8000 fix: reject fragment-only key lookup for foreign DID URLs in getWalletKeyId by murat-affinidi · Pull Request #267 · affinidi/affinidi-ssi-dart · GitHub
[go: up one dir, main page]
Skip to content

fix: reject fragment-only key lookup for foreign DID URLs in getWalletKeyId - #267

Open
murat-affinidi wants to merge 1 commit into
mainfrom
fix/foreign-did-fragment-lookup
Open

fix: reject fragment-only key lookup for foreign DID URLs in getWalletKeyId#267
murat-affinidi wants to merge 1 commit into
mainfrom
fix/foreign-did-fragment-lookup

Conversation

@murat-affinidi
@murat-affinidi murat-affinidi commented Mar 18, 2026
Copy link
Copy Markdown

Summary

  • Guard fragment-only fallback in DidManager.getWalletKeyId() with a DID ownership check
  • When the input is a fully qualified DID URL whose base doesn't match the manager's own DID, return null instead of falling
    back to fragment matching

Context

Defense-in-depth fix for the recipient DID confusion vulnerability. The didcomm layer already blocks the attack (see
affinidi/affinidi-didcomm-dart#83), but the underlying ssi getWalletKeyId() method still allowed
did:example:mallory#key-2 to resolve to a local #key-2 wallet key. This hardens the ssi layer so any consumer is protected.

Test plan

  • Full ssi test suite passes (943 tests, zero regressions)
  • Companion didcomm PR confirms the attack is blocked end-to-end

@murat-affinidi
fix: reject fragment-only key lookup for foreign DID URLs in getWalle…
3bce32c 
…tKeyId

  Prevent a fully qualified foreign DID URL (e.g. did:example:mallory#key-2)
  from resolving to a local wallet key via fragment-only matching. The
  fragment fallback now requires the DID base to match the manager's own DID.
@murat-affinidi
murat-affinidi requested a review from a team as a code owner March 18, 2026 14:00
@github-actions
github-actions Bot commented Mar 18, 2026
Copy link
Copy Markdown

