Make `LSPS5ServiceEvent::SendWebhookNotification::headers` a Vec
What changed, and why it matters
This commit is a straightforward internal API refactor: it changes how three HTTP webhook headers are packaged in an event from a key-value map (HashMap) to a list of pairs (Vec). The commit message explicitly states the reason is to reduce complexity and improve compatibility with language bindings, not to fix a security bug. There is no security relevance in the diff itself.
No security action required. Treat as a normal API ergonomics / bindings-compatibility change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies LSPS5ServiceEvent::SendWebhookNotification’s headers field from HashMap
Changed components
lightning-liquidity/src/lsps5/event.rslightning-liquidity/src/lsps5/service.rslightning-liquidity/tests/lsps5_integration_tests.rsInspect captured patch +14 / −10
diff --git a/lightning-liquidity/src/lsps5/event.rs b/lightning-liquidity/src/lsps5/event.rs
index a9c1052..c122738 100644
--- a/lightning-liquidity/src/lsps5/event.rs
+++ b/lightning-liquidity/src/lsps5/event.rs
@@ -15,7 +15,6 @@ use alloc::vec::Vec;
use bitcoin::secp256k1::PublicKey;
use lightning::impl_writeable_tlv_based_enum;
-use lightning::util::hash_tables::HashMap;
use super::msgs::LSPS5AppName;
use super::msgs::LSPS5Error;
@@ -70,7 +69,7 @@ pub enum LSPS5ServiceEvent {
/// - `"x-lsps5-timestamp"`: with the timestamp in RFC3339 format (`"YYYY-MM-DDThh:mm:ss.uuuZ"`).
/// - `"x-lsps5-signature"`: with the signature of the notification payload, signed using the LSP's node ID.
/// Other custom headers may also be included as needed.
- headers: HashMap<String, String>,
+ headers: Vec<(String, String)>,
},
}
diff --git a/lightning-liquidity/src/lsps5/service.rs b/lightning-liquidity/src/lsps5/service.rs
index f7f5e06..0b5a901 100644
--- a/lightning-liquidity/src/lsps5/service.rs
+++ b/lightning-liquidity/src/lsps5/service.rs
@@ -629,12 +629,12 @@ where
let signature_hex = self.sign_notification(¬ification, ×tamp)?;
- let mut headers: HashMap<String, String> = [("Content-Type", "application/json")]
+ let mut headers: Vec<(String, String)> = [("Content-Type", "application/json")]
.into_iter()
.map(|(k, v)| (k.to_string(), v.to_string()))
.collect();
- headers.insert("x-lsps5-timestamp".into(), timestamp.to_rfc3339());
- headers.insert("x-lsps5-signature".into(), signature_hex);
+ headers.push(("x-lsps5-timestamp".into(), timestamp.to_rfc3339()));
+ headers.push(("x-lsps5-signature".into(), signature_hex));
event_queue_notifier.enqueue(LSPS5ServiceEvent::SendWebhookNotification {
counterparty_node_id,
diff --git a/lightning-liquidity/tests/lsps5_integration_tests.rs b/lightning-liquidity/tests/lsps5_integration_tests.rs
index 41af2e8..80707a6 100644
--- a/lightning-liquidity/tests/lsps5_integration_tests.rs
+++ b/lightning-liquidity/tests/lsps5_integration_tests.rs
@@ -17,7 +17,7 @@ use lightning::ln::functional_test_utils::{
};
use lightning::ln::msgs::Init;
use lightning::ln::peer_handler::CustomMessageHandler;
-use lightning::util::hash_tables::{HashMap, HashSet};
+use lightning::util::hash_tables::HashSet;
use lightning::util::test_utils::TestStore;
use lightning_liquidity::events::LiquidityEvent;
use lightning_liquidity::lsps0::ser::LSPSDateTime;
@@ -288,15 +288,20 @@ impl TimeProvider for MockTimeProvider {
}
}
-fn extract_ts_sig(headers: &HashMap<String, String>) -> (LSPSDateTime, String) {
+fn extract_ts_sig(headers: &Vec<(String, String)>) -> (LSPSDateTime, String) {
let timestamp = headers
- .get("x-lsps5-timestamp")
+ .iter()
+ .find_map(|(key, value)| (key == "x-lsps5-timestamp").then(|| value))
.expect("missing x-lsps5-timestamp header")
.parse::<LSPSDateTime>()
.expect("failed to parse x-lsps5-timestamp header");
- let signature =
- headers.get("x-lsps5-signature").expect("missing x-lsps5-signature header").to_owned();
+ let signature = headers
+ .iter()
+ .find(|(key, _)| key == "x-lsps5-signature")
+ .expect("missing x-lsps5-signature header")
+ .1
+ .clone();
(timestamp, signature)
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.