-
Notifications
You must be signed in to change notification settings - Fork 116
/
parser.js
399 lines (328 loc) · 10.5 KB
/
parser.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
import { ab2str, coerceToArrayBuffer, coerceToBase64Url, tools } from "./utils.js";
import { PublicKey } from "./keyUtils.js";
import { Fido2Lib } from "./main.js";
// NOTE: throws if origin is https and has port 443
// use `new URL(originstr).origin` to create a properly formatted origin
function parseExpectations(exp) {
if (typeof exp !== "object") {
throw new TypeError(
"expected 'expectations' to be of type object, got " + typeof exp,
);
}
const ret = new Map();
// origin
if (exp.origin) {
if (typeof exp.origin !== "string") {
throw new TypeError(
"expected 'origin' should be string, got " + typeof exp.origin,
);
}
const origin = tools.checkOrigin(exp.origin);
ret.set("origin", origin);
}
// rpId
if (exp.rpId) {
if (typeof exp.rpId !== "string") {
throw new TypeError(
"expected 'rpId' should be string, got " + typeof exp.rpId,
);
}
const rpId = tools.checkRpId(exp.rpId);
ret.set("rpId", rpId);
}
// challenge
if (exp.challenge) {
let challenge = exp.challenge;
challenge = coerceToBase64Url(challenge, "expected challenge");
ret.set("challenge", challenge);
}
// flags
if (exp.flags) {
let flags = exp.flags;
if (Array.isArray(flags)) {
flags = new Set(flags);
}
if (!(flags instanceof Set)) {
throw new TypeError(
"expected flags to be an Array or a Set, got: " + typeof flags,
);
}
ret.set("flags", flags);
}
// counter
if (exp.prevCounter !== undefined) {
if (typeof exp.prevCounter !== "number") {
throw new TypeError(
"expected 'prevCounter' should be Number, got " +
typeof exp.prevCounter,
);
}
ret.set("prevCounter", exp.prevCounter);
}
// publicKey
if (exp.publicKey) {
if (typeof exp.publicKey !== "string") {
throw new TypeError(
"expected 'publicKey' should be String, got " +
typeof exp.publicKey,
);
}
ret.set("publicKey", exp.publicKey);
}
// userHandle
if (exp.userHandle !== undefined) {
let userHandle = exp.userHandle;
if (userHandle !== null && userHandle !== "") {
userHandle = coerceToBase64Url(userHandle, "userHandle");
}
ret.set("userHandle", userHandle);
}
// allowCredentials
if (exp.allowCredentials !== undefined) {
const allowCredentials = exp.allowCredentials;
if (allowCredentials !== null && !Array.isArray(allowCredentials)) {
throw new TypeError(
"expected 'allowCredentials' to be null or array, got " +
typeof allowCredentials,
);
}
for (const index in allowCredentials) {
if (allowCredentials[index].id != null) {
allowCredentials[index].id = coerceToArrayBuffer(
allowCredentials[index].id,
"allowCredentials[" + index + "].id",
);
}
}
ret.set("allowCredentials", allowCredentials);
}
return ret;
}
/**
* Parses the clientData JSON byte stream into an Object
* @param {ArrayBuffer} clientDataJSON The ArrayBuffer containing the properly formatted JSON of the clientData object
* @return {Object} The parsed clientData object
*/
function parseClientResponse(msg) {
if (typeof msg !== "object") {
throw new TypeError("expected msg to be Object");
}
if (msg.id && !msg.rawId) {
msg.rawId = msg.id;
}
const rawId = coerceToArrayBuffer(msg.rawId, "rawId");
if (typeof msg.response !== "object") {
throw new TypeError("expected response to be Object");
}
const clientDataJSON = coerceToArrayBuffer(
msg.response.clientDataJSON,
"clientDataJSON",
);
if (!(clientDataJSON instanceof ArrayBuffer)) {
