simplesamlphp / simplesamlphp-module-webauthn

src/Controller/AuthProcess.php

Spacing +1 added lines, -1 removed lines

@@ -172,7 +172,7 @@
 
         if ($debugEnabled) {
             $response = new RunnableResponse(
-                function ($authObject, $state) {
+                function($authObject, $state) {
                     echo $authObject->getDebugBuffer();
                     echo $authObject->getValidateBuffer();
                     echo "Debug mode, not continuing to " . ($state['FIDO2WantsRegister'] ? "credential registration page." : "destination.");

Indentation +4 added lines, -4 removed lines

@@ -149,10 +149,10 @@ 
         /**
          * §7.2 STEP 18 : detect physical object cloning on the token
          */
-	$counter = $authObject->getCounter();
-	if ($previousCounter == 0 && $counter == 0) {
+    $counter = $authObject->getCounter();
+    if ($previousCounter == 0 && $counter == 0) {
                 // no cloning check, it is a brand new token
-	} elseif ($counter > $previousCounter) {
+    } elseif ($counter > $previousCounter) {
             // Signature counter was incremented compared to last time, good
             $store = $state['webauthn:store'];
             $store->updateSignCount($oneToken[0], $counter);
@@ -208,7 +208,7 @@ 
             'private'          => false,
         ]);
         $response->setExpires(new DateTime('Thu, 19 Nov 1981 08:52:00 GMT'));
-        */
+         */
 
         return $response;
     }

src/Controller/RegProcess.php

Spacing +1 added lines, -1 removed lines

@@ -196,7 +196,7 @@
         $id = $this->authState::saveState($state, 'webauthn:request');
         if ($debugEnabled === true) {
             $response = new RunnableResponse(
-                function ($regObject, $id) {
+                function($regObject, $id) {
                     echo $regObject->getDebugBuffer();
                     echo $regObject->getValidateBuffer();
                     echo "<form id='regform' method='POST' action='" .

src/WebAuthn/WebAuthnRegistrationEvent.php

Indentation +52 added lines, -52 removed lines

@@ -122,9 +122,9 @@ 
             case "android-safetynet":
                 $this->validateAttestationFormatAndroidSafetyNet($attestationArray);
                 break;
-	    case "apple":
-		$this->validateAttestationFormatApple($attestationArray);
-		break;
+        case "apple":
+        $this->validateAttestationFormatApple($attestationArray);
+        break;
             case "tpm":
             case "android-key":
                 $this->fail("Attestation format " . $attestationArray['fmt'] . " validation not supported right now.");
@@ -161,9 +161,9 @@ 
     private function validateAttestationFormatApple(array $attestationArray): void
     {
 
-	// found at: https://www.apple.com/certificateauthority/private/
+    // found at: https://www.apple.com/certificateauthority/private/
 
-	$APPLE_WEBAUTHN_ROOT_CA = "-----BEGIN CERTIFICATE-----
+    $APPLE_WEBAUTHN_ROOT_CA = "-----BEGIN CERTIFICATE-----
 MIICEjCCAZmgAwIBAgIQaB0BbHo84wIlpQGUKEdXcTAKBggqhkjOPQQDAzBLMR8w
 HQYDVQQDDBZBcHBsZSBXZWJBdXRobiBSb290IENBMRMwEQYDVQQKDApBcHBsZSBJ
 bmMuMRMwEQYDVQQIDApDYWxpZm9ybmlhMB4XDTIwMDMxODE4MjEzMloXDTQ1MDMx
@@ -178,66 +178,66 @@ 
 1bWeT0vT
 -----END CERTIFICATE-----";
         // § 8.8 Bullet 1 of the draft spec at https://pr-preview.s3.amazonaws.com/alanwaketan/webauthn/pull/1491.html#sctn-apple-anonymous-attestation
-	// draft implemented in state of 11 Feb 2021
+    // draft implemented in state of 11 Feb 2021
 
-	// I can't help but notice that the verification procedure does NOTHING with CA certs from the chain, nor is there a root to validate to!
-	// Found the root CA with Google, see above, and will perform chain validation even if the spec doesn't say so.
+    // I can't help but notice that the verification procedure does NOTHING with CA certs from the chain, nor is there a root to validate to!
+    // Found the root CA with Google, see above, and will perform chain validation even if the spec doesn't say so.
 
