From 2ef8446d56ffa75ae421719d0793277c255eb323 Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Thu, 6 Jul 2023 00:00:25 +0200
Subject: [PATCH] Ignore key parameters with unsupported type

As required by the Webauthn spec, we now ignore public key credential
parameters with a type other than "public-key".

Fixes: https://github.com/Nitrokey/fido-authenticator/issues/20
---
 CHANGELOG.md |  4 ++++
 src/ctap2.rs | 16 +++++++---------
 2 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7ece47c..dc5f597 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 - Add config option for setting a maximum number of resident credentials.
+- Ignore public key credential paramters with an unknown type, as required by
+  the Webauthn spec ([#28][])
+
+[#28]: https://github.com/solokeys/fido-authenticator/issues/28
 
 ## [0.1.1] - 2022-08-22
 - Fix bug that treated U2F payloads as APDU over APDU in NFC transport @conorpp
diff --git a/src/ctap2.rs b/src/ctap2.rs
index 88c4a82..b4862f3 100644
--- a/src/ctap2.rs
+++ b/src/ctap2.rs
@@ -197,6 +197,11 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
 
         let mut algorithm: Option<SigningAlgorithm> = None;
         for param in parameters.pub_key_cred_params.iter() {
+            // Ignore unknown key types
+            if param.key_type != "public-key" {
+                continue;
+            }
+
             match param.alg {
                 -7 => {
                     if algorithm.is_none() {
@@ -210,15 +215,8 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
                 _ => {}
             }
         }
-        let algorithm = match algorithm {
-            Some(algorithm) => {
-                info_now!("algo: {:?}", algorithm as i32);
-                algorithm
-            }
-            None => {
-                return Err(Error::UnsupportedAlgorithm);
-            }
-        };
+        let algorithm = algorithm.ok_or(Error::UnsupportedAlgorithm)?;
+        info_now!("algo: {:?}", algorithm as i32);
 
         // 8. process options; on known but unsupported error UnsupportedOption