Fix name validation (EXPOSUREAPP-7569) (#3377)

* check non-null

* fix full name composition

* fix test

* check dose number > 0

Co-authored-by: BMItter <Berndus@gmx.de>

Corona-Warn-App/src/main/java/de/rki/coronawarnapp/vaccination/core/VaccinatedPerson.kt

@@ -23,17 +23,8 @@ data class VaccinatedPerson(
     val vaccineName: String
         get() = vaccinationCertificates.first().vaccineTypeName
 
-    val firstName: String?
-        get() = vaccinationCertificates.first().firstName
-
-    val lastName: String
-        get() = vaccinationCertificates.first().lastName
-
     val fullName: String
-        get() = when {
-            firstName == null -> lastName
-            else -> "$firstName $lastName"
-        }
+        get() = vaccinationCertificates.first().fullName
 
     val dateOfBirth: LocalDate
         get() = vaccinationCertificates.first().dateOfBirth

Corona-Warn-App/src/main/java/de/rki/coronawarnapp/vaccination/core/VaccinationCertificate.kt

@@ -8,6 +8,8 @@ interface VaccinationCertificate {
     val firstName: String?
     val lastName: String
 
+    val fullName: String
+
     val dateOfBirth: LocalDate
     val vaccinatedAt: LocalDate
 

Corona-Warn-App/src/main/java/de/rki/coronawarnapp/vaccination/core/certificate/VaccinationDGCV1Parser.kt

@@ -20,33 +20,44 @@ class VaccinationDGCV1Parser @Inject constructor(
 ) {
 
     fun parse(map: CBORObject): VaccinationDGCV1 = try {
-        val certificate: VaccinationDGCV1 = map[keyHCert]?.run {
+        map[keyHCert]?.run {
             this[keyEuDgcV1]?.run {
                 toCertificate()
             } ?: throw InvalidVaccinationCertificateException(HC_CWT_NO_DGC)
         } ?: throw InvalidVaccinationCertificateException(HC_CWT_NO_HCERT)
-        certificate.validate()
     } catch (e: InvalidHealthCertificateException) {
         throw e
     } catch (e: Throwable) {
         throw InvalidVaccinationCertificateException(HC_CBOR_DECODING_FAILED)
     }
 
+    @Suppress("UNNECESSARY_NOT_NULL_ASSERTION")
     private fun VaccinationDGCV1.validate(): VaccinationDGCV1 {
         if (vaccinationDatas.isNullOrEmpty()) {
             throw InvalidVaccinationCertificateException(VC_NO_VACCINATION_ENTRY)
         }
-        // Force date parsing
+        // check for non null (Gson does not enforce it) & force date parsing
+        version!!
+        nameData.familyNameStandardized.isNotBlank()
         dateOfBirth
         vaccinationDatas.forEach {
             it.vaccinatedAt
+            it.certificateIssuer.isNotBlank()
+            it.countryOfVaccination.isNotBlank()
+            it.marketAuthorizationHolderId.isNotBlank()
+            it.medicalProductId.isNotBlank()
+            it.targetId.isNotBlank()
+            it.doseNumber > 0
+            it.totalSeriesOfDoses > 0
         }
         return this
     }
 
     private fun CBORObject.toCertificate() = try {
         val json = ToJSONString()
-        gson.fromJson<VaccinationDGCV1>(json)
+        gson.fromJson<VaccinationDGCV1>(json).validate()
+    } catch (e: InvalidVaccinationCertificateException) {
+        throw e
     } catch (e: Throwable) {
         throw InvalidVaccinationCertificateException(JSON_SCHEMA_INVALID)
     }

Corona-Warn-App/src/main/java/de/rki/coronawarnapp/vaccination/core/repository/storage/VaccinationContainer.kt

