libplugin: fix 'i-promise-to-fix-broken-api-user' parsing.
What the developer wrote
Authored by Rusty Russell
libplugin: fix 'i-promise-to-fix-broken-api-user' parsing.
This is important for the first xpay deprecation end-of-life!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This is a one-line bug fix in how Core Lightning reads a configuration option named 'i-promise-to-fix-broken-api-user'. The old code expected a simple value, but the actual configuration format stores it as a list of string values. The fix changes the parser to read the list correctly. If left unfixed, the plugin would fail to read the setting and could crash or misbehave when deprecated API behavior is removed, but there is no direct security exploit here.
Treat as a routine functional bug fix with minor availability implications. No urgent security response is indicated, but verify that the corrected path is covered by tests and that plugin startup does not abort when the option is absent or present.
Security signals we found
Parser/schema mismatch fix
Potential plugin crash (plugin_err) on malformed or unexpected config response
Deprecation-handling path (xpay) affected
Evidence from the diff
The commit corrects a JSON schema mismatch in plugins/libplugin.c. The previous json_scan template treated ‘i-promise-to-fix-broken-api-user’ as an optional scalar (%), but listconfigs returns it under configs as an object with a ‘values_str’ array. The patch updates the scan template to ‘{configs:{i-promise-to-fix-broken-api-user:{values_str:%}}}’ so the existing json_to_apilist helper populates plugin->beglist correctly. Failure to parse would cause plugin_err and abort the plugin, which would break functionality relying on the ‘broken API user’ promise list, notably the xpay deprecation end-of-life.
Changed components
plugins/libplugin.clistconfigs JSON parsingi-promise-to-fix-broken-api-user configuration optionxpay plugin deprecation logicInspect captured patch +1 / −1
diff --git a/plugins/libplugin.c b/plugins/libplugin.c
index 22d49954..7f4db9f4 100644
--- a/plugins/libplugin.c
+++ b/plugins/libplugin.c
@@ -1487,7 +1487,7 @@ static struct command_result *get_beglist(struct command *aux_cmd,
const char *err;
err = json_scan(tmpctx, buf, result,
- "{configs:{i-promise-to-fix-broken-api-user?:%}}",
+ "{configs:{i-promise-to-fix-broken-api-user:{values_str:%}}}",
JSON_SCAN_TAL(plugin, json_to_apilist, &plugin->beglist));
if (err)
plugin_err(aux_cmd->plugin, "bad listconfigs '%.*s': %s",
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.