@spirobel/monero-wallet-api 0.6.12 → 0.6.15

package/dist/tools/calls/001.js

@@ -26,17 +26,24 @@ function make(payload) {
     const base = `${TOOL_MAGIC_STRING}001_amount_${payload.amount}_address_${payload.address}`;
     return payload.no_check ? `${base}_no_check` : base;
 }
+// base58, 95 chars for a standard address and 106 for an integrated one.
+const MONERO_ADDRESS_SHAPE = /^[1-9A-HJ-NP-Za-km-z]{95}$|^[1-9A-HJ-NP-Za-km-z]{106}$/;
 async function validate_check(invo) {
     const tool = invo.tool;
     if (tool.tool_id !== "001")
         return "unverified";
     if (tool.payload.no_check)
         return "unverified";
+    // the address goes into the path. a real address is base58 and 95 or 106 chars.
+    // anything else could rewrite the request path, so it never reaches the fetch.
+    if (!MONERO_ADDRESS_SHAPE.test(tool.payload.address))
+        return "invalid";
     const link = invo[invo.found_in];
     const invo_link = new URL(link);
     const checkUrl = `${invo_link.origin}/monerochan001/${tool.payload.address}`;
     try {
-        const result = (await (await fetch(checkUrl)).json());
+        // no redirects: a shop must not bounce the request to another host.
+        const result = (await (await fetch(checkUrl, { redirect: "error" })).json());
         if (result &&
             typeof result === "object" &&
             "valid_address" in result &&

package/dist/tools/content.d.ts

@@ -17,6 +17,5 @@ declare global {
 }
 export declare function interceptToolLinkCallback(e: Event): void;
 export declare function deliverToolUrl(url: string): boolean;
-export declare function DefaultConfirmationCallback(loc_href: string): boolean;
-export declare function installToolLinkEventInterception(confirmationcallback?: (loc_href: string) => boolean): void;
+export declare function installToolLinkEventInterception(): void;
 export {};

package/dist/tools/content.js

@@ -71,11 +71,8 @@ export function deliverToolUrl(url) {
     deliver(invo);
     return true;
 }
-export function DefaultConfirmationCallback(loc_href) {
-    return window.confirm("Did you just follow a monerochan tool link?");
-}
-export function installToolLinkEventInterception(confirmationcallback = DefaultConfirmationCallback) {
+export function installToolLinkEventInterception() {
+    // click only. keyboard activation (enter) dispatches a click, a touch tap does too.
+    // a keydown on a focused link is not an activation, so it must not deliver.
     document.addEventListener("click", interceptToolLinkCallback, true);
-    document.addEventListener("touchend", interceptToolLinkCallback, true);
-    document.addEventListener("keydown", interceptToolLinkCallback, true);
 }

package/dist/tools/monero-tools.d.ts

@@ -14,6 +14,7 @@ export declare const tools: {
 };
 export type ToolId = keyof typeof tools;
 export declare const TOOL_IDS: ToolId[];
+export declare const TOOL_IDS_WITHOUT_DIRECT_OPEN: ToolId[];
 export declare function getToolUiByPermissions(permissions: ToolPermission[]): ToolUiCopy | null;
 type PayloadOf<A> = A extends ToolArm<infer P, infer _E> ? P : never;
 export type MoneroTool = {

package/dist/tools/monero-tools.js

@@ -10,6 +10,9 @@ export const tools = {
     "002": tool002,
 };
 export const TOOL_IDS = Object.keys(tools);
+// tool calls that cannot be started from a tool link. the content script port
+// carries the rest of the exchange, so the page that made the call has to stay.
+export const TOOL_IDS_WITHOUT_DIRECT_OPEN = ["002"];
 export function getToolUiByPermissions(permissions) {
     const want = new Set(permissions);
     for (const id of Object.keys(tools)) {