@stellar/typescript-wallet-sdk 3.0.2 → 3.0.3-beta.1786146826692

package/CHANGELOG.MD

@@ -1,3 +1,11 @@
+# Release notes - Typescript Wallet SDK - 3.0.3
+
+### Fixed
+* Validate SEP-7 origin_domain as a fully qualified domain name (#244)
+
+### Added
+* `Types.isValidFullyQualifiedDomainName` and `Types.FULLY_QUALIFIED_DOMAIN_NAME_REGEX` (#244)
+
 # Release notes - Typescript Wallet SDK - 3.0.2
 * Version bump
 

package/lib/bundle.js

@@ -4851,7 +4851,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.URI_REPLACE_MAX_LENGTH = exports.URI_MSG_MAX_LENGTH = exports.Sep7OperationType = exports.WEB_STELLAR_SCHEME = void 0;
+exports.isValidFullyQualifiedDomainName = exports.FULLY_QUALIFIED_DOMAIN_NAME_REGEX = exports.URI_REPLACE_MAX_LENGTH = exports.URI_MSG_MAX_LENGTH = exports.Sep7OperationType = exports.WEB_STELLAR_SCHEME = void 0;
 exports.WEB_STELLAR_SCHEME = "web+stellar:";
 var Sep7OperationType;
 (function (Sep7OperationType) {
@@ -4860,6 +4860,27 @@ var Sep7OperationType;
 })(Sep7OperationType = exports.Sep7OperationType || (exports.Sep7OperationType = {}));
 exports.URI_MSG_MAX_LENGTH = 300;
 exports.URI_REPLACE_MAX_LENGTH = 4096;
+/**
+ * Matches a fully qualified domain name (e.g. "example.com", "sub.example.co.uk").
+ *
+ * Rejects userinfo ('@'), ports (':'), paths/queries ('/', '?'), scheme
+ * prefixes ('//'), bare hostnames like 'localhost', and raw IPv4/IPv6
+ * addresses (the all-numeric final label fails the alphabetic TLD rule).
+ *
+ * @see https://github.com/stellar/stellar-protocol/blob/master/ecosystem/sep-0007.md#verifying-the-signature step 3.
+ */
+exports.FULLY_QUALIFIED_DOMAIN_NAME_REGEX = /^(?=.{1,253}$)([a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,63}$/;
+/**
+ * Returns true if the given string is a valid fully qualified domain name.
+ *
+ * @param {string} domain the domain string to validate.
+ *
+ * @returns {boolean} true if 'domain' is a valid fully qualified domain name.
+ */
+var isValidFullyQualifiedDomainName = function (domain) {
+    return exports.FULLY_QUALIFIED_DOMAIN_NAME_REGEX.test(domain);
+};
+exports.isValidFullyQualifiedDomainName = isValidFullyQualifiedDomainName;
 
 
 /***/ }),
@@ -5178,6 +5199,14 @@ var Sep7Base = /** @class */ (function () {
                         if (!originDomain || !signature) {
                             return [2 /*return*/, false];
                         }
+                        // SEP-7 step 3: "If the origin_domain is not a valid fully qualified
+                        // domain name, do not allow the user to sign the transaction." This must
+                        // be enforced before resolving the stellar.toml, otherwise a malformed
+                        // origin_domain (e.g. containing userinfo, a port, or a path) could
+                        // redirect the trust-anchoring TOML fetch to an attacker-controlled host.
+                        if (!(0, Types_1.isValidFullyQualifiedDomainName)(originDomain)) {
+                            return [2 /*return*/, false];
+                        }
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
@@ -5748,6 +5777,7 @@ var isValidSep7Uri = function (uri) {
     var networkPassphrase = url.searchParams.get("network_passphrase") || stellar_sdk_1.Networks.PUBLIC;
     var destination = url.searchParams.get("destination");
     var msg = url.searchParams.get("msg");
+    var originDomain = url.searchParams.get("origin_domain");
     if (![Types_1.Sep7OperationType.tx, Types_1.Sep7OperationType.pay].includes(type)) {
         return {
             result: false,
@@ -5795,6 +5825,16 @@ var isValidSep7Uri = function (uri) {
             reason: "the 'msg' parameter should be no longer than ".concat(Types_1.URI_MSG_MAX_LENGTH, " characters"),
         };
     }
+    // 'origin_domain' is optional (SEP-7), but when present it must be a valid
+    // fully qualified domain name (SEP-7 step 3), otherwise a malformed value
+    // could later redirect the trust-anchoring stellar.toml fetch in
+    // Sep7Base.verifySignature() to an attacker-controlled host.
+    if (originDomain && !(0, Types_1.isValidFullyQualifiedDomainName)(originDomain)) {
+        return {
+            result: false,
+            reason: "the provided 'origin_domain' parameter is not a valid fully qualified domain name",
+        };
+    }
     return {
         result: true,
     };
@@ -82472,7 +82512,7 @@ function decode(arr) {
 /***/ ((module) => {
 
