fix: refactor origin check to cover the full spec (#5292)

Author: tomiir

.changeset/shaggy-spiders-cheer.md

@@ -0,0 +1,5 @@
+---
+'@reown/appkit-controllers': patch
+---
+
+Fixes issue where origin check would fail fordomains with nested wildcards

packages/controllers/src/utils/UrlUtils.ts

@@ -0,0 +1,181 @@
+/**
+ * Parses a string as a URL.
+ * @param value - The string to parse.
+ * @returns The parsed URL object or null if invalid.
+ */
+export function parseUrl(value: string): URL | null {
+  try {
+    return new URL(value)
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Parses a schemeless host:port pattern from a string.
+ * @param pattern - The input pattern string.
+ * @returns An object containing the host and optional port.
+ */
+export function parseSchemelessHostPort(pattern: string): { host: string; port?: string } {
+  const parts = pattern.split('/')
+  const withoutPath = parts.length > 0 && parts[0] !== undefined ? parts[0] : ''
+  const lastColon = withoutPath.lastIndexOf(':')
+  if (lastColon === -1) {
+    return { host: withoutPath }
+  }
+
+  return {
+    host: withoutPath.slice(0, lastColon),
+    port: withoutPath.slice(lastColon + 1)
+  }
+}
+
+/**
+ * Parses an origin string into its scheme, host, and optional port.
+ * @param origin - The origin string to parse.
+ * @returns An object with scheme, host, and optional port, or null if invalid.
+ */
+export function parseOriginRaw(
+  origin: string
+): { scheme: string; host: string; port?: string } | null {
+  const schemeIdx = origin.indexOf('://')
+  if (schemeIdx === -1) {
+    return null
+  }
+  const scheme = origin.slice(0, schemeIdx)
+  const start = schemeIdx + 3
+  let end = origin.indexOf('/', start)
+  if (end === -1) {
+    end = origin.length
+  }
+  const hostPort = origin.slice(start, end)
+  const lastColon = hostPort.lastIndexOf(':')
+  if (lastColon === -1) {
+    return { scheme, host: hostPort }
+  }
+
+  return { scheme, host: hostPort.slice(0, lastColon), port: hostPort.slice(lastColon + 1) }
+}
+
+/**
+ * Checks if the current origin matches a non-wildcard pattern.
+ * @param currentOrigin - The current origin as a string.
+ * @param pattern - The pattern string to match.
+ * @returns True if the pattern matches, otherwise false.
+ */
+export function matchNonWildcardPattern(currentOrigin: string, pattern: string): boolean {
+  // If pattern explicitly specifies a scheme, compare origins (ignore path)
+  if (pattern.includes('://')) {
+    const url = parseUrl(pattern)
+
+    return url ? url.origin === currentOrigin : false
+  }
+
+  // Schemeless: treat as hostname[:port]
+  const { host, port } = parseSchemelessHostPort(pattern)
+  // Extract raw host[:port] from the origin string to preserve case-sensitivity
+  const schemeIdx = currentOrigin.indexOf('://')
+  if (schemeIdx !== -1) {
+    const start = schemeIdx + 3
+    let end = currentOrigin.indexOf('/', start)
+    if (end === -1) {
+      end = currentOrigin.length
+    }
+    const rawHostPort = currentOrigin.slice(start, end)
+    if (port !== undefined) {
+      return `${host}:${port}` === rawHostPort
+    }
+
+    const rawHostOnly = rawHostPort.split(':')[0]
+
+    return host === rawHostOnly
+  }
+
+  // Fallback to URL parsing when origin isn't a standard scheme URL
+  const current = parseUrl(currentOrigin)
+  if (!current) {
+    return false
+  }
+  if (port !== undefined) {
+    return host === current.hostname && port === (current.port || undefined)
+  }
+
+  return host === current.hostname
+}
+
+/**
+ * Checks if the current origin matches a wildcard pattern.
+ * @param current - The current origin as a URL object.
+ * @param currentOrigin - The current origin as a string.
+ * @param pattern - The wildcard pattern string to use.
+ * @returns True if matches the wildcard pattern, otherwise false.
+ */
+export function matchWildcardPattern(
+  current: URL,
+  currentOrigin: string,
+  pattern: string
+): boolean {
+  // Extract scheme if present and strip path
+  let working = pattern
+  let scheme: string | undefined = undefined
+  const schemeIdx = working.indexOf('://')
+  if (schemeIdx !== -1) {
+    scheme = working.slice(0, schemeIdx)
+    working = working.slice(schemeIdx + 3)
+  }
+  const slashIdx = working.indexOf('/')
+  if (slashIdx !== -1) {
+    working = working.slice(0, slashIdx)
+  }
+
+  // Split host and optional port
+  let hostPart = working
+  let portPart: string | undefined = undefined
+  const lastColon = hostPart.lastIndexOf(':')
+  if (lastColon !== -1) {
+    portPart = hostPart.slice(lastColon + 1)
+    hostPart = hostPart.slice(0, lastColon)
+  }
+
+  // Validate wildcard usage (only full-label '*')
+  const patternLabels = hostPart.split('.')
+  for (const label of patternLabels) {
+    if (label.includes('*') && label !== '*') {
+      return false
+    }
+  }
+
+  // Scheme must match when specified
+  const currentScheme = current.protocol.replace(/:$/u, '')
+  if (scheme && scheme !== currentScheme) {
+    return false
+  }
+
+  // Port must match exactly when specified (or '*' allows any)
+  if (portPart !== undefined) {
+    if (portPart !== '*' && portPart !== current.port) {
+      return false
+    }
+  }
+
+  /**
+   * Host must have the same number of labels; '*' matches exactly one label.
+   * Uses raw host from the original origin to preserve case-sensitivity.
+   */
+  const raw = parseOriginRaw(currentOrigin)
+  const hostForCompare = raw ? raw.host : current.hostname
+  const currentLabels = hostForCompare.split('.')
+  if (patternLabels.length !== currentLabels.length) {
+    return false
+  }
+
+  for (let i = patternLabels.length - 1; i >= 0; i -= 1) {
+    const p = patternLabels[i]
+    const c = currentLabels[i]
+    if (p !== '*' && p !== c) {
+      return false
+    }
+  }
+
+  return true
+}