throw new TypeError("expected 'clientDataJSON' to be ArrayBuffer");
}
// convert to string
const clientDataJson = ab2str(clientDataJSON);
// parse JSON string
let parsed;
try {
parsed = JSON.parse(clientDataJson);
} catch (err) {
throw new Error("couldn't parse clientDataJson: " + err);
}
const ret = new Map([
["challenge", parsed.challenge],
["origin", parsed.origin],
["type", parsed.type],
["tokenBinding", parsed.tokenBinding],
["rawClientDataJson", clientDataJSON],
["rawId", rawId],
]);
return ret;
}
/**
* @deprecated
* Parses the CBOR attestation statement
* @param {ArrayBuffer} attestationObject The CBOR byte array representing the attestation statement
* @return {Object} The Object containing all the attestation information
* @see https://w3c.github.io/webauthn/#generating-an-attestation-object
* @see https://w3c.github.io/webauthn/#defined-attestation-formats
*/
async function parseAttestationObject(attestationObject) {
// update docs to say ArrayBuffer-ish object
attestationObject = coerceToArrayBuffer(
attestationObject,
"attestationObject",
);
// parse attestation
let parsed;
try {
parsed = tools.cbor.decode(new Uint8Array(attestationObject));
} catch (_err) {
throw new TypeError("couldn't parse attestationObject CBOR");
}
if (typeof parsed !== "object") {
throw new TypeError("invalid parsing of attestationObject cbor");
}
if (typeof parsed.fmt !== "string") {
throw new Error("expected attestation CBOR to contain a 'fmt' string");
}
if (typeof parsed.attStmt !== "object") {
throw new Error(
"expected attestation CBOR to contain a 'attStmt' object",
);
}
if (!(parsed.authData instanceof Uint8Array)) {
throw new Error(
"expected attestation CBOR to contain a 'authData' byte sequence",
);
}
const ret = new Map([
...Fido2Lib.parseAttestation(parsed.fmt, parsed.attStmt),
// return raw buffer for future signature verification
["rawAuthnrData", coerceToArrayBuffer(parsed.authData, "authData")],
// Added for compatibility with parseAuthnrAttestationResponse
["transports", undefined],
// parse authData
...await parseAuthenticatorData(parsed.authData),
]);
return ret;
}
async function parseAuthnrAttestationResponse(msg) {
if (typeof msg !== "object") {
throw new TypeError("expected msg to be Object");
}
if (typeof msg.response !== "object") {
throw new TypeError("expected response to be Object");
}
let attestationObject = msg.response.attestationObject;
// update docs to say ArrayBuffer-ish object
attestationObject = coerceToArrayBuffer(
attestationObject,
"attestationObject",
);
let parsed;
try {
parsed = tools.cbor.decode(new Uint8Array(attestationObject));
} catch (_err) {
throw new TypeError("couldn't parse attestationObject CBOR");
}
if (typeof parsed !== "object") {
throw new TypeError("invalid parsing of attestationObject CBOR");
}
if (typeof parsed.fmt !== "string") {
throw new Error("expected attestation CBOR to contain a 'fmt' string");
}
if (typeof parsed.attStmt !== "object") {
throw new Error("expected attestation CBOR to contain a 'attStmt' object");
}
if (!(parsed.authData instanceof Uint8Array)) {
throw new Error("expected attestation CBOR to contain a 'authData' byte sequence");
}
if (msg.transports != undefined && !Array.isArray(msg.transports)) {
throw new Error("expected transports to be 'null' or 'array<string>'");
}
// have to require here to prevent circular dependency
const ret = new Map([
...Fido2Lib.parseAttestation(parsed.fmt, parsed.attStmt),
