diff --git a/ts/textsecure/cds/LegacyCDS.ts b/ts/textsecure/cds/LegacyCDS.ts index 0a87987ab3..cec988a938 100644 --- a/ts/textsecure/cds/LegacyCDS.ts +++ b/ts/textsecure/cds/LegacyCDS.ts @@ -420,6 +420,8 @@ export class LegacyCDS extends CDSBase { } } +const ALLOWED_ADVISORIES = new Set(['INTEL-SA-00334', 'INTEL-SA-00615']); + function validateAttestationSignatureBody( signatureBody: { timestamp: string; @@ -445,12 +447,12 @@ function validateAttestationSignatureBody( if (signatureBody.isvEnclaveQuoteStatus !== 'SW_HARDENING_NEEDED') { throw new Error('Attestation signature status not "SW_HARDENING_NEEDED"!'); } - if ( - signatureBody.advisoryIDs.length !== 1 || - signatureBody.advisoryIDs[0] !== 'INTEL-SA-00334' - ) { + if (!signatureBody.advisoryIDs.every(id => ALLOWED_ADVISORIES.has(id))) { throw new Error('Attestation advisory ids are incorrect'); } + if (signatureBody.advisoryIDs.length > ALLOWED_ADVISORIES.size) { + throw new Error('Attestation advisory count is incorrect'); + } if (signatureTime < now - 24 * 60 * 60 * 1000) { throw new Error('Attestation signature timestamp older than 24 hours!'); }