packages/controllers/src/utils/WalletConnectUtil.ts

@@ -13,6 +13,7 @@ import {
 
 import { EnsController } from '../controllers/EnsController.js'
 import type { OptionsControllerState } from '../controllers/OptionsController.js'
+import { matchNonWildcardPattern, matchWildcardPattern, parseUrl } from './UrlUtils.js'
 
 interface ListenWcProviderParams {
   universalProvider: UniversalProvider
@@ -70,9 +71,21 @@ export const WcHelpersUtil = {
     USER_REJECTED: 5000,
     USER_REJECTED_METHODS: 5002
   },
+
+  /**
+   * Retrieves the array of supported methods for a given chain namespace.
+   * @param chainNamespace - The chain namespace.
+   * @returns An array of method strings.
+   */
   getMethodsByChainNamespace(chainNamespace: ChainNamespace): string[] {
     return DEFAULT_METHODS[chainNamespace as keyof typeof DEFAULT_METHODS] || []
   },
+
+  /**
+   * Creates a default WalletConnect namespace configuration for the given chain namespace.
+   * @param chainNamespace - The chain namespace.
+   * @returns The default Namespace object.
+   */
   createDefaultNamespace(chainNamespace: ChainNamespace): Namespace {
     return {
       methods: this.getMethodsByChainNamespace(chainNamespace),
@@ -82,6 +95,12 @@ export const WcHelpersUtil = {
     }
   },
 
+  /**
+   * Applies overrides to the base WalletConnect NamespaceConfig.
+   * @param baseNamespaces - The base namespace configuration.
+   * @param overrides - Optional overrides for methods, chains, events, rpcMap.
+   * @returns The resulting NamespaceConfig with overrides applied.
+   */
   applyNamespaceOverrides(
     baseNamespaces: NamespaceConfig,
     overrides?: OptionsControllerState['universalProviderConfigOverride']
@@ -170,6 +189,13 @@ export const WcHelpersUtil = {
     return result
   },
 
+  /**
+   * Creates WalletConnect namespaces based on CAIP network definitions,
+   * optionally applying custom overrides.
+   * @param caipNetworks - Array of CaipNetwork definitions.
+   * @param configOverride - Optional overrides for namespaces.
+   * @returns The resulting NamespaceConfig.
+   */
   createNamespaces(
     caipNetworks: CaipNetwork[],
     configOverride?: OptionsControllerState['universalProviderConfigOverride']
@@ -210,13 +236,25 @@ export const WcHelpersUtil = {
     return this.applyNamespaceOverrides(defaultNamespaces, configOverride)
   },
 
