feat(protocol): validate native app origins

This enables matching native application origins using simple string comparison. Effective web origins are still matched using case-insensitive matches provided they are valid web origins per HTML5 Section 5.3 (https://www.w3.org/TR/2011/WD-html5-20110525/origin-0.html) and/or simple string comparison per RFC3986 Section 6.2.1 (https://datatracker.ietf.org/doc/html/rfc3986#section-6.2.1).

Closes #462, Closes #463

Author: james-d-elliott

protocol/client.go

@@ -108,25 +108,11 @@ func (c *CollectedClientData) Verify(storedChallenge string, ceremony CeremonyTy
 
 	// Registration Step 5 & Assertion Step 9. Verify that the value of C.origin matches
 	// the Relying Party's origin.
-	var fqOrigin string
 
-	if fqOrigin, err = FullyQualifiedOrigin(c.Origin); err != nil {
-		return ErrParsingData.WithDetails("Error decoding clientData origin as URL").WithError(err)
-	}
-
-	found := false
-
-	for _, origin := range rpOrigins {
-		if strings.EqualFold(fqOrigin, origin) {
-			found = true
-			break
-		}
-	}
-
-	if !found {
+	if !IsOriginInHaystack(c.Origin, rpOrigins) {
 		return ErrVerification.
 			WithDetails("Error validating origin").
-			WithInfo(fmt.Sprintf("Expected Values: %s, Received: %s", rpOrigins, fqOrigin))
+			WithInfo(fmt.Sprintf("Expected Values: %s, Received: %s", rpOrigins, c.Origin))
 	}
 
 	if rpTopOriginsVerify != TopOriginIgnoreVerificationMode {
@@ -145,10 +131,6 @@ func (c *CollectedClientData) Verify(storedChallenge string, ceremony CeremonyTy
 				possibleTopOrigins []string
 			)
 
-			if fqTopOrigin, err = FullyQualifiedOrigin(c.TopOrigin); err != nil {
-				return ErrParsingData.WithDetails("Error decoding clientData topOrigin as URL").WithError(err)
-			}
-
 			switch rpTopOriginsVerify {
 			case TopOriginExplicitVerificationMode:
 				possibleTopOrigins = rpTopOrigins
@@ -160,16 +142,7 @@ func (c *CollectedClientData) Verify(storedChallenge string, ceremony CeremonyTy
 				return ErrNotImplemented.WithDetails("Error handling unknown Top Origin verification mode")
 			}
 
-			found = false
-
-			for _, origin := range possibleTopOrigins {
-				if strings.EqualFold(fqTopOrigin, origin) {
-					found = true
-					break
-				}
-			}
-
-			if !found {
+			if !IsOriginInHaystack(c.TopOrigin, possibleTopOrigins) {
 				return ErrVerification.
 					WithDetails("Error validating top origin").
 					WithInfo(fmt.Sprintf("Expected Values: %s, Received: %s", possibleTopOrigins, fqTopOrigin))
@@ -221,3 +194,138 @@ const (
 	// Top Origin is verified against the allowed Top Origins values.
 	TopOriginExplicitVerificationMode
 )
+
+// IsOriginInHaystack checks if the needle is in the haystack using the mechanism to determine origin equality defined
+// in HTML5 Section 5.3 and RFC3986 Section 6.2.1.
+//
+// Specifically if the needle value includes the '://' character sequence and can be parsed as URL's;
+// we check each item in the haystack to see if it matches the same rules, and then if the scheme and host components
+// match case-insensitively and check all other components with simple string comparison. The query arguments have a
+// special match condition where we check if the values are equal in length, then iteratively check if each key value
+// pair are matches. This allows the query arguments to have a different order.
+//
+// If the needle value does not include the '://' character sequence or can't be parsed as a URL equality is determined
+// using simple string comparison.
+//
+// See (Origin Definition): https://www.w3.org/TR/2011/WD-html5-20110525/origin-0.html
+//
+// See (Simple String Comparison Definition): https://datatracker.ietf.org/doc/html/rfc3986#section-6.2.1
+func IsOriginInHaystack(needle string, haystack []string) bool {
+	needleURI := parseNormalizedURI(needle)
+
+	if needleURI != nil {
+		for _, hay := range haystack {
+			if hayURI := parseNormalizedURI(hay); hayURI != nil {
+				if isOriginEqual(needleURI, hayURI) {
+					return true
+				}
+			}
+		}
+	} else {
+		for _, hay := range haystack {
+			if needle == hay {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
+func isOriginEqual(a *url.URL, b *url.URL) bool {
+	if !strings.EqualFold(a.Scheme, b.Scheme) {
+		return false
+	}
+
+	if !strings.EqualFold(a.Host, b.Host) {
+		return false
+	}
+
+	if a.Path != b.Path || a.RawPath != b.RawPath {
+		return false
+	}
+
+	if a.Fragment != b.Fragment || a.RawFragment != b.RawFragment {
+		return false
+	}
+
+	if a.Opaque != b.Opaque {
+		return false
+	}
+
+	if (len(a.RawQuery) != 0 || len(b.RawQuery) != 0) && !isURLValuesEqual(a.Query(), b.Query()) {
+		return false
+	}
+
+	if !isURLUserEqual(a.User, b.User) {
+		return false
+	}
+
+	return true
+}
+
+func isURLUserEqual(a, b *url.Userinfo) bool {
+	if a == nil && b == nil {
+		return true
+	}
+
+	if a.Username() != b.Username() {
+		return false
+	}
+
+	ap, aok := a.Password()
+	bp, bok := b.Password()
+
+	if !aok && !bok {
+		return true
+	}
+
+	if aok != bok {
+		return false
+	}
+
+	if ap != bp {
+		return false
+	}
+
+	return true
+}
+
+func isURLValuesEqual(a, b url.Values) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	for k := range a {
+		if a.Get(k) != b.Get(k) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func parseNormalizedURI(raw string) *url.URL {
+	if !strings.Contains(raw, "://") {
+		return nil
+	}
+
+	// We can ignore the error here because it's effectively not a FQDN if this fails.
+	uri, _ := url.Parse(raw)
+
+	if uri == nil {
+		return nil
+	}
+
+	// Perform Path Normalization.
+	if uri.Path == "/" || uri.RawPath == "/" {
+		uri.Path = ""
+		uri.RawPath = ""
+	}
+
+	// Perform Scheme/Host Normalization.
+	uri.Scheme = strings.ToLower(uri.Scheme)
+	uri.Host = strings.ToLower(uri.Host)
+
+	return uri
+}

