2.2.0

[jakubuid]

Description

Resolves # (issue)

How Has This Been Tested?

Due Dilligence

• Breaking change
• Requires a documentation update

[claude]

Claude finished @jakubuid's task in 2m 9s —— View job

---

PR Review Complete

Reviewed PR #257 (2.2.0 release) - develop → main

---

Issues Found

Issue 1: Unvalidated JavaScript message data in WebView handler

ID: paydatacoll-unvalidated-message-7f4a
File: Example/WalletApp/PresentationLayer/Wallet/Pay/PayDataCollectionWebView.swift:100
Severity: HIGH
Category: security

WebView message handler accepts arbitrary dictionary data from JavaScript without validating data types or sanitizing values before using them. Malicious web content could inject unexpected data types or XSS payloads.

Recommendation: Add input validation and type checking:

guard let body = message.body as? [String: Any],
      let type = body["type"] as? String,
      type.rangeOfCharacter(from: CharacterSet.alphanumerics.inverted.subtracting(CharacterSet(charactersIn: "_"))) == nil else {
    print("💳 [PayWebView] Invalid message format: \(message.body)")
    onError("Invalid message format")
    return
}

// Validate string fields
if let fullName = body["fullName"] as? String {
    guard fullName.count <= 256 else { return onError("Invalid name length") }
}
if let dob = body["dob"] as? String {
    guard dob.matches(regex: "^\\d{4}-\\d{2}-\\d{2}$") else { return onError("Invalid date format") }
}

---

Issue 2: Missing URL validation for WebView loads

ID: paydatacoll-url-validation-3c8b
File: Example/WalletApp/PresentationLayer/Wallet/Pay/PayDataCollectionWebView.swift:76
Severity: HIGH
Category: security

WebView loads arbitrary URLs without validating the scheme or domain. If collectData.url from API response is compromised or modified, malicious URLs could be loaded.

Recommendation: Add URL validation before loading:

// Validate URL before loading
guard ["https", "wss"].contains(url.scheme?.lowercased()),
      let host = url.host,
      !host.isEmpty else {
    context.coordinator.onError("Invalid URL scheme or host")
    return webView
}

// Optionally validate against allowlist of trusted domains
let trustedDomains = ["reown.com", "walletconnect.com", "walletconnect.org"]
guard trustedDomains.contains(where: { host.hasSuffix($0) }) else {
    context.coordinator.onError("Untrusted domain")
    return webView
}

webView.load(URLRequest(url: url))

---

Issue 3: Hardcoded sensitive test data in production code

ID: paypresente-hardcoded-test-data-9a2f
File: Example/WalletApp/PresentationLayer/Wallet/Pay/PayPresenter.swift:22
Severity: MEDIUM
Category: code_quality

Test data ("Test User", "1990-01-15", "New York, USA") hardcoded as defaults for IC form prefill. This is marked as "PoC" but exists in production code path.

Recommendation: Remove hardcoded test values or move them to debug-only configuration:

#if DEBUG
private static let defaultPrefillFullName = "Test User"
private static let defaultPrefillDob = "1990-01-15"
private static let defaultPrefillPobAddress = "New York, USA"
#else
private static let defaultPrefillFullName: String? = nil
private static let defaultPrefillDob: String? = nil
private static let defaultPrefillPobAddress: String? = nil
#endif

---

Issue 4: Weak error handling in certificate script

ID: createcerti-weak-error-handling-b1c4
File: scripts/create-certificates.sh:66
Severity: MEDIUM
Category: code_quality

Certificate creation script suppresses stderr when creating branches and doesn't distinguish between "branch exists" errors and permission/network errors, making debugging difficult.

Recommendation: Improve error detection and messaging:

if ! CREATE_OUTPUT=$(gh api repos/${CERTS_REPO}/git/refs \
  -f ref="refs/heads/${BRANCH_NAME}" \
  -f sha="${MASTER_SHA}" 2>&1); then
  if echo "$CREATE_OUTPUT" | grep -q "already exists"; then
    echo "❌ Error: Branch ${BRANCH_NAME} already exists"
  elif echo "$CREATE_OUTPUT" | grep -q "Not Found"; then
    echo "❌ Error: Repository ${CERTS_REPO} not found or inaccessible"
  else
    echo "❌ Error: Failed to create branch: $CREATE_OUTPUT"
  fi
  exit 1
fi

---

Issue 5: Unvalidated Base64 decode in prefill parameter

ID: paypresente-unvalidated-base64-8d3a
File: Example/WalletApp/PresentationLayer/Wallet/Pay/PayPresenter.swift:181
Severity: MEDIUM
Category: security

Schema JSON parsed without validation. Malformed schema from API could cause crashes or unexpected behavior. JSON parsing errors are silently ignored.

Recommendation: Add error logging and validation:

guard let schemaData = schema.data(using: .utf8) else {
    print("💳 [Pay] Warning: Invalid schema encoding")
    return nil
}

guard let schemaJson = try? JSONSerialization.jsonObject(with: schemaData) as? [String: Any] else {
    print("💳 [Pay] Warning: Schema is not valid JSON")
    return nil
}

guard let requiredArray = schemaJson["required"] as? [String], !requiredArray.isEmpty else {
    print("💳 [Pay] Warning: Schema missing 'required' array")
    return nil
}

---

Issue 6: Race condition in WebView isLoading state

ID: paydatacoll-race-condition-5e7b
File: Example/WalletApp/PresentationLayer/Wallet/Pay/PayDataCollectionWebView.swift:151
Severity: LOW
Category: code_quality

Multiple navigation delegate methods update isLoading state with DispatchQueue.main.async. If navigation events fire rapidly, final state may be incorrect.

Recommendation: Use synchronous main actor updates or track navigation state explicitly:

@MainActor
func webView(_ webView: WKWebView, didStartProvisionalNavigation navigation: WKNavigation!) {
    isLoading = true
}

@MainActor
func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
    isLoading = false
}

---

Automated Checks

✅ No external domain URLs detected in changed files
✅ No static resource cache-control issues detected
✅ No GitHub Actions workflow security issues (workflow uses manual trigger only, no PR triggers)

---

Summary

Found 6 issues: 2 HIGH severity (WebView security), 3 MEDIUM severity (test data, error handling, validation), 1 LOW severity (race condition). Primary concerns are WebView message injection and URL validation. Recommend addressing HIGH severity issues before release.

---

[sonarqubecloud]

Quality Gate failed

Failed conditions
7.1% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud