openbadgeslib 4.4.2__tar.gz → 4.4.4__tar.gz

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/CONTRIBUTING.md

@@ -75,8 +75,9 @@ policy is deliberately simple and predictable:
 
 - A version is **dropped** — from `requires-python`, the classifiers, and the CI
   matrix — at the next **major** release after it reaches end-of-life. For
-  example, Python **3.10 (EOL 2026-10)** is dropped in **4.0.0**; until then it
-  stays supported. Grouping drops into majors keeps breaking changes rare.
+  example, Python **3.10 (EOL 2026-10)** stays supported through 4.x and is
+  dropped at the next major after that EOL (5.0). Grouping drops into majors
+  keeps breaking changes rare.
 - A new CPython minor is **added** to the CI matrix once it has a stable
   (non-pre) release, so downstreams can adopt it early.
 - The current matrix is **3.10–3.14**, and `requires-python = ">=3.10"`.

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/Changelog.txt

@@ -4,6 +4,76 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v4.4.4 - 2026-09-10
+
+  - security(baking): SVG baking strips ``<script>`` / ``foreignObject`` /
+    event-handler attributes and ``javascript:`` / hostile ``data:`` URLs
+    from the carrier so a source image cannot turn a baked badge into an
+    XSS gadget.
+  - security(ob3): ``ecdsa-sd-2023`` presentations that omit ``validUntil``
+    or ``credentialStatus`` fail closed — a holder can no longer hide expiry
+    or revocation behind selective disclosure.
+  - security(oid4vci): explicit ``credential_endpoint`` / ``token_endpoint``
+    / ``nonce_endpoint`` overrides must be absolute ``https://`` URLs, not
+    plaintext HTTP.
+  - security(cli): ``signer.log`` is created and kept at mode ``0600``
+    (recipient emails); a file inherited from a permissive umask is
+    tightened on the next append.
+  - security(ci): wiki-sync authenticates clone/push with an HTTP extraheader
+    instead of embedding ``GITHUB_TOKEN`` in the git remote URL.
+  - security(mail): SMTP connections time out after 30 s; plaintext SMTP to
+    a non-loopback host is upgraded with STARTTLS (validating context).
+  - security(util): ``allow_insecure=True`` HTTP downloads pin the connect
+    IP the same way HTTPS already did (DNS rebinding).
+  - security(oid4vci): a live PIN-gated offer presented without ``tx_code``
+    returns the same ``invalid_grant`` as an unknown code, so the token
+    endpoint is not an oracle for which offers are PIN-gated.
+
+
+* v4.4.3 - 2026-08-18
+
+  - security(oid4vci): an issuer that advertises
+    ``key_attestations_required`` now refuses a proof without
+    ``key_attestation`` before the signature is checked and before the
+    ``c_nonce`` is spent (openvc-core 1.26's ``require_key_attestation``).
+    Set ``oid4vci_key_attestations_required`` on the badge section, or pass
+    ``require_key_attestation=True`` to ``handle_credential_request``.
+    Without this, a software wallet's §8.3.1 retry spent a fresh nonce on
+    every attempt and looped.
+
+  - build(deps): raise the openvc-core floors to `>=1.26` in the `[eudi]`,
+    `[ldp-sd]` and `[oid4vci]` extras.
+
+  - security(oid4vci): `--reclaim-unclaimed` no longer frees a status-list
+    index whose credential was already delivered to a wallet. Issued grants
+    are kept past the offer TTL (they are the only proof of delivery), and
+    a missing grant row is treated as undecided rather than "never claimed".
+  - security(oid4vci): presenting a pre-authorized code again after the
+    wallet has claimed no longer demotes the grant from issued to
+    invalidated (tokens are still revoked). That demotion made the next
+    `--reclaim-unclaimed` free the delivered credential's status index.
+  - security(ob2): a HostedBadge BadgeClass that embeds an issuer Profile
+    object is no longer trusted as-is. The Profile at ``issuer.id`` is
+    fetched and used for scope and revocation.
+  - security(publish): ``sd_jwt_vct`` paths are POSIX-normalized; a ``..``
+    that would write Type Metadata outside ``-o`` is refused.
+  - security(ob1): an empty revocation-list response fails closed instead
+    of treating the badge as not revoked.
+  - security(mail): attachment filenames are RFC 2231 encoded, and CR/LF
+    or quotes in a badge/recipient name are rejected before they can
+    inject MIME headers.
+  - security(ob2): HostedBadge ``startsWith`` is an origin + path-segment
+    prefix, not a raw string prefix (blocks subdomain / userinfo tricks).
+  - fix(oid4vci): a Credential Offer that fails validation (e.g. batch_size
+    > 1 with status_lists) no longer reserves a status-list index first.
+  - fix(ci): the Ubuntu test job installs ``[oid4vci]`` and sets
+    ``OPENBADGES_REQUIRE_OID4VCI=1`` so the credential-endpoint suite cannot
+    skip itself green.
+  - fix(oid4vci): minting an access token stretches the grant to cover the
+    advertised ``expires_in``, so redeeming late in the offer window no
+    longer clips the token's lifetime.
+
+
 * v4.4.2 - 2026-08-13
 
