@simplewebauthn/server 13.3.0 → 13.3.2

package/esm/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CA6HlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiHlB"}

package/esm/helpers/validateCertificatePath.js

@@ -1,6 +1,5 @@
-import { X509Certificate } from '@peculiar/x509';
+import { X509Certificate, X509ChainBuilder } from '@peculiar/x509';
 import { isCertRevoked } from './isCertRevoked.js';
-import { getWebCrypto } from './iso/isoCrypto/getWebCrypto.js';
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
@@ -11,7 +10,6 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
         // We have no trust anchors to chain back to, so skip path validation
         return true;
     }
-    const WebCrypto = await getWebCrypto();
     // Prepare to work with x5c certs
     const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new X509Certificate(certPEM));
     // Check for any expired or temporally invalid certs in x5c
@@ -64,50 +62,47 @@ export async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = [])
     if (validTrustAnchors.length === 0) {
         throw new Error('No specified trust anchor was valid for verifying x5c');
     }
-    // Try to verify x5c with each trust anchor
-    let invalidSubjectAndIssuerError = false;
-    for (const anchor of trustAnchorsParsed) {
+    // Try to verify x5c with each valid trust anchor
+    let invalidCertificateChain = true;
+    for (const anchor of validTrustAnchors) {
         try {
             const x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);
-            if (new Set(x5cWithTrustAnchor).size !== x5cWithTrustAnchor.length) {
+            const numUniqueCerts = new Set(x5cWithTrustAnchor.map((cert) => cert.toString('pem'))).size;
+            if (numUniqueCerts !== x5cWithTrustAnchor.length) {
                 throw new Error('Invalid certificate path: found duplicate certificates');
             }
-            // Check signatures, and notBefore and notAfter
-            for (let i = 0; i < x5cWithTrustAnchor.length - 1; i++) {
-                const subject = x5cWithTrustAnchor[i];
-                const issuer = x5cWithTrustAnchor[i + 1];
-                // Leaf or intermediate cert, make sure the next cert in the chain signed it
-                const issuerSignedSubject = await subject.verify({ publicKey: issuer.publicKey, signatureOnly: true }, WebCrypto);
-                if (!issuerSignedSubject) {
-                    throw new InvalidSubjectAndIssuer();
-                }
-                if (issuer.subject === issuer.issuer) {
-                    // Root cert detected, make sure it signed itself
-                    const issuerSignedIssuer = await issuer.verify({ publicKey: issuer.publicKey, signatureOnly: true }, WebCrypto);
-                    if (!issuerSignedIssuer) {
-                        throw new InvalidSubjectAndIssuer();
-                    }
-                    // Don't process anything else after a root cert
-                    break;
-                }
+            // Break apart x5c to try and build a valid cert chain
+            const x5cLeafCert = x5cCertsParsed[0];
+            let x5cIntermediates = [];
+            if (x5cCertsParsed.length > 1) {
+                x5cIntermediates = x5cCertsParsed.slice(1);
+            }
+            // Order of certs doesn't matter here but for readability
+            const chainBuilder = new X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
+            // Cert chain should be, from index 0: leaf cert -> ...intermediates -> trust anchor
+            const chain = await chainBuilder.build(x5cLeafCert);
+            // Check if the chain contains (all of the certs in x5c) + (the trust anchor)
+            if (chain.length < numUniqueCerts) {
+                // Invalid cert chain, try the next trust anchor
+                continue;
+            }
+            // Check if the chain is to the trust anchor
+            if (chain[chain.length - 1].subject !== anchor.subject) {
+                // Invalid cert chain, try the next trust anchor
+                continue;
             }
             // If we successfully validated a path then there's no need to continue. Reset any existing
             // errors that were thrown by earlier trust anchors
-            invalidSubjectAndIssuerError = false;
+            invalidCertificateChain = false;
             break;
         }
         catch (err) {
-            if (err instanceof InvalidSubjectAndIssuer) {
-                invalidSubjectAndIssuerError = true;
-            }
-            else {
-                throw new Error('Unexpected error while validating certificate path', { cause: err });
-            }
+            throw new Error('Unexpected error while validating certificate path', { cause: err });
         }
     }
     // We tried multiple trust anchors and none of them worked
-    if (invalidSubjectAndIssuerError) {
-        throw new InvalidSubjectAndIssuer();
+    if (invalidCertificateChain) {
+        throw new InvalidCertificatePath();
     }
     return true;
 }
@@ -130,11 +125,10 @@ function assertCertIsWithinValidTimeWindow(certNotBefore, certNotAfter) {
         throw new Error('Certificate is not yet valid or expired');
     }
 }
-// Custom errors to help pass on certain errors
-class InvalidSubjectAndIssuer extends Error {
+class InvalidCertificatePath extends Error {
     constructor() {
-        const message = 'Subject issuer did not match issuer subject';
+        const message = 'x5c could not be chained to any specified trust anchor';
         super(message);
-        this.name = 'InvalidSubjectAndIssuer';
+        this.name = 'InvalidX5CChain';
     }
 }

