mirrors/bitwarden-android
1
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2024-10-31 07:05:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

PM-7746 Added specific validation messages for (non) privileged apps validation on Fido2 flows. Also fixed typo on "privileged" and updated UT (#3198)

Browse source
This commit is contained in:
Federico Maccaroni 2024-04-26 13:59:03 -03:00 committed by GitHub
parent ba1183234b
commit f80ec1b221
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 179 additions and 60 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/App/App.csproj
View file

@ -266,6 +266,6 @@
<BundleResource Include="Platforms\iOS\PrivacyInfo.xcprivacy" LogicalName="PrivacyInfo.xcprivacy" />
</ItemGroup>
<ItemGroup Condition="$([MSBuild]::GetTargetPlatformIdentifier('$(TargetFramework)')) == 'android'">
<MauiAsset Include="Resources\Raw\fido2_priviliged_allow_list.json" LogicalName="fido2_priviliged_allow_list.json" />
<MauiAsset Include="Resources\Raw\fido2_privileged_allow_list.json" LogicalName="fido2_privileged_allow_list.json" />
</ItemGroup>
</Project>

52
src/App/Platforms/Android/Autofill/CredentialHelpers.cs
View file

@ -1,4 +1,5 @@
using System.Text.Json.Nodes;
using System.ComponentModel.DataAnnotations;
using System.Text.Json.Nodes;
using Android.App;
using Android.Content;
using Android.OS;
@ -83,23 +84,27 @@ namespace Bit.App.Platforms.Android.Autofill
if (callingRequest is null)
{
if (ServiceContainer.TryResolve<IDeviceActionService>(out var deviceActionService))
{
await deviceActionService.DisplayAlertAsync(AppResources.ErrorCreatingPasskey, string.Empty, AppResources.Ok);
}
await DisplayAlertAsync(AppResources.AnErrorHasOccurred, string.Empty);
FailAndFinish();
return;
}
var credentialCreationOptions = GetPublicKeyCredentialCreationOptionsFromJson(callingRequest.RequestJson);
var origin = await ValidateCallingAppInfoAndGetOriginAsync(getRequest.CallingAppInfo, credentialCreationOptions.Rp.Id);
string origin;
try
{
origin = await ValidateCallingAppInfoAndGetOriginAsync(getRequest.CallingAppInfo, credentialCreationOptions.Rp.Id);
}
catch (Core.Exceptions.ValidationException valEx)
{
await DisplayAlertAsync(AppResources.AnErrorHasOccurred, valEx.Message);
FailAndFinish();
return;
}
if (origin is null)
{
if (ServiceContainer.TryResolve<IDeviceActionService>(out var deviceActionService))
{
await deviceActionService.DisplayAlertAsync(AppResources.ErrorCreatingPasskey, AppResources.PasskeysNotSupportedForThisApp, AppResources.Ok);
}
await DisplayAlertAsync(AppResources.ErrorCreatingPasskey, AppResources.PasskeysNotSupportedForThisApp);
FailAndFinish();
return;
}
@ -202,6 +207,14 @@ namespace Bit.App.Platforms.Android.Autofill
activity.SetResult(Result.Ok, result);
activity.Finish();
async Task DisplayAlertAsync(string title, string message)
{
if (ServiceContainer.TryResolve<IDeviceActionService>(out var deviceActionService))
{
await deviceActionService.DisplayAlertAsync(title, message, AppResources.Ok);
}
}
void FailAndFinish()
{
var result = new Intent();
@ -244,11 +257,11 @@ namespace Bit.App.Platforms.Android.Autofill
return extensionsJson;
}
public static async Task<string> LoadFido2PriviligedAllowedListAsync()
public static async Task<string> LoadFido2PrivilegedAllowedListAsync()
{
try
{
using var stream = await FileSystem.OpenAppPackageFileAsync("fido2_priviliged_allow_list.json");
using var stream = await FileSystem.OpenAppPackageFileAsync("fido2_privileged_allow_list.json");
using var reader = new StreamReader(stream);
return reader.ReadToEnd();
@ -266,19 +279,24 @@ namespace Bit.App.Platforms.Android.Autofill
return await ValidateAssetLinksAndGetOriginAsync(callingAppInfo, rpId);
}
var priviligedAllowedList = await LoadFido2PriviligedAllowedListAsync();
if (priviligedAllowedList is null)
var privilegedAllowedList = await LoadFido2PrivilegedAllowedListAsync();
if (privilegedAllowedList is null)
{
throw new InvalidOperationException("Could not load Fido2 priviliged allowed list");
throw new InvalidOperationException("Could not load Fido2 privileged allowed list");
}
if (!privilegedAllowedList.Contains($"\"package_name\": \"{callingAppInfo.PackageName}\""))
{
throw new Core.Exceptions.ValidationException(AppResources.PasskeyOperationFailedBecauseBrowserIsNotPrivileged);
}
try
{
return callingAppInfo.GetOrigin(priviligedAllowedList);
return callingAppInfo.GetOrigin(privilegedAllowedList);
}
catch (Java.Lang.IllegalStateException)
{
return null; // not priviliged
throw new Core.Exceptions.ValidationException(AppResources.PasskeyOperationFailedBecauseBrowserSignatureDoesNotMatch);
}
catch (Java.Lang.IllegalArgumentException)
{

