What the developer wrote
Authored by f321x
plugin: nwc: handle 'null' params in request
Some clients send 'params: null' instead of 'params: {}' or no
params key at all.
What changed, and why it matters
This commit fixes a small bug in Electrum's NWC (Nostr Wallet Connect) plugin where a client sending 'params: null' in a request could cause the server to crash or behave unexpectedly. The fix treats null the same as missing or empty parameters, and improves the error message if something still goes wrong.
Apply the patch. Consider adding explicit JSON Schema validation for NWC request content to prevent similar edge cases.
Security signals we found
Input validation bypass due to null value
Potential denial-of-service via malformed JSON-RPC-style request
Crash or exception in request handling loop
Evidence from the diff
In electrum/plugins/nwc/nwcserver.py, the code previously used content.get(‘params’, {}) to default to an empty dict when ‘params’ was absent. However, when ‘params’ was explicitly set to JSON null, the returned value was None, bypassing the isinstance(params, dict) check and causing a downstream exception. The patch changes the default to content.get(‘params’) or {}, so null is coalesced to {}. It also updates the exception message to include the full content for debugging.
Changed components
electrum/plugins/nwc/nwcserver.pyNWCServer request parsing loopInspect captured patch +2 / −2
diff --git a/electrum/plugins/nwc/nwcserver.py b/electrum/plugins/nwc/nwcserver.py
index 6d6df54..6e124d9 100644
--- a/electrum/plugins/nwc/nwcserver.py
+++ b/electrum/plugins/nwc/nwcserver.py
@@ -344,9 +344,9 @@ class NWCServer(Logger, EventListener):
content = json.loads(content)
if not isinstance(content, dict):
raise Exception("malformed content, not dict")
- params: dict = content.get('params', {})
+ params: dict = content.get('params') or {} # some clients send 'params: null' or no params key at all
if not isinstance(params, dict):
- raise Exception("malformed params, not dict")
+ raise Exception(f"malformed params, not dict: {content=}")
except Exception:
self.logger.debug(f"Invalid request event content: {event.content}", exc_info=True)
continue
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.