peach-android / 0413521f37b3

fix: bind passkey ceremonies to the verified caller, fail-closed origin (v2.10.16) Security scan findings F1 (medium) + F2 (low), slice 1 of the verified-fix queue (checkpoint pre-security-fixes). - New PasskeyCallerOrigin: caller origin = privileged-browser web origin (Google allowlist bundled at res/raw/passkey_privileged_apps) else the WebAuthn L3 apk-key-hash origin from the caller's signing cert; unknown callers fail closed - PasskeyData.callerOrigin records the registration binding (legacy=null) - Get gate: web callers pass the rpId registrable-domain check unless the credential is bound to a native app; native callers get only their exact bound credentials; legacy credentials never go to native callers - Deleted originFromRpId synthesis in registration + assertion: clientDataJSON now carries only the verified origin; registration rejects web origins outside the rpId domain; selection activity stops trusting request.origin - Tests: PasskeyCallerOriginTest (6) + binding/fail-closed cases across the registration/assertion/planner suites. Full suite 912, only the 5 known pre-existing failures

dev · 3 weeks ago · 2026-08-03 · 5.9 MB

parent: 4daffdfa346f