From f3e4bb9e009073c1f1273fa5bccb9cbd001c955d Mon Sep 17 00:00:00 2001 From: Sander Kondratjev Date: Fri, 3 Jul 2026 15:10:00 +0300 Subject: [PATCH] NFC-176 Restrict supported Web eID token formats Signed-off-by: Sander Kondratjev sander.kondratjev@nortal.com Signed-off-by: Sander Kondratjev --- README.md | 2 +- .../AuthTokenVersion11Validator.java | 6 +++--- .../AuthTokenVersion1Validator.java | 8 ++------ .../AuthTokenVersion1ValidatorTest.java | 18 +++++++++++++++--- 4 files changed, 21 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index e3aa6986..234fb109 100644 --- a/README.md +++ b/README.md @@ -309,7 +309,7 @@ It contains the following fields: - `signature`: the base64-encoded signature of the token (see the description below), -- `format`: the type identifier and version of the token format separated by a colon character '`:`', `web-eid:1.0` as of now; the version number consists of the major and minor number separated by a dot, major version changes are incompatible with previous versions, minor version changes are backwards-compatible within the given major version, +- `format`: the type identifier and version of the token format separated by a colon character '`:`'. While minor version changes are intended to be backwards-compatible within the same major version, this validation library accepts only explicitly supported token format versions. - `appVersion`: the URL identifying the name and version of the application that issued the token; informative purpose, can be used to identify the affected application in case of faulty tokens. diff --git a/src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion11Validator.java b/src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion11Validator.java index db39fade..03280fa9 100644 --- a/src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion11Validator.java +++ b/src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion11Validator.java @@ -60,7 +60,7 @@ class AuthTokenVersion11Validator extends AuthTokenVersion1Validator implements AuthTokenVersionValidator { - private static final Pattern V11_SUPPORTED_TOKEN_FORMAT_PATTERN = Pattern.compile("^web-eid:1\\.1$"); + private static final String V11_SUPPORTED_TOKEN_FORMAT_PREFIX = "web-eid:1.1"; private static final Set SUPPORTED_SIGNING_CRYPTO_ALGORITHMS = Set.of("ECC", "RSA"); private static final Set SUPPORTED_SIGNING_PADDING_SCHEMES = Set.of("NONE", "PKCS1.5", "PSS"); private static final Set SUPPORTED_SIGNING_HASH_FUNCTIONS = Set.of( @@ -95,8 +95,8 @@ public AuthTokenVersion11Validator( } @Override - protected Pattern getSupportedFormatPattern() { - return V11_SUPPORTED_TOKEN_FORMAT_PATTERN; + public boolean supports(String format) { + return V11_SUPPORTED_TOKEN_FORMAT_PREFIX.equals(format); } @Override diff --git a/src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1Validator.java b/src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1Validator.java index f2c2105a..5b818c62 100644 --- a/src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1Validator.java +++ b/src/main/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1Validator.java @@ -41,7 +41,6 @@ class AuthTokenVersion1Validator implements AuthTokenVersionValidator { private static final String V1_SUPPORTED_TOKEN_FORMAT_PREFIX = "web-eid:1"; - private static final Pattern V1_SUPPORTED_TOKEN_FORMAT_PATTERN = Pattern.compile("^web-eid:1(?:\\.\\d+)?$"); private final SubjectCertificateValidatorBatch simpleSubjectCertificateValidators; private final Set trustedCACertificateAnchors; private final CertStore trustedCACertificateCertStore; @@ -70,11 +69,8 @@ public AuthTokenVersion1Validator( @Override public boolean supports(String format) { - return format != null && getSupportedFormatPattern().matcher(format).matches(); - } - - protected Pattern getSupportedFormatPattern() { - return V1_SUPPORTED_TOKEN_FORMAT_PATTERN; + return V1_SUPPORTED_TOKEN_FORMAT_PREFIX.equals(format) + || "web-eid:1.0".equals(format); } @Override diff --git a/src/test/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1ValidatorTest.java b/src/test/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1ValidatorTest.java index 271f5ed3..02cf4722 100644 --- a/src/test/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1ValidatorTest.java +++ b/src/test/java/eu/webeid/security/validator/versionvalidators/AuthTokenVersion1ValidatorTest.java @@ -61,14 +61,26 @@ class AuthTokenVersion1ValidatorTest { ); @ParameterizedTest - @ValueSource(strings = {"web-eid:1", "web-eid:1.0", "web-eid:1.1", "web-eid:1.10", "web-eid:1.999"}) - void whenFormatIsValidMajorV1Format_thenSupportsReturnsTrue(String format) { + @ValueSource(strings = {"web-eid:1", "web-eid:1.0"}) + void whenFormatIsSupportedV1_thenSupportsReturnsTrue(String format) { assertThat(validator.supports(format)).isTrue(); } @ParameterizedTest @NullAndEmptySource - @ValueSource(strings = {"web-eid", "web-eid:1.", "web-eid:1.0TEST", "web-eid:1.1.0", "web-eid:0.9", "web-eid:2", "webauthn:1"}) + @ValueSource(strings = { + "web-eid", + "web-eid:1.", + "web-eid:1.0TEST", + "web-eid:1.1", + "web-eid:1.1.0", + "web-eid:1.2", + "web-eid:1.10", + "web-eid:1.999", + "web-eid:0.9", + "web-eid:2", + "webauthn:1" + }) void whenFormatIsNullEmptyOrMalformedOrNotV1_thenSupportsReturnsFalse(String format) { assertThat(validator.supports(format)).isFalse(); }