github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-08 04:16:40 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[PR #6106] [MERGED] [PM-24971] Sanitize passkey attestation options from AliExpress #19075

New Issue
Closed
opened 2026-04-15 03:38:31 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-15 03:38:31 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/bitwarden/android/pull/6106
Author: @SaintPatrck
Created: 10/31/2025
Status: ✅ Merged
Merged: 11/3/2025
Merged by: @SaintPatrck

Base: main ← Head: PM-24971/sanitize-aliexpress-fido2-attestation-options

📝 Commits (10+)

  • 33b555b [PM-24971] Sanitize passkey attestation options from AliExpress
  • b3a5b2c Fix typo in sanitizer package name
  • 6544a46 Use apply instead of also for object sanitization
  • 1f03aad Rename PasskeyAttestationOptionSanitizerImpl to PasskeyAttestationOptionsSanitizerImpl
  • 52a0b55 Correct AliExpress Relying Party ID check for passkey creation
  • 50cfa57 Refactor PasskeyAttestationOptionsSanitizer comments for clarity
  • dd92be6 Trim trailing newlines from passkey user id
  • 4c5023d Address Claude review comments
  • 7fa03d6 Remove redundant blank line
  • df37505 Log passkey attestation option sanitization failures

📊 Changes

6 files changed (+281 additions, -33 deletions)

View changed files

📝 app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/di/CredentialProviderModule.kt (+11 -2)
📝 app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/manager/BitwardenCredentialManagerImpl.kt (+42 -25)
➕ app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/sanitizer/PasskeyAttestationOptionsSanitizer.kt (+22 -0)
➕ app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/sanitizer/PasskeyAttestationOptionsSanitizerImpl.kt (+26 -0)
📝 app/src/test/kotlin/com/x8bit/bitwarden/data/credentials/manager/BitwardenCredentialManagerTest.kt (+71 -6)
➕ app/src/test/kotlin/com/x8bit/bitwarden/data/credentials/sanitizer/PasskeyAttestationOptionSanitizerTest.kt (+109 -0)

📄 Description

🎟️ Tracking

PM-24971
#5740

📔 Objective

This commit introduces a sanitizer for PasskeyAttestationOptions to address an issue with the AliExpress Android app.

The AliExpress app incorrectly appends a newline character to the user.id field when creating a passkey. This malformed request causes the passkey creation to fail.

To work around this, a PasskeyAttestationOptionsSanitizer is introduced. This sanitizer specifically checks if the request originates from the AliExpress relying party ID (m.aliexpress.com) and if the user.id ends with a newline. If both conditions are met, it trims the user.id before the request is further processed, allowing the passkey registration to succeed.

Specific changes include:

  • Added PasskeyAttestationOptionsSanitizer interface and its implementation, PasskeyAttestationOptionSanitizerImpl, which contains the specific fix for AliExpress.
  • Injected and utilized the new sanitizer within BitwardenCredentialManagerImpl to clean the PasskeyAttestationOptions before they are used to register a FIDO2 credential.
  • Updated dependency injection in CredentialProviderModule to provide the sanitizer.
  • Added unit tests for the new sanitizer logic.

📸 Screenshots

Coming soon!

⏰ Reminders before review

  • Contributor guidelines followed
  • All formatters and local linters executed and passed
  • Written new unit and / or integration tests where applicable
  • Protected functional changes with optionality (feature flags)
  • Used internationalization (i18n) for all UI strings
  • CI builds passed
  • Communicated to DevOps any deployment requirements
  • Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

  • 👍 (:+1:) or similar for great changes
  • 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
  • ❓ (:question:) for questions
  • 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
  • 🎨 (:art:) for suggestions / improvements
  • ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
  • 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
  • ⛏ (:pick:) for minor or nitpick changes