   - fix(cli): key generation no longer crashes on Windows, where

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 4.4.2
+Version: 4.4.4
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -36,11 +36,11 @@ Requires-Dist: defusedxml>=0.7
 Provides-Extra: ldp
 Requires-Dist: pyld>=2.0.4; extra == "ldp"
 Provides-Extra: eudi
-Requires-Dist: openvc-core<2,>=1.25; extra == "eudi"
+Requires-Dist: openvc-core<2,>=1.26; extra == "eudi"
 Provides-Extra: ldp-sd
-Requires-Dist: openvc-core[data-integrity]<2,>=1.25; extra == "ldp-sd"
+Requires-Dist: openvc-core[data-integrity]<2,>=1.26; extra == "ldp-sd"
 Provides-Extra: oid4vci
-Requires-Dist: openvc-core<2,>=1.25; extra == "oid4vci"
+Requires-Dist: openvc-core<2,>=1.26; extra == "oid4vci"
 Provides-Extra: dev
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=5.0; extra == "dev"
@@ -144,7 +144,7 @@ all three OB versions.
 - Python >= 3.10 (tested on 3.10–3.14)
 - [pypng](https://pypi.org/project/pypng/) >= 0.20220715.0
 - [PyJWT[crypto]](https://pypi.org/project/PyJWT/) >= 2.13
-- [cryptography](https://pypi.org/project/cryptography/) >= 42
+- [cryptography](https://pypi.org/project/cryptography/) >= 45
 - [defusedxml](https://pypi.org/project/defusedxml/) >= 0.7
 
 ## Installation
@@ -157,8 +157,10 @@ All dependencies are installed automatically. The two OB 3.0 side-tracks ship
 as optional extras (the base install stays lean):
 
 ```bash
-pip install "openbadgeslib[ldp]"    # W3C Data Integrity issuance/verification
-pip install "openbadgeslib[eudi]"   # EUDI SD-JWT VC (pulls openvc-core)
+pip install "openbadgeslib[ldp]"     # W3C Data Integrity issuance/verification
+pip install "openbadgeslib[ldp-sd]"  # verify ecdsa-sd-2023 (selective disclosure)
+pip install "openbadgeslib[eudi]"    # EUDI SD-JWT VC (pulls openvc-core)
+pip install "openbadgeslib[oid4vci]" # issue to wallets (pre-authorized code flow)
 ```
 
 For a development checkout with the test suite and linters:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/README.md

@@ -89,7 +89,7 @@ all three OB versions.
 - Python >= 3.10 (tested on 3.10–3.14)
 - [pypng](https://pypi.org/project/pypng/) >= 0.20220715.0
 - [PyJWT[crypto]](https://pypi.org/project/PyJWT/) >= 2.13
-- [cryptography](https://pypi.org/project/cryptography/) >= 42
+- [cryptography](https://pypi.org/project/cryptography/) >= 45
 - [defusedxml](https://pypi.org/project/defusedxml/) >= 0.7
 
 ## Installation
@@ -102,8 +102,10 @@ All dependencies are installed automatically. The two OB 3.0 side-tracks ship
 as optional extras (the base install stays lean):
 
 ```bash
-pip install "openbadgeslib[ldp]"    # W3C Data Integrity issuance/verification
-pip install "openbadgeslib[eudi]"   # EUDI SD-JWT VC (pulls openvc-core)
+pip install "openbadgeslib[ldp]"     # W3C Data Integrity issuance/verification
+pip install "openbadgeslib[ldp-sd]"  # verify ecdsa-sd-2023 (selective disclosure)
+pip install "openbadgeslib[eudi]"    # EUDI SD-JWT VC (pulls openvc-core)
+pip install "openbadgeslib[oid4vci]" # issue to wallets (pre-authorized code flow)
 ```
 
