| 1 | // Copyright (c) 2018, Yubico AB | |
| 2 | // All rights reserved. | |
| 3 | // | |
| 4 | // Redistribution and use in source and binary forms, with or without | |
| 5 | // modification, are permitted provided that the following conditions are met: | |
| 6 | // | |
| 7 | // 1. Redistributions of source code must retain the above copyright notice, this | |
| 8 | // list of conditions and the following disclaimer. | |
| 9 | // | |
| 10 | // 2. Redistributions in binary form must reproduce the above copyright notice, | |
| 11 | // this list of conditions and the following disclaimer in the documentation | |
| 12 | // and/or other materials provided with the distribution. | |
| 13 | // | |
| 14 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" | |
| 15 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |
| 16 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | |
| 17 | // DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE | |
| 18 | // FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | |
| 19 | // DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR | |
| 20 | // SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER | |
| 21 | // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, | |
| 22 | // OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | |
| 23 | // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| 24 | ||
| 25 | package com.yubico.webauthn.data; | |
| 26 | ||
| 27 | import com.fasterxml.jackson.annotation.JsonCreator; | |
| 28 | import com.fasterxml.jackson.annotation.JsonProperty; | |
| 29 | import com.fasterxml.jackson.core.type.TypeReference; | |
| 30 | import com.yubico.internal.util.JacksonCodecs; | |
| 31 | import com.yubico.webauthn.AssertionResult; | |
| 32 | import com.yubico.webauthn.FinishAssertionOptions; | |
| 33 | import com.yubico.webauthn.FinishRegistrationOptions; | |
| 34 | import com.yubico.webauthn.RegistrationResult; | |
| 35 | import com.yubico.webauthn.RelyingParty; | |
| 36 | import java.io.IOException; | |
| 37 | import java.util.Optional; | |
| 38 | import lombok.AllArgsConstructor; | |
| 39 | import lombok.Builder; | |
| 40 | import lombok.NonNull; | |
| 41 | import lombok.Value; | |
| 42 | ||
| 43 | /** | |
| 44 | * The PublicKeyCredential interface inherits from Credential <a | |
| 45 | * href="https://www.w3.org/TR/credential-management-1/">[CREDENTIAL-MANAGEMENT-1]</a>, and contains | |
| 46 | * the attributes that are returned to the caller when a new credential is created, or a new | |
| 47 | * assertion is requested. | |
| 48 | * | |
| 49 | * @see <a href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#iface-pkcredential">§5.1. | |
| 50 | * PublicKeyCredential Interface</a> | |
| 51 | */ | |
| 52 | @Value | |
| 53 | @Builder(toBuilder = true) | |
| 54 | public class PublicKeyCredential< | |
| 55 | A extends AuthenticatorResponse, B extends ClientExtensionOutputs> { | |
| 56 | ||
| 57 | /** | |
| 58 | * The raw Credential ID of this credential, corresponding to the <code>rawId</code> attribute in | |
| 59 | * the WebAuthn API. | |
| 60 | */ | |
| 61 | @NonNull private final ByteArray id; | |
| 62 | ||
| 63 | /** | |
| 64 | * The authenticator's response to the client’s request to either create a public key credential, | |
| 65 | * or generate an authentication assertion. | |
| 66 | * | |
| 67 | * <p>If the {@link PublicKeyCredential} was created in response to <code> | |
| 68 | * navigator.credentials.create()</code>, this attribute’s value will be an {@link | |
| 69 | * AuthenticatorAttestationResponse}, otherwise, the {@link PublicKeyCredential} was created in | |
| 70 | * response to <code>navigator.credentials.get()</code>, and this attribute’s value will be an | |
| 71 | * {@link AuthenticatorAssertionResponse}. | |
| 72 | */ | |
| 73 | @NonNull private final A response; | |
| 74 | ||
| 75 | private final AuthenticatorAttachment authenticatorAttachment; | |
| 76 | ||
| 77 | /** | |