-	// first, clear the openssl error backlog. We might need error data in case things go sideways.
-	while(openssl_error_string() !== false);
+    // first, clear the openssl error backlog. We might need error data in case things go sideways.
+    while(openssl_error_string() !== false);
 
         $stmtDecoded = $attestationArray['attStmt'];
-	if (!isset($stmtDecoded['x5c'])) {
-		$this->fail("Apple attestation statement does not contain an x5c attestation statement!");
-	}
-	// § 8.8 Bullet 2
+    if (!isset($stmtDecoded['x5c'])) {
+        $this->fail("Apple attestation statement does not contain an x5c attestation statement!");
+    }
+    // § 8.8 Bullet 2
         $nonceToHash = $attestationArray['authData'] . $this->clientDataHash;
-	// § 8.8 Bullet 3
-	$nonce = hash("sha256", $nonceToHash, TRUE); // does raw_output have to be FALSE or TRUE?
+    // § 8.8 Bullet 3
+    $nonce = hash("sha256", $nonceToHash, TRUE); // does raw_output have to be FALSE or TRUE?
         $certProps = openssl_x509_parse(Utils\Crypto::der2pem($stmtDecoded['x5c'][0]));	
-	// § 8.8 Bullet 4
+    // § 8.8 Bullet 4
         if (
-           !isset($certProps['extensions']['1.2.840.113635.100.8.2'])
+            !isset($certProps['extensions']['1.2.840.113635.100.8.2'])
            || empty($certProps['extensions']['1.2.840.113635.100.8.2'])
                 ) {
                     $this->fail( "The required nonce value is not present in the OID." );
                 }
-	$toCompare = substr($certProps['extensions']['1.2.840.113635.100.8.2'], 6);
-	if ($nonce != $toCompare) {
-		$this->fail("There is a mismatch between the nonce and the OID (XXX $nonce XXX , XXX $toCompare XXX ).");
-	}
+    $toCompare = substr($certProps['extensions']['1.2.840.113635.100.8.2'], 6);
+    if ($nonce != $toCompare) {
+        $this->fail("There is a mismatch between the nonce and the OID (XXX $nonce XXX , XXX $toCompare XXX ).");
+    }
 
-	// chain validation first
-	foreach ( $stmtDecoded['x5c'] as $runIndex => $runCert ) {
-		if (isset($stmtDecoded['x5c'][$runIndex + 1])) { // there is a next cert, so follow the chain
-			$certResource = openssl_x509_read(Utils\Crypto::der2pem($runCert));
-			$signerPubKey = openssl_pkey_get_public(Utils\Crypto::der2pem($stmtDecoded['x5c'][$runIndex + 1]));
-			if (openssl_x509_verify($certResource, $signerPubKey) != 1) {
-				$this->fail("Error during chain validation of the attestation certificate (while validating cert #$runIndex, which is "
+    // chain validation first
+    foreach ( $stmtDecoded['x5c'] as $runIndex => $runCert ) {
+        if (isset($stmtDecoded['x5c'][$runIndex + 1])) { // there is a next cert, so follow the chain
+            $certResource = openssl_x509_read(Utils\Crypto::der2pem($runCert));
+            $signerPubKey = openssl_pkey_get_public(Utils\Crypto::der2pem($stmtDecoded['x5c'][$runIndex + 1]));
+            if (openssl_x509_verify($certResource, $signerPubKey) != 1) {
+                $this->fail("Error during chain validation of the attestation certificate (while validating cert #$runIndex, which is "
                                     . Utils\Crypto::der2pem($runCert)
                                     . "; next cert was "
                                     . Utils\Crypto::der2pem($stmtDecoded['x5c'][$runIndex + 1]));
-			}
-		} else { // last cert, compare to the root
-			$certResource = openssl_x509_read(Utils\Crypto::der2pem($runCert));
-			$signerPubKey = openssl_pkey_get_public($APPLE_WEBAUTHN_ROOT_CA);
-			if (openssl_x509_verify($certResource, $signerPubKey) != 1) {
+            }
+        } else { // last cert, compare to the root
+            $certResource = openssl_x509_read(Utils\Crypto::der2pem($runCert));
+            $signerPubKey = openssl_pkey_get_public($APPLE_WEBAUTHN_ROOT_CA);
+            if (openssl_x509_verify($certResource, $signerPubKey) != 1) {
                                 $this->fail("Error during root CA validation of the attestation chain certificate, which is ".Utils\Crypto::der2pem($runCert));
                         }
-		}
-	}
+        }
+    }
 