@@ -58,9 +58,20 @@ data class VaccinationContainer internal constructor(
             get() = certificate.personIdentifier
 
         override val firstName: String?
-            get() = certificate.nameData.givenName
+            get() = if (certificate.nameData.givenName.isNullOrBlank())
+                certificate.nameData.givenNameStandardized
+            else certificate.nameData.givenName
+
         override val lastName: String
-            get() = certificate.nameData.familyName ?: certificate.nameData.familyNameStandardized
+            get() = if (certificate.nameData.familyName.isNullOrBlank())
+                certificate.nameData.familyNameStandardized
+            else certificate.nameData.familyName!!
+
+        override val fullName: String
+            get() = when {
+                firstName.isNullOrBlank() -> lastName
+                else -> "$firstName $lastName"
+            }
 
         override val dateOfBirth: LocalDate
             get() = certificate.dateOfBirth

Corona-Warn-App/src/main/java/de/rki/coronawarnapp/vaccination/ui/details/VaccinationDetailsFragment.kt

@@ -87,7 +87,7 @@ class VaccinationDetailsFragment : Fragment(R.layout.fragment_vaccination_detail
     private fun FragmentVaccinationDetailsBinding.bindCertificateViews(
         certificate: VaccinationCertificate
     ) {
-        name.text = certificate.run { "$firstName $lastName" }
+        name.text = certificate.fullName
         birthDate.text = getString(
             R.string.vaccination_details_birth_date,
             certificate.dateOfBirth.toDayFormat()

Corona-Warn-App/src/test/java/de/rki/coronawarnapp/vaccination/core/VaccinatedPersonTest.kt

@@ -36,14 +36,12 @@ class VaccinatedPersonTest : BaseTest() {
         )
 
         certificate.apply {
-            every { firstName } returns "Straw"
-            every { lastName } returns "Berry"
+            every { fullName } returns "Straw Berry"
         }
         vaccinatedPerson.fullName shouldBe "Straw Berry"
 
         certificate.apply {
-            every { firstName } returns null // Thermo
-            every { lastName } returns "Siphon"
+            every { fullName } returns "Siphon"
         }
         vaccinatedPerson.fullName shouldBe "Siphon"
     }

Corona-Warn-App/src/test/java/de/rki/coronawarnapp/vaccination/core/VaccinationQrCodeTestData.java

