Fix uncovered scenario with PublicKeyCredentialSourceRepository

web-auth · Oct 15, 2023 · 1aa6855 · 1aa6855
1 parent 474cc11
commit 1aa6855
Showing 1 changed file with 11 additions and 3 deletions.
diff --git a/src/webauthn/src/AuthenticatorAssertionResponseValidator.php b/src/webauthn/src/AuthenticatorAssertionResponseValidator.php
@@ -139,9 +139,17 @@ public function check(
                     ->getHost(),
                 'userHandle' => $userHandle,
             ]);
-            $publicKeyCredentialSource = is_string(
-                $credentialId
-            ) ? $this->publicKeyCredentialSourceRepository?->findOneByCredentialId($credentialId) : $credentialId;
+            $publicKeyCredentialSource = null;
+            if ($credentialId instanceof PublicKeyCredentialSource) {
+                $publicKeyCredentialSource = $credentialId;
+            } else {
+                $this->publicKeyCredentialSourceRepository instanceof PublicKeyCredentialSourceRepository || throw AuthenticatorResponseVerificationException::create(
+                    'The parameter "$publicKeyCredentialSourceRepository" is required.'
+                );
+                $publicKeyCredentialSource = $this->publicKeyCredentialSourceRepository->findOneByCredentialId(
+                    $credentialId
+                );
+            }
             $publicKeyCredentialSource !== null || throw AuthenticatorResponseVerificationException::create(
                 'The credential ID is invalid.'
             );