[java-idp-plugin-webauthn] 05/11: Add length check to aaguid before metadata lookup

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=ea9ddcda30eb7a522b26d6e2928185a19f52b0da

commit ea9ddcda30eb7a522b26d6e2928185a19f52b0da
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Tue Oct 8 13:52:26 2024 +0100

    Add length check to aaguid before metadata lookup
---
 .../plugin/authn/webauthn/admin/impl/LookupCredentialsForUser.java | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/LookupCredentialsForUser.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/LookupCredentialsForUser.java
index dac1fde..a30626a 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/LookupCredentialsForUser.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/admin/impl/LookupCredentialsForUser.java
@@ -92,9 +92,10 @@ public class LookupCredentialsForUser extends AbstractWebAuthnAction<WebAuthnMan
             
             credentials.stream().filter(Objects::nonNull).forEach(cred -> {
                 final IBuildStage builder = EnhancedCredentialRegistration.builder().withCredentialRegistration(cred);
-                if (cred.getAaguid() != null) {
-                    builder.withAuthenticatorMetadata(getAuthenticatorMetadata(new ByteArray(cred.getAaguid())));
-                    builder.withAaguidMetadata(getAaguidMetadata(new AAGUID(new ByteArray(cred.getAaguid()))));
+                final byte[] aaguid = cred.getAaguid();
+                if (aaguid != null && aaguid.length == 16) {
+                    builder.withAuthenticatorMetadata(getAuthenticatorMetadata(new ByteArray(aaguid)));
+                    builder.withAaguidMetadata(getAaguidMetadata(new AAGUID(new ByteArray(aaguid))));
                 }
                 enhancedCredentialRegistrations.add(builder.build());
             });

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.