement Formats</a>
   *     <p>Users of this library should not need to access this value directly.
   */
  @NonNull private final transient String format;

  /**
   * An important component of the attestation object is the attestation statement. This is a
   * specific type of signed data object, containing statements about a public key credential itself
   * and the authenticator that created it. It contains an attestation signature created using the
   * key of the attesting authority (except for the case of self attestation, when it is created
   * using the credential private key).
   *
   * <p>Users of this library should not need to access this value directly.
   */
  @NonNull private final transient ObjectNode attestationStatement;

  /**
   * Decode an {@link AttestationObject} object from a raw attestation object byte array.
   *
   * @throws IOException if <code>bytes</code> cannot be parsed as a CBOR map.
   */
  @JsonCreator
  public AttestationObject(@NonNull ByteArray bytes) throws IOException {
    this.bytes = bytes;

    final JsonNode decoded = JacksonCodecs.cbor().readTree(bytes.getBytes());
    final ByteArray authDataBytes;

    if (!decoded.isObject()) {
      throw new IllegalArgumentException(
          String.format("Attestation object must be a CBOR map, was: %s", decoded.getNodeType()));
    }

    final JsonNode authData = decoded.get("authData");
    if (authData == null) {
      throw new IllegalArgumentException(
          "Required property \"authData\" missing from attestation object: "
              + bytes.getBase64Url());
    } else {
      if (authData.isBinary()) {
        authDataBytes = new ByteArray(authData.binaryValue());
      } else {
        throw new IllegalArgumentException(
            String.format(
                "Property \"authData\" of attestation object must be a CBOR byte array, was: %s. Attestation object: %s",
                authData.getNodeType(), bytes.getBase64Url()));
      }
    }

    final JsonNode format = decoded.get("fmt");
    if (format == null) {
      throw new IllegalArgumentException(
          "Required property \"fmt\" missing from attestation object: " + bytes.getBase64Url());
    } else {
      if (format.isTextual()) {
        this.format = decoded.get("fmt").textValue();
      } else {
        throw new IllegalArgumentException(
            String.format(
                "Property \"fmt\" of attestation object must be a CBOR text value, was: %s. Attestation object: %s",
                format.getNodeType(), bytes.getBase64Url()));
      }
    }

    final JsonNode attStmt = decoded.get("attStmt");
    if (attStmt == null) {
      throw new IllegalArgumentException(
          "Required property \"attStmt\" missing from attestation object: " + bytes.getBase64Url());
    } else {
      if (attStmt.isObject()) {
        this.attestationStatement = (ObjectNode) attStmt;
      } else {
        throw new IllegalArgumentException(
            String.format(
                "Property \"attStmt\" of attestation object must be a CBOR map, was: %s. Attestation object: %s",
                attStmt.getNodeType(), bytes.getBase64Url()));
      }
    }

    authenticatorData = new AuthenticatorData(authDataBytes);
  }

  static class JsonSerializer
      extends com.fasterxml.jackson.databind.JsonSerializer<AttestationObject> {
    @Override
    public void serialize(
        AttestationObject value, JsonGenerator gen, SerializerProvider serializers)
        throws IOException {
      gen.writeString(value.getBytes().getBase64Url());
    }
  }
}











Active mutators

CONDITIONALS_BOUNDARY
EMPTY_RETURNS
FALSE_RETURNS
INCREMENTS
INVERT_NEGS
MATH
NEGATE_CONDITIONALS
NULL_RETURNS
PRIMITIVE_RETURNS
TRUE_RETURNS
VOID_METHOD_CALLS

Tests examined

com.yubico.webauthn.data.AttestationObjectSpec (15 ms)
com.yubico.webauthn.data.AuthenticatorAttestationResponseSpec (1 ms)
com.yubico.webauthn.data.ExtensionsSpec (220 ms)
com.yubico.webauthn.data.BuildersSpec (494 ms)
com.yubico.webauthn.PackedAttestationStatementVerifierSpec (738 ms)
com.yubico.webauthn.RelyingPartyCeremoniesSpec (664 ms)
com.yubico.webauthn.RelyingPartyV2AssertionSpec (844 ms)
com.yubico.webauthn.AppleAttestationStatementVerifierSpec (1111 ms)
com.yubico.webauthn.RelyingPartyAssertionSpec (1883 ms)
com.yubico.webauthn.data.JsonIoSpec (3834 ms)
com.yubico.webauthn.RelyingPartyV2RegistrationSpec (8702 ms)
com.yubico.webauthn.RelyingPartyRegistrationSpec (11335 ms)

