Package io.jans.fido2.service.readiness

Class RpIdValidator

java.lang.Object

io.jans.fido2.service.readiness.RpIdValidator

public final class RpIdValidator
extends Object

Decides whether a relying party ID may be used to build an outbound URL.

Pure string validation: it never resolves DNS. It accepts a DNS hostname with at least two labels and nothing else, which is what rules out the SSRF-shaped inputs: IP literals (including the decimal and hex forms such as 2130706433 and 0x7f.1), localhost, internal-only suffixes, credentials, ports, paths, queries and fragments.

IDN rule. An internationalized name is converted with IDN.toASCII(String) and the result is what is returned. A label whose letters come from more than one script (for example Latin mixed with Cyrillic) is rejected, whether it was written as Unicode or as xn-- punycode: the punycode form is decoded and checked too, so it cannot be used to smuggle a homograph through. This is deliberately conservative; a legitimate name that mixes scripts, such as Japanese Han with Kana, is rejected too.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	RpIdValidator.Rejection	Why a value was rejected.
static final class	RpIdValidator.Result	Outcome of validate(String): either an accepted ID or a rejection reason.

Method Summary

Modifier and Type	Method	Description
static RpIdValidator.Result	validate(String value)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

validate

public static RpIdValidator.Result validate(String value)