// return raw buffer for future signature verification
["rawAuthnrData", coerceToArrayBuffer(parsed.authData, "authData")],
["transports", msg.transports],
// parse authData
...await parseAuthenticatorData(parsed.authData),
]);
return ret;
}
async function parseAuthenticatorData(authnrDataArrayBuffer) {
// convert to ArrayBuffer
authnrDataArrayBuffer = coerceToArrayBuffer(authnrDataArrayBuffer, "authnrDataArrayBuffer");
const ret = new Map();
// console.log("authnrDataArrayBuffer", authnrDataArrayBuffer);
// console.log("typeof authnrDataArrayBuffer", typeof authnrDataArrayBuffer);
// printHex("authnrDataArrayBuffer", authnrDataArrayBuffer);
const authnrDataBuf = new DataView(authnrDataArrayBuffer);
let offset = 0;
ret.set("rpIdHash", authnrDataBuf.buffer.slice(offset, offset + 32));
offset += 32;
const flags = authnrDataBuf.getUint8(offset);
const flagsSet = new Set();
ret.set("flags", flagsSet);
if (flags & 0x01) flagsSet.add("UP");
if (flags & 0x02) flagsSet.add("RFU1");
if (flags & 0x04) flagsSet.add("UV");
if (flags & 0x08) flagsSet.add("RFU3");
if (flags & 0x10) flagsSet.add("RFU4");
if (flags & 0x20) flagsSet.add("RFU5");
if (flags & 0x40) flagsSet.add("AT");
if (flags & 0x80) flagsSet.add("ED");
offset++;
ret.set("counter", authnrDataBuf.getUint32(offset, false));
offset += 4;
// see if there's more data to process
const attestation = flagsSet.has("AT");
const extensions = flagsSet.has("ED");
if (attestation) {
ret.set("aaguid", authnrDataBuf.buffer.slice(offset, offset + 16));
offset += 16;
const credIdLen = authnrDataBuf.getUint16(offset, false);
ret.set("credIdLen", credIdLen);
offset += 2;
ret.set(
"credId",
authnrDataBuf.buffer.slice(offset, offset + credIdLen),
);
offset += credIdLen;
// Import public key
const publicKey = new PublicKey();
await publicKey.fromCose(
authnrDataBuf.buffer.slice(offset, authnrDataBuf.buffer.byteLength),
);
// TODO: does not only contain the COSE if the buffer contains extensions
ret.set("credentialPublicKeyCose", await publicKey.toCose());
ret.set("credentialPublicKeyJwk", await publicKey.toJwk());
ret.set("credentialPublicKeyPem", await publicKey.toPem());
}
if (extensions) {
const cborObjects = tools.cbor.decodeMultiple(new Uint8Array(authnrDataBuf.buffer.slice(offset, authnrDataBuf.buffer.byteLength)));
// skip publicKey if present
if (attestation) {
cborObjects.shift();
}
if (cborObjects.length === 0) {
throw new Error("extensions missing");
}
ret.set("webAuthnExtensions", cborObjects);
}
return ret;
}
async function parseAuthnrAssertionResponse(msg) {
if (typeof msg !== "object") {
throw new TypeError("expected msg to be Object");
}
if (typeof msg.response !== "object") {
throw new TypeError("expected response to be Object");
}
let userHandle;
if (msg.response.userHandle !== undefined && msg.response.userHandle !== null) {
userHandle = coerceToArrayBuffer(msg.response.userHandle, "response.userHandle");
if (userHandle.byteLength === 0) {
userHandle = undefined;
}
}
const sigAb = coerceToArrayBuffer(msg.response.signature, "response.signature");
const ret = new Map([
["sig", sigAb],
["userHandle", userHandle],
["rawAuthnrData", coerceToArrayBuffer(msg.response.authenticatorData, "response.authenticatorData")],
...await parseAuthenticatorData(msg.response.authenticatorData),
]);
return ret;
}
export {
parseAttestationObject,
parseAuthenticatorData,
parseAuthnrAssertionResponse,
parseAuthnrAttestationResponse,
parseClientResponse,
parseExpectations
};