What the developer wrote
Authored by f321x
pi: don't match literal | char in regexes
The RE_EMAIL and RE_DOMAIN regexes matched the '|' character
which is probably not what they should do.
What changed, and why it matters
This commit fixes two email/domain recognition patterns so they no longer treat the vertical bar character '|' as a valid letter. Before the fix, a string like 'example.c|m' could be accepted as a domain or email ending, which could let malformed payment identifiers slip through validation. The change is a small correctness fix in input parsing, not a dramatic security hole on its own.
Treat as a low-severity input-validation bug. Review whether the malformed identifiers could reach any security-sensitive path such as DNS resolution, BIP353 resolution, or Lightning Address lookup, and add regression tests for '|' rejection. No urgent response is warranted unless such a path is confirmed.
Security signals we found
regex character class included unintended literal '|' character
commit message states the previous behavior was 'probably not what they should do'
affected code parses payment identifiers (email-style and domain-style)
no explicit security claim or CVE from the vendor
Evidence from the diff
In electrum/payment_identifier.py, the regexes RE_EMAIL and RE_DOMAIN used the character class [A-Z|a-z], which includes the literal pipe ‘|’ as an allowed character. The intended class was almost certainly [A-Za-z] (all ASCII letters). The patch removes the pipe. This could have allowed malformed domains/email TLDs containing ‘|’ to pass validation, potentially affecting downstream payment-identifier parsing or BIP353 / Lightning Address resolution logic. The commit message explicitly calls this out as unintended behavior.
Changed components
electrum/payment_identifier.pyRE_EMAIL regexRE_DOMAIN regexInspect captured patch +2 / −2
diff --git a/electrum/payment_identifier.py b/electrum/payment_identifier.py
index 4fac9ad..198bb68 100644
--- a/electrum/payment_identifier.py
+++ b/electrum/payment_identifier.py
@@ -62,8 +62,8 @@ def maybe_extract_url_from_lud_17_uri(data: str) -> Optional[str]:
RE_ALIAS = r'(.*?)\s*\<([0-9A-Za-z]{1,})\>'
-RE_EMAIL = r'\b[A-Za-z0-9._%+-]+@([A-Za-z0-9-]+\.)+[A-Z|a-z]{2,7}\b'
-RE_DOMAIN = r'\b([A-Za-z0-9-]+\.)+[A-Z|a-z]{2,7}\b'
+RE_EMAIL = r'\b[A-Za-z0-9._%+-]+@([A-Za-z0-9-]+\.)+[A-Za-z]{2,7}\b'
+RE_DOMAIN = r'\b([A-Za-z0-9-]+\.)+[A-Za-z]{2,7}\b'
RE_SCRIPT_FN = r'script\((.*)\)'
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.