Skip to content

Commit f7088d7

Browse files
jumaallanjumaallan
authored
Fix Insecure Object Serialization (#456)
* fix unsecure object serialization * updated CHANGELOG.md * updated CHANGELOG.md
1 parent eda7582 commit f7088d7

File tree

8 files changed

+79
-25
lines changed

8 files changed

+79
-25
lines changed

‎CHANGELOG.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
# Release Notes
22

3+
## 10.3.1
4+
5+
* Fix insecure object serialization on fragments
6+
37
## 10.3.0
48

5-
* Changed initialize() to return a deferred result (allow partners to handle errors)
9+
* Changed `initialize()` to return a deferred result (allow partners to handle errors)
610
* Update to Compose Fragment and remove ComposeView
711

812
## 10.2.7

‎lib/src/main/java/com/smileidentity/SmileID.kt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import com.smileidentity.models.UploadRequest
2020
import com.smileidentity.networking.BiometricKycJobResultAdapter
2121
import com.smileidentity.networking.DocumentVerificationJobResultAdapter
2222
import com.smileidentity.networking.EnhancedDocumentVerificationJobResultAdapter
23+
import com.smileidentity.networking.FileAdapter
2324
import com.smileidentity.networking.FileNameAdapter
2425
import com.smileidentity.networking.GzipRequestInterceptor
2526
import com.smileidentity.networking.JobResultAdapter
@@ -496,6 +497,7 @@ object SmileID {
496497
.add(StringifiedBooleanAdapter)
497498
.add(MetadataAdapter)
498499
.add(FileNameAdapter)
500+
.add(FileAdapter)
499501
.add(SmartSelfieJobResultAdapter)
500502
.add(DocumentVerificationJobResultAdapter)
501503
.add(BiometricKycJobResultAdapter)

‎lib/src/main/java/com/smileidentity/fragment/BiometricKYCFragment.kt

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ import com.smileidentity.models.IdInfo
2020
import com.smileidentity.results.BiometricKycResult
2121
import com.smileidentity.results.SmileIDResult
2222
import com.smileidentity.util.getParcelableCompat
23-
import com.smileidentity.util.getSerializableCompat
2423
import com.smileidentity.util.randomJobId
2524
import com.smileidentity.util.randomUserId
25+
import com.squareup.moshi.Types
2626
import kotlinx.collections.immutable.toImmutableMap
2727

2828
/**
@@ -125,6 +125,8 @@ class BiometricKYCFragment : Fragment() {
125125
}
126126
}
127127

128+
private val moshi = SmileID.moshi
129+
128130
private const val KEY_ID_INFO = "idInfo"
129131
private var Bundle.idInfo: IdInfo
130132
get() = getParcelableCompat(KEY_ID_INFO)!!
@@ -161,9 +163,15 @@ private var Bundle.showInstructions: Boolean
161163
set(value) = putBoolean(KEY_SHOW_INSTRUCTIONS, value)
162164

163165
private const val KEY_EXTRA_PARTNER_PARAMS = "extraPartnerParams"
164-
private var Bundle.extraPartnerParams: HashMap<String, String>?
165-
get() = getSerializableCompat(KEY_EXTRA_PARTNER_PARAMS)
166-
set(value) = putSerializable(KEY_EXTRA_PARTNER_PARAMS, value)
166+
private val type = Types.newParameterizedType(
167+
Map::class.java,
168+
String::class.java,
169+
String::class.java,
170+
)
171+
private val adapter = moshi.adapter<Map<String, String>>(type)
172+
private var Bundle.extraPartnerParams: Map<String, String>?
173+
get() = getString(KEY_EXTRA_PARTNER_PARAMS)?.let { adapter.fromJson(it) }
174+
set(value) = putString(KEY_EXTRA_PARTNER_PARAMS, value?.let { adapter.toJson(it) })
167175

168176
private var Bundle.smileIDResult: SmileIDResult<BiometricKycResult>
169177
get() = getParcelableCompat(KEY_RESULT)!!

‎lib/src/main/java/com/smileidentity/fragment/DocumentVerificationFragment.kt

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ import com.smileidentity.fragment.SmartSelfieEnrollmentFragment.Companion.result
1919
import com.smileidentity.results.DocumentVerificationResult
2020
import com.smileidentity.results.SmileIDResult
2121
import com.smileidentity.util.getParcelableCompat
22-
import com.smileidentity.util.getSerializableCompat
2322
import com.smileidentity.util.randomJobId
2423
import com.smileidentity.util.randomUserId
24+
import com.squareup.moshi.Types
2525
import java.io.File
2626
import kotlinx.collections.immutable.toImmutableMap
2727

@@ -138,6 +138,8 @@ class DocumentVerificationFragment : Fragment() {
138138
}
139139
}
140140

141+
private val moshi = SmileID.moshi
142+
141143
private const val KEY_USER_ID = "userId"
142144
private var Bundle.userId: String
143145
get() = getString(KEY_USER_ID)!!
@@ -197,14 +199,21 @@ private var Bundle.captureBothSides: Boolean
197199
set(value) = putBoolean(KEY_CAPTURE_BOTH_SIDES, value)
198200