package/esm/registration/verifications/verifyAttestationAndroidSafetyNet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationAndroidSafetyNet.d.ts","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAttestationAndroidSafetyNet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAWtF;;GAEG;AACH,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA4IlB"}
+{"version":3,"file":"verifyAttestationAndroidSafetyNet.d.ts","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAttestationAndroidSafetyNet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAWtF;;GAEG;AACH,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA6IlB"}

package/esm/registration/verifications/verifyAttestationAndroidSafetyNet.js

@@ -104,6 +104,7 @@ export async function verifyAttestationAndroidSafetyNet(options) {
         signature: signatureBuffer,
         data: signatureBaseBuffer,
         x509Certificate: leafCertBuffer,
+        hashAlgorithm: alg,
     });
     /**
      * END Verify Signature

package/esm/registration/verifications/verifyAttestationPacked.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationPacked.d.ts","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAttestationPacked.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAYtF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CAyJlB"}
+{"version":3,"file":"verifyAttestationPacked.d.ts","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAttestationPacked.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAYtF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA0JlB"}

package/esm/registration/verifications/verifyAttestationPacked.js

@@ -98,6 +98,7 @@ export async function verifyAttestationPacked(options) {
             signature: sig,
             data: signatureBase,
             x509Certificate: x5c[0],
+            hashAlgorithm: alg,
         });
     }
     else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simplewebauthn/server",
-  "version": "13.3.0",
+  "version": "13.3.2",
   "description": "SimpleWebAuthn for Servers",
   "keywords": [
     "typescript",

package/script/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CA6HlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiHlB"}