13
src/App/Platforms/Android/Autofill/CredentialProviderSelectionActivity.cs
View file

@ -77,7 +77,18 @@ namespace Bit.Droid.Autofill
var packageName = getRequest.CallingAppInfo.PackageName;
var origin = await CredentialHelpers.ValidateCallingAppInfoAndGetOriginAsync(getRequest.CallingAppInfo, RpId);
string origin;
try
{
origin = await CredentialHelpers.ValidateCallingAppInfoAndGetOriginAsync(getRequest.CallingAppInfo, RpId);
}
catch (Core.Exceptions.ValidationException valEx)
{
await _deviceActionService.Value.DisplayAlertAsync(AppResources.AnErrorHasOccurred, valEx.Message, AppResources.Ok);
FailAndFinish();
return;
}
if (origin is null)
{
await _deviceActionService.Value.DisplayAlertAsync(AppResources.ErrorReadingPasskey, AppResources.PasskeysNotSupportedForThisApp, AppResources.Ok);

0
src/App/Resources/Raw/fido2_priviliged_allow_list.json → src/App/Resources/Raw/fido2_privileged_allow_list.json
View file

10
src/Core/Exceptions/ValidationException.cs Normal file
View file

@ -0,0 +1,10 @@
namespace Bit.Core.Exceptions
{
public class ValidationException : Exception
{
public ValidationException(string localizedMessage)
: base(localizedMessage)
{
}
}
}

45
src/Core/Resources/Localization/AppResources.Designer.cs generated
View file

@ -5263,6 +5263,51 @@ namespace Bit.Core.Resources.Localization {
}
}
/// <summary>
/// Looks up a localized string similar to Passkey operation failed because app could not be verified.
/// </summary>
public static string PasskeyOperationFailedBecauseAppCouldNotBeVerified {
get {
return ResourceManager.GetString("PasskeyOperationFailedBecauseAppCouldNotBeVerified", resourceCulture);
}
}
/// <summary>
/// Looks up a localized string similar to Passkey operation failed because app not found in asset links.
/// </summary>
public static string PasskeyOperationFailedBecauseAppNotFoundInAssetLinks {
get {
return ResourceManager.GetString("PasskeyOperationFailedBecauseAppNotFoundInAssetLinks", resourceCulture);
}
}
/// <summary>
/// Looks up a localized string similar to Passkey operation failed because browser is not privileged.
/// </summary>
public static string PasskeyOperationFailedBecauseBrowserIsNotPrivileged {
get {
return ResourceManager.GetString("PasskeyOperationFailedBecauseBrowserIsNotPrivileged", resourceCulture);
}
}
/// <summary>
/// Looks up a localized string similar to Passkey operation failed because browser signature does not match.
/// </summary>
public static string PasskeyOperationFailedBecauseBrowserSignatureDoesNotMatch {
get {
return ResourceManager.GetString("PasskeyOperationFailedBecauseBrowserSignatureDoesNotMatch", resourceCulture);
}
}
/// <summary>
/// Looks up a localized string similar to Passkey operation failed because of missing asset links.
/// </summary>
public static string PasskeyOperationFailedBecauseOfMissingAssetLinks {
get {
return ResourceManager.GetString("PasskeyOperationFailedBecauseOfMissingAssetLinks", resourceCulture);
}
}
/// <summary>
/// Looks up a localized string similar to Passkeys.
/// </summary>