 For a development checkout with the test suite and linters:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/baking.py

@@ -29,7 +29,7 @@
 from struct import pack
 from zlib import crc32
 
-from typing import List, Optional, Tuple, Union, cast
+from typing import Any, List, Optional, Tuple, Union, cast
 
 from defusedxml.minidom import parseString
 from png import Reader, signature as _png_signature
@@ -76,6 +76,66 @@ def _bounded_inflate(data: bytes, limit: int = MAX_ITXT_DECOMPRESSED) -> bytes:
 
 # ── SVG ─────────────────────────────────────────────────────────────────────
 
+# Active content stripped from the carrier at bake time. A baked badge is an
+# image a recipient may open in a browser; leaving <script>, on* handlers or
+# javascript: URLs in the source SVG would execute in that context (#328).
+# `opacity` is the one SVG presentation attribute whose local name starts
+# with "on" and is not an event handler.
+_ACTIVE_SVG_ELEMENTS = frozenset({
+    'script', 'foreignobject', 'iframe', 'embed', 'object', 'handler',
+})
+_URL_ATTRS = frozenset({'href', 'src', 'action'})
+_SAFE_DATA_IMAGE_TYPES = (
+    'image/png', 'image/jpeg', 'image/jpg', 'image/gif', 'image/webp',
+)
+
+
+def _svg_local_name(node: Any) -> str:
+    return str(node.tagName).split(':')[-1].lower()
+
+
+def _iter_svg_elements(node: Any) -> List[Any]:
+    found: List[Any] = []
+    if getattr(node, 'nodeType', None) == node.ELEMENT_NODE:
+        found.append(node)
+        for child in list(node.childNodes):
+            found.extend(_iter_svg_elements(child))
+    return found
+
+
+def _is_active_url(value: str) -> bool:
+    """True for javascript:/vbscript: and for data: that is not a raster image."""
+    lowered = value.strip().lower()
+    if lowered.startswith('javascript:') or lowered.startswith('vbscript:'):
+        return True
+    if not lowered.startswith('data:'):
+        return False
+    payload = lowered[5:]
+    return not any(payload.startswith(kind) for kind in _SAFE_DATA_IMAGE_TYPES)
+
+
+def _strip_svg_active_content(root: Any) -> None:
+    """Drop script-class elements, on* handlers and active URLs under *root*."""
+    if root is None:
+        return
+    for el in _iter_svg_elements(root):
+        if _svg_local_name(el) in _ACTIVE_SVG_ELEMENTS:
+            parent = el.parentNode
+            if parent is not None:
+                parent.removeChild(el)
+    for el in _iter_svg_elements(root):
+        attrs = el.attributes
+        if attrs is None:
+            continue
+        for name in list(attrs.keys()):
+            local = name.split(':')[-1].lower()
+            if local.startswith('on') and local != 'opacity':
+                el.removeAttribute(name)
+                continue
+            if local in _URL_ATTRS and _is_active_url(attrs[name].value):
+                el.removeAttribute(name)
+
+
 def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None, *,
              element: str = SVG_ELEMENT, namespace: str = SVG_NS,
              as_text: bool = False) -> bytes:
@@ -87,10 +147,15 @@ def bake_svg(image_bytes: bytes, token: str, comment: Optional[str] = None, *,
     instead of the ``verify`` attribute — the OB 3.0 carrier for credentials
     secured with a Data Integrity proof, whose payload is a JSON document
     rather than a compact JWT (OB 3.0 §5.3).
+
+    Active content in the source SVG (``<script>``, event-handler attributes,
+    ``javascript:`` / hostile ``data:`` URLs) is stripped before the token is
+    attached, so the baked carrier is not an XSS gadget (#328).
     """
     svg_doc = parseString(image_bytes)
     try:
         svg_tag = svg_doc.getElementsByTagName('svg').item(0)
+        _strip_svg_active_content(svg_tag)
         node = svg_doc.createElement(element)
         node.attributes['xmlns:openbadges'] = namespace
         if as_text:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/config.ini.example