         $keyResource = openssl_pkey_get_public(Utils\Crypto::der2pem($stmtDecoded['x5c'][0]));
         if ($keyResource === FALSE) {
-		$this->fail("Did not get a parseable X.509 structure out of the Apple attestation statement - x5c nr. 0 statement was: XXX "
+        $this->fail("Did not get a parseable X.509 structure out of the Apple attestation statement - x5c nr. 0 statement was: XXX "
                     . $stmtDecoded['x5c'][0]
                     . " XXX; PEM equivalent is "
                     . Utils\Crypto::der2pem($stmtDecoded['x5c'][0])
                     . ". OpenSSL error: "
                     . openssl_error_string()
                     );
-	}
-	// $this->credential is a public key in CBOR, not "PEM". We need to convert it first.
+    }
+    // $this->credential is a public key in CBOR, not "PEM". We need to convert it first.
         $keyArray = $this->cborDecode(hex2bin($this->credential));
         $keyObject = new Ec2Key($keyArray);
         $credentialResource = openssl_pkey_get_public($keyObject->asPEM());
@@ -251,20 +251,20 @@ 
                     . openssl_error_string()
                     );
         }
-	// § 8.8 Bullet 5
-	$credentialDetails = openssl_pkey_get_details($credentialResource);
-	$keyDetails = openssl_pkey_get_details($keyResource);
-	if ( $credentialDetails['bits'] != $keyDetails['bits'] ||
+    // § 8.8 Bullet 5
+    $credentialDetails = openssl_pkey_get_details($credentialResource);
+    $keyDetails = openssl_pkey_get_details($keyResource);
+    if ( $credentialDetails['bits'] != $keyDetails['bits'] ||
              $credentialDetails['key']  != $keyDetails['key']  ||
              $credentialDetails['type'] != $keyDetails['type'] ) { 
-		$this->fail("The credential public key does not match the certificate public key in attestationData. ("
-              . $credentialDetails['key'] 
-              . " - "
-              . $keyDetails['key'] 
-              . ")");
-	}
-	$this->pass("Apple attestation format verification passed.");
-	return;
+        $this->fail("The credential public key does not match the certificate public key in attestationData. ("
+                . $credentialDetails['key'] 
+                . " - "
+                . $keyDetails['key'] 
+                . ")");
+    }
+    $this->pass("Apple attestation format verification passed.");
+    return;
     }
 
     /**
@@ -391,7 +391,7 @@ 
                 $keyObject = new Ec2Key($this->cborDecode(hex2bin($this->credential)));
                 $keyResource = openssl_pkey_get_public($keyObject->asPEM());
                 if ($keyResource === false) {
-                      $this->fail("Unable to construct ECDSA public key resource from PEM.");
+                        $this->fail("Unable to construct ECDSA public key resource from PEM.");
                 };
                 break;
             case self::PK_ALGORITHM_RSA:

Spacing +9 added lines, -9 removed lines

@@ -23,7 +23,7 @@ 
      */
     public const PK_ALGORITHM_ECDSA = "-7";
     public const PK_ALGORITHM_RSA = "-257";
-    public const PK_ALGORITHM = [ self::PK_ALGORITHM_ECDSA, self::PK_ALGORITHM_RSA ];
+    public const PK_ALGORITHM = [self::PK_ALGORITHM_ECDSA, self::PK_ALGORITHM_RSA];
     public const AAGUID_ASSURANCE_LEVEL_NONE = 0;
     public const AAGUID_ASSURANCE_LEVEL_SELF = 1;
     public const AAGUID_ASSURANCE_LEVEL_BASIC = 2;
@@ -184,7 +184,7 @@ 
 	// Found the root CA with Google, see above, and will perform chain validation even if the spec doesn't say so.
 
 	// first, clear the openssl error backlog. We might need error data in case things go sideways.
-	while(openssl_error_string() !== false);
+	while (openssl_error_string() !== false);
 
         $stmtDecoded = $attestationArray['attStmt'];
 	if (!isset($stmtDecoded['x5c'])) {
@@ -200,7 +200,7 @@ 
            !isset($certProps['extensions']['1.2.840.113635.100.8.2'])
            || empty($certProps['extensions']['1.2.840.113635.100.8.2'])
                 ) {
-                    $this->fail( "The required nonce value is not present in the OID." );
+                    $this->fail("The required nonce value is not present in the OID.");
                 }
 	$toCompare = substr($certProps['extensions']['1.2.840.113635.100.8.2'], 6);
 	if ($nonce != $toCompare) {
@@ -208,7 +208,7 @@ 
 	}
 