 "use strict";
-module.exports = JSON.parse('{"name":"@stellar/typescript-wallet-sdk","version":"3.0.2","engines":{"node":">=20"},"browser":"./lib/bundle_browser.js","main":"./lib/bundle.js","types":"./lib/index.d.ts","license":"Apache-2.0","private":false,"devDependencies":{"@babel/preset-env":"^7.20.2","@babel/preset-typescript":"^7.23.3","@stellar/prettier-config":"^1.0.1","@stellar/tsconfig":"^1.0.2","@types/jest":"^29.4.0","@types/lodash":"^4.14.194","@types/sinon":"^10.0.15","@typescript-eslint/eslint-plugin":"^6.7.5","@typescript-eslint/parser":"^6.7.5","babel-jest":"^29.4.1","crypto-browserify":"^3.12.0","dotenv":"^16.3.1","eslint":"^8.51.0","eslint-config-prettier":"^9.0.0","eslint-plugin-jsdoc":"^46.8.2","express":"^4.19.2","husky":"^8.0.0","jest":"^29.4.1","lint-staged":"^14.0.1","npm-run-all":"^4.1.5","playwright":"^1.43.1","prettier":"^2.0.5","pretty-quick":"^2.0.1","process":"^0.11.10","sinon":"^15.1.0","stream-browserify":"^3.0.0","ts-jest":"^29.0.5","ts-loader":"^9.4.2","ts-node":"^10.9.1","tslib":"^2.5.0","typescript":"^5.0.4","webpack":"^5.83.1","webpack-cli":"^5.1.1"},"dependencies":{"@stablelib/base64":"^2.0.0","@stablelib/utf8":"^2.0.0","@stellar/stellar-sdk":"15.0.1","axios":"^1.4.0","base64url":"^3.0.1","https-browserify":"^1.0.0","jws":"^4.0.0","lodash":"^4.17.21","query-string":"^7.1.3","stream-http":"^3.2.0","tweetnacl":"^1.0.3","url":"^0.11.0","util":"^0.12.5","utility-types":"^3.10.0","vm-browserify":"^1.1.2"},"scripts":{"test":"jest --watchAll","test:ci":"jest --ci","test:e2e:ci":"jest --config jest.e2e.config.js --ci","test:recovery:ci":"jest --config jest.integration.config.js recovery.test.ts --ci","test:anchorplatform:ci":"yarn jest --config jest.integration.config.js anchorplatform.test.ts --ci","build:web":"webpack --config webpack.config.js","build:node":"webpack --env NODE=true --config webpack.config.js","build":"run-p build:web build:node","example:sep10Server":"ts-node examples/sep10/sep10Server.ts","example:sep10Wallet":"ts-node examples/sep10/sep10Wallet.ts","example:sep24":"ts-node examples/sep24/sep24.ts","example:sep12":"ts-node examples/sep12/sep12.ts"}}');
+module.exports = JSON.parse('{"name":"@stellar/typescript-wallet-sdk","version":"3.0.3","engines":{"node":">=20"},"browser":"./lib/bundle_browser.js","main":"./lib/bundle.js","types":"./lib/index.d.ts","license":"Apache-2.0","private":false,"devDependencies":{"@babel/preset-env":"^7.20.2","@babel/preset-typescript":"^7.23.3","@stellar/prettier-config":"^1.0.1","@stellar/tsconfig":"^1.0.2","@types/jest":"^29.4.0","@types/lodash":"^4.14.194","@types/sinon":"^10.0.15","@typescript-eslint/eslint-plugin":"^6.7.5","@typescript-eslint/parser":"^6.7.5","babel-jest":"^29.4.1","crypto-browserify":"^3.12.0","dotenv":"^16.3.1","eslint":"^8.51.0","eslint-config-prettier":"^9.0.0","eslint-plugin-jsdoc":"^46.8.2","express":"^4.19.2","husky":"^8.0.0","jest":"^29.4.1","lint-staged":"^14.0.1","npm-run-all":"^4.1.5","playwright":"^1.43.1","prettier":"^2.0.5","pretty-quick":"^2.0.1","process":"^0.11.10","sinon":"^15.1.0","stream-browserify":"^3.0.0","ts-jest":"^29.0.5","ts-loader":"^9.4.2","ts-node":"^10.9.1","tslib":"^2.5.0","typescript":"^5.0.4","webpack":"^5.83.1","webpack-cli":"^5.1.1"},"dependencies":{"@stablelib/base64":"^2.0.0","@stablelib/utf8":"^2.0.0","@stellar/stellar-sdk":"15.0.1","axios":"^1.4.0","base64url":"^3.0.1","https-browserify":"^1.0.0","jws":"^4.0.0","lodash":"^4.17.21","query-string":"^7.1.3","stream-http":"^3.2.0","tweetnacl":"^1.0.3","url":"^0.11.0","util":"^0.12.5","utility-types":"^3.10.0","vm-browserify":"^1.1.2"},"scripts":{"test":"jest --watchAll","test:ci":"jest --ci","test:e2e:ci":"jest --config jest.e2e.config.js --ci","test:recovery:ci":"jest --config jest.integration.config.js recovery.test.ts --ci","test:anchorplatform:ci":"yarn jest --config jest.integration.config.js anchorplatform.test.ts --ci","build:web":"webpack --config webpack.config.js","build:node":"webpack --env NODE=true --config webpack.config.js","build":"run-p build:web build:node","example:sep10Server":"ts-node examples/sep10/sep10Server.ts","example:sep10Wallet":"ts-node examples/sep10/sep10Wallet.ts","example:sep24":"ts-node examples/sep24/sep24.ts","example:sep12":"ts-node examples/sep12/sep12.ts"}}');
 
 /***/ }),