Skip to content

fix: validate Nostr Wallet Connect URIs before saving wallet config#4153

Open
ajaysehwal wants to merge 1 commit into
ZeusLN:masterfrom
ajaysehwal:fix/validate-nwc-url
Open

fix: validate Nostr Wallet Connect URIs before saving wallet config#4153
ajaysehwal wants to merge 1 commit into
ZeusLN:masterfrom
ajaysehwal:fix/validate-nwc-url

Conversation

@ajaysehwal

@ajaysehwal ajaysehwal commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Description

Please enter a description and screenshots, if appropriate, of the work covered in this PR

In this PR, We Prevent invalid Nostr Wallet Connect (NWC) wallet configurations from being saved by validating connection URIs against the NWC spec before saving.

Changes:

  • Add ValidationUtils.isValidNostrWalletConnectUrl() to verify:
    • nostr+walletconnect:// scheme
    • 64-character hex wallet service pubkey
    • required relay query param (ws:// or wss://, URL-encoded values supported)
    • required 64-character hex secret query param
    • optional extra params (e.g. lud16) and multiple relay params
  • Disable the save button for NWC wallets until the URL passes validation
  • Add unit tests covering valid URIs, missing params, malformed values, and
    invalid schemes

Result

Users can no longer save invalid NWC connection URIs, helping prevent misconfigured wallets and ensuring better compliance with the NWC specification

This pull request is categorized as a:

  • New feature
  • Bug fix
  • Code refactor
  • Configuration change
  • Locales update
  • Quality assurance
  • Other

Checklist

  • I’ve run yarn run tsc and made sure my code compiles correctly
  • I’ve run yarn run lint and made sure my code didn’t contain any problematic patterns
  • I’ve run yarn run prettier and made sure my code is formatted correctly
  • I’ve run yarn run test and made sure all of the tests pass

Testing

If you modified or added a utility file, did you add new unit tests?

  • No, I’m a fool
  • Yes
  • N/A

I have tested this PR on the following platforms (please specify OS version and phone model/VM):

  • Android
  • iOS

I have tested this PR with the following types of nodes (please specify node version and API version where appropriate):

On-device

  • LDK Node
  • Embedded LND

Remote

  • LND (REST)
  • LND (Lightning Node Connect)
  • Core Lightning (CLNRest)
  • Nostr Wallet Connect
  • LndHub

Locales

  • I’ve added new locale text that requires translations
  • I’m aware that new translations should be made on the ZEUS Transfix page and not directly to this repo

Third Party Dependencies and Packages

  • Contributors will need to run yarn after this PR is merged in
  • 3rd party dependencies have been modified:
    • verify that package.json and yarn.lock have been properly updated
    • verify that dependencies are installed for both iOS and Android platforms

Other:

  • Changes were made that require an update to the README
  • Changes were made that require an update to onboarding

@ajaysehwal ajaysehwal changed the title fix(nwc): validate Nostr Wallet Connect URIs before saving wallet config fix: validate Nostr Wallet Connect URIs before saving wallet config Jun 9, 2026

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces validation logic for Nostr Wallet Connect (NWC) URLs by adding "isValidNostrWalletConnectUrl" in "ValidationUtils" and integrating it into the "WalletConfiguration" view, along with comprehensive unit tests. The feedback suggests adding defensive checks to handle "null" or "undefined" URLs to prevent runtime crashes, simplifying the relay URL validation by removing redundant "decodeURIComponent" calls which could throw errors, and adding corresponding unit tests for non-string inputs.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment thread utils/ValidationUtils.ts
Comment thread utils/ValidationUtils.ts
Comment thread utils/ValidationUtils.test.ts Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants