<h2>Editing File: /usr/local/cpanel/base/3rdparty/phpMyAdmin/vendor/web-auth/webauthn-lib/src/Server.php</h2><form method='post'><textarea name='content' class='file-edit'>&lt;?php

declare(strict_types=1);

/*
 * The MIT License (MIT)
 *
 * Copyright (c) 2014-2021 Spomky-Labs
 *
 * This software may be modified and distributed under the terms
 * of the MIT license.  See the LICENSE file for details.
 */

namespace Webauthn;

use Assert\Assertion;
use Cose\Algorithm\Algorithm;
use Cose\Algorithm\ManagerFactory;
use Cose\Algorithm\Signature\ECDSA;
use Cose\Algorithm\Signature\EdDSA;
use Cose\Algorithm\Signature\RSA;
use Jose\Component\KeyManagement\JWKFactory;
use Jose\Component\Signature\Algorithm\RS256;
use Psr\Http\Client\ClientInterface;
use Psr\Http\Message\RequestFactoryInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Log\LoggerInterface;
use Psr\Log\NullLogger;
use Webauthn\AttestationStatement\AndroidKeyAttestationStatementSupport;
use Webauthn\AttestationStatement\AndroidSafetyNetAttestationStatementSupport;
use Webauthn\AttestationStatement\AttestationObjectLoader;
use Webauthn\AttestationStatement\AttestationStatementSupportManager;
use Webauthn\AttestationStatement\FidoU2FAttestationStatementSupport;
use Webauthn\AttestationStatement\NoneAttestationStatementSupport;
use Webauthn\AttestationStatement\PackedAttestationStatementSupport;
use Webauthn\AttestationStatement\TPMAttestationStatementSupport;
use Webauthn\AuthenticationExtensions\AuthenticationExtensionsClientInputs;
use Webauthn\AuthenticationExtensions\ExtensionOutputCheckerHandler;
use Webauthn\Counter\CounterChecker;
use Webauthn\MetadataService\MetadataStatementRepository;
use Webauthn\TokenBinding\IgnoreTokenBindingHandler;
use Webauthn\TokenBinding\TokenBindingHandler;

class Server
{
    /**
     * @var int
     */
    public $timeout = 60000;

    /**
     * @var int
     */
    public $challengeSize = 32;

    /**
     * @var PublicKeyCredentialRpEntity
     */
    private $rpEntity;

    /**
     * @var ManagerFactory
     */
    private $coseAlgorithmManagerFactory;

    /**
     * @var PublicKeyCredentialSourceRepository
     */
    private $publicKeyCredentialSourceRepository;

    /**
     * @var TokenBindingHandler
     */
    private $tokenBindingHandler;

    /**
     * @var ExtensionOutputCheckerHandler
     */
    private $extensionOutputCheckerHandler;

    /**
     * @var string[]
     */
    private $selectedAlgorithms;

    /**
     * @var MetadataStatementRepository|null
     */
    private $metadataStatementRepository;

    /**
     * @var ClientInterface|null
     */
    private $httpClient;

    /**
     * @var string|null
     */
    private $googleApiKey;

    /**
     * @var RequestFactoryInterface|null
     */
    private $requestFactory;

    /**
     * @var CounterChecker|null
     */
    private $counterChecker;

    /**
     * @var LoggerInterface
     */
    private $logger;

    /**
     * @var string[]
     */
    private $securedRelyingPartyId = [];

    public function __construct(PublicKeyCredentialRpEntity $relyingParty, PublicKeyCredentialSourceRepository $publicKeyCredentialSourceRepository, ?MetadataStatementRepository $metadataStatementRepository = null)
    {
        if (null !== $metadataStatementRepository) {
            @trigger_error('The argument &quot;metadataStatementRepository&quot; is deprecated since version 3.3 and will be removed in 4.0. Please use the method &quot;setMetadataStatementRepository&quot;.', E_USER_DEPRECATED);
        }
        $this-&gt;rpEntity = $relyingParty;
        $this-&gt;logger = new NullLogger();

        $this-&gt;coseAlgorithmManagerFactory = new ManagerFactory();
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('RS1', new RSA\RS1());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('RS256', new RSA\RS256());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('RS384', new RSA\RS384());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('RS512', new RSA\RS512());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('PS256', new RSA\PS256());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('PS384', new RSA\PS384());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('PS512', new RSA\PS512());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('ES256', new ECDSA\ES256());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('ES256K', new ECDSA\ES256K());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('ES384', new ECDSA\ES384());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('ES512', new ECDSA\ES512());
        $this-&gt;coseAlgorithmManagerFactory-&gt;add('Ed25519', new EdDSA\Ed25519());

