Parsing AuthenticatorData Failure With Extensions

[felix-gohla]

When parsing the AuthenticatorData from an attestation, the library does not consider data from extensions.
The format of the attestation object can be found here: https://www.w3.org/TR/webauthn/#sctn-attestation

Currently, everything after the credential_id is considered the public key, like can be seen here:

py_webauthn/webauthn/helpers/parse_authenticator_data.py

Line 56 in 78a6019

# The remainder of the bytes will be the credential public key

However, this is not true for authenticators returning extension data, which ends up being parsed as a public key.
For example the following authData (hex-encoded):

50569158be61d7a1ba084f80e45e938fd326e0a8dff07b37036e6c82303ae26bc1000004377b3024675546afcb92e4495c8a1e193f00dca30058b8d74f6bd74de90baeb34afb51e3578e1ac4ca9f79a7f88473d8254d5762ca82d68f3bf63f49e9b284caab4d45d6f9bb468d0c1b7f0f727378c1db8adb4802cb7c5ad9c5eb905bf0ba03f79bd1f04d63765452d49c4087acfad340516dc892eafd87d498ae9e6fd6f06a3f423108ebdc032d93e82fdd6deacc1b638fd56838a482f01232ad01e266e016a50b8121816997a167f41139900fe46094b8ef30aad14ee08cc457366a033bb4a0554dcf9c9589f9622d4f84481541014c870291c87d7a3bbe3d8b07eb02509de5721e3f728aa5eac41e9c5af02869a4010103272006215820e613b86a8d4ebae24e84a0270b6773f7bb30d1d59f5ec379910ebe7c87714274a16b6372656450726f7465637401

leads to the following (wrong) public key (it contains the word credProtect, which certainly does not belong into the public key):

a4010103272006215820e613b86a8d4ebae24e84a0270b6773f7bb30d1d59f5ec379910ebe7c87714274a16b6372656450726f7465637401

To resolve this problem, one could parse the bytes from the public key (encoded with COSE) and determine the length. After removing that bytes that form the public key, the rest, as per standard, must be the extension data.

If you're fine with it, I would create a PR, as I already implemented a fix. However, I don't know if the approach mentioned above is the best one.

[MasterKale]

@felix-gohla Thank you for creating this issue, and for providing examples of authenticator data. I created PR #125 to improve parse_authenticator_data() so it correctly parses the public key even when extension data is present. I'll merge that in a bit and then cut a release, and let you know when it's up on PyPI to hopefully fix this for good.

[felix-gohla]

Nice! Thank you very very much. 😊

[MasterKale]

@felix-gohla This fix is now available in webauthn==1.5.0 on PyPI 🚀

[felix-gohla]

So cool, thank you very much for your work! 🌟