Changeset 256001 in webkit

Timestamp:

Feb 6, 2020 6:57:30 PM (4 years ago)

Author:

jiewen_tan@apple.com

Message:

[WebAuthn] authenticatorGetAssertion should be sent without pinAuth if UV = "discouraged"
​https://bugs.webkit.org/show_bug.cgi?id=206547
<rdar://problem/58768032>

Reviewed by Brent Fulgham.

Source/WebKit:

Covered by new tests within existing files.

• UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:

(WebKit::CtapAuthenticator::makeCredential):
(WebKit::CtapAuthenticator::getAssertion):

LayoutTests:

• http/wpt/webauthn/public-key-credential-get-success-hid.https-expected.txt:
• http/wpt/webauthn/public-key-credential-get-success-hid.https.html:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https-expected.txt (modified) (1 diff)
• LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https.html (modified) (1 diff)
• Source/WebKit/ChangeLog (modified) (1 diff)
• Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2020-02-06  Jiewen Tan  <jiewen_tan@apple.com>
+
+        [WebAuthn] authenticatorGetAssertion should be sent without pinAuth if UV = "discouraged"
+        https://bugs.webkit.org/show_bug.cgi?id=206547
+        <rdar://problem/58768032>
+
+        Reviewed by Brent Fulgham.
+
+        * http/wpt/webauthn/public-key-credential-get-success-hid.https-expected.txt:
+        * http/wpt/webauthn/public-key-credential-get-success-hid.https.html:
+
 2020-02-06  Antti Koivisto  <antti@apple.com>
 

trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https-expected.txt

@@ -7 +7 @@
 PASS PublicKeyCredential's [[get]] with two consecutive requests. 
 PASS PublicKeyCredential's [[get]] with multiple accounts in a mock hid authenticator. 
+PASS PublicKeyCredential's [[get]] with PIN supported in the authenticator but userVerification = 'discouraged' in a mock hid authenticator. 
 

trunk/LayoutTests/http/wpt/webauthn/public-key-credential-get-success-hid.https.html

@@ -117 +117 @@
         });
     }, "PublicKeyCredential's [[get]] with multiple accounts in a mock hid authenticator.");
+
+    promise_test(t => {
+        const options = {
+            publicKey: {
+                challenge: Base64URL.parse("MTIzNDU2"),
+                userVerification: "discouraged",
+                timeout: 100
+            }
+        };
+
+        if (window.internals)
+            internals.setMockWebAuthenticationConfiguration({ hid: { supportClientPin: true, payloadBase64: [testAssertionMessageBase64] } });
+        return navigator.credentials.get(options).then(credential => {
+            return checkCtapGetAssertionResult(credential);
+        });
+    }, "PublicKeyCredential's [[get]] with PIN supported in the authenticator but userVerification = 'discouraged' in a mock hid authenticator.");
 </script>

trunk/Source/WebKit/ChangeLog

@@ +1 @@
+2020-02-06  Jiewen Tan  <jiewen_tan@apple.com>
+
+        [WebAuthn] authenticatorGetAssertion should be sent without pinAuth if UV = "discouraged"
+        https://bugs.webkit.org/show_bug.cgi?id=206547
+        <rdar://problem/58768032>
+
+        Reviewed by Brent Fulgham.
+
+        Covered by new tests within existing files.
+
+        * UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:
+        (WebKit::CtapAuthenticator::makeCredential):
+        (WebKit::CtapAuthenticator::getAssertion):
+
 2020-02-06  Wenson Hsieh  <wenson_hsieh@apple.com>
 

trunk/Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp

@@ -59 +59 @@
         return;
     Vector<uint8_t> cborCmd;
+    auto& options = WTF::get<PublicKeyCredentialCreationOptions>(requestData().options);
     if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet)
-        cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, WTF::get<PublicKeyCredentialCreationOptions>(requestData().options), m_info.options().userVerificationAvailability(), PinParameters { pin::kProtocolVersion, m_pinAuth });
+        cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, options, m_info.options().userVerificationAvailability(), PinParameters { pin::kProtocolVersion, m_pinAuth });
     else
-        cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, WTF::get<PublicKeyCredentialCreationOptions>(requestData().options), m_info.options().userVerificationAvailability());
+        cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, options, m_info.options().userVerificationAvailability());
     driver().transact(WTFMove(cborCmd), [weakThis = makeWeakPtr(*this)](Vector<uint8_t>&& data) {
         ASSERT(RunLoop::isMain());
@@ -92 +93 @@
     ASSERT(!m_isDowngraded);
     Vector<uint8_t> cborCmd;
-    if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet)
-        cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, WTF::get<PublicKeyCredentialRequestOptions>(requestData().options), m_info.options().userVerificationAvailability(), PinParameters { pin::kProtocolVersion, m_pinAuth });
+    auto& options = WTF::get<PublicKeyCredentialRequestOptions>(requestData().options);
+    if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet && options.userVerification != UserVerificationRequirement::Discouraged)
+        cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, options, m_info.options().userVerificationAvailability(), PinParameters { pin::kProtocolVersion, m_pinAuth });
     else
-        cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, WTF::get<PublicKeyCredentialRequestOptions>(requestData().options), m_info.options().userVerificationAvailability());
+        cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, options, m_info.options().userVerificationAvailability());
     driver().transact(WTFMove(cborCmd), [weakThis = makeWeakPtr(*this)](Vector<uint8_t>&& data) {
         ASSERT(RunLoop::isMain());