Fixes passkeys validation errors#2916
Conversation
1. `length` - the length in elements, `byteLength` - the length in bytes. Also `length` does not exist in `ArrayBuffer`. - https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray - https://www.w3.org/TR/webauthn-2/#sctn-cryptographic-challenges 2. `rp.id` in PublicKeyCredentialCreationOptions, but `rpId` in PublicKeyCredentialRequestOptions - https://www.w3.org/TR/webauthn-2/#idl-index
- Prevent tracking and non-domain requests - Checking response status code https://www.w3.org/TR/webauthn-3/#sctn-validating-relation-origin
|
Validation of Related Origins is made in the KeePassXC side. |
I'm not checking ROR. I'm checking the data for a GET request the same way you check the |
| let hostname; | ||
| try { | ||
| hostname = new URL(`https://${rpId}`).hostname; | ||
| } catch { } |
There was a problem hiding this comment.
Should return already in here?
There was a problem hiding this comment.
So there should be code duplication?
try {
if (new URL(`https://${rpId}`).hostname !== rpId) {
logError(`getRelatedOrigins error: "${rpId}" is wrong rpId`);
return [];
}
} catch {
logError(`getRelatedOrigins error: "${rpId}" is wrong rpId`);
return [];
}There was a problem hiding this comment.
Of course we want to handle the exception.
There was a problem hiding this comment.
The error itself does not provide any useful information. The rpId may be incorrect both in case of an error and without one.
If an error occurs, the assignment operation will not be executed, and the hostname will be equal to undefined.
3 participants
length- the length in elements,byteLength- the length in bytes. Alsolengthdoes not exist inArrayBuffer. ForArrayBuffervalidation isundefined < 16. ButBigUint64Arrayrequires 128 bytes to pass validation.https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/TypedArray
https://www.w3.org/TR/webauthn-2/#sctn-cryptographic-challenges
rp.idin PublicKeyCredentialCreationOptions, butrpIdin PublicKeyCredentialRequestOptionshttps://www.w3.org/TR/webauthn-2/#idl-index
strict ROR validation
https://www.w3.org/TR/webauthn-3/#sctn-validating-relation-origin
Fixes #2915
Screenshots or videos
Testing strategy
Additional information, resources etc.
Type of change