AppId.java

1
// Copyright (c) 2018, Yubico AB
2
// All rights reserved.
3
//
4
// Redistribution and use in source and binary forms, with or without
5
// modification, are permitted provided that the following conditions are met:
6
//
7
// 1. Redistributions of source code must retain the above copyright notice, this
8
//    list of conditions and the following disclaimer.
9
//
10
// 2. Redistributions in binary form must reproduce the above copyright notice,
11
//    this list of conditions and the following disclaimer in the documentation
12
//    and/or other materials provided with the distribution.
13
//
14
// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
15
// AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16
// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
17
// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
18
// FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19
// DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
20
// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
21
// CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
22
// OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24
25
package com.yubico.webauthn.extension.appid;
26
27
import com.fasterxml.jackson.annotation.JsonCreator;
28
import com.fasterxml.jackson.core.JsonGenerator;
29
import com.fasterxml.jackson.databind.SerializerProvider;
30
import com.fasterxml.jackson.databind.annotation.JsonSerialize;
31
import com.google.common.net.InetAddresses;
32
import java.io.IOException;
33
import java.net.URI;
34
import java.net.URISyntaxException;
35
import lombok.NonNull;
36
import lombok.Value;
37
38
/**
39
 * A FIDO AppID verified to be syntactically valid.
40
 *
41
 * @see <a
42
 *     href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html">FIDO
43
 *     AppID and Facet Specification</a>
44
 */
45
@Value
46
@JsonSerialize(using = AppId.JsonSerializer.class)
47
public class AppId {
48
49
  /** The underlying string representation of this AppID. */
50
  private final String id;
51
52
  /**
53
   * Verify that the <code>appId</code> is a valid FIDO AppID, and wrap it as an {@link AppId}.
54
   *
55
   * @throws InvalidAppIdException if <code>appId</code> is not a valid FIDO AppID.
56
   * @see <a
57
   *     href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html">FIDO
58
   *     AppID and Facet Specification</a>
59
   */
60
  @JsonCreator
61 1 1. <init> : negated conditional → KILLED
  public AppId(@NonNull String appId) throws InvalidAppIdException {
62 1 1. <init> : removed call to com/yubico/webauthn/extension/appid/AppId::checkIsValid → KILLED
    checkIsValid(appId);
63
    this.id = appId;
64
  }
65
66
  /**
67
   * Throws {@link InvalidAppIdException} if the given App ID is found to be incompatible with the
68
   * U2F specification or any major U2F Client implementation.
69
   *
70
   * @param appId the App ID to be validated
71
   */
72
  private static void checkIsValid(String appId) throws InvalidAppIdException {
73 1 1. checkIsValid : negated conditional → KILLED
    if (!appId.contains(":")) {
74
      throw new InvalidAppIdException(
75
          "App ID does not look like a valid facet or URL. Web facets must start with 'https://'.");
76
    }
77 1 1. checkIsValid : negated conditional → KILLED
    if (appId.startsWith("http:")) {
78
      throw new InvalidAppIdException(
79
          "HTTP is not supported for App IDs (by Chrome). Use HTTPS instead.");
80
    }
81 1 1. checkIsValid : negated conditional → KILLED
    if (appId.startsWith("https://")) {
82
      URI url = checkValidUrl(appId);
83 1 1. checkIsValid : removed call to com/yubico/webauthn/extension/appid/AppId::checkPathIsNotSlash → KILLED
      checkPathIsNotSlash(url);
84 1 1. checkIsValid : removed call to com/yubico/webauthn/extension/appid/AppId::checkNotIpAddress → KILLED
      checkNotIpAddress(url);
85
    }
86
  }
87
88
  private static void checkPathIsNotSlash(URI url) throws InvalidAppIdException {
89 1 1. checkPathIsNotSlash : negated conditional → KILLED
    if ("/".equals(url.getPath())) {
90
      throw new InvalidAppIdException(
91
          "The path of the URL set as App ID is '/'. This is probably not what you want -- remove the trailing slash of the App ID URL.");
92
    }
93
  }
94
95
  private static URI checkValidUrl(String appId) throws InvalidAppIdException {
96
    try {
97 1 1. checkValidUrl : replaced return value with null for com/yubico/webauthn/extension/appid/AppId::checkValidUrl → KILLED
      return new URI(appId);
98
    } catch (URISyntaxException e) {
99
      throw new InvalidAppIdException("App ID looks like a HTTPS URL, but has syntax errors.", e);
100
    }
101
  }
102
103
  private static void checkNotIpAddress(URI url) throws InvalidAppIdException {
104 1 1. checkNotIpAddress : negated conditional → KILLED
    if (InetAddresses.isInetAddress(url.getAuthority())
105 2 1. checkNotIpAddress : negated conditional → KILLED
2. checkNotIpAddress : negated conditional → KILLED
        || (url.getHost() != null && InetAddresses.isInetAddress(url.getHost()))) {
106
      throw new InvalidAppIdException(
107
          "App ID must not be an IP-address, since it is not supported (by Chrome). Use a host name instead.");
108
    }
109
  }
110
111
  static class JsonSerializer extends com.fasterxml.jackson.databind.JsonSerializer<AppId> {
112
    @Override
113
    public void serialize(AppId value, JsonGenerator gen, SerializerProvider serializers)
114
        throws IOException {
115 1 1. serialize : removed call to com/fasterxml/jackson/core/JsonGenerator::writeString → KILLED
      gen.writeString(value.getId());
116
    }
117
  }
118
}