protocol/client_test.go

@@ -106,3 +106,133 @@ func TestFullyQualifiedOrigin(t *testing.T) {
 		})
 	}
 }
+
+func TestIsOriginInHaystack(t *testing.T) {
+	testCases := []struct {
+		name     string
+		origin   string
+		haystack []string
+		expected bool
+	}{
+		{
+			"ShouldHandleFullyQualifiedOrigin",
+			"https://app.example.com",
+			[]string{"https://app.example.com"},
+			true,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginCaseInsensitiveScheme",
+			"https://app.example.com",
+			[]string{"HTTPS://app.example.com"},
+			true,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginCaseInsensitiveHost",
+			"https://app.EXAMPLE.com",
+			[]string{"https://app.example.com"},
+			true,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginWithPort",
+			"https://app.example.com:443",
+			[]string{"https://app.example.com:443"},
+			true,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginDifferentScheme",
+			"http://app.example.com",
+			[]string{"https://app.example.com"},
+			false,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginDifferentPort",
+			"https://app.example.com:443",
+			[]string{"https://app.example.com"},
+			false,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginDifferentPath",
+			"https://app.example.com/abc",
+			[]string{"https://app.example.com"},
+			false,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginDifferentQuery",
+			"https://app.example.com/?abc=123",
+			[]string{"https://app.example.com"},
+			false,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginDifferentQueryCount",
+			"https://app.example.com/?abc=123",
+			[]string{"https://app.example.com/?zyz=123&abc=123"},
+			false,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginDifferentQueryOrder",
+			"https://app.example.com/?abc=123&xyz=123",
+			[]string{"https://app.example.com/?xyz=123&abc=123"},
+			true,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginDifferentQueryValue",
+			"https://app.example.com/?abc=123&xyz=123",
+			[]string{"https://app.example.com/?xyz=1234&abc=123"},
+			false,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginFragment",
+			"https://app.example.com/#abc",
+			[]string{"https://app.example.com/#abc"},
+			true,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginFragmentDifferent",
+			"https://app.example.com/#abc",
+			[]string{"https://app.example.com/#abc2"},
+			false,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginWithoutAllowed",
+			"https://app.example.com",
+			nil,
+			false,
+		},
+		{
+			"ShouldHandleFullyQualifiedOriginWithTrailingSlashes",
+			"https://app.example.com/",
+			[]string{"https://app.example.com"},
+			true,
+		},
+		{
+			"ShouldHandleNativeAppAndroid",
+			"android:apk-key-hash:7d1043473d55bfa90e8530d35801d4e381bc69f0",
+			[]string{"android:apk-key-hash:7d1043473d55bfa90e8530d35801d4e381bc69f0"},
+			true,
+		},
+		{
+			"ShouldHandleNativeAppAndroidCaseSensitive",
+			"android:apk-key-hash:7d1043473d55bfa90e8530d35801d4e381bc69F0",
+			[]string{"android:apk-key-hash:7d1043473d55bfa90e8530d35801d4e381bc69f0"},
+			false,
+		},
+		{
+			"ShouldHandleNonFQDNOrigin",
+			"https://user:[email protected]/",
+			[]string{"https://app.example.com/"},
+			false,
+		},
+		{
+			"ShouldHandleNonFQDNOriginExactStringMatch",
+			"https://user:[email protected]/",
+			[]string{"https://user:[email protected]/"},
+			true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.expected, IsOriginInHaystack(tc.origin, tc.haystack))
+		})
+	}
+}