+  /**
+   * Resolves a Reown/ENS name to its first matching address across configured networks.
+   * @param name - The ENS or Reown name to resolve.
+   * @returns The resolved address as a string, or false if not found.
+   */
   resolveReownName: async (name: string) => {
     const wcNameAddress = await EnsController.resolveName(name)
-    const networkNameAddresses = Object.values(wcNameAddress?.addresses) || []
+    const networkNameAddresses = wcNameAddress?.addresses
+      ? Object.values(wcNameAddress.addresses)
+      : []
 
     return networkNameAddresses[0]?.address || false
   },
 
+  /**
+   * Extracts all CAIP network IDs used in given WalletConnect namespaces.
+   * @param namespaces - WalletConnect Namespaces object.
+   * @returns Array of CAIP network IDs (chainNamespace:chainId).
+   */
   getChainsFromNamespaces(namespaces: SessionTypes.Namespaces = {}): CaipNetworkId[] {
     return Object.values(namespaces).flatMap<CaipNetworkId>(namespace => {
       const chains = (namespace.chains || []) as CaipNetworkId[]
@@ -230,6 +268,11 @@ export const WcHelpersUtil = {
     })
   },
 
+  /**
+   * Type guard to check if an object is a WalletConnect session event data.
+   * @param data - The data to check.
+   * @returns True if data matches SessionEventData structure.
+   */
   isSessionEventData(data: unknown): data is WcHelpersUtil.SessionEventData {
     return (
       typeof data === 'object' &&
@@ -246,6 +289,11 @@ export const WcHelpersUtil = {
     )
   },
 
+  /**
+   * Detects if an error object represents a user-rejected WalletConnect request.
+   * @param error - The error object to check.
+   * @returns True if user rejected request, otherwise false.
+   */
   isUserRejectedRequestError(error: unknown) {
     try {
       if (typeof error === 'object' && error !== null) {
@@ -266,42 +314,54 @@ export const WcHelpersUtil = {
     }
   },
 
+  /**
+   * Checks if a current origin is allowed by configured allowed and default origin patterns.
+   * Localhost and 127.0.0.1 are always allowed.
+   * @param currentOrigin - The current web origin.
+   * @param allowedPatterns - Patterns from project configuration.
+   * @param defaultAllowedOrigins - Built-in or default allowed patterns.
+   * @returns True if the origin is allowed, false otherwise.
+   */
   isOriginAllowed(
     currentOrigin: string,
     allowedPatterns: string[],
     defaultAllowedOrigins: string[]
   ): boolean {
-    for (const pattern of [...allowedPatterns, ...defaultAllowedOrigins]) {
-      if (pattern.includes('*')) {
-        // Convert wildcard pattern to regex, escape special chars, replace *, match whole string
-        const escapedPattern = pattern.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')
-        const regexString = `^${escapedPattern.replace(/\\\*/gu, '.*')}$`
-        const regex = new RegExp(regexString, 'u')
+    const patterns = [...allowedPatterns, ...defaultAllowedOrigins]
+    // Spec: empty allowlist allows all origins
+    if (allowedPatterns.length === 0) {
+      return true
+    }
+    // Parse current origin up-front
+    const current = parseUrl(currentOrigin)
+    if (!current) {
+      // Legacy exact string equality when pattern has no wildcard
+      return patterns.some(pattern => !pattern.includes('*') && pattern === currentOrigin)
+    }
+
+    // Local development is always permitted
+    if (current.hostname === 'localhost' || current.hostname === '127.0.0.1') {
+      return true
+    }
 
-        if (regex.test(currentOrigin)) {
+    for (const pattern of patterns) {
+      if (pattern.includes('*')) {
+        if (matchWildcardPattern(current, currentOrigin, pattern)) {
           return true
         }
-      } else {
-        /**
-         * There are some cases where pattern is getting just the origin, where using new URL(pattern).origin will throw an error
-         * thus we a try catch to handle this case
-         */
-        try {
-          if (new URL(pattern).origin === currentOrigin) {
-            return true
-          }
-        } catch (e) {
-          if (pattern === currentOrigin) {
-            return true
-          }
-        }
+        // Keep checking remaining patterns
+      } else if (matchNonWildcardPattern(currentOrigin, pattern)) {
+        return true
       }
     }
 
-    // No match found
     return false
   },
 
+  /**
+   * Attaches event listeners to a UniversalProvider instance for WalletConnect events.
+   * @param params - The listener parameters including handlers for connect, disconnect, etc.
+   */
   listenWcProvider({
     universalProvider,
     namespace,
@@ -384,6 +444,12 @@ export const WcHelpersUtil = {
     }
   },
 
+  /**
+   * Retrieves and parses the unique set of accounts for a given WalletConnect namespace.
+   * @param universalProvider - The UniversalProvider instance.
+   * @param namespace - The chain namespace to extract accounts for.
+   * @returns Array of parsed CaipAddress objects.
+   */
   getWalletConnectAccounts(universalProvider: UniversalProvider, namespace: ChainNamespace) {
     const accountsAdded = new Set<string>()