spiffe / java-spiffe / 31023546327

87%

master: 98%

push

github

fix(provider): validate peer chain before invoking SpiffeIdVerifier

`SpiffeTrustManager` invoked the `SpiffeIdVerifier` before any
cryptographic validation.
The callback received an unvalidated, attacker-supplied chain despite the verifier's [API spec calling it `verifiedChain`](https://github.com/spiffe/java-spiffe/blob/55200fc8e/java-spiffe-provider/src/main/java/io/spiffe/provider/SpiffeIdVerifier.java#L13).

Validate the chain against the trust bundle first and only then invoke the verifier.

This matches go-spiffe, where [the `Authorizer` only receives chains returned by `x509svid.ParseAndVerify`](https://github.com/spiffe/go-spiffe/blob/v2.8.1/spiffetls/tlsconfig/config.go#L193-L201) (`ParseAndVerify` first checks the certificates, afterwards `Authorizer` checks if the SPIFFE ID is authorized).

Observable change: for a chain that is both untrusted and carries an unacceptable SPIFFE ID, the reported error is now the chain validation failure, rather than the verifier error.

There is a small conflict on imports with https://github.com/spiffe/java-spiffe/pull/433 , so if you poke me after that one is merged, I'm happy to rebase.

Signed-off-by: bcleenders <bcleenders@spotify.com>

485 of 635 branches covered (76.38%)

Branch coverage included in aggregate %.

1864 of 2051 relevant lines covered (90.88%)

3.59 hits per line