@@ -143,6 +143,13 @@ key_type    = RSA
 ; above; vc+sd-jwt is the EUDI track and is IRREVOCABLE, so it cannot be
 ; combined with status_lists. vc+sd-jwt also needs key_type = ED25519 or ECC.
 ;oid4vci_formats  = jwt_vc_json
+; Demand a key attestation from the wallet (OID4VCI 1.0 §12.2.4). Unset is
+; the spec default: the parameter MUST NOT appear unless you actually
+; require one, or software wallets are locked out. true / {} = required
+; with no extra constraints; a JSON object is the Appendix D.2 set.
+; Advertising this also refuses a proof without key_attestation before
+; the nonce is spent — do not publish it and then accept inline-jwk proofs.
+;oid4vci_key_attestations_required = true
 ;mail        = ${paths:base}/badge_1_mail.txt
 
 [badge_2]

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/confparser.py

@@ -23,7 +23,8 @@
 
 from configparser import ConfigParser, ExtendedInterpolation, Error as ConfigParserError
 from dataclasses import dataclass
-from typing import Dict, List, Optional, Tuple, TYPE_CHECKING
+from typing import Any, Dict, List, Optional, Tuple, TYPE_CHECKING
+import json
 import os
 import sys
 import logging
@@ -304,7 +305,15 @@ def oid4vci_config(conf: ConfigParser) -> OID4VCIConfig:
 
     def endpoint(key: str, default_path: str) -> str:
         explicit = (section.get(key) or '').strip() if section else ''
-        return explicit or urljoin(endpoint_base, default_path)
+        url = explicit or urljoin(endpoint_base, default_path)
+        # Derived endpoints inherit https from credential_issuer; an explicit
+        # override can be any string, and a plaintext http URL would advertise
+        # a token/credential/nonce endpoint wallets POST secrets to (#328).
+        if not url.startswith('https://'):
+            raise ConfigError(
+                "[oid4vci] %s must be an absolute https URL, got %r"
+                % (key, url))
+        return url
 
     store_path = (section.get('store_path') if section else None) or \
         os.path.join(conf['paths']['base'], 'oid4vci.sqlite3')
@@ -380,6 +389,52 @@ def oid4vci_formats(conf: ConfigParser, badge_section: str) -> Tuple[str, ...]:
     return tuple(formats)
 
 
+def oid4vci_key_attestations_required(
+        conf: ConfigParser, badge_section: str) -> Optional[Dict[str, Any]]:
+    """The key-attestation policy a badge advertises over OID4VCI, or None.
+
+    Absent (the default) means the issuer does **not** require a key
+    attestation, and OpenID4VCI 1.0 §12.2.4 says the parameter MUST NOT then
+    appear in metadata. Present means it is required:
+
+    * ``true`` / ``yes`` / ``1`` / ``{}`` / empty advertise an unconstrained
+      requirement (a key attestation is needed, with no extra constraints);
+    * a JSON object is the Appendix D.2 constraint set, validated by the same
+      shape check :func:`~openbadgeslib.ob3.eudi.badge_credential_configuration`
+      uses.
+
+    The credential endpoint reads this same key, so advertising the
+    requirement without enforcing it — the wallet-retry loop openvc-core
+    1.26's ``require_key_attestation`` exists to close — cannot happen from
+    configuration alone.
+    """
+    if (badge_section not in conf
+            or 'oid4vci_key_attestations_required' not in conf[badge_section]):
+        return None
+    raw = (conf[badge_section].get('oid4vci_key_attestations_required')
+           or '').strip()
+    if raw.lower() in ('', 'true', 'yes', '1', '{}'):
+        value: Any = {}
+    else:
+        try:
+            parsed = json.loads(raw)
+        except ValueError as exc:
+            raise ConfigError(
+                "[%s] oid4vci_key_attestations_required must be true or a "
+                "JSON object, got %r" % (badge_section, raw)) from exc
+        if not isinstance(parsed, dict):
+            raise ConfigError(
+                "[%s] oid4vci_key_attestations_required must be a JSON "
+                "object, got %s" % (badge_section, type(parsed).__name__))
+        value = parsed
+    from .ob3.eudi import EudiError, _key_attestations_required
+    try:
+        return _key_attestations_required(value)
+    except EudiError as exc:
+        raise ConfigError("[%s] oid4vci_key_attestations_required: %s"
+                          % (badge_section, exc)) from exc
+
+
 # ── centralized config defaults ──────────────────────────────────────────────
 # One inventory for the accepted-key defaults, so each lives in a single place
 # rather than being re-spelled at every read site. (The status-list defaults —

