Merge Fix Jackson Deserializer for AuthenticationExtensionsClientOutputs

Author: rwinch

webauthn/src/main/java/org/springframework/security/web/webauthn/jackson/AuthenticationExtensionsClientOutputsDeserializer.java

@@ -55,19 +55,18 @@ public AuthenticationExtensionsClientOutputs deserialize(JsonParser parser, Dese
 			throws JacksonException {
 		List<AuthenticationExtensionsClientOutput<?>> outputs = new ArrayList<>();
 		for (String key = parser.nextName(); key != null; key = parser.nextName()) {
-			JsonToken startObject = parser.nextValue();
-			if (startObject != JsonToken.START_OBJECT) {
-				break;
-			}
-			if (CredentialPropertiesOutput.EXTENSION_ID.equals(key)) {
+			JsonToken next = parser.nextToken();
+			if (next == JsonToken.START_OBJECT && CredentialPropertiesOutput.EXTENSION_ID.equals(key)) {
 				CredentialPropertiesOutput output = parser.readValueAs(CredentialPropertiesOutput.class);
 				outputs.add(output);
 			}
 			else {
 				if (logger.isDebugEnabled()) {
 					logger.debug("Skipping unknown extension with id " + key);
 				}
-				parser.nextValue();
+				if (next.isStructStart()) {
+					parser.skipChildren();
+				}
 			}
 		}
 

webauthn/src/main/java/org/springframework/security/web/webauthn/jackson/AuthenticationExtensionsClientOutputsJackson2Deserializer.java

@@ -62,19 +62,18 @@ public AuthenticationExtensionsClientOutputs deserialize(JsonParser parser, Dese
 			throws IOException, JacksonException {
 		List<AuthenticationExtensionsClientOutput<?>> outputs = new ArrayList<>();
 		for (String key = parser.nextFieldName(); key != null; key = parser.nextFieldName()) {
-			JsonToken startObject = parser.nextValue();
-			if (startObject != JsonToken.START_OBJECT) {
-				break;
-			}
-			if (CredentialPropertiesOutput.EXTENSION_ID.equals(key)) {
+			JsonToken next = parser.nextToken();
+			if (next == JsonToken.START_OBJECT && CredentialPropertiesOutput.EXTENSION_ID.equals(key)) {
 				CredentialPropertiesOutput output = parser.readValueAs(CredentialPropertiesOutput.class);
 				outputs.add(output);
 			}
 			else {
 				if (logger.isDebugEnabled()) {
 					logger.debug("Skipping unknown extension with id " + key);
 				}
-				parser.nextValue();
+				if (next.isStructStart()) {
+					parser.skipChildren();
+				}
 			}
 		}
 

webauthn/src/test/java/org/springframework/security/web/webauthn/jackson/Jackson2Tests.java

@@ -123,6 +123,47 @@ void readCredPropsWhenAuthenticatorDisplayName() throws Exception {
 		assertThat(outputs).usingRecursiveComparison().isEqualTo(credProps);
 	}
 
+	@Test
+	void readAuthenticationExtensionsClientOutputsWhenAppId() throws Exception {
+		String json = """
+				{
+				  "appid": false,
+				  "credProps": {
+				    "rk": false
+				  }
+				}
+				""";
+		CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
+
+		AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
+				AuthenticationExtensionsClientOutputs.class);
+		assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
+	}
+
+	@Test
+	void readAuthenticationExtensionsClientOutputsWhenUnknownExtension() throws Exception {
+		String json = """
+				{
+				  "unknownObject1": {
+				    "key": "value"
+				  },
+				  "unknownArray": [
+				    { "key": "value1" },
+				    { "key": "value2" }
+				  ],
+				  "credProps": {
+				    "rk": false
+				  },
+				  "unknownObject2": {}
+				}
+				""";
+		CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
+
+		AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
+				AuthenticationExtensionsClientOutputs.class);
+		assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
+	}
+
 	@Test
 	void readAuthenticationExtensionsClientOutputsWhenFieldAfter() throws Exception {
 		String json = """

webauthn/src/test/java/org/springframework/security/web/webauthn/jackson/JacksonTests.java

@@ -121,6 +121,47 @@ void readCredPropsWhenAuthenticatorDisplayName() throws Exception {
 		assertThat(outputs).usingRecursiveComparison().isEqualTo(credProps);
 	}
 
+	@Test
+	void readAuthenticationExtensionsClientOutputsWhenAppId() {
+		String json = """
+				{
+				  "appid": false,
+				  "credProps": {
+				    "rk": false
+				  }
+				}
+				""";
+		CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
+
+		AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
+				AuthenticationExtensionsClientOutputs.class);
+		assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
+	}
+
+	@Test
+	void readAuthenticationExtensionsClientOutputsWhenUnknownExtension() {
+		String json = """
+				{
+				  "unknownObject1": {
+				    "key": "value"
+				  },
+				  "unknownArray": [
+				    { "key": "value1" },
+				    { "key": "value2" }
+				  ],
+				  "credProps": {
+				    "rk": false
+				  },
+				  "unknownObject2": {}
+				}
+				""";
+		CredentialPropertiesOutput credProps = new CredentialPropertiesOutput(false);
+
+		AuthenticationExtensionsClientOutputs outputs = this.mapper.readValue(json,
+				AuthenticationExtensionsClientOutputs.class);
+		assertThat(outputs.getOutputs()).usingRecursiveFieldByFieldElementComparator().contains(credProps);
+	}
+
 	@Test
 	void readAuthenticationExtensionsClientOutputsWhenFieldAfter() throws Exception {
 		String json = """