@@ -8,4 +8,6 @@ public class VaccinationQrCodeTestData {
     static public String validVaccinationQrCode3 = "HC1:NCFOXN%TS3DH3ZSUZK+.V0ETD%65NL-AH%TAIOOW%I-1W0658WA/UAN9AAT4V22F/8X*G3M9JUPY0BX/KR96R/S09T./0LWTKD33236J3TA3M*4VV2 73-E3ND3DAJ-43%*48YIB73A*G3W19UEBY5:PI0EGSP4*2D$43B+2SEB7:I/2DY73CIBC:G 7376BXBJBAJ UNFMJCRN0H3PQN*E33H3OA70M3FMJIJN523S+0B/S7-SN2H N37J3JFTULJ5CB3ZCIATULV:SNS8F-67N%21Q21$48X2+36D-I/2DBAJDAJCNB-43SZ4RZ4E%5B/9OK53:UCT16DEZIE IE9.M CVCT1+9V*QERU1MK93P5 U02Y9.G9/G9F:QQ28R3U6/V.*NT*QM.SY$N-P1S29 34S0BYBRC.UYS1U%O6QKN*Q5-QFRMLNKNM8JI0EUGP$I/XK$M8-L9KDI:ZH2E4EVS6O0FVAQNJT:EZ6Q%D0*T1.XSDYV0.VI2OKSNODA.BOD:C.OTXS02:M5OGJIF4LHJW7FFJ2NLGFL/EE%CJF+KM%V$AUS:H+NARLK IBMMG";
     static public String validVaccinationQrCode4 = "HC1:6BFOXN*TS0BI$ZD.P9UOL97O4-2HH77HRM3DSPTLRR+%3KXH9M9ESIGUBA KWML%6S5B9-+P70Q5VC9:BPCNYKMXEE1JAA/CXGG0JK1WL260X638J3-E3ND3DAJ-43TTTO3HK1H3QBCWNZ83UQJ:T0/8F7V0HKN:Q8.HBV+0SZ4GH00T9UKP0T9WC5PF6846A$Q$76QW6%V98T5$FQMI5DN9QZ5Y0Q$UPE%5MZ5*T57ZA$O7T6LEJOA+MZ55EII-EB1EKC422JBBD0D2K.EJJ14B2MP41WTRZPQEC5L64HX6IAS 8S8FT/MAMXP6QS03L0QIRR97I2HOAXL92L0. KOKG8VG5SI:TU+MMPZ55%PBT1YEGEA7IB65C94JBQ2NLEE:NQ% GC3MXHFLF9OIFN0IZ95LJL80P1FDLW452I8941:HH3M41GTNP8EFUNT$.FTD852IWKP/HLIJL8JF8JF172IMAS EDAHMXFBFBQSKJE72KV$FHJ%3O%6:XM+1QD+T2/VKKER3L3%1THL7MGY.1S:T:GLOX6OCE7+RWYL3.C-L27WNV0G::M74O%K7C50AAEI4";
     static public String qrCodeWithNonsenseCountry = "HC1:NCF3Y28.P-O0PS3JPU7RBWBA2*9VTS/9VZ+PLUOVTJ$EB7W3R9B3VN/3A44E./EZ.6Y8C$.C.IK6MA$00J1TQZ9$9IU+S7HP%X9%*MW09:4WB/5SWB20V5VFBBREWO+GIIUF4+PBZR7MNX/N1JIIML/X3Z.Q67RMB6:BJYE26A5NNL:CIM-A*/UZTM+QO: ACV6212500GUC+KM-5AUYGUD1330PFBA855/SNDPCSOC3KMR9X$DB61.0AESG$:THFGP-M/VI2SG/ 22SS+V8OP3R8LDJ50HR6S94JMN-84Q0C+2/8FUV9HH6N91GB3/YCHN6ALFFZL3M116O/IBU6QKJK/3FMQ0TLK-.UQOO$%A $J%H0%*J:DE6/DOKTG*F605WRK8G7S96JG0 4IF:B9VM0CIBRF/XNBOH9 SGIFJ/2CX593I0GE7FFDEQ6+UO5D+HM/2IDBI.ET/L725IHPKB/T/Q9KRJ* NOWN$6K8VOZIHJ5R29KQWSPYKYSDZRJ+1IVBFGPMXEVY6JIYI/ CVBTJ-FY%MO%RUTF17S:1OL8PVXHRPTUOTK/VF%U%:IR G";
+    static public String qrCodeWithNullValues = "HC1:NCFOXN%TS3DH3ZSUZK+.V0ETD%65NL-AH.TAIOO6+I2HU7A28WAI1G$H4AT4V22F/8X*G8QHJUPZ0BR/S09T./0LWTKD33236J3TA3M*4VV2 73-E3GG396B-43O058YIB73A*G3W19UEBY5:PIDHGNTI4L6YO1%UG/YL WO*Z7ON1 *L:O8PN1QP5O PLU9A/RUX96 B0V1ZZB.T12.H.ZJ$%HN 9GTBIQ16-I5NI5K1*TB3:U-1VVS1UU15%HVLIWQHYZKOP6OH6XO9IE5IVU5P2-GA*PE1H6IO2OO9$G40GHS-O:S9UZ4+FJE 4Y3L 78OAJ/9TL4T1C9 UPVD5BT17$1MV15K1DR1FIEC2F5+1T+UC2FSH9 UP+/UXJDTW5CL52U50$EZ*N.KUW*P .UUQKC.U%KIP3FY5LG1A614I%KZYNNEVQ KB+P8$JG+SB.V Q5FN9ZK1BCTD PPQ3X:J15RM*F9TVYPVE6G1OU-5Q.-OP*17:FX+52AWI1C0:HPE2%90Q:H2SFUGVP56O1W:W7MEGZNBC3WJ0J:*JITJ%W6XK2L3S.GA/S14 FD$G";
+    static public String qrCodeBlankLastNameStandardized = "HC1:NCFOXN%TS3DH3ZSUZK+.V0ETD%65NL-AH0YIIOO6+I-DHHH58WAIAW-ULKD93B4:ZH6I1$4JN:IN1MKK9+OC*PP:+P*.1D9R+Q6646C%6RF6:X93O5RF6$T61R64IM64631AWC5ME65H1KD34LT HBSZ4GH0B69X5QF36FY1OSMNV1L8VNF6O M9R1RF6ECM676746C0FFS6NWE0Y6Z EJZ6KS6YQEE%61Y6LMEA46*-ALK9KZ56DE/.QC$Q3J62:6LZ64998T5UEIY0Q$UPR$5:NLOEPNRAE69K P4NPDDAJP5DMH1$48X2+36D-I/2DBAJDAJPK0%KC$ZJ*DJM47+Y5P QKBLQ+M3+L IMXDRHJUXYOOP6NQQ0THYZQ4H99$R2-JIS77%F.UINXU: RFTIDG62QEZUIQJAZGA+1VG%U5SI:TU+MM0W5JW5.:JOH6L9EP2CG3T1$T98TSYT3YFI7VC2QL:LF3M7RLEITYZF GQ3GVKQVI:NSWR%DJ3/C3AD%W7.WQKGFV 08:P1R3OHKFD7AEULNEW24T EUZ30XVKGG";
 }