199201
private const val KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE = "bypassSelfieCaptureWithFile"
202+
private val fileAdapter = moshi.adapter(File::class.java)
200203
private var Bundle.bypassSelfieCaptureWithFile: File?
201-
get() = getSerializableCompat(KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE) as File?
202-
set(value) = putSerializable(KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE, value)
204+
get() = getString(KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE)?.let { fileAdapter.fromJson(it) }
205+
set(value) = putString(KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE, fileAdapter.toJson(value))
203206

204207
private const val KEY_EXTRA_PARTNER_PARAMS = "extraPartnerParams"
205-
private var Bundle.extraPartnerParams: HashMap<String, String>?
206-
get() = getSerializableCompat(KEY_EXTRA_PARTNER_PARAMS)
207-
set(value) = putSerializable(KEY_EXTRA_PARTNER_PARAMS, value)
208+
private val type = Types.newParameterizedType(
209+
Map::class.java,
210+
String::class.java,
211+
String::class.java,
212+
)
213+
private val adapter = moshi.adapter<Map<String, String>>(type)
214+
private var Bundle.extraPartnerParams: Map<String, String>?
215+
get() = getString(KEY_EXTRA_PARTNER_PARAMS)?.let { adapter.fromJson(it) }
216+
set(value) = putString(KEY_EXTRA_PARTNER_PARAMS, value?.let { adapter.toJson(it) })
208217

209218
private var Bundle.smileIDResult: SmileIDResult<DocumentVerificationResult>
210219
get() = getParcelableCompat(KEY_RESULT)!!

‎lib/src/main/java/com/smileidentity/fragment/EnhancedDocumentVerificationFragment.kt

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ import com.smileidentity.fragment.SmartSelfieEnrollmentFragment.Companion.result
1717
import com.smileidentity.results.EnhancedDocumentVerificationResult
1818
import com.smileidentity.results.SmileIDResult
1919
import com.smileidentity.util.getParcelableCompat
20-
import com.smileidentity.util.getSerializableCompat
2120
import com.smileidentity.util.randomJobId
2221
import com.smileidentity.util.randomUserId
22+
import com.squareup.moshi.Types
2323
import java.io.File
2424
import kotlinx.collections.immutable.toImmutableMap
2525

@@ -136,6 +136,8 @@ class EnhancedDocumentVerificationFragment : Fragment() {
136136
}
137137
}
138138

139+
private val moshi = SmileID.moshi
140+
139141
private const val KEY_USER_ID = "userId"
140142
private var Bundle.userId: String
141143
get() = getString(KEY_USER_ID)!!
@@ -190,9 +192,10 @@ private var Bundle.idAspectRatio: Float
190192
set(value) = putFloat(KEY_ID_ASPECT_RATIO, value)
191193

192194
private const val KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE = "bypassSelfieCaptureWithFile"
195+
private val fileAdapter = moshi.adapter(File::class.java)
193196
private var Bundle.bypassSelfieCaptureWithFile: File?
194-
get() = getSerializableCompat(KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE) as File?
195-
set(value) = putSerializable(KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE, value)
197+
get() = getString(KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE)?.let { fileAdapter.fromJson(it) }
198+
set(value) = putString(KEY_BYPASS_SELFIE_CAPTURE_WITH_FILE, fileAdapter.toJson(value))
196199

197200
private const val KEY_CAPTURE_BOTH_SIDES = "captureBothSides"
198201

@@ -201,9 +204,15 @@ private var Bundle.captureBothSides: Boolean
201204
set(value) = putBoolean(KEY_CAPTURE_BOTH_SIDES, value)
202205

203206
private const val KEY_EXTRA_PARTNER_PARAMS = "extraPartnerParams"
204-
private var Bundle.extraPartnerParams: HashMap<String, String>?
205-
get() = getSerializableCompat(KEY_EXTRA_PARTNER_PARAMS)
206-
set(value) = putSerializable(KEY_EXTRA_PARTNER_PARAMS, value)
207+
private val type = Types.newParameterizedType(
208+
Map::class.java,
209+
String::class.java,
210+
String::class.java,
211+
)
212+
private val adapter = moshi.adapter<Map<String, String>>(type)
213+
private var Bundle.extraPartnerParams: Map<String, String>?
214+
get() = getString(KEY_EXTRA_PARTNER_PARAMS)?.let { adapter.fromJson(it) }
215+
set(value) = putString(KEY_EXTRA_PARTNER_PARAMS, value?.let { adapter.toJson(it) })
207216

208217
private var Bundle.smileIDResult: SmileIDResult<EnhancedDocumentVerificationResult>
209218
get() = getParcelableCompat(DocumentVerificationFragment.KEY_RESULT)!!