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/issue.py

@@ -116,6 +116,12 @@ def _safe_filename_component(value: str, field_name: str) -> str:
         raise ValueError('%s is not safe for use in an output filename' % field_name)
     if os.path.basename(value) != value or ntpath.basename(value) != value:
         raise ValueError('%s must not contain path separators' % field_name)
+    # CR/LF/quotes/semicolons would inject MIME headers when this name is
+    # used as Content-Disposition filename (#316).
+    if any(ch in value for ch in '\r\n"\';'):
+        raise ValueError(
+            '%s contains characters that are not safe in a filename'
+            % field_name)
     return value
 
 

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/mail.py

@@ -33,6 +33,18 @@ from email.header import Header
 from .badge_model import BadgeImgType   # version-neutral model (was ob1.badge)
 from .errors import BadgeImgFormatUnsupported
 
+#: Per-operation socket timeout for SMTP connect/read/write. smtplib's
+#: default is None (block forever).
+SMTP_TIMEOUT_SECONDS = 30
+
+
+def _smtp_is_loopback(host: str) -> bool:
+    """True for the hostnames/addresses operators use for a local MTA."""
+    name = host.strip().lower()
+    if name.startswith('[') and name.endswith(']'):
+        name = name[1:-1]
+    return name in ('localhost', '127.0.0.1', '::1')
+
 
 class BadgeMail():
     def __init__(self, smtp_server: str = 'localhost', smtp_port: int = 25,
@@ -67,10 +79,12 @@ class BadgeMail():
             raise BadgeImgFormatUnsupported(
                 'Unsupported image type: %r' % (badge.source.image_type,))
 
-        image = MIMEImage(badge.source.image,
-                          Content_Disposition='attachment; filename=%s' % basename(badge.file_out),
-                          Content_Description='Signed OpenBadge',
-                          _subtype=mime_type)
+        image = MIMEImage(badge.source.image, _subtype=mime_type)
+        # Keyword form so the filename is RFC 2231 encoded, never interpolated
+        # into the header value as raw bytes (#316).
+        image.add_header('Content-Disposition', 'attachment',
+                         filename=basename(badge.file_out))
+        image.add_header('Content-Description', 'Signed OpenBadge')
         msg.attach(image)
 
         try:
@@ -81,9 +95,17 @@ class BadgeMail():
                 # CERT_NONE), which would let an on-path attacker intercept the
                 # connection and capture the AUTH credentials sent below.
                 smtp = SMTP_SSL(self.smtp_server, self.smtp_port,
+                                timeout=SMTP_TIMEOUT_SECONDS,
                                 context=ssl.create_default_context())
             else:
-                smtp = SMTP(self.smtp_server, self.smtp_port)
+                smtp = SMTP(self.smtp_server, self.smtp_port,
+                            timeout=SMTP_TIMEOUT_SECONDS)
+                # Plain SMTP to a non-loopback host is upgraded with STARTTLS
+                # so the message (and any later AUTH) is not sent in the
+                # clear. localhost is left alone: a local MTA often has no
+                # TLS listener on :25 (#328).
+                if not _smtp_is_loopback(self.smtp_server):
+                    smtp.starttls(context=ssl.create_default_context())
 
             if self.username:
                 smtp.login(self.username, self.password)

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/ob1/verifier.py

@@ -182,7 +182,10 @@ class Verifier():
 
         revocation_json = download_file(revocation_url)
         if not revocation_json:
-            return None
+            # The issuer published a revocationList URL; an empty body is not
+            # "no revocations" — that is a missing key. Fail closed (#317).
+            raise AssertionFormatIncorrect(
+                "Revocation list at %s is empty" % revocation_url)
         try:
             revocation = jws_utils.from_json(revocation_json)
         except Exception:

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/ob2/verifier.py

@@ -274,7 +274,8 @@ class OB2Verifier:
             starts_with = _as_str_list(verification.get("startsWith"))
             allowed_origins = _as_str_list(verification.get("allowedOrigins"))
             if starts_with:
-                if not any(assertion_id.startswith(prefix) for prefix in starts_with):
+                if not any(_url_starts_with(assertion_id, prefix)
+                           for prefix in starts_with):
                     raise OB2VerificationError(
                         "Hosted assertion id %s is outside the issuer's declared "
                         "startsWith scope" % assertion_id)
@@ -342,16 +343,33 @@ class OB2Verifier:
     # ── network / decode helpers ─────────────────────────────────────────────────
 
