feat: add validation for leading whitespace in BOLT 12 bech32 strings #3998
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
👋 I see @joostjager was un-assigned. |
erickcestari
force-pushed
the
encoded-offer-with-leading-whitespace
branch
from
24d25bb to
cc0947a
Compare
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3998 +/- ##
==========================================
- Coverage 88.97% 88.94% -0.04%
==========================================
Files 174 174
Lines 124161 124593 +432
Branches 124161 124593 +432
==========================================
+ Hits 110470 110814 +344
- Misses 11216 11285 +69
- Partials 2475 2494 +19
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
erickcestari
force-pushed
the
encoded-offer-with-leading-whitespace
branch
from
cc0947a to
45afedb
Compare
TheBlueMatt
reviewed
Aug 8, 2025
Found through differential fuzzing between C-Lightning and rust-lightning: rust-lightning incorrectly accepted offers starting with whitespace when continuation characters (+) were present, while C-Lightning correctly rejected them per BOLT 12 specification. - Add InvalidLeadingWhitespace error variant to Bolt12ParseError - Validate that bech32 strings don't start with whitespace characters - Separate validation logic for first chunk vs continuation chunks - Add test case for leading whitespace validation
erickcestari
force-pushed
the
encoded-offer-with-leading-whitespace
branch
from
45afedb to
29dfc1f
Compare
|
👋 The first review has been submitted! Do you think this PR is ready for a second reviewer? If so, click here to assign a second reviewer. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Through differential fuzzing between C-Lightning and rust-lightning, I discovered that rust-lightning incorrectly accepts BOLT 12 offers that start with whitespace when they contain continuation characters (+).
Expected behavior: Both implementations should reject this offer
Actual behavior:
This pr check that the first chunk doesn't contain whitespace characters without trimming it.