From 23e77e1bc3d04747f38684578a339ea18db7bc53 Mon Sep 17 00:00:00 2001 From: Alan Parra Date: Thu, 31 Aug 2023 19:17:26 -0300 Subject: [PATCH] fix: Downgrade github.com/fxamacker/cbor/v2 to v2.4.0 (#31322) * Capture attestation data parsing issue in a test * Downgrade github.com/fxamacker/cbor/v2 to v2.4.0 --- go.mod | 2 +- go.sum | 4 ++-- lib/auth/webauthn/register_test.go | 15 +++++++++++++++ 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index cc428becdee..a032c40ba92 100644 --- a/go.mod +++ b/go.mod @@ -69,7 +69,7 @@ require ( github.com/flynn/hid v0.0.0-20190502022136-f1b9b6cc019a github.com/flynn/u2f v0.0.0-20180613185708-15554eb68e5d github.com/fsouza/fake-gcs-server v1.47.4 - github.com/fxamacker/cbor/v2 v2.5.0 + github.com/fxamacker/cbor/v2 v2.4.0 github.com/ghodss/yaml v1.0.0 github.com/gizak/termui/v3 v3.1.0 github.com/go-ldap/ldap/v3 v3.4.5 diff --git a/go.sum b/go.sum index 06f3b4852b3..ed0282463e0 100644 --- a/go.sum +++ b/go.sum @@ -525,8 +525,8 @@ github.com/fullstorydev/grpcurl v1.8.1/go.mod h1:3BWhvHZwNO7iLXaQlojdg5NA6SxUDeP github.com/fullstorydev/grpcurl v1.8.2/go.mod h1:YvWNT3xRp2KIRuvCphFodG0fKkMXwaxA9CJgKCcyzUQ= github.com/fvbommel/sortorder v1.1.0 h1:fUmoe+HLsBTctBDoaBwpQo5N+nrCp8g/BjKb/6ZQmYw= github.com/fvbommel/sortorder v1.1.0/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0= -github.com/fxamacker/cbor/v2 v2.5.0 h1:oHsG0V/Q6E/wqTS2O1Cozzsy69nqCiguo5Q1a1ADivE= -github.com/fxamacker/cbor/v2 v2.5.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo= +github.com/fxamacker/cbor/v2 v2.4.0 h1:ri0ArlOR+5XunOP8CRUowT0pSJOwhW098ZCUyskZD88= +github.com/fxamacker/cbor/v2 v2.4.0/go.mod h1:TA1xS00nchWmaBnEIxPSE5oHLuJBAVvqrtAnWBwBCVo= github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU= github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA= github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ= diff --git a/lib/auth/webauthn/register_test.go b/lib/auth/webauthn/register_test.go index fd4292aab18..ce63769a363 100644 --- a/lib/auth/webauthn/register_test.go +++ b/lib/auth/webauthn/register_test.go @@ -19,6 +19,7 @@ import ( "context" "encoding/pem" "sort" + "strings" "testing" "github.com/go-webauthn/webauthn/protocol" @@ -516,6 +517,20 @@ func TestRegistrationFlow_Finish_attestation(t *testing.T) { } } +// TestIssue31187_errorParsingAttestationResponse reproduces the root cause of +// https://github.com/gravitational/teleport/issues/31187 by attempting to parse +// a current CCR created using a Chrome/Yubikey pair. +// +// The test exposes a poor interaction between go-webauthn/webauthn v0.8.6 and +// fxamacker/cbor/v2 v2.5.0. +func TestIssue31187_errorParsingAttestationResponse(t *testing.T) { + // Captured from an actual Yubikey 5Ci registration request. + const body = `{"id":"ibfM_71b4q2_xWPZDyvhZmJ_KU8f-mOCCLXHp-fTVoHZpDelym5lvBJDPr1EtD_l","type":"public-key","rawId":"ibfM_71b4q2_xWPZDyvhZmJ_KU8f-mOCCLXHp-fTVoHZpDelym5lvBJDPr1EtD_l","response":{"clientDataJSON":"eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoidEdiVFhEbzBGMXRNUVlmamRSLWNETlV1TUNvVURTX0w0OElSWmY4MUVuWSIsIm9yaWdpbiI6Imh0dHBzOi8vemFycXVvbi5kZXY6MzA4MCIsImNyb3NzT3JpZ2luIjpmYWxzZSwib3RoZXJfa2V5c19jYW5fYmVfYWRkZWRfaGVyZSI6ImRvIG5vdCBjb21wYXJlIGNsaWVudERhdGFKU09OIGFnYWluc3QgYSB0ZW1wbGF0ZS4gU2VlIGh0dHBzOi8vZ29vLmdsL3lhYlBleCJ9","attestationObject":"o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjCnNjmsqMh0nu-_tuMkxVZkZShAhdoz0tK9evxg8ys9CLFAAAAAQAAAAAAAAAAAAAAAAAAAAAAMIm3zP-9W-Ktv8Vj2Q8r4WZifylPH_pjggi1x6fn01aB2aQ3pcpuZbwSQz69RLQ_5aUBAgMmIAEhWCCJt8z_vVvirb_FY9kPpoIwbfhER3VHTmOV0Y6xs7uHySJYIMFARJxlUoR4DbDzlKYnfJKitWgR3GHK9_Lz211z-128oWtjcmVkUHJvdGVjdAI"}}` + + _, err := protocol.ParseCredentialCreationResponseBody(strings.NewReader(body)) + require.NoError(t, err, "ParseCredentialCreationResponseBody failed") +} + func derToPEMs(certs [][]byte) []string { res := make([]string, len(certs)) for i, cert := range certs {