plugin: nwc: handle missing params dict in request
What the developer wrote
Authored by f321x
plugin: nwc: handle missing params dict in request
Even though the NIP-47 specification kind of defines that requests should
always pass a params dict in their request i witnessed way too often
that clients don't include it in some requests where it is technically
not neccessary and we fail on it.
Handling this gracefully improves compatibility without obvious
downsides.
What changed, and why it matters
This is a small compatibility fix for the NWC (Nostr Wallet Connect) plugin in Electrum. It changes how incoming client requests are read so that if a request does not include a 'params' section, the server treats it as an empty params dictionary instead of crashing. The change makes Electrum work with more third-party NWC clients, but it does not appear to introduce a security vulnerability on its own.
No immediate security action required. Treat as a normal compatibility/robustness improvement. Reviewers may optionally verify that downstream handlers safely handle an empty `params` dict and that no code path assumes required params keys without further validation.
Security signals we found
No security-relevant keywords in commit title or message
Change is defensive input normalization, not a vulnerability patch
No validation logic removed; type check for params remains
No CVE, advisory, or researcher attribution present in commit
No explicit vendor security disclosure in commit message
Evidence from the diff
The patch replaces a direct dictionary access content['params'] with content.get('params', {}) in electrum/plugins/nwc/nwcserver.py. Previously, any NWC request missing the params key would raise a KeyError, be caught by the surrounding except Exception, and return a generic error response. After the patch, such requests continue with an empty params dict. The subsequent isinstance(params, dict) check still validates the type if params is present. This is a robustness/compatibility improvement rather than a security fix.
Changed components
electrum/plugins/nwc/nwcserver.pyNWC (Nostr Wallet Connect) server plugin request parsingInspect captured patch +1 / −1
diff --git a/electrum/plugins/nwc/nwcserver.py b/electrum/plugins/nwc/nwcserver.py
index 9e278d0..6d6df54 100644
--- a/electrum/plugins/nwc/nwcserver.py
+++ b/electrum/plugins/nwc/nwcserver.py
@@ -344,7 +344,7 @@ class NWCServer(Logger, EventListener):
content = json.loads(content)
if not isinstance(content, dict):
raise Exception("malformed content, not dict")
- params: dict = content['params']
+ params: dict = content.get('params', {})
if not isinstance(params, dict):
raise Exception("malformed params, not dict")
except Exception:
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.