| 78 | * A map containing extension identifier → client extension output entries produced by the | |
| 79 | * extension’s client extension processing. | |
| 80 | */ | |
| 81 | @NonNull private final B clientExtensionResults; | |
| 82 | ||
| 83 | /** The {@link PublicKeyCredential}'s type value is the string "public-key". */ | |
| 84 | @NonNull @Builder.Default | |
| 85 | private final PublicKeyCredentialType type = PublicKeyCredentialType.PUBLIC_KEY; | |
| 86 | ||
| 87 | @JsonCreator | |
| 88 | private PublicKeyCredential( | |
| 89 | @JsonProperty("id") ByteArray id, | |
| 90 | @JsonProperty("rawId") ByteArray rawId, | |
| 91 |
1
1. <init> : negated conditional → KILLED |
@NonNull @JsonProperty("response") A response, |
| 92 | @JsonProperty("authenticatorAttachment") AuthenticatorAttachment authenticatorAttachment, | |
| 93 |
1
1. <init> : negated conditional → KILLED |
@NonNull @JsonProperty("clientExtensionResults") B clientExtensionResults, |
| 94 |
1
1. <init> : negated conditional → KILLED |
@NonNull @JsonProperty("type") PublicKeyCredentialType type) { |
| 95 |
2
1. <init> : negated conditional → KILLED 2. <init> : negated conditional → KILLED |
if (id == null && rawId == null) { |
| 96 | throw new NullPointerException("At least one of \"id\" and \"rawId\" must be non-null."); | |
| 97 | } | |
| 98 |
3
1. <init> : negated conditional → KILLED 2. <init> : negated conditional → KILLED 3. <init> : negated conditional → KILLED |
if (id != null && rawId != null && !id.equals(rawId)) { |
| 99 | throw new IllegalArgumentException( | |
| 100 | String.format("\"id\" and \"rawId\" are not equal: %s != %s", id, rawId)); | |
| 101 | } | |
| 102 | ||
| 103 |
1
1. <init> : negated conditional → KILLED |
this.id = id == null ? rawId : id; |
| 104 | this.response = response; | |
| 105 | this.authenticatorAttachment = authenticatorAttachment; | |
| 106 | this.clientExtensionResults = clientExtensionResults; | |
| 107 | this.type = type; | |
| 108 | } | |
| 109 | ||
| 110 | private PublicKeyCredential( | |
| 111 | ByteArray id, | |
| 112 |
1
1. <init> : negated conditional → KILLED |
@NonNull A response, |
| 113 | AuthenticatorAttachment authenticatorAttachment, | |
| 114 |
1
1. <init> : negated conditional → KILLED |
@NonNull B clientExtensionResults, |
| 115 |
1
1. <init> : negated conditional → KILLED |
@NonNull PublicKeyCredentialType type) { |
| 116 | this(id, null, response, authenticatorAttachment, clientExtensionResults, type); | |
| 117 | } | |
| 118 | ||
| 119 | /** | |
| 120 | * The <a href="https://w3c.github.io/webauthn/#authenticator-attachment-modality">authenticator | |
| 121 | * attachment modality</a> in effect at the time the credential was created or used. | |
| 122 | * | |
| 123 | * <p>If parsed from JSON, this will be present if and only if the input was a valid value of | |
| 124 | * {@link AuthenticatorAttachment}. | |
| 125 | * | |
| 126 | * <p>The same value will also be available via {@link | |
| 127 | * RegistrationResult#getAuthenticatorAttachment()} or {@link | |
| 128 | * AssertionResult#getAuthenticatorAttachment()} on the result from {@link | |
| 129 | * RelyingParty#finishRegistration(FinishRegistrationOptions)} or {@link | |
| 130 | * RelyingParty#finishAssertion(FinishAssertionOptions)}. | |
| 131 | * | |
| 132 | * @see RegistrationResult#getAuthenticatorAttachment() | |
| 133 | * @see AssertionResult#getAuthenticatorAttachment() | |
| 134 | * @deprecated EXPERIMENTAL: This feature is from a not yet mature standard; it could change as | |
| 135 | * the standard matures. | |
| 136 | */ | |
| 137 | @Deprecated | |
| 138 | public Optional<AuthenticatorAttachment> getAuthenticatorAttachment() { | |
| 139 |
1
1. getAuthenticatorAttachment : replaced return value with Optional.empty for com/yubico/webauthn/data/PublicKeyCredential::getAuthenticatorAttachment → KILLED |
return Optional.ofNullable(authenticatorAttachment); |
| 140 | } | |
| 141 | ||
| 142 | public static <A extends AuthenticatorResponse, B extends ClientExtensionOutputs> | |