Corona-Warn-App/src/test/java/de/rki/coronawarnapp/vaccination/core/qrcode/VaccinationQRCodeExtractorTest.kt

 package de.rki.coronawarnapp.vaccination.core.qrcode
 
+import de.rki.coronawarnapp.covidcertificate.exception.InvalidHealthCertificateException
 import de.rki.coronawarnapp.covidcertificate.exception.InvalidHealthCertificateException.ErrorCode.HC_BASE45_DECODING_FAILED
 import de.rki.coronawarnapp.covidcertificate.exception.InvalidHealthCertificateException.ErrorCode.HC_CWT_NO_ISS
 import de.rki.coronawarnapp.covidcertificate.exception.InvalidHealthCertificateException.ErrorCode.HC_ZLIB_DECOMPRESSION_FAILED
@@ -118,4 +119,18 @@ class VaccinationQRCodeExtractorTest : BaseTest() {
         val extracted = extractor.extract(vaccinationTestData.personBVac1QRCodeString)
         extracted shouldBe vaccinationTestData.personBVac1QRCode
     }
+
+    @Test
+    fun `null values fail with JSON_SCHEMA_INVALID`() {
+        shouldThrow<InvalidVaccinationCertificateException> {
+            extractor.extract(VaccinationQrCodeTestData.qrCodeWithNullValues)
+        }.errorCode shouldBe InvalidHealthCertificateException.ErrorCode.JSON_SCHEMA_INVALID
+    }
+
+    @Test
+    fun `blank name fail with JSON_SCHEMA_INVALID`() {
+        shouldThrow<InvalidVaccinationCertificateException> {
+            extractor.extract(VaccinationQrCodeTestData.qrCodeBlankLastNameStandardized)
+        }.errorCode shouldBe InvalidHealthCertificateException.ErrorCode.JSON_SCHEMA_INVALID
+    }
 }

Corona-Warn-App/src/test/java/de/rki/coronawarnapp/vaccination/core/repository/storage/VaccinationContainerTest.kt

@@ -62,6 +62,7 @@ class VaccinationContainerTest : BaseTest() {
         testData.personAVac1Container.toVaccinationCertificate(null, userLocale = Locale.GERMAN).apply {
             firstName shouldBe "Andreas"
             lastName shouldBe "Astrá Eins"
+            fullName shouldBe "Andreas Astrá Eins"
             dateOfBirth shouldBe LocalDate.parse("1966-11-11")
             vaccinatedAt shouldBe LocalDate.parse("2021-03-01")
             vaccineTypeName shouldBe "1119305005"
@@ -108,6 +109,7 @@ class VaccinationContainerTest : BaseTest() {
         testData.personAVac1Container.toVaccinationCertificate(vaccinationValueSets, userLocale = Locale.GERMAN).apply {
             firstName shouldBe "Andreas"
             lastName shouldBe "Astrá Eins"
+            fullName shouldBe "Andreas Astrá Eins"
             dateOfBirth shouldBe LocalDate.parse("1966-11-11")
             vaccinatedAt shouldBe LocalDate.parse("2021-03-01")
             vaccineTypeName shouldBe "Vaccine-Name"