 	// chain validation first
-	foreach ( $stmtDecoded['x5c'] as $runIndex => $runCert ) {
+	foreach ($stmtDecoded['x5c'] as $runIndex => $runCert) {
 		if (isset($stmtDecoded['x5c'][$runIndex + 1])) { // there is a next cert, so follow the chain
 			$certResource = openssl_x509_read(Utils\Crypto::der2pem($runCert));
 			$signerPubKey = openssl_pkey_get_public(Utils\Crypto::der2pem($stmtDecoded['x5c'][$runIndex + 1]));
@@ -222,7 +222,7 @@ 
 			$certResource = openssl_x509_read(Utils\Crypto::der2pem($runCert));
 			$signerPubKey = openssl_pkey_get_public($APPLE_WEBAUTHN_ROOT_CA);
 			if (openssl_x509_verify($certResource, $signerPubKey) != 1) {
-                                $this->fail("Error during root CA validation of the attestation chain certificate, which is ".Utils\Crypto::der2pem($runCert));
+                                $this->fail("Error during root CA validation of the attestation chain certificate, which is " . Utils\Crypto::der2pem($runCert));
                         }
 		}
 	}
@@ -254,9 +254,9 @@ 
 	// § 8.8 Bullet 5
 	$credentialDetails = openssl_pkey_get_details($credentialResource);
 	$keyDetails = openssl_pkey_get_details($keyResource);
-	if ( $credentialDetails['bits'] != $keyDetails['bits'] ||
-             $credentialDetails['key']  != $keyDetails['key']  ||
-             $credentialDetails['type'] != $keyDetails['type'] ) { 
+	if ($credentialDetails['bits'] != $keyDetails['bits'] ||
+             $credentialDetails['key'] != $keyDetails['key'] ||
+             $credentialDetails['type'] != $keyDetails['type']) { 
 		$this->fail("The credential public key does not match the certificate public key in attestationData. ("
               . $credentialDetails['key'] 
               . " - "
@@ -542,7 +542,7 @@ 
          */
         if (in_array($arrayPK['3'], self::PK_ALGORITHM)) { // we requested -7 or -257, so want to see it here
             $this->algo = $arrayPK['3'];
-            $this->pass("Public Key Algorithm is expected (".implode(' or ', WebAuthnRegistrationEvent::PK_ALGORITHM).").");
+            $this->pass("Public Key Algorithm is expected (" . implode(' or ', WebAuthnRegistrationEvent::PK_ALGORITHM) . ").");
         } else {
             $this->fail("Public Key Algorithm mismatch!");
         }

src/Auth/Process/WebAuthn.php

Indentation +1 added lines, -1 removed lines

@@ -96,7 +96,7 @@
         }
 
         // Set the derived scope so we can compare it to the sent host at a later point
-	$httpUtils = new Utils\HTTP();
+    $httpUtils = new Utils\HTTP();
         $baseurl = $httpUtils->getSelfHost();
         $hostname = parse_url($baseurl, PHP_URL_HOST);
         if ($hostname !== null) {

src/WebAuthn/StaticProcessHelper.php

Indentation +1 added lines, -1 removed lines

@@ -12,7 +12,7 @@
     {
         $id = Auth\State::saveState($state, 'webauthn:request');
         $url = Module::getModuleURL('webauthn/webauthn');
-	$httpUtils = new Utils\HTTP();
+    $httpUtils = new Utils\HTTP();
         $httpUtils->redirectTrustedURL($url, ['StateId' => $id]);
     }
 

src/WebAuthn/WebAuthnAuthenticationEvent.php

Spacing +1 added lines, -1 removed lines

@@ -75,7 +75,7 @@
         }
         $keyResource = openssl_pkey_get_public($keyObject->asPEM());
         if ($keyResource === false) {
-            $this->fail("Unable to construct public key resource from PEM (was algo type ". $this->algo .").");
+            $this->fail("Unable to construct public key resource from PEM (was algo type " . $this->algo . ").");
         }
         /**
          * §7.2 STEP 17: validate signature

src/WebAuthn/WebAuthnAbstractEvent.php

Indentation +1 added lines, -1 removed lines

@@ -182,7 +182,7 @@
         return $this->credential;
     }
 
-   /**
+    /**
      * @return int
      */
     public function getAlgo(): int

src/Controller/WebAuthn.php

Indentation +1 added lines, -1 removed lines

@@ -106,7 +106,7 @@
 
         $challenge = str_split($state['FIDO2SignupChallenge'], 2);
         $entityid = $state['Source']['entityid'];
-	$configUtils = new Utils\Config();
+    $configUtils = new Utils\Config();
         $username = str_split(
             hash('sha512', $state['FIDO2Username'] . '|' . $configUtils->getSecretSalt() . '|' . $entityid),
             2

