Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2026-03-21 05:51:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs

Browse Source
This commit is contained in:
Rob Winch 2026-03-16 12:07:49 -04:00 committed by GitHub
commit d174b10f2a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 92 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
webauthn/src/main/java/org/springframework/security/web/webauthn/jackson/AuthenticationExtensionsClientOutputsDeserializer.java
View File

@ -55,11 +55,8 @@ class AuthenticationExtensionsClientOutputsDeserializer extends StdDeserializer<
throws JacksonException {
List<AuthenticationExtensionsClientOutput<?>> outputs = new ArrayList<>();
for (String key = parser.nextName(); key != null; key = parser.nextName()) {
JsonToken startObject = parser.nextValue();
if (startObject != JsonToken.START_OBJECT) {
break;
}
if (CredentialPropertiesOutput.EXTENSION_ID.equals(key)) {
JsonToken next = parser.nextToken();
if (next == JsonToken.START_OBJECT && CredentialPropertiesOutput.EXTENSION_ID.equals(key)) {
CredentialPropertiesOutput output = parser.readValueAs(CredentialPropertiesOutput.class);
outputs.add(output);
}
@ -67,7 +64,9 @@ class AuthenticationExtensionsClientOutputsDeserializer extends StdDeserializer<
if (logger.isDebugEnabled()) {
logger.debug("Skipping unknown extension with id " + key);
}
parser.nextValue();
if (next.isStructStart()) {
parser.skipChildren();
}
}
}

11
webauthn/src/main/java/org/springframework/security/web/webauthn/jackson/AuthenticationExtensionsClientOutputsJackson2Deserializer.java
View File

@ -62,11 +62,8 @@ class AuthenticationExtensionsClientOutputsJackson2Deserializer
throws IOException, JacksonException {
List<AuthenticationExtensionsClientOutput<?>> outputs = new ArrayList<>();
for (String key = parser.nextFieldName(); key != null; key = parser.nextFieldName()) {
JsonToken startObject = parser.nextValue();
if (startObject != JsonToken.START_OBJECT) {
break;
}
if (CredentialPropertiesOutput.EXTENSION_ID.equals(key)) {
JsonToken next = parser.nextToken();
if (next == JsonToken.START_OBJECT && CredentialPropertiesOutput.EXTENSION_ID.equals(key)) {
CredentialPropertiesOutput output = parser.readValueAs(CredentialPropertiesOutput.class);
outputs.add(output);
}
@ -74,7 +71,9 @@ class AuthenticationExtensionsClientOutputsJackson2Deserializer
if (logger.isDebugEnabled()) {
logger.debug("Skipping unknown extension with id " + key);
}
parser.nextValue();
if (next.isStructStart()) {
parser.skipChildren();
}
}
}

41
webauthn/src/test/java/org/springframework/security/web/webauthn/jackson/Jackson2Tests.java
View File

@ -123,6 +123,47 @@ class Jackson2Tests {
assertThat(outputs).usingRecursiveComparison().isEqualTo(credProps);
}
@Test
void readAuthenticationExtensionsClientOutputsWhenAppId() throws Exception {
String json = """
{
"appid": false,
"credProps": {
"rk": false
}
}
""";
CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
AuthenticationExtensionsClientOutputs.class);
assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
}
@Test
void readAuthenticationExtensionsClientOutputsWhenUnknownExtension() throws Exception {
String json = """
{
"unknownObject1": {
"key": "value"
},
"unknownArray": [
{ "key": "value1" },
{ "key": "value2" }
],
"credProps": {
"rk": false
},
"unknownObject2": {}
}
""";
CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
AuthenticationExtensionsClientOutputs.class);
assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
}
@Test
void readAuthenticationExtensionsClientOutputsWhenFieldAfter() throws Exception {
String json = """

41
webauthn/src/test/java/org/springframework/security/web/webauthn/jackson/JacksonTests.java
View File

@ -121,6 +121,47 @@ class JacksonTests {
assertThat(outputs).usingRecursiveComparison().isEqualTo(credProps);
}
@Test
void readAuthenticationExtensionsClientOutputsWhenAppId() {
String json = """
{
"appid": false,
"credProps": {
"rk": false
}
}
""";
CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
AuthenticationExtensionsClientOutputs.class);
assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
}
@Test
void readAuthenticationExtensionsClientOutputsWhenUnknownExtension() {
String json = """
{
"unknownObject1": {
"key": "value"
},
"unknownArray": [
{ "key": "value1" },
{ "key": "value2" }
],
"credProps": {
"rk": false
},
"unknownObject2": {}
}
""";
CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
AuthenticationExtensionsClientOutputs.class);
assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
}
@Test
void readAuthenticationExtensionsClientOutputsWhenFieldAfter() throws Exception {
String json = """