Skip to content

Restrict supported Web eID token formats #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aarmam wants to merge 1 commit into
base: web-eid-mobile
Choose a base branch
from
Open

Restrict supported Web eID token formats #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions src/WebEid.Security.Tests/Validator/VersionValidators/AuthTokenVersion1ValidatorTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,9 +84,6 @@ public void SetUp()

[TestCase("web-eid:1")]
[TestCase("web-eid:1.0")]
[TestCase("web-eid:1.1")]
[TestCase("web-eid:1.10")]
[TestCase("web-eid:1.999")]
public void WhenFormatIsValidMajorV1FormatThenSupportsReturnsTrue(string format) =>
Assert.That(validator.Supports(format), Is.True);

Expand All @@ -95,7 +92,11 @@ public void WhenFormatIsValidMajorV1FormatThenSupportsReturnsTrue(string format)
[TestCase("web-eid")]
[TestCase("web-eid:1.")]
[TestCase("web-eid:1.0TEST")]
[TestCase("web-eid:1.1")]
[TestCase("web-eid:1.1.0")]
[TestCase("web-eid:1.2")]
[TestCase("web-eid:1.10")]
[TestCase("web-eid:1.999")]
[TestCase("web-eid:0.9")]
[TestCase("web-eid:2")]
[TestCase("webauthn:1")]
Expand Down
14 changes: 7 additions & 7 deletions src/WebEid.Security/Validator/VersionValidators/AuthTokenVersion11Validator.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,6 @@ namespace WebEid.Security.Validator.VersionValidators
using System.Collections.Generic;
using System.Linq;
using System.Security.Cryptography.X509Certificates;
using System.Text.RegularExpressions;
using System.Threading.Tasks;
using AuthToken;
using CertValidators;
Expand All @@ -40,10 +39,9 @@ namespace WebEid.Security.Validator.VersionValidators
/// Validator for token format web-eid:1.1.
/// Extends V1 validator with additional checks for signing certificate + supported algorithms.
/// </summary>
public sealed partial class AuthTokenVersion11Validator : AuthTokenVersion1Validator
public sealed class AuthTokenVersion11Validator : AuthTokenVersion1Validator
{
[GeneratedRegex(@"^web-eid:1\.1$", RegexOptions.IgnoreCase)]
private static partial Regex V11SupportedTokenFormatPattern();
private const string V11_SUPPORTED_TOKEN_FORMAT = "web-eid:1.1";

private static readonly HashSet<string> SupportedSigningCryptoAlgorithms =
new(StringComparer.OrdinalIgnoreCase)
Expand Down Expand Up @@ -97,9 +95,11 @@ internal AuthTokenVersion11Validator(
this.logger = logger;
}

/// <inheritdoc />
protected override Regex GetSupportedFormatPattern() =>
V11SupportedTokenFormatPattern();
/// <summary>
/// Determines whether this validator supports the specified token format.
/// </summary>
public override bool Supports(string format) =>
format == V11_SUPPORTED_TOKEN_FORMAT;

/// <summary>
/// Validates a Web eID authentication token in format <c>web-eid:1.1</c>
Expand Down
14 changes: 2 additions & 12 deletions src/WebEid.Security/Validator/VersionValidators/AuthTokenVersion1Validator.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ namespace WebEid.Security.Validator.VersionValidators
{
using System;
using System.Security.Cryptography.X509Certificates;
using System.Text.RegularExpressions;
using System.Threading.Tasks;
using AuthToken;
using CertValidators;
Expand All @@ -39,9 +38,6 @@ public partial class AuthTokenVersion1Validator : IAuthTokenVersionValidator
{
private const string V1_SUPPORTED_TOKEN_FORMAT_PREFIX = "web-eid:1";

[GeneratedRegex(@"^web-eid:1(?:\.\d+)?$", RegexOptions.IgnoreCase)]
private static partial Regex V1SupportedTokenFormatPattern();

private readonly SubjectCertificateValidatorBatch simpleSubjectCertificateValidators;
private readonly AuthTokenSignatureValidator signatureValidator;
private readonly AuthTokenValidationConfiguration configuration;
Expand Down Expand Up @@ -72,14 +68,8 @@ internal AuthTokenVersion1Validator(
/// Determines whether this validator supports the specified token format.
/// </summary>
public virtual bool Supports(string format) =>
format != null &&
GetSupportedFormatPattern().IsMatch(format);

/// <summary>
/// Gets the supported token format pattern for this validator.
/// </summary>
protected virtual Regex GetSupportedFormatPattern() =>
V1SupportedTokenFormatPattern();
format == V1_SUPPORTED_TOKEN_FORMAT_PREFIX ||
format == "web-eid:1.0";

/// <summary>
/// Validates a Web eID authentication token and returns the authenticated user's certificate.
Expand Down
Loading