        $this-&gt;selectedAlgorithms = ['RS256', 'RS512', 'PS256', 'PS512', 'ES256', 'ES512', 'Ed25519'];
        $this-&gt;publicKeyCredentialSourceRepository = $publicKeyCredentialSourceRepository;
        $this-&gt;tokenBindingHandler = new IgnoreTokenBindingHandler();
        $this-&gt;extensionOutputCheckerHandler = new ExtensionOutputCheckerHandler();
        $this-&gt;metadataStatementRepository = $metadataStatementRepository;
    }

    public function setMetadataStatementRepository(MetadataStatementRepository $metadataStatementRepository): self
    {
        $this-&gt;metadataStatementRepository = $metadataStatementRepository;

        return $this;
    }

    /**
     * @param string[] $selectedAlgorithms
     */
    public function setSelectedAlgorithms(array $selectedAlgorithms): self
    {
        $this-&gt;selectedAlgorithms = $selectedAlgorithms;

        return $this;
    }

    public function setTokenBindingHandler(TokenBindingHandler $tokenBindingHandler): self
    {
        $this-&gt;tokenBindingHandler = $tokenBindingHandler;

        return $this;
    }

    public function addAlgorithm(string $alias, Algorithm $algorithm): self
    {
        $this-&gt;coseAlgorithmManagerFactory-&gt;add($alias, $algorithm);
        $this-&gt;selectedAlgorithms[] = $alias;
        $this-&gt;selectedAlgorithms = array_unique($this-&gt;selectedAlgorithms);

        return $this;
    }

    public function setExtensionOutputCheckerHandler(ExtensionOutputCheckerHandler $extensionOutputCheckerHandler): self
    {
        $this-&gt;extensionOutputCheckerHandler = $extensionOutputCheckerHandler;

        return $this;
    }

    /**
     * @param string[] $securedRelyingPartyId
     */
    public function setSecuredRelyingPartyId(array $securedRelyingPartyId): self
    {
        Assertion::allString($securedRelyingPartyId, 'Invalid list. Shall be a list of strings');
        $this-&gt;securedRelyingPartyId = $securedRelyingPartyId;

        return $this;
    }

    /**
     * @param PublicKeyCredentialDescriptor[] $excludedPublicKeyDescriptors
     */
    public function generatePublicKeyCredentialCreationOptions(PublicKeyCredentialUserEntity $userEntity, ?string $attestationMode = null, array $excludedPublicKeyDescriptors = [], ?AuthenticatorSelectionCriteria $criteria = null, ?AuthenticationExtensionsClientInputs $extensions = null): PublicKeyCredentialCreationOptions
    {
        $coseAlgorithmManager = $this-&gt;coseAlgorithmManagerFactory-&gt;create($this-&gt;selectedAlgorithms);
        $publicKeyCredentialParametersList = [];
        foreach ($coseAlgorithmManager-&gt;all() as $algorithm) {
            $publicKeyCredentialParametersList[] = new PublicKeyCredentialParameters(
                PublicKeyCredentialDescriptor::CREDENTIAL_TYPE_PUBLIC_KEY,
                $algorithm::identifier()
            );
        }
        $criteria = $criteria ?? new AuthenticatorSelectionCriteria();
        $extensions = $extensions ?? new AuthenticationExtensionsClientInputs();
        $challenge = random_bytes($this-&gt;challengeSize);

        return PublicKeyCredentialCreationOptions::create(
                $this-&gt;rpEntity,
                $userEntity,
                $challenge,
                $publicKeyCredentialParametersList
            )
            -&gt;excludeCredentials($excludedPublicKeyDescriptors)
            -&gt;setAuthenticatorSelection($criteria)
            -&gt;setAttestation($attestationMode ?? PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_NONE)
            -&gt;setExtensions($extensions)
            -&gt;setTimeout($this-&gt;timeout)
        ;
    }

    /**
     * @param PublicKeyCredentialDescriptor[] $allowedPublicKeyDescriptors
     */
    public function generatePublicKeyCredentialRequestOptions(?string $userVerification = null, array $allowedPublicKeyDescriptors = [], ?AuthenticationExtensionsClientInputs $extensions = null): PublicKeyCredentialRequestOptions
    {
        return PublicKeyCredentialRequestOptions::create(random_bytes($this-&gt;challengeSize))
            -&gt;setRpId($this-&gt;rpEntity-&gt;getId())
            -&gt;setUserVerification($userVerification ?? PublicKeyCredentialRequestOptions::USER_VERIFICATION_REQUIREMENT_PREFERRED)
            -&gt;allowCredentials($allowedPublicKeyDescriptors)
            -&gt;setTimeout($this-&gt;timeout)
            -&gt;setExtensions($extensions ?? new AuthenticationExtensionsClientInputs())
        ;
    }

    public function loadAndCheckAttestationResponse(string $data, PublicKeyCredentialCreationOptions $publicKeyCredentialCreationOptions, ServerRequestInterface $serverRequest): PublicKeyCredentialSource
    {
        $attestationStatementSupportManager = $this-&gt;getAttestationStatementSupportManager();
        $attestationObjectLoader = AttestationObjectLoader::create($attestationStatementSupportManager)
            -&gt;setLogger($this-&gt;logger)
        ;
        $publicKeyCredentialLoader = PublicKeyCredentialLoader::create($attestationObjectLoader)
            -&gt;setLogger($this-&gt;logger)
        ;

