Validate client credential shape before decoding

lib/webauthn/authenticator_assertion_response.rb

@@ -11,6 +11,7 @@ class SignCountVerificationError < VerificationError; end
 
   class AuthenticatorAssertionResponse < AuthenticatorResponse
     def self.from_client(response, relying_party: WebAuthn.configuration.relying_party)
+      validate_client_response!(response, %w[authenticatorData clientDataJSON signature])
       encoder = relying_party.encoder
 
       user_handle =

lib/webauthn/authenticator_attestation_response.rb

@@ -18,6 +18,7 @@ class AuthenticatorAttestationResponse < AuthenticatorResponse
     extend Forwardable
 
     def self.from_client(response, relying_party: WebAuthn.configuration.relying_party)
+      validate_client_response!(response, %w[attestationObject clientDataJSON])
       encoder = relying_party.encoder
 
       new(

lib/webauthn/authenticator_response.rb

@@ -20,6 +20,12 @@ class UserPresenceVerificationError < VerificationError; end
   class UserVerifiedVerificationError < VerificationError; end
 
   class AuthenticatorResponse
+    def self.validate_client_response!(response, required_fields)
+      unless response.is_a?(Hash) && required_fields.all? { |field| response[field].respond_to?(:to_str) }
+        raise CredentialFormatError, "Credential response must contain string-like #{required_fields.join(', ')} fields"
+      end
+    end
+
     def initialize(client_data_json:, relying_party: WebAuthn.configuration.relying_party)
       @client_data_json = client_data_json
       @relying_party = relying_party

lib/webauthn/error.rb

@@ -2,4 +2,5 @@
 
 module WebAuthn
   class Error < StandardError; end
+  class CredentialFormatError < Error; end
 end

lib/webauthn/public_key_credential.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "webauthn/encoder"
+require "webauthn/error"
 
 module WebAuthn
   class PublicKeyCredential
@@ -9,6 +10,11 @@ class InvalidChallengeError < Error; end
     attr_reader :type, :id, :raw_id, :client_extension_outputs, :authenticator_attachment, :response
 
     def self.from_client(credential, relying_party: WebAuthn.configuration.relying_party)
+      unless credential.is_a?(Hash) && %w[type id rawId].all? { |field| credential[field].respond_to?(:to_str) } &&
+             credential["response"].is_a?(Hash)
+        raise CredentialFormatError, "Credential must contain string-like type, id, rawId and an object response"
+      end
+
       new(
         type: credential["type"],
         id: credential["id"],