package/script/helpers/validateCertificatePath.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateCertificatePath = validateCertificatePath;
 const x509_1 = require("@peculiar/x509");
 const isCertRevoked_js_1 = require("./isCertRevoked.js");
-const getWebCrypto_js_1 = require("./iso/isoCrypto/getWebCrypto.js");
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`
@@ -14,7 +13,6 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
         // We have no trust anchors to chain back to, so skip path validation
         return true;
     }
-    const WebCrypto = await (0, getWebCrypto_js_1.getWebCrypto)();
     // Prepare to work with x5c certs
     const x5cCertsParsed = x5cCertsPEM.map((certPEM) => new x509_1.X509Certificate(certPEM));
     // Check for any expired or temporally invalid certs in x5c
@@ -67,50 +65,47 @@ async function validateCertificatePath(x5cCertsPEM, trustAnchorsPEM = []) {
     if (validTrustAnchors.length === 0) {
         throw new Error('No specified trust anchor was valid for verifying x5c');
     }
-    // Try to verify x5c with each trust anchor
-    let invalidSubjectAndIssuerError = false;
-    for (const anchor of trustAnchorsParsed) {
+    // Try to verify x5c with each valid trust anchor
+    let invalidCertificateChain = true;
+    for (const anchor of validTrustAnchors) {
         try {
             const x5cWithTrustAnchor = x5cCertsParsed.concat([anchor]);
-            if (new Set(x5cWithTrustAnchor).size !== x5cWithTrustAnchor.length) {
+            const numUniqueCerts = new Set(x5cWithTrustAnchor.map((cert) => cert.toString('pem'))).size;
+            if (numUniqueCerts !== x5cWithTrustAnchor.length) {
                 throw new Error('Invalid certificate path: found duplicate certificates');
             }
-            // Check signatures, and notBefore and notAfter
-            for (let i = 0; i < x5cWithTrustAnchor.length - 1; i++) {
-                const subject = x5cWithTrustAnchor[i];
-                const issuer = x5cWithTrustAnchor[i + 1];
-                // Leaf or intermediate cert, make sure the next cert in the chain signed it
-                const issuerSignedSubject = await subject.verify({ publicKey: issuer.publicKey, signatureOnly: true }, WebCrypto);
-                if (!issuerSignedSubject) {
-                    throw new InvalidSubjectAndIssuer();
-                }
-                if (issuer.subject === issuer.issuer) {
-                    // Root cert detected, make sure it signed itself
-                    const issuerSignedIssuer = await issuer.verify({ publicKey: issuer.publicKey, signatureOnly: true }, WebCrypto);
-                    if (!issuerSignedIssuer) {
-                        throw new InvalidSubjectAndIssuer();
-                    }
-                    // Don't process anything else after a root cert
-                    break;
-                }
+            // Break apart x5c to try and build a valid cert chain
+            const x5cLeafCert = x5cCertsParsed[0];
+            let x5cIntermediates = [];
+            if (x5cCertsParsed.length > 1) {
+                x5cIntermediates = x5cCertsParsed.slice(1);
+            }
+            // Order of certs doesn't matter here but for readability
+            const chainBuilder = new x509_1.X509ChainBuilder({ certificates: [...x5cIntermediates, anchor] });
+            // Cert chain should be, from index 0: leaf cert -> ...intermediates -> trust anchor
+            const chain = await chainBuilder.build(x5cLeafCert);
+            // Check if the chain contains (all of the certs in x5c) + (the trust anchor)
+            if (chain.length < numUniqueCerts) {
+                // Invalid cert chain, try the next trust anchor
+                continue;
+            }
+            // Check if the chain is to the trust anchor
+            if (chain[chain.length - 1].subject !== anchor.subject) {
+                // Invalid cert chain, try the next trust anchor
+                continue;
             }
             // If we successfully validated a path then there's no need to continue. Reset any existing
             // errors that were thrown by earlier trust anchors
-            invalidSubjectAndIssuerError = false;
+            invalidCertificateChain = false;
             break;
         }
         catch (err) {
-            if (err instanceof InvalidSubjectAndIssuer) {
-                invalidSubjectAndIssuerError = true;
-            }
-            else {
-                throw new Error('Unexpected error while validating certificate path', { cause: err });
-            }
+            throw new Error('Unexpected error while validating certificate path', { cause: err });
         }
     }
     // We tried multiple trust anchors and none of them worked
-    if (invalidSubjectAndIssuerError) {
-        throw new InvalidSubjectAndIssuer();
+    if (invalidCertificateChain) {
+        throw new InvalidCertificatePath();
     }
     return true;
 }
@@ -133,11 +128,10 @@ function assertCertIsWithinValidTimeWindow(certNotBefore, certNotAfter) {
         throw new Error('Certificate is not yet valid or expired');
     }
 }
-// Custom errors to help pass on certain errors
-class InvalidSubjectAndIssuer extends Error {
+class InvalidCertificatePath extends Error {
     constructor() {
-        const message = 'Subject issuer did not match issuer subject';
+        const message = 'x5c could not be chained to any specified trust anchor';
         super(message);
-        this.name = 'InvalidSubjectAndIssuer';
+        this.name = 'InvalidX5CChain';
     }
 }

package/script/registration/verifications/verifyAttestationAndroidSafetyNet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationAndroidSafetyNet.d.ts","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAttestationAndroidSafetyNet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAWtF;;GAEG;AACH,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA4IlB"}
+{"version":3,"file":"verifyAttestationAndroidSafetyNet.d.ts","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAttestationAndroidSafetyNet.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAWtF;;GAEG;AACH,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA6IlB"}

package/script/registration/verifications/verifyAttestationAndroidSafetyNet.js

@@ -107,6 +107,7 @@ async function verifyAttestationAndroidSafetyNet(options) {
         signature: signatureBuffer,
         data: signatureBaseBuffer,
         x509Certificate: leafCertBuffer,
+        hashAlgorithm: alg,
     });
     /**
      * END Verify Signature

package/script/registration/verifications/verifyAttestationPacked.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAttestationPacked.d.ts","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAttestationPacked.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAYtF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CAyJlB"}
+{"version":3,"file":"verifyAttestationPacked.d.ts","sourceRoot":"","sources":["../../../src/registration/verifications/verifyAttestationPacked.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AAYtF;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,OAAO,CAAC,CA0JlB"}

package/script/registration/verifications/verifyAttestationPacked.js

@@ -101,6 +101,7 @@ async function verifyAttestationPacked(options) {
             signature: sig,
             data: signatureBase,
             x509Certificate: x5c[0],
+            hashAlgorithm: alg,
         });
     }
     else {