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/bitwarden/android/pull/6106 **Author:** [@SaintPatrck](https://github.com/SaintPatrck) **Created:** 10/31/2025 **Status:** ✅ Merged **Merged:** 11/3/2025 **Merged by:** [@SaintPatrck](https://github.com/SaintPatrck) **Base:** `main` ← **Head:** `PM-24971/sanitize-aliexpress-fido2-attestation-options` --- ### 📝 Commits (10+) - [`33b555b`](https://github.com/bitwarden/android/commit/33b555b9d6a868520361ad297782e8fcddba59ce) [PM-24971] Sanitize passkey attestation options from AliExpress - [`b3a5b2c`](https://github.com/bitwarden/android/commit/b3a5b2cfa4a63e991ab9f863dce98686179e2ca0) Fix typo in `sanitizer` package name - [`6544a46`](https://github.com/bitwarden/android/commit/6544a463207cf41675c9007ce31b86923460a33a) Use `apply` instead of `also` for object sanitization - [`1f03aad`](https://github.com/bitwarden/android/commit/1f03aad5d0f0eeab1b9b4333f553a2da2ca954f9) Rename PasskeyAttestationOptionSanitizerImpl to PasskeyAttestationOptionsSanitizerImpl - [`52a0b55`](https://github.com/bitwarden/android/commit/52a0b550626f1689cd7ab24e56b32a7b6b631aaf) Correct AliExpress Relying Party ID check for passkey creation - [`50cfa57`](https://github.com/bitwarden/android/commit/50cfa5720e34c0c9c27454f8e23d5ace9cec4897) Refactor PasskeyAttestationOptionsSanitizer comments for clarity - [`dd92be6`](https://github.com/bitwarden/android/commit/dd92be6c8ebc60ed7ad6ccc6737e99cd5598ead6) Trim trailing newlines from passkey user id - [`4c5023d`](https://github.com/bitwarden/android/commit/4c5023da842e0965e28c46f1b5348982817af35b) Address Claude review comments - [`7fa03d6`](https://github.com/bitwarden/android/commit/7fa03d6a7f83ab55e273acd384c4413a20359782) Remove redundant blank line - [`df37505`](https://github.com/bitwarden/android/commit/df37505c478f1cc6489bde145119edda88c39b09) Log passkey attestation option sanitization failures ### 📊 Changes **6 files changed** (+281 additions, -33 deletions) <details> <summary>View changed files</summary> 📝 `app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/di/CredentialProviderModule.kt` (+11 -2) 📝 `app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/manager/BitwardenCredentialManagerImpl.kt` (+42 -25) ➕ `app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/sanitizer/PasskeyAttestationOptionsSanitizer.kt` (+22 -0) ➕ `app/src/main/kotlin/com/x8bit/bitwarden/data/credentials/sanitizer/PasskeyAttestationOptionsSanitizerImpl.kt` (+26 -0) 📝 `app/src/test/kotlin/com/x8bit/bitwarden/data/credentials/manager/BitwardenCredentialManagerTest.kt` (+71 -6) ➕ `app/src/test/kotlin/com/x8bit/bitwarden/data/credentials/sanitizer/PasskeyAttestationOptionSanitizerTest.kt` (+109 -0) </details> ### 📄 Description ## 🎟️ Tracking PM-24971 #5740 ## 📔 Objective This commit introduces a sanitizer for `PasskeyAttestationOptions` to address an issue with the AliExpress Android app. The AliExpress app incorrectly appends a newline character to the `user.id` field when creating a passkey. This malformed request causes the passkey creation to fail. To work around this, a `PasskeyAttestationOptionsSanitizer` is introduced. This sanitizer specifically checks if the request originates from the AliExpress relying party ID (`m.aliexpress.com`) and if the `user.id` ends with a newline. If both conditions are met, it trims the `user.id` before the request is further processed, allowing the passkey registration to succeed. Specific changes include: - Added `PasskeyAttestationOptionsSanitizer` interface and its implementation, `PasskeyAttestationOptionSanitizerImpl`, which contains the specific fix for AliExpress. - Injected and utilized the new sanitizer within `BitwardenCredentialManagerImpl` to clean the `PasskeyAttestationOptions` before they are used to register a FIDO2 credential. - Updated dependency injection in `CredentialProviderModule` to provide the sanitizer. - Added unit tests for the new sanitizer logic. ## 📸 Screenshots Coming soon! ## ⏰ Reminders before review - Contributor guidelines followed - All formatters and local linters executed and passed - Written new unit and / or integration tests where applicable - Protected functional changes with optionality (feature flags) - Used internationalization (i18n) for all UI strings - CI builds passed - Communicated to DevOps any deployment requirements - Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team ## 🦮 Reviewer guidelines <!-- Suggested interactions but feel free to use (or not) as you desire! --> - 👍 (`:+1:`) or similar for great changes - 📝 (`:memo:`) or ℹ️ (`:information_source:`) for notes or general info - ❓ (`:question:`) for questions - 🤔 (`:thinking:`) or 💭 (`:thought_balloon:`) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion - 🎨 (`:art:`) for suggestions / improvements - ❌ (`:x:`) or ⚠️ (`:warning:`) for more significant problems or concerns needing attention - 🌱 (`:seedling:`) or ♻️ (`:recycle:`) for future improvements or indications of technical debt - ⛏ (`:pick:`) for minor or nitpick changes --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-15 03:38:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#19075
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?