| 143 | PublicKeyCredentialBuilder<A, B>.MandatoryStages builder() { | |
| 144 |
1
1. builder : replaced return value with null for com/yubico/webauthn/data/PublicKeyCredential::builder → KILLED |
return new PublicKeyCredentialBuilder<A, B>().start(); |
| 145 | } | |
| 146 | ||
| 147 | public static class PublicKeyCredentialBuilder< | |
| 148 | A extends AuthenticatorResponse, B extends ClientExtensionOutputs> { | |
| 149 | private MandatoryStages start() { | |
| 150 |
1
1. start : replaced return value with null for com/yubico/webauthn/data/PublicKeyCredential$PublicKeyCredentialBuilder::start → KILLED |
return new MandatoryStages(this); |
| 151 | } | |
| 152 | ||
| 153 | @AllArgsConstructor | |
| 154 | public class MandatoryStages { | |
| 155 | private final PublicKeyCredentialBuilder<A, B> builder; | |
| 156 | ||
| 157 | /** | |
| 158 | * {@link PublicKeyCredentialBuilder#id(ByteArray) id} is a required parameter. | |
| 159 | * | |
| 160 | * @see PublicKeyCredentialBuilder#id(ByteArray) | |
| 161 | */ | |
| 162 | public Step2 id(ByteArray id) { | |
| 163 | builder.id(id); | |
| 164 |
1
1. id : replaced return value with null for com/yubico/webauthn/data/PublicKeyCredential$PublicKeyCredentialBuilder$MandatoryStages::id → KILLED |
return new Step2(); |
| 165 | } | |
| 166 | ||
| 167 | public class Step2 { | |
| 168 | /** | |
| 169 | * {@link PublicKeyCredentialBuilder#response(AuthenticatorResponse) response} is a required | |
| 170 | * parameter. | |
| 171 | * | |
| 172 | * @see PublicKeyCredentialBuilder#response(AuthenticatorResponse) | |
| 173 | */ | |
| 174 | public Step3 response(A response) { | |
| 175 | builder.response(response); | |
| 176 |
1
1. response : replaced return value with null for com/yubico/webauthn/data/PublicKeyCredential$PublicKeyCredentialBuilder$MandatoryStages$Step2::response → KILLED |
return new Step3(); |
| 177 | } | |
| 178 | } | |
| 179 | ||
| 180 | public class Step3 { | |
| 181 | /** | |
| 182 | * {@link PublicKeyCredentialBuilder#clientExtensionResults(ClientExtensionOutputs) | |
| 183 | * clientExtensionResults} is a required parameter. | |
| 184 | * | |
| 185 | * @see PublicKeyCredentialBuilder#clientExtensionResults(ClientExtensionOutputs) | |
| 186 | */ | |
| 187 | public PublicKeyCredentialBuilder<A, B> clientExtensionResults(B clientExtensionResults) { | |
| 188 |
1
1. clientExtensionResults : replaced return value with null for com/yubico/webauthn/data/PublicKeyCredential$PublicKeyCredentialBuilder$MandatoryStages$Step3::clientExtensionResults → KILLED |
return builder.clientExtensionResults(clientExtensionResults); |
| 189 | } | |
| 190 | } | |
| 191 | } | |
| 192 | } | |
| 193 | ||
| 194 | /** | |
| 195 | * Parse a {@link PublicKeyCredential} object from JSON. | |
| 196 | * | |
| 197 | * <p>The <code>json</code> should be of the following format: | |
| 198 | * | |
| 199 | * <pre> | |
| 200 | * { | |
| 201 | * "id": "(resp.id)", | |
| 202 | * "response": { | |
| 203 | * "attestationObject": "(Base64Url encoded resp.attestationObject)", | |
| 204 | * "clientDataJSON": "(Base64Url encoded resp.clientDataJSON)" | |
| 205 | * }, | |
| 206 | * "clientExtensionResults": { (resp.getClientExtensionResults()) }, | |
| 207 | * "type": "public-key" | |
| 208 | * } | |
| 209 | * </pre> | |
| 210 | * | |
| 211 | * <dl> | |
| 212 | * <dt>resp: | |
| 213 | * <dd>The <a | |
| 214 | * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#iface-pkcredential">PublicKeyCredential</a> | |
| 215 | * object returned from a registration ceremony. | |
| 216 | * <dt>id: | |
| 217 | * <dd>The string value of <code>resp.id</code> | |
| 218 | * <dt>response.attestationObject: | |
| 219 | * <dd>The value of <code>resp.attestationObject</code>, Base64Url encoded as a string | |
| 220 | * <dt>response.clientDataJSON: | |
| 221 | * <dd>The value of <code>resp.clientDataJSON</code>, Base64Url encoded as a string | |
| 222 | * <dt>clientExtensionResults: | |
| 223 | * <dd>The return value of <code>resp.getClientExtensionResults()</code> | |
