From 3840f3ee54f1593f1e3862b5b5c27b37b9f28d90 Mon Sep 17 00:00:00 2001 From: Kyle Cox Date: Wed, 7 Oct 2026 17:24:50 +0000 Subject: [PATCH] fix(qr): refuse extra keys in the v1 signing-request envelope The v1 Wire struct accepted envelopes with extra keys while the wallets, the SDK, and the NEAR envelope in the same file all refuse them. Add #[serde(deny_unknown_fields)] to match, plus a regression test mirroring the NEAR extra-key test. --- src/qr/sign_request.rs | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/qr/sign_request.rs b/src/qr/sign_request.rs index ed2a3e2..3719e5b 100644 --- a/src/qr/sign_request.rs +++ b/src/qr/sign_request.rs @@ -174,6 +174,7 @@ pub struct SignRequest { } #[derive(Serialize, Deserialize)] +#[serde(deny_unknown_fields)] struct Wire { v: u8, signer: String, @@ -282,6 +283,17 @@ mod tests { assert!(SignRequest::decode(wire.to_string().as_bytes()).is_err()); } + #[test] + fn refuses_extra_keys_like_the_wallets_do() { + // The wallets accept exactly {v, signer, payload} for a v1 request and + // refuse any other key set; the NEAR envelope already enforces that + // here via deny_unknown_fields, the v1 envelope must too. + let mut extra = serde_json::json!({ "v": 1, "signer": ADDRESS, "payload": "0xab" }); + extra["chain"] = "near".into(); + assert!(SignRequest::decode(extra.to_string().as_bytes()).is_err()); + assert!(AnySignRequest::decode(extra.to_string().as_bytes()).is_err()); + } + #[test] fn near_request_round_trips_through_the_wire_format() { let request = NearSignRequest::new("testnet", vec![0x0d, 0x00, 0x00, 0x00]).unwrap();