Skip to content

Commit 01f4719

Browse files
elukewalkerelukewalker
authored
Merge pull request #2 from elukewalker/scion/java-webauthn-v2
v0.0.1.0 — Upgrade java-webauthn-server to 2.9.0 and modernize dependencies
2 parents cfba85a + c975df5 commit 01f4719

39 files changed

Lines changed: 845 additions & 745 deletions

‎.gstack/security-reports/20260519-163613.json‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
{
2+
"version": "2.0.0",
3+
"date": "2026-05-19T16:30:00Z",
4+
"mode": "daily",
5+
"scope": "full",
6+
"diff_mode": false,
7+
"phases_run": [0, 1, 2, 3, 5, 6, 9, 12, 13, 14],
8+
"attack_surface": {
9+
"code": {
10+
"public_endpoints": 4,
11+
"authenticated": 1,
12+
"admin": 0,
13+
"api": 5,
14+
"uploads": 0,
15+
"integrations": 1,
16+
"background_jobs": 0,
17+
"websockets": 0
18+
},
19+
"infrastructure": {
20+
"ci_workflows": 0,
21+
"webhook_receivers": 0,
22+
"container_configs": 4,
23+
"iac_configs": 0,
24+
"deploy_targets": 0,
25+
"secret_management": "environment-variables"
26+
}
27+
},
28+
"findings": [
29+
{
30+
"id": 1,
31+
"severity": "MEDIUM",
32+
"confidence": 9,
33+
"status": "VERIFIED",
34+
"phase": 5,
35+
"phase_name": "Infrastructure Shadow Surface",
36+
"category": "Infrastructure",
37+
"fingerprint": "sha256-docker-root-user-missing",
38+
"title": "Dockerfiles run as root",
39+
"file": "*/Dockerfile",
40+
"line": 0,
41+
"description": "All workshop Dockerfiles are missing the USER directive, causing containers to run as root.",
42+
"exploit_scenario": "If attacker compromises the application via RCE, they gain root access inside container, enabling container escape and host pivot.",
43+
"impact": "Elevated privileges for compromised containers. Increased blast radius.",
44+
"recommendation": "Add non-root user to Dockerfiles with educational comments for workshop participants.",
45+
"verification": "self-verified"
46+
},
47+
{
48+
"id": 2,
49+
"severity": "INFO",
50+
"confidence": 10,
51+
"status": "VERIFIED",
52+
"phase": 3,
53+
"phase_name": "Dependency Supply Chain",
54+
"category": "Supply Chain",
55+
"fingerprint": "sha256-spring-boot-eol-2-7-18",
56+
"title": "Spring Boot 2.7.18 is EOL",
57+
"file": "*/pom.xml",
58+
"line": 8,
59+
"description": "Spring Boot 2.7.18 reached end-of-life in November 2023. No further security patches available.",
60+
"exploit_scenario": "Future CVEs in Spring Boot 2.7.x will not be patched. Workshop users deploying to production would be vulnerable.",
61+
"impact": "Unpatched vulnerabilities accumulate over time. Production risk.",
62+
"recommendation": "Add README warning about EOL status and migration path to Spring Boot 3.x for production use.",
63+
"verification": "self-verified"
64+
}
65+
],
66+
"supply_chain_summary": {
67+
"direct_deps": 15,
68+
"transitive_deps": 0,
69+
"critical_cves": 0,
70+
"high_cves": 0,
71+
"install_scripts": 0,
72+
"lockfile_present": false,
73+
"lockfile_tracked": false,
74+
"tools_skipped": ["mvn"]
75+
},
76+
"filter_stats": {
77+
"candidates_scanned": 15,
78+
"hard_exclusion_filtered": 12,
79+
"confidence_gate_filtered": 1,
80+
"verification_filtered": 0,
81+
"reported": 2
82+
},
83+
"totals": {
84+
"critical": 0,
85+
"high": 0,
86+
"medium": 1,
87+
"info": 1,
88+
"tentative": 0
89+
},
90+
"trend": {
91+
"prior_report_date": null,
92+
"resolved": 0,
93+
"persistent": 0,
94+
"new": 2,
95+
"direction": "first_run"
96+
}
97+
}