Report generated by PIT 1.15.0

1		// Copyright (c) 2018, Yubico AB
2		// All rights reserved.
3		//
4		// Redistribution and use in source and binary forms, with or without
5		// modification, are permitted provided that the following conditions are met:
6		//
7		// 1. Redistributions of source code must retain the above copyright notice, this
8		// list of conditions and the following disclaimer.
9		//
10		// 2. Redistributions in binary form must reproduce the above copyright notice,
11		// this list of conditions and the following disclaimer in the documentation
12		// and/or other materials provided with the distribution.
13		//
14		// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
15		// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16		// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17		// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
18		// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19		// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
20		// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
21		// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
22		// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23		// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24
25		package com.yubico.webauthn.data;
26
27		import com.fasterxml.jackson.annotation.JsonCreator;
28		import com.fasterxml.jackson.core.JsonGenerator;
29		import com.fasterxml.jackson.databind.JsonNode;
30		import com.fasterxml.jackson.databind.SerializerProvider;
31		import com.fasterxml.jackson.databind.annotation.JsonSerialize;
32		import com.fasterxml.jackson.databind.node.ObjectNode;
33		import com.yubico.internal.util.JacksonCodecs;
34		import java.io.IOException;
35		import lombok.NonNull;
36		import lombok.Value;
37
38		/**
39		* Authenticators MUST provide some form of attestation. The basic requirement is that the
40		* authenticator can produce, for each credential public key, an attestation statement verifiable by
41		* the WebAuthn Relying Party. Typically, this attestation statement contains a signature by an
42		* attestation private key over the attested credential public key and a challenge, as well as a
43		* certificate or similar data providing provenance information for the attestation public key,
44		* enabling the Relying Party to make a trust decision. However, if an attestation key pair is not
45		* available, then the authenticator MUST perform <a
46		* href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#self-attestation">self attestation</a>
47		* of the credential public key with the corresponding credential private key. All this information
48		* is returned by authenticators any time a new public key credential is generated, in the overall
49		* form of an attestation object. The relationship of the attestation object with authenticator data
50		* (containing attested credential data) and the attestation statement is illustrated in <a
51		* href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#fig-attStructs">figure 5</a>.
52		*
53		* @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-attestation">§6.4.
54		* Attestation</a>
55		*/
56		@Value
57		@JsonSerialize(using = AttestationObject.JsonSerializer.class)
58		public class AttestationObject {
59
60		/**
61		* The original raw byte array that this object is decoded from.
62		*
63		* @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-attestation">§6.4.
64		* Attestation</a>
65		*/
66		@NonNull private final ByteArray bytes;
67
68		/**
69		* The authenticator data embedded inside this attestation object. This is one part of the signed
70		* data that the signature in the attestation statement (if any) is computed over.
71		*/
72		@NonNull private final transient AuthenticatorData authenticatorData;
73
74		/**
75		* The attestation statement format identifier of this attestation object.
76		*
77		* @see <a
78		* href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-defined-attestation-formats">§8.
79		* Defined Attestation Statement Formats</a>
80		* <p>Users of this library should not need to access this value directly.
81		*/
82		@NonNull private final transient String format;
83
84		/**
85		* An important component of the attestation object is the attestation statement. This is a
86		* specific type of signed data object, containing statements about a public key credential itself
87		* and the authenticator that created it. It contains an attestation signature created using the
88		* key of the attesting authority (except for the case of self attestation, when it is created
