nebius/SWE-rebench-V2-PRs huggingface dataset:
Repository: go-webauthn/webauthn
Pull request #8 (2022-03-01 05:35:12)

fix: potential index out of range panic
Co-authored-by: Zachary Huff <zach.huff.386@gmail.com>


Patch:
diff --git a/protocol/authenticator.go b/protocol/authenticator.go
index 395d47f..21f0852 100644
--- a/protocol/authenticator.go
+++ b/protocol/authenticator.go
@@ -8,7 +8,10 @@ import (
 	"github.com/go-webauthn/webauthn/protocol/webauthncbor"
 )
 
-var minAuthDataLength = 37
+var (
+	minAuthDataLength     = 37
+	minAttestedAuthLength = 55
+)
 
 // Authenticators respond to Relying Party requests by returning an object derived from the
 // AuthenticatorResponse interface. See §5.2. Authenticator Responses
@@ -159,8 +162,11 @@ func (a *AuthenticatorData) Unmarshal(rawAuthData []byte) error {
 	remaining := len(rawAuthData) - minAuthDataLength
 
 	if a.Flags.HasAttestedCredentialData() {
-		if len(rawAuthData) > minAuthDataLength {
-			a.unmarshalAttestedData(rawAuthData)
+		if len(rawAuthData) > minAttestedAuthLength {
+			validError := a.unmarshalAttestedData(rawAuthData)
+			if validError != nil {
+				return validError
+			}
 			attDataLen := len(a.AttData.AAGUID) + 2 + len(a.AttData.CredentialID) + len(a.AttData.CredentialPublicKey)
 			remaining = remaining - attDataLen
 		} else {
@@ -189,11 +195,15 @@ func (a *AuthenticatorData) Unmarshal(rawAuthData []byte) error {
 }
 
 // If Attestation Data is present, unmarshall that into the appropriate public key structure
-func (a *AuthenticatorData) unmarshalAttestedData(rawAuthData []byte) {
+func (a *AuthenticatorData) unmarshalAttestedData(rawAuthData []byte) error {
 	a.AttData.AAGUID = rawAuthData[37:53]
 	idLength := binary.BigEndian.Uint16(rawAuthData[53:55])
+	if len(rawAuthData) < int(55+idLength) {
+		return ErrBadRequest.WithDetails("Authenticator attestation data length too short")
+	}
 	a.AttData.CredentialID = rawAuthData[55 : 55+idLength]
 	a.AttData.CredentialPublicKey = unmarshalCredentialPublicKey(rawAuthData[55+idLength:])
+	return nil
 }
 
 // Unmarshall the credential's Public Key into CBOR encoding


Test patch:
diff --git a/protocol/authenticator_test.go b/protocol/authenticator_test.go
index 135b40b..032e37b 100644
--- a/protocol/authenticator_test.go
+++ b/protocol/authenticator_test.go
@@ -184,9 +184,10 @@ func TestAuthenticatorData_unmarshalAttestedData(t *testing.T) {
 		rawAuthData []byte
 	}
 	tests := []struct {
-		name   string
-		fields fields
-		args   args
+		name    string
+		fields  fields
+		args    args
+		wantErr bool
 	}{
 		// TODO: Add test cases.
 	}
@@ -199,7 +200,9 @@ func TestAuthenticatorData_unmarshalAttestedData(t *testing.T) {
 				AttData:  tt.fields.AttData,
 				ExtData:  tt.fields.ExtData,
 			}
-			a.unmarshalAttestedData(tt.args.rawAuthData)
+			if err := a.unmarshalAttestedData(tt.args.rawAuthData); (err != nil) != tt.wantErr {
+				t.Errorf("AuthenticatorData.unmarshalAttestedData() error = %v, wantErr %v", err, tt.wantErr)
+			}
 		})
 	}
 }
Repository: go-webauthn/webauthn
Pull request #152 (2023-07-07 11:59:11)

feat: migrate to jwt v5
Hi,

I did the migration do jwtv5 there wasn't much to do as the repo doesn't use methods that have been refactored

Have a look at https://github.com/golang-jwt/jwt/releases/tag/v5.0.0 if you want more details on the changes