15
src/Core/Resources/Localization/AppResources.resx
View file

@ -2990,4 +2990,19 @@ Do you want to switch to this account?</value>
<data name="PasskeysNotSupportedForThisApp" xml:space="preserve">
<value>Passkeys not supported for this app</value>
</data>
<data name="PasskeyOperationFailedBecauseBrowserIsNotPrivileged" xml:space="preserve">
<value>Passkey operation failed because browser is not privileged</value>
</data>
<data name="PasskeyOperationFailedBecauseBrowserSignatureDoesNotMatch" xml:space="preserve">
<value>Passkey operation failed because browser signature does not match</value>
</data>
<data name="PasskeyOperationFailedBecauseOfMissingAssetLinks" xml:space="preserve">
<value>Passkey operation failed because of missing asset links</value>
</data>
<data name="PasskeyOperationFailedBecauseAppNotFoundInAssetLinks" xml:space="preserve">
<value>Passkey operation failed because app not found in asset links</value>
</data>
<data name="PasskeyOperationFailedBecauseAppCouldNotBeVerified" xml:space="preserve">
<value>Passkey operation failed because app could not be verified</value>
</data>
</root>

40
src/Core/Services/AssetLinksService.cs
View file

@ -1,4 +1,5 @@
using Bit.Core.Abstractions;
using Bit.Core.Resources.Localization;
namespace Bit.Core.Services
{
@ -18,18 +19,35 @@ namespace Bit.Core.Services
/// <returns><c>True</c> if matches, <c>False</c> otherwise.</returns>
public async Task<bool> ValidateAssetLinksAsync(string rpId, string packageName, string normalizedFingerprint)
{
var statementList = await _apiService.GetDigitalAssetLinksForRpAsync(rpId);
try
{
var statementList = await _apiService.GetDigitalAssetLinksForRpAsync(rpId);
return statementList
.Any(s => s.Target.Namespace == "android_app"
&&
s.Target.PackageName == packageName
&&
s.Relation.Contains("delegate_permission/common.get_login_creds")
&&
s.Relation.Contains("delegate_permission/common.handle_all_urls")
&&
s.Target.Sha256CertFingerprints.Contains(normalizedFingerprint));
var androidAppPackageStatements = statementList
.Where(s => s.Target.Namespace == "android_app"
&&
s.Target.PackageName == packageName
&&
s.Relation.Contains("delegate_permission/common.get_login_creds")
&&
s.Relation.Contains("delegate_permission/common.handle_all_urls"));
if (!androidAppPackageStatements.Any())
{
throw new Exceptions.ValidationException(AppResources.PasskeyOperationFailedBecauseAppNotFoundInAssetLinks);
}
if (!androidAppPackageStatements.Any(s => s.Target.Sha256CertFingerprints.Contains(normalizedFingerprint)))
{
throw new Exceptions.ValidationException(AppResources.PasskeyOperationFailedBecauseAppCouldNotBeVerified);
}
return true;
}
catch (Exceptions.ApiException)
{
throw new Exceptions.ValidationException(AppResources.PasskeyOperationFailedBecauseOfMissingAssetLinks);
}
}
}
}