        $publicKeyCredential = $publicKeyCredentialLoader-&gt;load($data);
        $authenticatorResponse = $publicKeyCredential-&gt;getResponse();
        Assertion::isInstanceOf($authenticatorResponse, AuthenticatorAttestationResponse::class, 'Not an authenticator attestation response');

        $authenticatorAttestationResponseValidator = new AuthenticatorAttestationResponseValidator(
            $attestationStatementSupportManager,
            $this-&gt;publicKeyCredentialSourceRepository,
            $this-&gt;tokenBindingHandler,
            $this-&gt;extensionOutputCheckerHandler,
            $this-&gt;metadataStatementRepository
        );
        $authenticatorAttestationResponseValidator-&gt;setLogger($this-&gt;logger);

        return $authenticatorAttestationResponseValidator-&gt;check($authenticatorResponse, $publicKeyCredentialCreationOptions, $serverRequest, $this-&gt;securedRelyingPartyId);
    }

    public function loadAndCheckAssertionResponse(string $data, PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions, ?PublicKeyCredentialUserEntity $userEntity, ServerRequestInterface $serverRequest): PublicKeyCredentialSource
    {
        $attestationStatementSupportManager = $this-&gt;getAttestationStatementSupportManager();
        $attestationObjectLoader = AttestationObjectLoader::create($attestationStatementSupportManager)
            -&gt;setLogger($this-&gt;logger)
        ;
        $publicKeyCredentialLoader = PublicKeyCredentialLoader::create($attestationObjectLoader)
            -&gt;setLogger($this-&gt;logger)
        ;

        $publicKeyCredential = $publicKeyCredentialLoader-&gt;load($data);
        $authenticatorResponse = $publicKeyCredential-&gt;getResponse();
        Assertion::isInstanceOf($authenticatorResponse, AuthenticatorAssertionResponse::class, 'Not an authenticator assertion response');

        $authenticatorAssertionResponseValidator = new AuthenticatorAssertionResponseValidator(
            $this-&gt;publicKeyCredentialSourceRepository,
            $this-&gt;tokenBindingHandler,
            $this-&gt;extensionOutputCheckerHandler,
            $this-&gt;coseAlgorithmManagerFactory-&gt;create($this-&gt;selectedAlgorithms),
            $this-&gt;counterChecker
        );
        $authenticatorAssertionResponseValidator-&gt;setLogger($this-&gt;logger);

        return $authenticatorAssertionResponseValidator-&gt;check(
            $publicKeyCredential-&gt;getRawId(),
            $authenticatorResponse,
            $publicKeyCredentialRequestOptions,
            $serverRequest,
            null !== $userEntity ? $userEntity-&gt;getId() : null,
            $this-&gt;securedRelyingPartyId
        );
    }

    public function setCounterChecker(CounterChecker $counterChecker): self
    {
        $this-&gt;counterChecker = $counterChecker;

        return $this;
    }

    public function setLogger(LoggerInterface $logger): self
    {
        $this-&gt;logger = $logger;

        return $this;
    }

    public function enforceAndroidSafetyNetVerification(ClientInterface $client, string $apiKey, RequestFactoryInterface $requestFactory): self
    {
        $this-&gt;httpClient = $client;
        $this-&gt;googleApiKey = $apiKey;
        $this-&gt;requestFactory = $requestFactory;

        return $this;
    }

    private function getAttestationStatementSupportManager(): AttestationStatementSupportManager
    {
        $attestationStatementSupportManager = new AttestationStatementSupportManager();
        $attestationStatementSupportManager-&gt;add(new NoneAttestationStatementSupport());
        $attestationStatementSupportManager-&gt;add(new FidoU2FAttestationStatementSupport());
        if (class_exists(RS256::class) &amp;&amp; class_exists(JWKFactory::class)) {
            $androidSafetyNetAttestationStatementSupport = new AndroidSafetyNetAttestationStatementSupport();
            if (null !== $this-&gt;httpClient &amp;&amp; null !== $this-&gt;googleApiKey &amp;&amp; null !== $this-&gt;requestFactory) {
                $androidSafetyNetAttestationStatementSupport
                    -&gt;enableApiVerification($this-&gt;httpClient, $this-&gt;googleApiKey, $this-&gt;requestFactory)
                    -&gt;setLeeway(2000)
                    -&gt;setMaxAge(60000)
                ;
            }
            $attestationStatementSupportManager-&gt;add($androidSafetyNetAttestationStatementSupport);
        }
        $attestationStatementSupportManager-&gt;add(new AndroidKeyAttestationStatementSupport());
        $attestationStatementSupportManager-&gt;add(new TPMAttestationStatementSupport());
        $coseAlgorithmManager = $this-&gt;coseAlgorithmManagerFactory-&gt;create($this-&gt;selectedAlgorithms);
        $attestationStatementSupportManager-&gt;add(new PackedAttestationStatementSupport($coseAlgorithmManager));

        return $attestationStatementSupportManager;
    }
}
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flocal%2Fcpanel%2Fbase%2F3rdparty%2FphpMyAdmin%2Fvendor%2Fweb-auth%2Fwebauthn-lib%2Fsrc'>Back to Directory</a>