Skip to content

Commit

Permalink
fix: properly manage RFC 3986 authority domain check (#2351)
Browse files Browse the repository at this point in the history
* fix: properly manage `RFC 3986 authority domain` check

## PR overview
Using the current regex expression only second level domains are accepted. However, that is not the way it is specified on RFC 3986.

With the current implementation for instance all country code second-level domains (ccSLD) like domain.co.uk are not accepted.

The fix allows multi-level domains.

### Detailed summary
Changed `domainRegex` regex to allow multiple level domains.

* Create rfc3986-authority-domain.md

* Fix: Replace instead of adding

* Update .changeset/rfc3986-authority-domain.md

Co-authored-by: awkweb <tom@meagher.co>

* test(siwe): sub/multi-level domains

---------

Co-authored-by: awkweb <tom@meagher.co>
  • Loading branch information
agsola and tmm committed Jun 4, 2024
1 parent 8984eee commit 48e6d50
Show file tree
Hide file tree
Showing 3 changed files with 47 additions and 1 deletion.
5 changes: 5 additions & 0 deletions .changeset/rfc3986-authority-domain.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"viem": patch
---

Fixed `createSiweMessage` domain check to be RFC 3986 compliant.
41 changes: 41 additions & 0 deletions src/utils/siwe/createSiweMessage.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,47 @@ test('default', () => {
vi.useRealTimers()
})

test('parameters: domain', () => {
vi.useFakeTimers()
vi.setSystemTime(new Date(Date.UTC(2023, 1, 1)))

expect(
createSiweMessage({
...message,
domain: 'foo.example.com',
}),
).toMatchInlineSnapshot(`
"foo.example.com wants you to sign in with your Ethereum account:
0xA0Cf798816D4b9b9866b5330EEa46a18382f251e
URI: https://example.com/path
Version: 1
Chain ID: 1
Nonce: foobarbaz
Issued At: 2023-02-01T00:00:00.000Z"
`)

expect(
createSiweMessage({
...message,
domain: 'example.co.uk',
}),
).toMatchInlineSnapshot(`
"example.co.uk wants you to sign in with your Ethereum account:
0xA0Cf798816D4b9b9866b5330EEa46a18382f251e
URI: https://example.com/path
Version: 1
Chain ID: 1
Nonce: foobarbaz
Issued At: 2023-02-01T00:00:00.000Z"
`)

vi.useRealTimers()
})

test('parameters: scheme', () => {
vi.useFakeTimers()
vi.setSystemTime(new Date(Date.UTC(2023, 1, 1)))
Expand Down
2 changes: 1 addition & 1 deletion src/utils/siwe/createSiweMessage.ts
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ export function createSiweMessage(
}

const domainRegex =
/^([a-zA-Z0-9][-a-zA-Z0-9]{0,61}[a-zA-Z0-9])\.[a-zA-Z]{2,}(:[0-9]{1,5})?$/
/^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}(:[0-9]{1,5})?$/
const ipRegex =
/^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(:[0-9]{1,5})?$/
const localhostRegex = /^localhost(:[0-9]{1,5})?$/
Expand Down

0 comments on commit 48e6d50

Please sign in to comment.