62
test/Core.Test/Services/AssetLinksServiceTest.cs
View file

@ -3,6 +3,7 @@ using System.Collections.Generic;
using System.IO;
using System.Threading.Tasks;
using Bit.Core.Abstractions;
using Bit.Core.Resources.Localization;
using Bit.Core.Services;
using Bit.Core.Utilities.DigitalAssetLinks;
using Bit.Test.Common.AutoFixture;
@ -71,7 +72,7 @@ namespace Bit.Core.Test.Services
}
[Fact]
public async Task ValidateAssetLinksAsync_Returns_False_When_Data_Statement_Has_No_GetLoginCreds_Relation()
public async Task ValidateAssetLinksAsync_Throws_When_Data_Statement_Has_No_GetLoginCreds_Relation()
{
// Arrange
_sutProvider.GetDependency<IApiService>()
@ -79,14 +80,14 @@ namespace Bit.Core.Test.Services
.Returns(Task.FromResult(Deserialize(BasicAssetLinksTestData.OneStatementNoGetLoginCredsRelationJson())));
// Act
var isValid = await _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint);
var exception = await Assert.ThrowsAsync<Exceptions.ValidationException>(() => _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint));
// Assert
Assert.False(isValid);
Assert.Equal(AppResources.PasskeyOperationFailedBecauseAppNotFoundInAssetLinks, exception.Message);
}
[Fact]
public async Task ValidateAssetLinksAsync_Returns_False_When_Data_Statement_Has_No_HandleAllUrls_Relation()
public async Task ValidateAssetLinksAsync_Throws_When_Data_Statement_Has_No_HandleAllUrls_Relation()
{
// Arrange
_sutProvider.GetDependency<IApiService>()
@ -94,14 +95,14 @@ namespace Bit.Core.Test.Services
.Returns(Task.FromResult(Deserialize(BasicAssetLinksTestData.OneStatementNoHandleAllUrlsRelationJson())));
// Act
var isValid = await _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint);
var exception = await Assert.ThrowsAsync<Exceptions.ValidationException>(() => _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint));
// Assert
Assert.False(isValid);
Assert.Equal(AppResources.PasskeyOperationFailedBecauseAppNotFoundInAssetLinks, exception.Message);
}
[Fact]
public async Task ValidateAssetLinksAsync_Returns_False_When_Data_Statement_Has_Wrong_Namespace()
public async Task ValidateAssetLinksAsync_Throws_When_Data_Statement_Has_Wrong_Namespace()
{
// Arrange
_sutProvider.GetDependency<IApiService>()
@ -109,14 +110,14 @@ namespace Bit.Core.Test.Services
.Returns(Task.FromResult(Deserialize(BasicAssetLinksTestData.OneStatementWrongNamespaceJson())));
// Act
var isValid = await _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint);
var exception = await Assert.ThrowsAsync<Exceptions.ValidationException>(() => _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint));
// Assert
Assert.False(isValid);
Assert.Equal(AppResources.PasskeyOperationFailedBecauseAppNotFoundInAssetLinks, exception.Message);
}
[Fact]
public async Task ValidateAssetLinksAsync_Returns_False_When_Data_Statement_Has_No_Fingerprints()
public async Task ValidateAssetLinksAsync_Throws_When_Data_Statement_Has_No_Fingerprints()
{
// Arrange
_sutProvider.GetDependency<IApiService>()
@ -124,14 +125,30 @@ namespace Bit.Core.Test.Services
.Returns(Task.FromResult(Deserialize(BasicAssetLinksTestData.OneStatementNoFingerprintsJson())));
// Act
var isValid = await _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint);
var exception = await Assert.ThrowsAsync<Exceptions.ValidationException>(() => _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint));
// Assert
Assert.False(isValid);
Assert.Equal(AppResources.PasskeyOperationFailedBecauseAppCouldNotBeVerified, exception.Message);
}
[Fact]
public async Task ValidateAssetLinksAsync_Returns_False_When_Data_PackageName_Doesnt_Match()
public async Task ValidateAssetLinksAsync_Throws_When_Data_PackageName_Doesnt_Match()
{
// Arrange
_sutProvider.GetDependency<IApiService>()
.GetDigitalAssetLinksForRpAsync(_validRpId)
.Returns(Task.FromResult(Deserialize(BasicAssetLinksTestData.OneStatementOneFingerprintJson())));
// Act
var exception = await Assert.ThrowsAsync<Exceptions.ValidationException>(() => _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, "com.foo.another", _validFingerprint));
// Assert
Assert.Equal(AppResources.PasskeyOperationFailedBecauseAppNotFoundInAssetLinks, exception.Message);
}
[Fact]
public async Task ValidateAssetLinksAsync_Throws_When_Data_Fingerprint_Doesnt_Match()
{
// Arrange
_sutProvider.GetDependency<IApiService>()
@ -139,25 +156,10 @@ namespace Bit.Core.Test.Services
.Returns(Task.FromResult(Deserialize(BasicAssetLinksTestData.OneStatementOneFingerprintJson())));
// Act
var isValid = await _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, "com.foo.another", _validFingerprint);
var exception = await Assert.ThrowsAsync<Exceptions.ValidationException>(() => _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint.Replace("00", "33")));
// Assert
Assert.False(isValid);
}
[Fact]
public async Task ValidateAssetLinksAsync_Returns_False_When_Data_Fingerprint_Doesnt_Match()
{
// Arrange
_sutProvider.GetDependency<IApiService>()
.GetDigitalAssetLinksForRpAsync(_validRpId)
.Returns(Task.FromResult(Deserialize(BasicAssetLinksTestData.OneStatementOneFingerprintJson())));
// Act
var isValid = await _sutProvider.Sut.ValidateAssetLinksAsync(_validRpId, _validPackageName, _validFingerprint.Replace("00", "33"));
// Assert
Assert.False(isValid);
Assert.Equal(AppResources.PasskeyOperationFailedBecauseAppCouldNotBeVerified, exception.Message);
}
public void Dispose() {}