‎2_Credential_Repository/README.md‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,25 +50,36 @@ Windows 10 example of multiple credentials on a security key. The top choice is
5050

5151

5252
### Dependency configuration
53-
Open the ```pom.xml``` and add the webauthn-server-core and webauthn-server-attestation dependencies. The workshop is known to work with version 1.2.0 of the java-webauthn-server.
53+
Open the ```pom.xml``` and add the webauthn-server-core and webauthn-server-attestation dependencies. The workshop is known to work with version 2.9.0 of the java-webauthn-server.
5454
```xml
5555
<dependency>
5656
<groupId>ch.qos.logback</groupId>
5757
<artifactId>logback-classic</artifactId>
58-
<version>1.2.3</version>
58+
<version>1.2.13</version>
5959
</dependency>
6060
<dependency>
6161
<groupId>com.yubico</groupId>
6262
<artifactId>webauthn-server-core</artifactId>
6363
<!--Check for the latest version at Maven Central-->
64-
<version>1.2.0</version>
64+
<version>2.9.0</version>
6565
<scope>compile</scope>
6666
</dependency>
6767
<dependency>
6868
<groupId>com.yubico</groupId>
6969
<artifactId>webauthn-server-attestation</artifactId>
7070
<!--Check for the latest version at Maven Central-->
71-
<version>1.2.0</version>
71+
<version>2.9.0</version>
72+
<scope>compile</scope>
73+
</dependency>
74+
<dependency>
75+
<groupId>org.bouncycastle</groupId>
76+
<artifactId>bcprov-jdk15on</artifactId>
77+
<version>1.70</version>
78+
</dependency>
79+
<dependency>
80+
<groupId>com.google.guava</groupId>
81+
<artifactId>guava</artifactId>
82+
<version>32.1.3-jre</version>
7283
<scope>compile</scope>
7384
</dependency>
7485
```

‎2_Credential_Repository/complete/pom.xml‎

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<parent>
66
<groupId>org.springframework.boot</groupId>
77
<artifactId>spring-boot-starter-parent</artifactId>
8-
<version>2.1.4.RELEASE</version>
8+
<version>2.7.18</version>
99
<relativePath/> <!-- lookup parent from repository -->
1010
</parent>
1111
<groupId>com.example</groupId>
@@ -16,6 +16,7 @@
1616

1717
<properties>
1818
<java.version>1.8</java.version>
19+
<maven.compiler.release>17</maven.compiler.release>
1920
</properties>
2021

2122
<dependencies>
@@ -35,6 +36,7 @@
3536
<dependency>
3637
<groupId>org.projectlombok</groupId>
3738
<artifactId>lombok</artifactId>
39+
<version>1.18.46</version>
3840
<optional>true</optional>
3941
</dependency>
4042
<dependency>
@@ -55,26 +57,51 @@
5557
<dependency>
5658
<groupId>ch.qos.logback</groupId>
5759
<artifactId>logback-classic</artifactId>
58-
<version>1.2.3</version>
60+
<version>1.2.13</version>
5961
</dependency>
6062
<dependency>
6163
<groupId>com.yubico</groupId>
6264
<artifactId>webauthn-server-core</artifactId>
6365
<!--Check for the latest version at Maven Central-->
64-
<version>1.2.0</version>
66+
<version>2.9.0</version>
6567
<scope>compile</scope>
6668
</dependency>
6769
<dependency>
6870
<groupId>com.yubico</groupId>
6971
<artifactId>webauthn-server-attestation</artifactId>
7072
<!--Check for the latest version at Maven Central-->
71-
<version>1.2.0</version>
73+
<version>2.9.0</version>
7274
<scope>compile</scope>
7375
</dependency>
76+
<!-- BouncyCastle for EdDSA support on Java 8 -->
77+
<dependency>
78+
<groupId>org.bouncycastle</groupId>
79+
<artifactId>bcprov-jdk15on</artifactId>
80+
<version>1.70</version>
81+
</dependency>
82+
<!-- Guava for caching -->
83+
<dependency>
84+
<groupId>com.google.guava</groupId>
85+
<artifactId>guava</artifactId>
86+
<version>31.1-jre</version>
87+
</dependency>
7488
</dependencies>
7589