Mutations

61

1.1
Location : <init>
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.disallowHttp(com.yubico.webauthn.extension.appid.AppIdTest)
negated conditional → KILLED

62

1.1
Location : <init>
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.disallowHttp(com.yubico.webauthn.extension.appid.AppIdTest)
removed call to com/yubico/webauthn/extension/appid/AppId::checkIsValid → KILLED

73

1.1
Location : checkIsValid
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.validUris(com.yubico.webauthn.extension.appid.AppIdTest)
negated conditional → KILLED

77

1.1
Location : checkIsValid
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.disallowHttp(com.yubico.webauthn.extension.appid.AppIdTest)
negated conditional → KILLED

81

1.1
Location : checkIsValid
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.validUris(com.yubico.webauthn.extension.appid.AppIdTest)
negated conditional → KILLED

83

1.1
Location : checkIsValid
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.disallowSlashAsPath(com.yubico.webauthn.extension.appid.AppIdTest)
removed call to com/yubico/webauthn/extension/appid/AppId::checkPathIsNotSlash → KILLED

84

1.1
Location : checkIsValid
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.disallowIP(com.yubico.webauthn.extension.appid.AppIdTest)
removed call to com/yubico/webauthn/extension/appid/AppId::checkNotIpAddress → KILLED

89

1.1
Location : checkPathIsNotSlash
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.disallowSlashAsPath(com.yubico.webauthn.extension.appid.AppIdTest)
negated conditional → KILLED

97

1.1
Location : checkValidUrl
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.disallowSlashAsPath(com.yubico.webauthn.extension.appid.AppIdTest)
replaced return value with null for com/yubico/webauthn/extension/appid/AppId::checkValidUrl → KILLED

104

1.1
Location : checkNotIpAddress
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.validUrls(com.yubico.webauthn.extension.appid.AppIdTest)
negated conditional → KILLED

105

1.1
Location : checkNotIpAddress
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.validUrls(com.yubico.webauthn.extension.appid.AppIdTest)
negated conditional → KILLED

2.2
Location : checkNotIpAddress
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.validUrls(com.yubico.webauthn.extension.appid.AppIdTest)
negated conditional → KILLED

115

1.1
Location : serialize
Killed by : com.yubico.webauthn.extension.appid.AppIdTest.jsonEncode(com.yubico.webauthn.extension.appid.AppIdTest)
removed call to com/fasterxml/jackson/core/JsonGenerator::writeString → KILLED

Active mutators

Tests examined


Report generated by PIT 1.15.0