Spacing +3 added lines, -3 removed lines

@@ -97,7 +97,7 @@ 
         /** @var array $state */
         $state = $this->authState::loadState($stateId, 'webauthn:request');
 
-        $templateFile = ( $state['UseInflowRegistration'] || $state['InRegistration'] ) ? 'webauthn:webauthn.twig' : 'webauthn:authentication.twig';
+        $templateFile = ($state['UseInflowRegistration'] || $state['InRegistration']) ? 'webauthn:webauthn.twig' : 'webauthn:authentication.twig';
 
         // Make, populate and layout consent form
         $t = new Template($this->config, $templateFile);
@@ -134,7 +134,7 @@ 
         $frontendData = [];
         $frontendData['challengeEncoded'] = $challengeEncoded;
         $frontendData['state'] = [];
-        foreach (['Source', 'FIDO2Scope','FIDO2Username','FIDO2Displayname','requestTokenModel'] as $stateItem) {
+        foreach (['Source', 'FIDO2Scope', 'FIDO2Username', 'FIDO2Displayname', 'requestTokenModel'] as $stateItem) {
             $frontendData['state'][$stateItem] = $state[$stateItem];
         }
 
@@ -147,7 +147,7 @@ 
         $t->data['FIDO2AuthSuccessful'] = $state['FIDO2AuthSuccessful'];
         if (
             count($state['FIDO2Tokens']) === 0 || // no tokens
-            ($state['FIDO2WantsRegister'] === true && $state['FIDO2AuthSuccessful'] !== false ) || // authenticated and wants to change something
+            ($state['FIDO2WantsRegister'] === true && $state['FIDO2AuthSuccessful'] !== false) || // authenticated and wants to change something
             $state['UseInflowRegistration'] !== true // stand-alone registration active - can change without being authenticated with second factor
         ) {
             $t->data['regURL'] = Module::getModuleURL('webauthn/regprocess?StateId=' . urlencode($stateId));

bin/updateMetadata.php

Indentation +8 added lines, -8 removed lines

@@ -1,18 +1,18 @@
 #!/usr/bin/php
 <?php
 if (!isset($argv[1])) {
-	echo "First and only argument is the filename of the FIDO Alliance Metadata v3 blob as can be downloaded from: https://mds3.fidoalliance.org/ \n";
-	exit(1);
+    echo "First and only argument is the filename of the FIDO Alliance Metadata v3 blob as can be downloaded from: https://mds3.fidoalliance.org/ \n";
+    exit(1);
 }
 $token = file_get_contents($argv[1]);
 $blobContent = json_decode(base64_decode(str_replace('_', '/', str_replace('-','+',explode('.', $token)[1]))),true);
 $outFormat = [];
 foreach ($blobContent['entries'] as $oneEntry) {
-	if (isset($oneEntry['aaguid'])) {
-		$outFormat[str_replace('-','',$oneEntry['aaguid'])] = [ 
-                	"model" => $oneEntry["metadataStatement"]["description"], 
-	                "RootPEMs" => $oneEntry["metadataStatement"]["attestationRootCertificates"] 
-		];
-	}
+    if (isset($oneEntry['aaguid'])) {
+        $outFormat[str_replace('-','',$oneEntry['aaguid'])] = [ 
+                    "model" => $oneEntry["metadataStatement"]["description"], 
+                    "RootPEMs" => $oneEntry["metadataStatement"]["attestationRootCertificates"] 
+        ];
+    }
 }
 echo json_encode($outFormat, JSON_PRETTY_PRINT);

Spacing +2 added lines, -2 removed lines

@@ -5,11 +5,11 @@
 	exit(1);
 }
 $token = file_get_contents($argv[1]);
-$blobContent = json_decode(base64_decode(str_replace('_', '/', str_replace('-','+',explode('.', $token)[1]))),true);
+$blobContent = json_decode(base64_decode(str_replace('_', '/', str_replace('-', '+', explode('.', $token)[1]))), true);
 $outFormat = [];
 foreach ($blobContent['entries'] as $oneEntry) {
 	if (isset($oneEntry['aaguid'])) {
-		$outFormat[str_replace('-','',$oneEntry['aaguid'])] = [ 
+		$outFormat[str_replace('-', '', $oneEntry['aaguid'])] = [ 
                 	"model" => $oneEntry["metadataStatement"]["description"], 
 	                "RootPEMs" => $oneEntry["metadataStatement"]["attestationRootCertificates"] 
 		];