     def _fetch_issuer(self, assertion: Assertion) -> dict[str, Any]:
-        """Resolve the issuer Profile via the assertion's BadgeClass ``badge`` URL."""
+        """Resolve the issuer Profile via the assertion's BadgeClass ``badge`` URL.
+
+        An embedded Profile object is not trusted: its ``id`` is fetched and
+        that retrieved document is the trust anchor (scope, revocation). A
+        holder-supplied BadgeClass could otherwise name a real issuer ``id``
+        while writing its own ``startsWith`` / ``revocationList`` (#315).
+        """
         badge = self._fetch_json(assertion.badge, "BadgeClass")
-        issuer_url = badge.get("issuer")
-        if isinstance(issuer_url, dict):
-            # BadgeClass.issuer may be an embedded Profile object.
-            return issuer_url
-        if not isinstance(issuer_url, str) or not issuer_url:
+        issuer = badge.get("issuer")
+        if isinstance(issuer, dict):
+            issuer_url = issuer.get("id")
+            if not isinstance(issuer_url, str) or not issuer_url:
+                raise OB2VerificationError(
+                    "BadgeClass at %s has an embedded issuer with no id"
+                    % assertion.badge)
+        elif isinstance(issuer, str) and issuer:
+            issuer_url = issuer
+        else:
             raise OB2VerificationError(
                 "BadgeClass at %s has no valid 'issuer'" % assertion.badge)
-        return self._fetch_json(issuer_url, "issuer Profile")
+        fetched = self._fetch_json(issuer_url, "issuer Profile")
+        fetched_id = fetched.get("id")
+        if isinstance(fetched_id, str) and fetched_id != issuer_url:
+            raise OB2VerificationError(
+                "Issuer Profile at %s has id %r, expected %r"
+                % (issuer_url, fetched_id, issuer_url))
+        return fetched
 
     def _fetch_json(self, url: str, where: str) -> dict[str, Any]:
         try:
@@ -445,3 +463,24 @@ def _same_origin(a: str, b: str) -> bool:
     """Return True if two URLs share scheme + host + port (their origin)."""
     pa, pb = urlparse(a), urlparse(b)
     return (pa.scheme, pa.hostname, pa.port) == (pb.scheme, pb.hostname, pb.port)
+
+
+def _url_starts_with(url: str, prefix: str) -> bool:
+    """True if *url* is in the hosted scope declared by *prefix*.
+
+    A raw ``str.startswith`` treats ``https://issuer.example`` as a prefix of
+    ``https://issuer.example.attacker.tld/…`` (and similar userinfo tricks).
+    Require the same origin, then a path that equals the prefix path or is
+    a strict path-segment descendant (#314).
+    """
+    if not prefix:
+        return False
+    if not _same_origin(url, prefix):
+        return False
+    u, p = urlparse(url), urlparse(prefix)
+    upath, ppath = u.path or '/', p.path or '/'
+    if upath == ppath:
+        return True
+    if not ppath.endswith('/'):
+        ppath += '/'
+    return upath.startswith(ppath)

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/ob3/ldp.py

@@ -453,6 +453,29 @@ def _reject_unsigned_ldp_aliases(doc: dict[str, Any]) -> None:
                 "not sign; use BitstringStatusListEntry")
 
 
+def _reject_hidden_sd_lifecycle(doc: dict[str, Any], proof: dict[str, Any]) -> None:
+    """Fail closed when an ecdsa-sd-2023 presentation omits lifecycle claims.
+
+    Selective disclosure lets a holder drop statements the issuer signed.
+    ``validUntil`` and ``credentialStatus`` are the ones that bound a badge's
+    life: hiding them makes an expired or revoked credential look perpetual.
+    eddsa-rdfc-2022 signs the whole document, so this only applies to
+    ecdsa-sd-2023. The low-level ``verify_data_integrity_proof`` does not
+    enforce it (it checks the proof alone); ``OB3LdpVerifier.verify`` does
+    (#328).
+    """
+    if proof.get('cryptosuite') != 'ecdsa-sd-2023':
+        return
+    if 'validUntil' not in doc:
+        raise OB3VerificationError(
+            "ecdsa-sd-2023 presentation omitted validUntil, which a holder "
+            "could hide to un-expire the badge; disclose validUntil")
+    if 'credentialStatus' not in doc:
+        raise OB3VerificationError(
+            "ecdsa-sd-2023 presentation omitted credentialStatus, which a "
+            "holder could hide to un-revoke the badge; disclose credentialStatus")
+
+
 class OB3LdpVerifier:
     """Verifies OpenBadges 3.0 credentials secured with a Data Integrity
     (Linked Data Proof) embedded proof — cryptosuites eddsa-rdfc-2022 and,
@@ -511,7 +534,9 @@ class OB3LdpVerifier:
         own signature is verified too (reusing a pinned key, or resolving the
         issuer DID), unless ``verify_status_list=False``. ``download`` resolves
         a did:web verificationMethod and status list issuer DID (injectable for
-        testing).
+        testing). An ``ecdsa-sd-2023`` presentation that omits ``validUntil``
+        or ``credentialStatus`` is rejected so a holder cannot hide expiry or
+        revocation (#328).
         """
         doc = self._parse_document(document)
 