Thanks

CoreFloDev: I did the required changes for the DCO, it doesn't seems to work I don't get why. Anyway, this PR should close https://github.com/go-webauthn/webauthn/pull/136 as well
CoreFloDev: Nice! I don't have merge right so I let you do it :smile: 

Patch:
diff --git a/go.mod b/go.mod
index 82a810e..7192d05 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,7 @@ go 1.20
 require (
 	github.com/fxamacker/cbor/v2 v2.4.0
 	github.com/go-webauthn/x v0.1.4
-	github.com/golang-jwt/jwt/v4 v4.5.0
+	github.com/golang-jwt/jwt/v5 v5.0.0
 	github.com/google/go-tpm v0.9.0
 	github.com/google/uuid v1.3.0
 	github.com/mitchellh/mapstructure v1.5.0
diff --git a/go.sum b/go.sum
index 9aa403b..8f598ad 100644
--- a/go.sum
+++ b/go.sum
@@ -8,6 +8,8 @@ github.com/go-webauthn/x v0.1.4 h1:sGmIFhcY70l6k7JIDfnjVBiAAFEssga5lXIUXe0GtAs=
 github.com/go-webauthn/x v0.1.4/go.mod h1:75Ug0oK6KYpANh5hDOanfDI+dvPWHk788naJVG/37H8=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
+github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/google/go-tpm v0.9.0 h1:sQF6YqWMi+SCXpsmS3fd21oPy/vSddwZry4JnmltHVk=
 github.com/google/go-tpm v0.9.0/go.mod h1:FkNVkc6C+IsvDI9Jw1OveJmxGZUUaKxtrpOS47QWKfU=
 github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
diff --git a/metadata/metadata.go b/metadata/metadata.go
index f0701ad..af0a495 100644
--- a/metadata/metadata.go
+++ b/metadata/metadata.go
@@ -9,7 +9,7 @@ import (
 	"reflect"
 	"time"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/google/uuid"
 	"github.com/mitchellh/mapstructure"
 


Test patch:
diff --git a/protocol/attestation_safetynet.go b/protocol/attestation_safetynet.go
index e63ba3e..8e94ad1 100644
--- a/protocol/attestation_safetynet.go
+++ b/protocol/attestation_safetynet.go
@@ -8,7 +8,7 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/golang-jwt/jwt/v4"
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/mitchellh/mapstructure"
 
 	"github.com/go-webauthn/webauthn/metadata"
Repository: go-webauthn/webauthn
Pull request #418 (2025-05-08 10:25:24)

feat(protocol): cable transport
This adds a remapping for the cable transport which has been observed in the wild, even though it has not been ratified and only exited for a short while before it was renamed.


Patch:
diff --git a/protocol/const.go b/protocol/const.go
index a1560f2..210f82b 100644
--- a/protocol/const.go
+++ b/protocol/const.go
@@ -9,3 +9,13 @@ const (
 	stmtCertInfo  = "certInfo"
 	stmtPubArea   = "pubArea"
 )
+
+var (
+	// internalRemappedAuthenticatorTransport handles remapping of AuthenticatorTransport values. Specifically it is
+	// intentional on remapping only transports that never made recommendation but are being used in the wild. It
+	// should not be used to handle transports that were ratified.
+	internalRemappedAuthenticatorTransport = map[string]AuthenticatorTransport{
+		// The Authenticator Transport 'hybrid' was previously named 'cable'; even if it was for a short period.
+		"cable": Hybrid,
+	}
+)


Test patch:
diff --git a/protocol/attestation.go b/protocol/attestation.go
index 11d9ce8..2d7d3af 100644
--- a/protocol/attestation.go
+++ b/protocol/attestation.go
@@ -114,7 +114,11 @@ func (ccr *AuthenticatorAttestationResponse) Parse() (p *ParsedAttestationRespon
 	}
 
 	for _, t := range ccr.Transports {
-		p.Transports = append(p.Transports, AuthenticatorTransport(t))
+		if transport, ok := internalRemappedAuthenticatorTransport[t]; ok {
+			p.Transports = append(p.Transports, transport)
+		} else {
+			p.Transports = append(p.Transports, AuthenticatorTransport(t))
+		}
 	}
 
 	return p, nil