fido2-lib - npm Package Compare versions

Comparing version 2.6.5 to 2.6.6

lib/main.js

@@ -712,2 +712,3 @@ "use strict";
 		case "first":
+			flags.push("UP");
 			flags.push("UV");
@@ -714,0 +715,0 @@ break;

lib/validator.js

@@ -478,3 +478,9 @@ /* eslint-disable no-invalid-this */
 		if (expFlag === "UP-or-UV") {
-			if (flags.has("UP") || flags.has("UV")) {
+			if (flags.has("UV")) {
+				if (flags.has("UP")) {
+					continue;
+				} else {
+					throw new Error("expected User Presence (UP) flag to be set if User Verification (UV) is set");
+				}
+			} else if (flags.has("UP")) {
 				continue;
@@ -486,2 +492,14 @@ } else {
 
+		if (expFlag === "UV") {
+			if (flags.has("UV")) {
+				if (flags.has("UP")) {
+					continue;
+				} else {
+					throw new Error("expected User Presence (UP) flag to be set if User Verification (UV) is set");
+				}
+			} else {
+				throw new Error(`expected flag was not set: ${expFlag}`);
+			}
+		}
+
 		if (!flags.has(expFlag)) {
@@ -488,0 +506,0 @@ throw new Error(`expected flag was not set: ${expFlag}`);

package.json

 {
 	"name": "fido2-lib",
-	"version": "2.6.5",
+	"version": "2.6.6",
 	"description": "A library for performing FIDO 2.0 / WebAuthn functionality",
@@ -5,0 +5,0 @@ "main": "index.js",

test/parseNoneAttestationDataTest.js

@@ -6,2 +6,3 @@ "use strict";
 const h = require("fido2-helpers");
+const noneParseFn = require("../lib/attestations/none").parseFn;
 
@@ -146,2 +147,9 @@ var runs = [
 	});
+});
+
+describe("parseFn (none)", function() {
+	it("throws if attStmn has fields", function() {
+		var attStmt = {test: 1};
+		assert.throws(() => { noneParseFn(attStmt); }, Error, "'none' attestation format: attStmt had fields");
+	});
 });

test/validatorTest.js

@@ -723,2 +723,20 @@ "use strict";
 
+				it("throws if UV is set but UP is not set", function() {
+					attResp.expectations.set("flags", ["UV"]);
+					attResp.authnrData.set("flags", new Set(["UV"]));
+					return assert.isRejected(attResp.validateFlags(), Error, "expected User Presence (UP) flag to be set if User Verification (UV) is set");
+				});
+
+				it("throws if UV is not set", function() {
+					attResp.expectations.set("flags", ["UV"]);
+					attResp.authnrData.set("flags", new Set(["ED"]));
+					return assert.isRejected(attResp.validateFlags(), Error, "expected flag was not set: UV");
+				});
+
+				it("throws if UV but only UP is set", function() {
+					attResp.expectations.set("flags", ["UV"]);
+					attResp.authnrData.set("flags", new Set(["UP"]));
+					return assert.isRejected(attResp.validateFlags(), Error, "expected flag was not set: UV");
+				});
+
 				it("returns true on UP with UP-or-UV", async function() {
@@ -734,3 +752,3 @@ attResp.expectations.set("flags", ["UP-or-UV"]);
 					attResp.expectations.set("flags", ["UP-or-UV"]);
-					attResp.authnrData.set("flags", new Set(["UV"]));
+					attResp.authnrData.set("flags", new Set(["UV", "UP"]));
 					var ret = await attResp.validateFlags();
@@ -741,2 +759,8 @@ assert.isTrue(ret);
 
+				it("throws if UP-or-UV and UV is set but not UP", function() {
+					attResp.expectations.set("flags", ["UP-or-UV"]);
+					attResp.authnrData.set("flags", new Set(["UV"]));
+					return assert.isRejected(attResp.validateFlags(), Error, "expected User Presence (UP) flag to be set if User Verification (UV) is set");
+				});
+
 				it("throws if UP-or-UV and neither is set", function() {
@@ -743,0 +767,0 @@ attResp.expectations.set("flags", ["UP-or-UV"]);

No alert changes

Improved metrics

Total package byte prevSize

418709

increased by0.47%

Lines of code

9394

increased by0.48%

No dependency changes