Coverage after merging fix/foreign-did-fragment-lookup into main will be

79.15%

Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
lib/src
   types.dart70.83%100%100%70.83%122, 159–160, 172, 174, 189, 244
   digest_utils.dart100%100%100%100%
   utility.dart100%100%100%100%
lib/src/credentials/jwt
   jwt_data_model_v1.dart100%100%100%100%
   jwt_dm_v1_suite.dart86.27%100%100%86.27%100, 102, 39, 41, 59, 74, 76
lib/src/credentials/linked_data
   ld_base_suite.dart93.44%100%100%93.44%120, 122, 168, 171
   ld_dm_v1_suite.dart100%100%100%100%
   ld_dm_v2_suite.dart100%100%100%100%
lib/src/credentials/models
   sdjwt_signer_adapter.dart100%100%100%100%
lib/src/credentials/models/field_types
   issuer.dart100%100%100%100%
   context.dart85.96%100%100%85.96%171, 173, 206–211
   credential_schema.dart100%100%100%100%
   credential_subject.dart72.97%100%100%72.97%38, 55, 57–58, 61, 64–65, 70–71, 94
   evidence.dart76.47%100%100%76.47%50–52, 54
   holder.dart100%100%100%100%
   terms_of_use.dart75%100%100%75%46–48, 50
lib/src/credentials/models/field_types/credential_status
   revocation_list_2020.dart20.90%100%100%20.90%101–104, 107, 110–112, 114–116, 118–120, 122–124, 14, 171, 173, 175–182, 22–27, 65, 68–75, 81, 84–85, 87–88, 90–91, 93–94, 99
   v1.dart72.73%100%100%72.73%60–61, 71, 73–76, 78, 82–83, 88–89
   v2.dart72.73%100%100%72.73%59–60, 70, 72–75, 77, 81–82, 87–88
lib/src/credentials/models/field_types/refresh_service
   v1.dart76.47%100%100%76.47%46–48, 50
   v2.dart18.18%100%100%18.18%35–36, 38, 55–56, 61, 66–67, 69
lib/src/credentials/models/v1
   mutable_vc_data_model_v1.dart88.14%100%100%88.14%154, 202–203, 209–210, 216, 222
   vc_data_model_v1.dart91.27%100%100%91.27%160, 162–163, 187–189, 212–215, 218
lib/src/credentials/models/v2
   mutable_vc_data_model_v2.dart84.75%100%100%84.75%179, 185–186, 196–197, 204–205, 211, 217
   vc_data_model_v2.dart90.76%100%100%90.76%165–167, 190–193, 196, 316, 322, 326
lib/src/credentials/parsers
   jwt_parser.dart88.89%100%100%88.89%51, 53
   ld_parser.dart85.71%100%100%85.71%26
   sdjwt_parser.dart70%100%100%70%40, 56, 58
lib/src/credentials/presentations/linked_data
   ld_vp_dm_v1_suite.dart100%100%100%100%
   ld_vp_dm_v2_suite.dart100%100%100%100%
lib/src/credentials/presentations/models
   vc_parse_present.dart57.14%100%100%57.14%101, 104, 109–110, 35–37, 62–64, 88–89, 92–97
lib/src/credentials/presentations/models/v1
   mutable_vp_data_model_v1.dart48.15%100%100%48.15%102, 75, 81–82, 84–86, 88, 90, 92, 94–95, 98–99
   vp_data_model_v1.dart88.52%100%100%88.52%111, 113, 138, 143, 84, 86–87
lib/src/credentials/presentations/models/v2
   vp_data_model_v2.dart88.06%100%100%88.06%116, 118, 142, 147, 205, 89, 91–92
   mutable_vp_data_model_v2.dart46.88%100%100%46.88%101–102, 105–106, 109, 111–112, 115, 81, 87–88, 90, 92–93, 95, 97, 99
lib/src/credentials/presentations/suites
   universal_presentation_parser.dart42.86%100%100%42.86%21–22, 24–25
   universal_presentation_verifier.dart90.63%100%100%90.63%106–108
   vp_suites.dart61.54%100%100%61.54%31, 33, 53–55
lib/src/credentials/presentations/verification
   delegation_vc_verifier.dart100%100%100%100%
   holder_binding_verifier.dart94.87%100%100%94.87%64–65
   vp_expiry_verifier.dart100%100%100%100%
   vp_integrity_verifier.dart100%100%100%100%
   vp_domain_challenge_verifier.dart75%100%100%75%36, 53–54, 62–63
lib/src/credentials/proof
   data_integrity_ecdsa_suite.dart77.98%100%100%77.98%143, 152, 155, 158, 161, 164, 171, 174, 181, 268, 272, 274–275, 350, 355, 384, 386, 404, 408, 410–411, 52, 54–55
   data_integrity_eddsa_suite.dart80%100%100%80%137, 146, 149, 152, 155, 158, 165, 168, 175, 181, 49, 51–52
   ecdsa_secp256k1_signature2019_suite.dart75%100%100%75%125, 130–131, 133, 135–136, 138, 140–141, 143, 145–146, 148, 152–153, 155, 158, 76, 78, 81
   embedded_proof_suite.dart100%100%100%100%
   jcs_utils.dart49.06%100%100%49.06%17, 193, 196, 199–202, 221, 225, 229, 240–241, 249, 252, 42, 44–45, 53, 55, 61, 64, 72–73, 75, 79, 81, 84
   embedded_proof.dart75%100%100%75%107–108, 110, 117, 158–159, 165–167, 169, 183, 191, 197, 199, 91, 96–97
   base_data_integrity_verifier.dart63.50%100%100%63.50%101–102, 116–119, 123–127, 154–159, 183–184, 211, 213, 215–216, 219, 222–223, 227–228, 302, 304–305, 339, 344–345, 347, 349–350, 352, 354–355, 357, 359–360, 362, 365–366, 368, 371, 87–88
   proof_validation_utils.dart100%100%100%100%
   base_jcs_generator.dart100%100%100%100%
   data_integrity_context_util.dart60%100%100%60%14, 23, 25, 31, 35, 37
   base_jcs_verifier.dart72.73%100%100%72.73%101, 103–104, 115, 117–118, 153–154, 184–187, 189,

reza-maghoul-affinidi
reza-maghoul-affinidi approved these changes Mar 18, 2026
View reviewed changes
@reza-maghoul-affinidi reza-maghoul-affinidi left a comment
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@reza-maghoul-affinidi reza-maghoul-affinidi reza-maghoul-affinidi approved these changes

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@murat-affinidi @reza-maghoul-affinidi
0