eu-federation-gateway-service/efgs-federation-gateway

Insufficient TEK Data Validation

SchulzeStTSI opened this issue · 2 comments

The TEK Data Validation is in some places insufficent:

  1. Transmission Risklevel is checked for euqal to 0 and higher than 8. More better would be to check if TRL is in this range: (0<=TRL<=8) OR has Value 0x7FFFFFFF. ( (0>TRL or TRL>8) and not 0x7FFFFFFF )
  2. Key Length is not checked, but must be checked equal to 16.
  3. Rolling Period is just checked for 0, but not check for greater than 144
  4. Report Type "Unknown" is an valid enum value and should be removed as validation check.

Related Pullrequest: #169

Google Reference Server Validation Guide:

google/exposure-notifications-server#1041

This issue is partially fixed by #169 but some pieces missing, pls consult Steffen

closed because part of 1.0.1