cln-plugin: adapt send_custom_notification to send modern-style notifications.
What the developer wrote
Authored by Rusty Russell
cln-plugin: adapt send_custom_notification to send modern-style notifications.
Modern style for notifications is to put everything inside an object
of same name as the method.
For now this means duplication for backward compatibility. ChatGPT
helped me do that.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit changes how plugin notifications are formatted so they match a newer convention used by the rest of the software. It wraps the notification payload inside an extra object named after the notification method, while still accepting the old format for backward compatibility. There is no direct security fix here; it is a compatibility and cleanup change that may reduce confusion or interoperability bugs down the road.
No immediate security action required. Developers using custom plugin notifications should verify their consumers expect the new wrapped format. Monitor the scheduled deprecation for version 26.09 to remove duplicated wrapping.
Security signals we found
Behavior change in message serialization
Deprecation marker for future removal
Input validation added: params must be a JSON object
Evidence from the diff
The patch modifies send_custom_notification in plugins/src/lib.rs. Previously the JSON-RPC notification was sent with params: v directly. Now v is required to be a JSON object, cloned into params, and then re-inserted under a key matching the method name (params[method] = v). A comment notes this duplicated wrapping is deprecated and scheduled for removal in version 26.09. The change enforces the modern notification style where everything lives inside an object of the same name as the method.
Changed components
plugins/src/lib.rscln-plugin notification dispatchsend_custom_notificationInspect captured patch +9 / −1
diff --git a/plugins/src/lib.rs b/plugins/src/lib.rs
index 112459ae..dc9cf1ab 100644
--- a/plugins/src/lib.rs
+++ b/plugins/src/lib.rs
@@ -876,11 +876,19 @@ where
method: String,
v: serde_json::Value,
) -> Result<(), Error> {
+ // Modern has them inside object of same name.
+ // This is deprecated, scheduled for removal 26.09.
+ let mut params = match &v {
+ serde_json::Value::Object(map) => map.clone(),
+ _ => return Err(anyhow::anyhow!("params must be a JSON object")),
+ };
+ params.insert(method.clone(), json!(v));
+
self.sender
.send(json!({
"jsonrpc": "2.0",
"method": method,
- "params": v,
+ "params": params,
}))
.await
.context("sending custom notification")?;
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.