89		* using the credential private key).
90		*
91		* <p>Users of this library should not need to access this value directly.
92		*/
93		@NonNull private final transient ObjectNode attestationStatement;
94
95		/**
96		* Decode an {@link AttestationObject} object from a raw attestation object byte array.
97		*
98		* @throws IOException if <code>bytes</code> cannot be parsed as a CBOR map.
99		*/
100		@JsonCreator
101	1 1. <init> : negated conditional → KILLED	public AttestationObject(@NonNull ByteArray bytes) throws IOException {
102		this.bytes = bytes;
103
104		final JsonNode decoded = JacksonCodecs.cbor().readTree(bytes.getBytes());
105		final ByteArray authDataBytes;
106
107	1 1. <init> : negated conditional → KILLED	if (!decoded.isObject()) {
108		throw new IllegalArgumentException(
109		String.format("Attestation object must be a CBOR map, was: %s", decoded.getNodeType()));
110		}
111
112		final JsonNode authData = decoded.get("authData");
113	1 1. <init> : negated conditional → KILLED	if (authData == null) {
114		throw new IllegalArgumentException(
115		"Required property \"authData\" missing from attestation object: "
116		+ bytes.getBase64Url());
117		} else {
118	1 1. <init> : negated conditional → KILLED	if (authData.isBinary()) {
119		authDataBytes = new ByteArray(authData.binaryValue());
120		} else {
121		throw new IllegalArgumentException(
122		String.format(
123		"Property \"authData\" of attestation object must be a CBOR byte array, was: %s. Attestation object: %s",
124		authData.getNodeType(), bytes.getBase64Url()));
125		}
126		}
127
128		final JsonNode format = decoded.get("fmt");
129	1 1. <init> : negated conditional → KILLED	if (format == null) {
130		throw new IllegalArgumentException(
131		"Required property \"fmt\" missing from attestation object: " + bytes.getBase64Url());
132		} else {
133	1 1. <init> : negated conditional → KILLED	if (format.isTextual()) {
134		this.format = decoded.get("fmt").textValue();
135		} else {
136		throw new IllegalArgumentException(
137		String.format(
138		"Property \"fmt\" of attestation object must be a CBOR text value, was: %s. Attestation object: %s",
139		format.getNodeType(), bytes.getBase64Url()));
140		}
141		}
142
143		final JsonNode attStmt = decoded.get("attStmt");
144	1 1. <init> : negated conditional → KILLED	if (attStmt == null) {
145		throw new IllegalArgumentException(
146		"Required property \"attStmt\" missing from attestation object: " + bytes.getBase64Url());
147		} else {
148	1 1. <init> : negated conditional → KILLED	if (attStmt.isObject()) {
149		this.attestationStatement = (ObjectNode) attStmt;
150		} else {
151		throw new IllegalArgumentException(
152		String.format(
153		"Property \"attStmt\" of attestation object must be a CBOR map, was: %s. Attestation object: %s",
154		attStmt.getNodeType(), bytes.getBase64Url()));
155		}
156		}
157
158		authenticatorData = new AuthenticatorData(authDataBytes);
159		}
160
161		static class JsonSerializer
162		extends com.fasterxml.jackson.databind.JsonSerializer<AttestationObject> {
163		@Override
164		public void serialize(
165		AttestationObject value, JsonGenerator gen, SerializerProvider serializers)
166		throws IOException {
167	1 1. serialize : removed call to com/fasterxml/jackson/core/JsonGenerator::writeString → KILLED	gen.writeString(value.getBytes().getBase64Url());
168		}
169		}
170		}
		Mutations
101		1.1 Location : <init> Killed by : com.yubico.webauthn.data.AttestationObjectSpec negated conditional → KILLED
107		1.1 Location : <init> Killed by : com.yubico.webauthn.data.AttestationObjectSpec negated conditional → KILLED
113		1.1 Location : <init> Killed by : com.yubico.webauthn.data.AttestationObjectSpec negated conditional → KILLED
118		1.1 Location : <init> Killed by : com.yubico.webauthn.data.AttestationObjectSpec negated conditional → KILLED
129		1.1 Location : <init> Killed by : com.yubico.webauthn.data.AttestationObjectSpec negated conditional → KILLED
133		1.1 Location : <init> Killed by : com.yubico.webauthn.data.AttestationObjectSpec negated conditional → KILLED
144		1.1 Location : <init> Killed by : com.yubico.webauthn.data.AttestationObjectSpec negated conditional → KILLED
148		1.1 Location : <init> Killed by : com.yubico.webauthn.data.AttestationObjectSpec negated conditional → KILLED
167		1.1 Location : serialize Killed by : com.yubico.webauthn.data.JsonIoSpec removed call to com/fasterxml/jackson/core/JsonGenerator::writeString → KILLED

AttestationObject.java

Mutations

Active mutators

Tests examined