Skip to content

Commit 786d2d8

Browse files
MasterKaleMasterKale
authored
Merge pull request #695 from MasterKale/fix/broken-tests-may-2025
Update tests for the passage of time (May 2025)
2 parents 736ea03 + c32e802 commit 786d2d8

File tree

5 files changed

+94
-24
lines changed

5 files changed

+94
-24
lines changed

‎.vscode/settings.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"typescript.tsdk": "node_modules/typescript/lib",
33
"editor.formatOnSave": true,
4-
"deno.path": "/opt/homebrew/bin/deno",
4+
"deno.path": "/Users/matt/.dvm/bin/deno",
55
"deno.enable": true,
66
"deno.config": "./deno.json",
77
"deno.disablePaths": [

‎packages/server/src/metadata/verifyAttestationWithMetadata.test.ts‎

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
import { assertEquals } from '@std/assert';
1+
import { assertEquals, assertRejects } from '@std/assert';
22
import { FakeTime } from '@std/testing/time';
33

44
import { verifyAttestationWithMetadata } from './verifyAttestationWithMetadata.ts';
55
import type { MetadataStatement } from '../metadata/mdsTypes.ts';
66
import { isoBase64URL } from '../helpers/iso/index.ts';
77

8-
Deno.test('should verify attestation with metadata (android-safetynet)', async () => {
8+
Deno.test('should not verify attestation with revoked certificate in metadata (android-safetynet)', async () => {
99
// Faking time to something that'll satisfy all of these ranges:
1010
// {
1111
// notBefore: 2022-01-25T10:00:34.000Z,
@@ -69,13 +69,16 @@ Deno.test('should verify attestation with metadata (android-safetynet)', async (
6969
const credentialPublicKey =
7070
'pQECAyYgASFYIAKH2NrGZT-lUEA3tbBXR9owjW_7OnA1UqoL1UuKY_VCIlggpjeOH0xyBCpGDya55JLXXKrzyOieQN3dvG1pV-Qs-Gs';
7171

72-
const verified = await verifyAttestationWithMetadata({
73-
statement: metadataStatementJSONSafetyNet,
74-
credentialPublicKey: isoBase64URL.toBuffer(credentialPublicKey),
75-
x5c,
76-
});
77-
78-
assertEquals(verified, true);
72+
await assertRejects(
73+
() =>
74+
verifyAttestationWithMetadata({
75+
statement: metadataStatementJSONSafetyNet,
76+
credentialPublicKey: isoBase64URL.toBuffer(credentialPublicKey),
77+
x5c,
78+
}),
79+
Error,
80+
'revoked certificate',
81+
);
7982

8083
fakedNow.restore();
8184
});
@@ -201,6 +204,16 @@ Deno.test('should not validate certificate path when authenticator is self-refer
201204
});
202205

203206
Deno.test('should verify idmelon attestation with updated root certificate', async () => {
207+
// Faking time to something that'll satisfy all of these ranges:
208+
// {
209+
// notBefore: 2018-12-22T17:43:28.000Z,
210+
// notAfter: 2068-12-09T17:43:28.000Z
211+
// }
212+
// {
213+
// notBefore: 2022-12-14T18:41:09.000Z,
214+
// notAfter: 2072-12-01T18:41:09.000Z
215+
// }
216+
// const mockDate = new FakeTime(new Date('2025-01-30T23:59:59.000Z'));
204217
/**
205218
* See https://github.com/MasterKale/SimpleWebAuthn/issues/302 for more context, basically
206219
* IDmelon's root cert in FIDO MDS was missing an extension. I worked with IDmelon to generate a

‎packages/server/src/registration/verifications/tpm/verifyAttestationTPM.test.ts‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,13 @@ import { FakeTime } from '@std/testing/time';
44
import { verifyRegistrationResponse } from '../../verifyRegistrationResponse.ts';
55

66
Deno.test('should verify TPM response', async () => {
7+
// Faking time to something that'll satisfy all of these ranges:
8+
// {
9+
// notBefore: 2018-02-01T00:00:00.000Z,
10+
// notAfter: 2025-01-31T23:59:59.000Z
11+
// }
12+
const mockDate = new FakeTime(new Date('2025-01-30T23:59:59.000Z'));
13+
714
const verification = await verifyRegistrationResponse({
815
response: {
916
id: 'SErwRhxIzjPowcnM3e-D-u89EQXLUe1NYewpshd7Mc0',
@@ -25,9 +32,18 @@ Deno.test('should verify TPM response', async () => {
2532
});
2633

2734
assertEquals(verification.verified, true);
35+
36+
mockDate.restore();
2837
});
2938

3039
Deno.test('should verify SHA1 TPM response', async () => {
40+
// Faking time to something that'll satisfy all of these ranges:
41+
// {
42+
// notBefore: 2018-02-01T00:00:00.000Z,
43+
// notAfter: 2025-01-31T23:59:59.000Z
44+
// }
45+
const mockDate = new FakeTime(new Date('2025-01-30T23:59:59.000Z'));
46+
3147
/**
3248
* Generated on real hardware on 03/03/2020
3349
*
@@ -55,9 +71,18 @@ Deno.test('should verify SHA1 TPM response', async () => {
5571
});
5672

5773
assertEquals(verification.verified, true);
74+
75+
mockDate.restore();
5876
});
5977