@@ -528,6 +553,9 @@ class OB3LdpVerifier:
 
         proof = _select_proof(doc)
         _validate_proof(proof, 'assertionMethod')
+        # Before resolving keys or running crypto: an SD presentation that hid
+        # expiry/revocation is already a fail, regardless of the proof.
+        _reject_hidden_sd_lifecycle(doc, proof)
 
         vm = proof['verificationMethod']
         vm_did = vm.partition('#')[0]

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/ob3/publish.py

@@ -39,6 +39,7 @@
 
 import configparser
 import os
+import posixpath
 import shutil
 import tempfile
 
@@ -174,14 +175,28 @@ def _write_atomic(path: str, data: str) -> None:
 def _sd_jwt_vct_relpath(vct: str, publish_url: str) -> Optional[str]:
     """The output-relative path to write Type Metadata for *vct* so serving the
     output dir at *publish_url* resolves it there — or None if *vct* is not
-    hosted under *publish_url* (same scheme+host, path under it)."""
+    hosted under *publish_url* (same scheme+host, path under it).
+
+    The remainder is POSIX-normalized. A ``..`` that would leave the publish
+    prefix is refused (PublishError) rather than joined onto ``-o`` — a vct
+    of ``https://host/out/../../../tmp/x`` used to write outside the output
+    directory (#318).
+    """
     v, p = urlparse(vct), urlparse(publish_url)
     if (v.scheme, v.netloc) != (p.scheme, p.netloc):
         return None
     base = p.path if p.path.endswith('/') else p.path + '/'
     if not v.path.startswith(base):
         return None
-    return v.path[len(base):] or None
+    rel = v.path[len(base):]
+    if not rel:
+        return None
+    normalized = posixpath.normpath(rel)
+    if posixpath.isabs(normalized) or normalized == '..' \
+            or normalized.startswith('../'):
+        raise PublishError(
+            "[issuer] sd_jwt_vct path escapes the publish_url prefix")
+    return normalized
 
 
 def _publish_type_metadata(vct: str, publish_url: str, output: str,
@@ -198,6 +213,12 @@ def _publish_type_metadata(vct: str, publish_url: str, output: str,
     document = badge_type_metadata(vct)
     served = type_metadata_document_bytes(document)
     path = os.path.join(output, rel.replace('/', os.sep))
+    root = os.path.abspath(output)
+    dest = os.path.abspath(path)
+    if os.path.commonpath([root, dest]) != root:
+        raise PublishError(
+            "[issuer] sd_jwt_vct would write Type Metadata outside %s"
+            % output)
     parent = os.path.dirname(path)
     if parent:
         os.makedirs(parent, exist_ok=True)

{openbadgeslib-4.4.2 → openbadgeslib-4.4.4}/openbadgeslib/oid4vci/errors.py

@@ -76,7 +76,10 @@ INVALID_NONCE = 'invalid_nonce'
 INVALID_ENCRYPTION_PARAMETERS = 'invalid_encryption_parameters'
 #: The pre-authorized code was unknown, expired, already redeemed or killed.
 INVALID_GRANT = 'invalid_grant'
-#: The token request itself was malformed (missing tx_code, bad grant type).
+#: The token request itself was malformed (bad grant type, empty code).
+#: A live PIN-gated offer missing tx_code is invalid_grant, not this — the
+#: distinct invalid_request was an oracle that the offer exists and is
+#: PIN-gated (#328).
 INVALID_REQUEST = 'invalid_request'
 #: The access token was missing, unknown or expired. Served as HTTP 401 with a
 #: ``WWW-Authenticate: Bearer`` header, per RFC 6750 — not 400.