| 1 | // Copyright (c) 2018, Yubico AB | |
| 2 | // All rights reserved. | |
| 3 | // | |
| 4 | // Redistribution and use in source and binary forms, with or without | |
| 5 | // modification, are permitted provided that the following conditions are met: | |
| 6 | // | |
| 7 | // 1. Redistributions of source code must retain the above copyright notice, this | |
| 8 | // list of conditions and the following disclaimer. | |
| 9 | // | |
| 10 | // 2. Redistributions in binary form must reproduce the above copyright notice, | |
| 11 | // this list of conditions and the following disclaimer in the documentation | |
| 12 | // and/or other materials provided with the distribution. | |
| 13 | // | |
| 14 | // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" | |
| 15 | // AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |
| 16 | // IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | |
| 17 | // DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE | |
| 18 | // FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | |
| 19 | // DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR | |
| 20 | // SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER | |
| 21 | // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, | |
| 22 | // OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | |
| 23 | // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| 24 | ||
| 25 | package com.yubico.webauthn; | |
| 26 | ||
| 27 | import com.yubico.webauthn.data.AuthenticatorAssertionResponse; | |
| 28 | import com.yubico.webauthn.data.ByteArray; | |
| 29 | import com.yubico.webauthn.data.ClientAssertionExtensionOutputs; | |
| 30 | import com.yubico.webauthn.data.CollectedClientData; | |
| 31 | import com.yubico.webauthn.data.PublicKeyCredential; | |
| 32 | import java.util.Optional; | |
| 33 | import java.util.Set; | |
| 34 | import lombok.Builder; | |
| 35 | import lombok.NonNull; | |
| 36 | import lombok.Value; | |
| 37 | ||
| 38 | /** Parameters for {@link RelyingParty#finishAssertion(FinishAssertionOptions)}. */ | |
| 39 | @Value | |
| 40 | @Builder(toBuilder = true) | |
| 41 | public class FinishAssertionOptions { | |
| 42 | ||
| 43 | /** The request that the {@link #getResponse() response} is a response to. */ | |
| 44 | @NonNull private final AssertionRequest request; | |
| 45 | ||
| 46 | /** | |
| 47 | * The client's response to the {@link #getRequest() request}. | |
| 48 | * | |
| 49 | * @see <a | |
| 50 | * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-getAssertion">navigator.credentials.get()</a> | |
| 51 | */ | |
| 52 | @NonNull | |
| 53 | private final PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> | |
| 54 | response; | |
| 55 | ||
| 56 | /** | |
| 57 | * The <a href="https://tools.ietf.org/html/rfc8471#section-3.2">token binding ID</a> of the | |
| 58 | * connection to the client, if any. | |
| 59 | * | |
| 60 | * @see <a href="https://tools.ietf.org/html/rfc8471">The Token Binding Protocol Version 1.0</a> | |
| 61 | */ | |
| 62 | private final ByteArray callerTokenBindingId; | |
| 63 | ||
| 64 | /** | |
| 65 | * EXPERIMENTAL FEATURE: | |
| 66 | * | |
| 67 | * <p>If set to <code>false</code> (the default), the <code>"type"</code> property in the <a | |
| 68 | * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dictionary-client-data">collected | |
| 69 | * client data</a> of the assertion will be verified to equal <code>"webauthn.get"</code>. | |
| 70 | * | |
| 71 | * <p>If set to <code>true</code>, it will instead be verified to equal <code>"payment.get"</code> | |
| 72 | * . | |
| 73 | * | |
| 74 | * <p>NOTE: If you're using <a | |
| 75 | * href="https://www.w3.org/TR/2023/CR-secure-payment-confirmation-20230615/">Secure Payment | |
| 76 | * Confirmation</a> (SPC), you likely also need to relax the origin validation logic. Right now | |
| 77 | * this library only supports matching against a finite {@link Set} of acceptable origins. If | |
| 78 | * necessary, your application may validate the origin externally (see {@link | |
| 79 | * PublicKeyCredential#getResponse()}, {@link AuthenticatorAssertionResponse#getClientData()} and | |
| 80 | * {@link CollectedClientData#getOrigin()}) and construct a new {@link RelyingParty} instance for | |
| 81 | * each SPC response, setting the {@link RelyingParty.RelyingPartyBuilder#origins(Set) origins} | |
| 82 | * setting on that instance to contain the pre-validated origin value. | |
| 83 | * | |
| 84 | * <p>Better support for relaxing origin validation may be added as the feature matures. | |
| 85 | * | |
| 86 | * @deprecated EXPERIMENTAL: This is an experimental feature. It is likely to change or be deleted | |
| 87 | * before reaching a mature release. | |
| 88 | * @see <a href="https://www.w3.org/TR/2023/CR-secure-payment-confirmation-20230615/">Secure | |
