lightning-payer-proof: flag the uniffi record's untrusted strings
What the developer wrote
Authored by auto-pr-bot
lightning-payer-proof: flag the uniffi record's untrusted strings
The uniffi record hands its three free-text fields back as plain
`String`s, copied straight out of the proof with no sanitization, but
only `offer_description` warned about that. `offer_issuer` and
`proof_note` are just as attacker-controlled, so carry the same warning
on both.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
What changed, and why it matters
This commit only adds documentation comments warning developers that two text fields returned by a UniFFI record are untrusted and should be sanitized before display. It does not change any code behavior, add sanitization, or fix an active vulnerability. It is a defensive documentation improvement for a potential injection/display-risk issue.
Treat as a low-priority hygiene/documentation patch. If using these strings in UI or logs, ensure downstream callers sanitize control characters. Consider following up with runtime sanitization or a safe display type rather than relying solely on doc comments.
Security signals we found
untrusted attacker-controlled strings exposed through FFI binding
missing runtime sanitization of free-text proof fields
documentation-only warning about control-character injection/display risks
partial hardening (warning only, no code change)
Evidence from the diff
The change adds doc comments to VerifiedPayerProof::offer_issuer and VerifiedPayerProof::proof_note in lightning-payer-proof/uniffi/src/lib.rs, noting they are ‘Untrusted text; sanitize control characters before displaying.’ The fields were already exposed as plain Strings copied from the proof. The commit does not implement sanitization or alter parsing/serialization logic. A similar warning already existed for offer_description.
Changed components
lightning-payer-proof/uniffi/src/lib.rsVerifiedPayerProof UniFFI recordoffer_issuer fieldproof_note fieldInspect captured patch +4 / −0
### lightning-payer-proof/uniffi/src/lib.rs
@@ -80,8 +80,12 @@ pub struct VerifiedPayerProof {
/// The offer issuer, if disclosed.
///
/// A human-readable label chosen by whoever built the offer, not an identity.
+ ///
+ /// Untrusted text; sanitize control characters before displaying.
pub offer_issuer: Option<String>,
/// A note the payer attached when building the proof, if any.
+ ///
+ /// Untrusted text; sanitize control characters before displaying.
pub proof_note: Option<String>,
/// The merkle root of the invoice the issuer signed, 32 bytes.
pub merkle_root: Vec<u8>,Why this scored 30/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.