6078
Deno.test('should verify SHA256 TPM response', async () => {
79+
// Faking time to something that'll satisfy all of these ranges:
80+
// {
81+
// notBefore: 2018-02-01T00:00:00.000Z,
82+
// notAfter: 2025-01-31T23:59:59.000Z
83+
// }
84+
const mockDate = new FakeTime(new Date('2025-01-30T23:59:59.000Z'));
85+
6186
/**
6287
* Generated on real hardware on 03/03/2020
6388
*
@@ -85,9 +110,17 @@ Deno.test('should verify SHA256 TPM response', async () => {
85110
});
86111

87112
assertEquals(verification.verified, true);
113+
114+
mockDate.restore();
88115
});
89116

90117
Deno.test('should verify TPM response with spec-compliant tcgAtTpm SAN structure', async () => {
118+
// Faking time to something that'll satisfy all of these ranges:
119+
// {
120+
// notBefore: 2020-08-27T15:12:30.000Z,
121+
// notAfter: 2025-03-21T20:29:15.000Z
122+
// }
123+
const mockDate = new FakeTime(new Date('2025-03-20T00:00:42.000Z'));
91124
/**
92125
* Name [
93126
* RelativeDistinguishedName [
@@ -121,6 +154,8 @@ Deno.test('should verify TPM response with spec-compliant tcgAtTpm SAN structure
121154
});
122155

123156
assertEquals(verification.verified, true);
157+
158+
mockDate.restore();
124159
});
125160

126161
Deno.test('should verify TPM response with non-spec-compliant tcgAtTpm SAN structure', async () => {

‎packages/server/src/registration/verifications/verifyAttestationAndroidSafetyNet.test.ts‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ Deno.test('should throw error when timestamp is not within one minute of now', a
121121
);
122122
});
123123

124-
Deno.test('should validate response with cert path completed with GlobalSign R1 root cert', async () => {
124+
Deno.test('should reject when a revoked certificate is found', async () => {
125125
const {
126126
aaguid,
127127
attStmt,
@@ -151,19 +151,22 @@ Deno.test('should validate response with cert path completed with GlobalSign R1
151151
// }
152152
const mockDate = new FakeTime(new Date('2021-10-15T00:00:42.000Z'));
153153

154-
const verified = await verifyAttestationAndroidSafetyNet({
155-
attStmt,
156-
authData,
157-
clientDataHash,
158-
verifyTimestampMS: false,
159-
aaguid,
160-
rootCertificates,
161-
credentialID,
162-
credentialPublicKey,
163-
rpIdHash,
164-
});
165-
166-
assert(verified);
154+
await assertRejects(
155+
() =>
156+
verifyAttestationAndroidSafetyNet({
157+
attStmt,
158+
authData,
159+
clientDataHash,
160+
verifyTimestampMS: false,
161+
aaguid,
162+
rootCertificates,
163+
credentialID,
164+
credentialPublicKey,
165+
rpIdHash,
166+
}),
167+
Error,
168+
'revoked certificate',
169+
);
167170

168171
mockDate.restore();
169172
});

‎packages/server/src/registration/verifyRegistrationResponse.test.ts‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import { assert, assertEquals, assertFalse, assertObjectMatch, assertRejects } from '@std/assert';
22
import { returnsNext, stub } from '@std/testing/mock';
3+
import { FakeTime } from '@std/testing/time';
34

45
import { verifyRegistrationResponse } from './verifyRegistrationResponse.ts';
56
import type { RegistrationResponseJSON } from '../types/index.ts';
@@ -608,6 +609,13 @@ Deno.test(
608609
);
609610

610611
Deno.test('should validate TPM RSA response (SHA256)', async () => {
612+
// Faking time to something that'll satisfy all of these ranges:
613+
// {
614+
// notBefore: 2018-02-01T00:00:00.000Z,
615+
// notAfter: 2025-01-31T23:59:59.000Z
616+
// }
617+
const mockDate = new FakeTime(new Date('2025-01-30T23:59:59.000Z'));
618+
611619
const expectedChallenge = '3a07cf85-e7b6-447f-8270-b25433f6018e';
612620
const verification = await verifyRegistrationResponse({
613621
response: {
@@ -647,9 +655,18 @@ Deno.test('should validate TPM RSA response (SHA256)', async () => {
647655
'https://dev.dontneeda.pw',
648656
);
649657
assertEquals(verification.registrationInfo?.rpID, 'dev.dontneeda.pw');
658+
659+
mockDate.restore();
650660
});
651661

652662
Deno.test('should validate TPM RSA response (SHA1)', async () => {
663+
// Faking time to something that'll satisfy all of these ranges:
664+
// {
665+
// notBefore: 2018-02-01T00:00:00.000Z,
666+
// notAfter: 2025-01-31T23:59:59.000Z
667+
// }
668+
const mockDate = new FakeTime(new Date('2025-01-30T23:59:59.000Z'));
669+
653670
const expectedChallenge = 'f4e8d87b-d363-47cc-ab4d-1a84647bf245';
654671
const verification = await verifyRegistrationResponse({
655672
response: {
@@ -689,6 +706,8 @@ Deno.test('should validate TPM RSA response (SHA1)', async () => {
689706
'https://dev.dontneeda.pw',
690707
);
691708
assertEquals(verification.registrationInfo?.rpID, 'dev.dontneeda.pw');
709+
710+
mockDate.restore();
692711
});
693712

694713
Deno.test('should validate Android-Key response', async () => {

0 commit comments

Comments
 (0)