7690
<build>
7791
<plugins>
92+
<plugin>
93+
<groupId>org.apache.maven.plugins</groupId>
94+
<artifactId>maven-compiler-plugin</artifactId>
95+
<configuration>
96+
<annotationProcessorPaths>
97+
<path>
98+
<groupId>org.projectlombok</groupId>
99+
<artifactId>lombok</artifactId>
100+
<version>1.18.46</version>
101+
</path>
102+
</annotationProcessorPaths>
103+
</configuration>
104+
</plugin>
78105
<plugin>
79106
<groupId>org.springframework.boot</groupId>
80107
<artifactId>spring-boot-maven-plugin</artifactId>
@@ -83,7 +110,7 @@
83110
<groupId>com.microsoft.azure</groupId>
84111
<artifactId>azure-webapp-maven-plugin</artifactId>
85112
<!--Check for the latest version at Maven Central-->
86-
<version>1.6.0</version>
113+
<version>2.13.0</version>
87114
<configuration>
88115
<deploymentType>jar</deploymentType>
89116

‎2_Credential_Repository/complete/src/main/java/com/example/demo/Config.java‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424

2525
package com.example.demo;
2626

27-
import com.yubico.internal.util.CollectionUtil;
2827
import com.yubico.webauthn.data.RelyingPartyIdentity;
2928
import com.yubico.webauthn.extension.appid.AppId;
3029
import com.yubico.webauthn.extension.appid.InvalidAppIdException;
@@ -53,7 +52,7 @@ public class Config {
5352
private final Optional<AppId> appId;
5453

5554
private Config(Set<String> origins, int port, RelyingPartyIdentity rpIdentity, Optional<AppId> appId) {
56-
this.origins = CollectionUtil.immutableSet(origins);
55+
this.origins = Collections.unmodifiableSet(new HashSet<>(origins));
5756
this.port = port;
5857
this.rpIdentity = rpIdentity;
5958
this.appId = appId;
@@ -140,15 +139,9 @@ private static RelyingPartyIdentity computeRpIdentity() throws MalformedURLExcep
140139
resultBuilder.id(id);
141140
}
142141

143-
if (icon == null) {
144-
logger.debug("RP icon not given - using none.");
145-
} else {
146-
try {
147-
resultBuilder.icon(Optional.of(new URL(icon)));
148-
} catch (MalformedURLException e) {
149-
logger.error("Invalid icon URL: {}", icon, e);
150-
throw e;
151-
}
142+
// Icon field removed in WebAuthn Level 2 (java-webauthn-server 2.x)
143+
if (icon != null) {
144+
logger.warn("RP icon specified but ignored - icon field removed in WebAuthn Level 2. Value was: {}", icon);
152145
}
153146

154147
final RelyingPartyIdentity result = resultBuilder.build();

‎2_Credential_Repository/complete/src/main/java/com/example/demo/InMemoryRegistrationStorage.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@
2626

2727
import com.google.common.cache.Cache;
2828
import com.google.common.cache.CacheBuilder;
29-
import com.yubico.internal.util.CollectionUtil;
3029
import com.yubico.webauthn.AssertionResult;
3130
import com.yubico.webauthn.CredentialRepository;
3231
import com.yubico.webauthn.RegisteredCredential;
3332
import com.yubico.webauthn.data.ByteArray;
3433
import com.yubico.webauthn.data.PublicKeyCredentialDescriptor;
3534
import com.example.demo.data.CredentialRegistration;
3635
import java.util.Collection;
36+
import java.util.Collections;
3737
import java.util.HashSet;
3838
import java.util.NoSuchElementException;
3939
import java.util.Optional;
@@ -171,7 +171,7 @@ public Optional<RegisteredCredential> lookup(ByteArray credentialId, ByteArray u
171171

172172
@Override
173173
public Set<RegisteredCredential> lookupAll(ByteArray credentialId) {
174-
return CollectionUtil.immutableSet(
174+
return Collections.unmodifiableSet(
175175
storage.asMap().values().stream()
176176
.flatMap(Collection::stream)
177177
.filter(reg -> reg.getCredential().getCredentialId().equals(credentialId))

0 commit comments

Comments
 (0)