Merge pull request #342 from cedarcode/braulio_fix_acceptable_attesta…

…tion_types_inclusion_for_none

Fix: validate acceptable attestation type inclusion when attestation statement is None

lib/webauthn/attestation_statement/none.rb

@@ -6,12 +6,18 @@ module WebAuthn
  module AttestationStatement
  class None < Base
  def valid?(*_args)
- if statement == {}
+ if statement == {} && trustworthy?
  [WebAuthn::AttestationStatement::ATTESTATION_TYPE_NONE, nil]
  else
  false
  end
  end
+
+ private
+
+ def attestation_type
+ WebAuthn::AttestationStatement::ATTESTATION_TYPE_NONE
+ end
  end
  end
 end

spec/webauthn/attestation_statement/none_spec.rb

@@ -31,5 +31,11 @@
  expect(WebAuthn::AttestationStatement::None.new([]).valid?(authenticator_data, nil)).to be_falsy
  expect(WebAuthn::AttestationStatement::None.new("a" => "b").valid?(authenticator_data, nil)).to be_falsy
  end
+
+ it "returns false if None is not among the acceptable attestation types" do
+ WebAuthn.configuration.acceptable_attestation_types = ['AttCA']
+
+ expect(WebAuthn::AttestationStatement::None.new({}).valid?(authenticator_data, nil)).to be_falsy
+ end
  end
 end