| 89 | * Payment Confirmation</a> | |
| 90 | * @see <a | |
| 91 | * href="https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#dictionary-client-data">5.8.1. | |
| 92 | * Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> | |
| 93 | * @see RelyingParty.RelyingPartyBuilder#origins(Set) | |
| 94 | * @see CollectedClientData | |
| 95 | * @see CollectedClientData#getOrigin() | |
| 96 | */ | |
| 97 | @Deprecated @Builder.Default private final boolean isSecurePaymentConfirmation = false; | |
| 98 | ||
| 99 | /** | |
| 100 | * The <a href="https://tools.ietf.org/html/rfc8471#section-3.2">token binding ID</a> of the | |
| 101 | * connection to the client, if any. | |
| 102 | * | |
| 103 | * @see <a href="https://tools.ietf.org/html/rfc8471">The Token Binding Protocol Version 1.0</a> | |
| 104 | */ | |
| 105 | public Optional<ByteArray> getCallerTokenBindingId() { | |
| 106 |
1
1. getCallerTokenBindingId : replaced return value with Optional.empty for com/yubico/webauthn/FinishAssertionOptions::getCallerTokenBindingId → KILLED |
return Optional.ofNullable(callerTokenBindingId); |
| 107 | } | |
| 108 | ||
| 109 | public static FinishAssertionOptionsBuilder.MandatoryStages builder() { | |
| 110 |
1
1. builder : replaced return value with null for com/yubico/webauthn/FinishAssertionOptions::builder → KILLED |
return new FinishAssertionOptionsBuilder.MandatoryStages(); |
| 111 | } | |
| 112 | ||
| 113 | public static class FinishAssertionOptionsBuilder { | |
| 114 | private ByteArray callerTokenBindingId = null; | |
| 115 | ||
| 116 | public static class MandatoryStages { | |
| 117 | private final FinishAssertionOptionsBuilder builder = new FinishAssertionOptionsBuilder(); | |
| 118 | ||
| 119 | /** | |
| 120 | * {@link FinishAssertionOptionsBuilder#request(AssertionRequest) request} is a required | |
| 121 | * parameter. | |
| 122 | * | |
| 123 | * @see FinishAssertionOptionsBuilder#request(AssertionRequest) | |
| 124 | */ | |
| 125 | public Step2 request(AssertionRequest request) { | |
| 126 | builder.request(request); | |
| 127 |
1
1. request : replaced return value with null for com/yubico/webauthn/FinishAssertionOptions$FinishAssertionOptionsBuilder$MandatoryStages::request → KILLED |
return new Step2(); |
| 128 | } | |
| 129 | ||
| 130 | public class Step2 { | |
| 131 | /** | |
| 132 | * {@link FinishAssertionOptionsBuilder#response(PublicKeyCredential) response} is a | |
| 133 | * required parameter. | |
| 134 | * | |
| 135 | * @see FinishAssertionOptionsBuilder#response(PublicKeyCredential) | |
| 136 | */ | |
| 137 | public FinishAssertionOptionsBuilder response( | |
| 138 | PublicKeyCredential<AuthenticatorAssertionResponse, ClientAssertionExtensionOutputs> | |
| 139 | response) { | |
| 140 |
1
1. response : replaced return value with null for com/yubico/webauthn/FinishAssertionOptions$FinishAssertionOptionsBuilder$MandatoryStages$Step2::response → KILLED |
return builder.response(response); |
| 141 | } | |
| 142 | } | |
| 143 | } | |
| 144 | ||
| 145 | /** | |
| 146 | * The <a href="https://tools.ietf.org/html/rfc8471#section-3.2">token binding ID</a> of the | |
| 147 | * connection to the client, if any. | |
| 148 | * | |
| 149 | * @see <a href="https://tools.ietf.org/html/rfc8471">The Token Binding Protocol Version 1.0</a> | |
| 150 | */ | |
| 151 | public FinishAssertionOptionsBuilder callerTokenBindingId( | |
| 152 |
1
1. callerTokenBindingId : negated conditional → KILLED |
@NonNull Optional<ByteArray> callerTokenBindingId) { |
| 153 | this.callerTokenBindingId = callerTokenBindingId.orElse(null); | |
| 154 |
1
1. callerTokenBindingId : replaced return value with null for com/yubico/webauthn/FinishAssertionOptions$FinishAssertionOptionsBuilder::callerTokenBindingId → KILLED |
return this; |
| 155 | } | |
| 156 | ||
| 157 | /** | |
| 158 | * The <a href="https://tools.ietf.org/html/rfc8471#section-3.2">token binding ID</a> of the | |
| 159 | * connection to the client, if any. | |
| 160 | * | |
| 161 | * @see <a href="https://tools.ietf.org/html/rfc8471">The Token Binding Protocol Version 1.0</a> | |
| 162 | */ | |
| 163 | public FinishAssertionOptionsBuilder callerTokenBindingId( | |
| 164 |
1
1. callerTokenBindingId : negated conditional → NO_COVERAGE |
@NonNull ByteArray callerTokenBindingId) { |
| 165 |
1
1. callerTokenBindingId : replaced return value with null for com/yubico/webauthn/FinishAssertionOptions$FinishAssertionOptionsBuilder::callerTokenBindingId → NO_COVERAGE |
return this.callerTokenBindingId(Optional.of(callerTokenBindingId)); |
| 166 | } | |
| 167 | } | |
| 168 | } | |
Mutations | ||
| 106 |
1.1 |
|
| 110 |
1.1 |
|
| 127 |
1.1 |
|
| 140 |
1.1 |
|
| 152 |
1.1 |
|
| 154 |
1.1 |
|
| 164 |
1.1 |
|
| 165 |
1.1 |