‎lib/src/main/java/com/smileidentity/fragment/SmartSelfieAuthenticationFragment.kt

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ import com.smileidentity.fragment.SmartSelfieEnrollmentFragment.Companion.result
1717
import com.smileidentity.results.SmartSelfieResult
1818
import com.smileidentity.results.SmileIDResult
1919
import com.smileidentity.util.getParcelableCompat
20-
import com.smileidentity.util.getSerializableCompat
2120
import com.smileidentity.util.randomJobId
2221
import com.smileidentity.util.randomUserId
22+
import com.squareup.moshi.Types
2323
import kotlinx.collections.immutable.toImmutableMap
2424

2525
/**
@@ -131,6 +131,8 @@ class SmartSelfieAuthenticationFragment : Fragment() {
131131
}
132132
}
133133

134+
private val moshi = SmileID.moshi
135+
134136
private const val KEY_ALLOW_AGENT_MODE = "allowAgentMode"
135137
private var Bundle.allowAgentMode: Boolean
136138
get() = getBoolean(KEY_ALLOW_AGENT_MODE)
@@ -162,9 +164,15 @@ private var Bundle.showInstructions: Boolean
162164
set(value) = putBoolean(KEY_SHOW_INSTRUCTIONS, value)
163165

164166
private const val KEY_EXTRA_PARTNER_PARAMS = "extraPartnerParams"
165-
private var Bundle.extraPartnerParams: HashMap<String, String>?
166-
get() = getSerializableCompat(KEY_EXTRA_PARTNER_PARAMS)
167-
set(value) = putSerializable(KEY_EXTRA_PARTNER_PARAMS, value)
167+
private val type = Types.newParameterizedType(
168+
Map::class.java,
169+
String::class.java,
170+
String::class.java,
171+
)
172+
private val adapter = moshi.adapter<Map<String, String>>(type)
173+
private var Bundle.extraPartnerParams: Map<String, String>?
174+
get() = getString(KEY_EXTRA_PARTNER_PARAMS)?.let { adapter.fromJson(it) }
175+
set(value) = putString(KEY_EXTRA_PARTNER_PARAMS, value?.let { adapter.toJson(it) })
168176

169177
private var Bundle.smileIdResult: SmileIDResult<SmartSelfieResult>
170178
get() = getParcelableCompat(KEY_RESULT)!!

‎lib/src/main/java/com/smileidentity/fragment/SmartSelfieEnrollmentFragment.kt

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ import com.smileidentity.fragment.SmartSelfieEnrollmentFragment.Companion.result
1515
import com.smileidentity.results.SmartSelfieResult
1616
import com.smileidentity.results.SmileIDResult
1717
import com.smileidentity.util.getParcelableCompat
18-
import com.smileidentity.util.getSerializableCompat
1918
import com.smileidentity.util.randomJobId
2019
import com.smileidentity.util.randomUserId
20+
import com.squareup.moshi.Types
2121
import kotlinx.collections.immutable.toImmutableMap
2222

2323
/**
@@ -128,6 +128,8 @@ class SmartSelfieEnrollmentFragment : Fragment() {
128128
}
129129
}
130130

131+
private val moshi = SmileID.moshi
132+
131133
private const val KEY_ALLOW_AGENT_MODE = "allowAgentMode"
132134
private var Bundle.allowAgentMode: Boolean
133135
get() = getBoolean(KEY_ALLOW_AGENT_MODE)
@@ -159,9 +161,12 @@ private var Bundle.showInstructions: Boolean
159161
set(value) = putBoolean(KEY_SHOW_INSTRUCTIONS, value)
160162

161163
private const val KEY_EXTRA_PARTNER_PARAMS = "extraPartnerParams"
162-
private var Bundle.extraPartnerParams: HashMap<String, String>?
163-
get() = getSerializableCompat(KEY_EXTRA_PARTNER_PARAMS)
164-
set(value) = putSerializable(KEY_EXTRA_PARTNER_PARAMS, value)
164+
private val type =
165+
Types.newParameterizedType(Map::class.java, String::class.java, String::class.java)
166+
private val adapter = moshi.adapter<Map<String, String>>(type)
167+
private var Bundle.extraPartnerParams: Map<String, String>?
168+
get() = getString(KEY_EXTRA_PARTNER_PARAMS)?.let { adapter.fromJson(it) }
169+
set(value) = putString(KEY_EXTRA_PARTNER_PARAMS, value?.let { adapter.toJson(it) })
165170

166171
private var Bundle.smileIdResult: SmileIDResult<SmartSelfieResult>
167172
get() = getParcelableCompat(KEY_RESULT)!!

‎lib/src/main/java/com/smileidentity/networking/Retrofit.kt

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,15 @@ object FileNameAdapter {
118118
fun fromJson(fileName: String): File = File(fileName)
119119
}
120120

121+
@Suppress("unused")
122+
object FileAdapter {
123+
@ToJson
124+
fun toJson(file: File): String = file.absolutePath
125+
126+
@FromJson
127+
fun fromJson(path: String): File = File(path)
128+
}
129+
121130
@Suppress("unused")
122131
object JobResultAdapter {
123132
@FromJson

0 commit comments

Comments
 (0)