Class Cbor

java.lang.Object

com.codename1.backend.security.webauthn.Cbor

public final class Cbor
extends Object

Reads the CBOR (RFC 8949) an authenticator sends: an attestation object, and the COSE key and the extensions inside authenticator data.

It reads what those are made of and refuses everything else:

CBOR	Java
unsigned and negative integers that fit 64 bits signed	Long
byte string	byte[]
text string, which must be well-formed UTF-8	String
array	List
map whose keys are integers or text, each once	Map, in the order sent
false, true	Boolean
null	null

Strings, arrays and maps may be of indefinite length, which RFC 8949 allows and some authenticators use. Tags, floating point numbers, undefined, the other simple values and the reserved encodings are refused: nothing a ceremony reads is one, and what is not read is not parsed.

The input is the client's, so nothing is taken on its word. A length is checked against the bytes that remain before anything is allocated for it; an array or a map is given no room ahead of its elements; nesting is limited to MAX_DEPTH; and an input over MAX_BYTES is refused before it is looked at. Every failure is a WebAuthnException with the reason WebAuthnException.MALFORMED_CBOR.

It is public for what is built the same way outside WebAuthn: an App Attest attestation object is the same CBOR map of fmt, attStmt and authData, and reads with [#decode(byte[])] as it stands.

Map attestation = (Map) Cbor.decode(attestationObject);
byte[] authData = (byte[]) attestation.get("authData");

Field Summary

Fields

Modifier and Type	Field	Description
static final int	MAX_BYTES	The largest input read, in bytes.
static final int	MAX_DEPTH	The deepest nesting read.

Method Summary

Modifier and Type	Method	Description
static Object	decode(byte[] data)	The one value data is; anything after it is refused.
static Object	decode(byte[] data, int offset, int[] next)	The value that starts at offset.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

MAX_DEPTH

public static final int MAX_DEPTH

The deepest nesting read. An attestation statement nests four deep.

See Also:

• Constant Field Values

MAX_BYTES

public static final int MAX_BYTES

The largest input read, in bytes.

See Also:

• Constant Field Values

Method Details

decode

public static Object decode(byte[] data)

The one value data is; anything after it is refused.

Throws:

WebAuthnException - when data is not one value of the kinds above, with the reason WebAuthnException.MALFORMED_CBOR

decode

public static Object decode(byte[] data,
 int offset,
 int[] next)

The value that starts at offset.

Parameters:

next - receives, at index 0, the offset of the byte after the value

Throws:

WebAuthnException - when no value of the kinds above starts there