| 224 | * <dt>type: | |
| 225 | * <dd>The literal string value <code>"public-key"</code> | |
| 226 | * </dl> | |
| 227 | * | |
| 228 | * @param json a JSON string of the above format | |
| 229 | * @throws IOException if the <code>json</code> is invalid or cannot be decoded as a {@link | |
| 230 | * PublicKeyCredential} | |
| 231 | */ | |
| 232 | public static PublicKeyCredential< | |
| 233 | AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs> | |
| 234 | parseRegistrationResponseJson(String json) throws IOException { | |
| 235 |
1
1. parseRegistrationResponseJson : replaced return value with null for com/yubico/webauthn/data/PublicKeyCredential::parseRegistrationResponseJson → KILLED |
return JacksonCodecs.json() |
| 236 | .readValue( | |
| 237 | json, | |
| 238 | new TypeReference< | |
| 239 | PublicKeyCredential< | |
| 240 | AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>>() {}); | |
| 241 | } | |
| 242 | ||
| 243 | /** | |
| 244 | * Parse a {@link PublicKeyCredential} object from JSON. | |
| 245 | * | |
| 246 | * <p>The <code>json</code> should be of the following format: | |
| 247 | * | |
| 248 | * <pre> | |
| 249 | * { | |
| 250 | * "id": "(resp.id)", | |
| 251 | * "response": { | |
| 252 | * "authenticatorData": "(Base64Url encoded resp.authenticatorData)", | |
| 253 | * "signature": "(Base64Url encoded resp.signature)", | |
| 254 | * "clientDataJSON": "(Base64Url encoded resp.clientDataJSON)", | |
| 255 | * "userHandle": "(null, undefined or Base64Url encoded resp.userHandle)" | |
| 256 | * }, | |
| 257 | * "clientExtensionResults": { (resp.getClientExtensionResults()) }, | |
| 258 | * "type": "public-key" | |
| 259 | * } | |
| 260 | * </pre> | |
| 261 | * | |
| 262 | * <dl> | |
| 263 | * <dt>resp: | |
| 264 | * <dd>The <a | |
| 265 | * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#iface-pkcredential">PublicKeyCredential</a> | |
| 266 | * object returned from an authentication ceremony. | |
| 267 | * <dt>id: | |
| 268 | * <dd>The string value of <code>resp.id</code> | |
| 269 | * <dt>response.authenticatorData: | |
| 270 | * <dd>The value of <code>resp.authenticatorData</code>, Base64Url encoded as a string | |
| 271 | * <dt>response.signature: | |
| 272 | * <dd>The value of <code>resp.signature</code>, Base64Url encoded as a string | |
| 273 | * <dt>response.clientDataJSON: | |
| 274 | * <dd>The value of <code>resp.clientDataJSON</code>, Base64Url encoded as a string | |
| 275 | * <dt>response.userHandle: | |
| 276 | * <dd>The value of <code>resp.userHandle</code> Base64Url encoded as a string if present, | |
| 277 | * otherwise <code>null</code> or <code>undefined</code> | |
| 278 | * <dt>clientExtensionResults: | |
| 279 | * <dd>The return value of <code>resp.getClientExtensionResults()</code> | |
| 280 | * <dt>type: | |
| 281 | * <dd>The literal string value <code>"public-key"</code> | |
| 282 | * </dl> | |
| 283 | * | |
| 284 | * @param json a JSON string of the above format | |
| 285 | * @throws IOException if the <code>json</code> is invalid or cannot be decoded as a {@link | |
| 286 | * PublicKeyCredential} | |
| 287 | */ | |
| 288 | public static PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> | |
| 289 | parseAssertionResponseJson(String json) throws IOException { | |
| 290 |
1
1. parseAssertionResponseJson : replaced return value with null for com/yubico/webauthn/data/PublicKeyCredential::parseAssertionResponseJson → KILLED |
return JacksonCodecs.json() |
| 291 | .readValue( | |
| 292 | json, | |
| 293 | new TypeReference< | |
| 294 | PublicKeyCredential< | |
| 295 | AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs>>() {}); | |
| 296 | } | |
| 297 | } | |
Mutations | ||
| 91 |
1.1 |
|
| 93 |
1.1 |
|
| 94 |
1.1 |
|
| 95 |
1.1 2.2 |
|
| 98 |
1.1 2.2 3.3 |
|
| 103 |
1.1 |
|
| 112 |
1.1 |
|
| 114 |
1.1 |
|
| 115 |
1.1 |
|
| 139 |
1.1 |
|
| 144 |
1.1 |
|
| 150 |
1.1 |
|
| 164 |
1.1 |
|
| 176 |
1.1 |
|
| 188 |
1.1 |
|
| 235 |
1.1 |
|
| 290 |
1.1 |