From 703715aea50bedb6087832f650446502fd175daf Mon Sep 17 00:00:00 2001
From: Matt Bishop <mbishop@bitwarden.com>
Date: Fri, 6 Jun 2025 10:57:57 -0400
Subject: [PATCH] [PM-4780] Relax UUID validation (#6792)

* Relax UUID validation

* Remove unneeded word boundaries

* Compress given the duplicated three parts

* Revert "Added separate function for GUID validation for passkeys (#6806)"
---
 libs/common/src/platform/misc/utils.ts           |  2 +-
 .../src/platform/services/fido2/guid-utils.ts    | 16 ++++++++--------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/libs/common/src/platform/misc/utils.ts b/libs/common/src/platform/misc/utils.ts
index a1e914da531..b3c1db91806 100644
--- a/libs/common/src/platform/misc/utils.ts
+++ b/libs/common/src/platform/misc/utils.ts
@@ -260,7 +260,7 @@ export class Utils {
     });
   }
 
-  static guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+  static guidRegex = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/;
 
   static isGuid(id: string) {
     return RegExp(Utils.guidRegex, "i").test(id);
diff --git a/libs/common/src/platform/services/fido2/guid-utils.ts b/libs/common/src/platform/services/fido2/guid-utils.ts
index 92c69c29eb0..66e6cbb1d7c 100644
--- a/libs/common/src/platform/services/fido2/guid-utils.ts
+++ b/libs/common/src/platform/services/fido2/guid-utils.ts
@@ -7,12 +7,14 @@
   The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.*/
 
+import { Utils } from "../../../platform/misc/utils";
+
 /** Private array used for optimization */
 const byteToHex = Array.from({ length: 256 }, (_, i) => (i + 0x100).toString(16).substring(1));
 
 /** Convert standard format (XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX) UUID to raw 16 byte array. */
 export function guidToRawFormat(guid: string) {
-  if (!isValidGuid(guid)) {
+  if (!Utils.isGuid(guid)) {
     throw TypeError("GUID parameter is invalid");
   }
 
@@ -81,15 +83,13 @@ export function guidToStandardFormat(bufferSource: BufferSource) {
   ).toLowerCase();
 
   // Consistency check for valid UUID.  If this throws, it's likely due to one
-  // or more input array values not mapping to a hex octet (leading to "undefined" in the uuid)
-  if (!isValidGuid(guid)) {
+  // of the following:
+  // - One or more input array values don't map to a hex octet (leading to
+  // "undefined" in the uuid)
+  // - Invalid input values for the RFC `version` or `variant` fields
+  if (!Utils.isGuid(guid)) {
     throw TypeError("Converted GUID is invalid");
   }
 
   return guid;
 }
-
-// Perform format validation, without enforcing any variant restrictions as Utils.isGuid does
-function isValidGuid(guid: string): boolean {
-  return RegExp(/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/, "i").test(guid);
-}