Fix TypeError crash in SEP-7 replace parameter parsing

@stellar/typescript-wallet-sdk/src/walletSdk/Types/sep7.ts

@@ -6,6 +6,7 @@ export enum Sep7OperationType {
 }
 
 export const URI_MSG_MAX_LENGTH = 300;
+export const URI_REPLACE_MAX_LENGTH = 4096;
 
 export type Sep7Replacement = {
   id: string;

@stellar/typescript-wallet-sdk/src/walletSdk/Uri/sep7Parser.ts

@@ -7,6 +7,7 @@ import {
   IsValidSep7UriResult,
   WEB_STELLAR_SCHEME,
   URI_MSG_MAX_LENGTH,
+  URI_REPLACE_MAX_LENGTH,
 } from "../Types";
 import {
   Sep7InvalidUriError,
@@ -162,16 +163,55 @@ export const sep7ReplacementsFromString = (
     return [];
   }
 
+  if (replacements.length > URI_REPLACE_MAX_LENGTH) {
+    throw new Sep7InvalidUriError(
+      "the 'replace' parameter exceeds the maximum allowed length",
+    );
+  }
+
   const [txrepString, hintsString] = replacements.split(HINT_DELIMITER);
-  const hintsList = hintsString.split(LIST_DELIMITER);
 
-  const hintsMap: { [id: string]: string } = {};
+  const txrepList = txrepString.split(LIST_DELIMITER);
+  const txrepIds: string[] = [];
+  txrepList.forEach((item) => {
+    const parts = item.split(ID_DELIMITER);
+    if (parts.length < 2 || !parts[0] || !parts[1]) {
+      throw new Sep7InvalidUriError(
+        "the 'replace' parameter has an entry missing a path or reference identifier",
+      );
+    }
+    const id = parts[1];
+    if (txrepIds.indexOf(id) === -1) {
+      txrepIds.push(id);
+    }
+  });
 
-  hintsList
-    .map((item) => item.split(ID_DELIMITER))
-    .forEach(([id, hint]) => (hintsMap[id] = hint));
+  const hintsMap = Object.create(null) as Record<string, string>;
 
-  const txrepList = txrepString.split(LIST_DELIMITER);
+  if (hintsString) {
+    const hintsList = hintsString.split(LIST_DELIMITER);
+    hintsList.forEach((item) => {
+      const parts = item.split(ID_DELIMITER);
+      if (parts.length < 2 || !parts[0] || !parts[1]) {
+        throw new Sep7InvalidUriError(
+          "the 'replace' parameter has a hint entry missing an identifier or hint value",
+        );
+      }
+      hintsMap[parts[0]] = parts[1];
+    });
+  }
+
+  const hintIds = Object.keys(hintsMap);
+
+  const isBalanced =
+    txrepIds.length === hintIds.length &&
+    txrepIds.every((id) => Object.prototype.hasOwnProperty.call(hintsMap, id));
+
+  if (!isBalanced) {
+    throw new Sep7InvalidUriError(
+      "the 'replace' parameter has unbalanced reference identifiers",
+    );
+  }
 
   const replacementsList = txrepList
     .map((item) => item.split(ID_DELIMITER))

@stellar/typescript-wallet-sdk/test/sep7.test.ts

@@ -11,7 +11,10 @@ import {
   sep7ReplacementsFromString,
   sep7ReplacementsToString,
 } from "../src";
-import { Sep7OperationType } from "../src/walletSdk/Types";
+import {
+  Sep7OperationType,
+  URI_REPLACE_MAX_LENGTH,
+} from "../src/walletSdk/Types";
 import {
   Sep7InvalidUriError,
   Sep7LongMsgError,
@@ -798,6 +801,45 @@ describe("sep7Parser", () => {
     );
   });
 
+  it("sep7ReplacementsFromString() throws on replace string without hints (no ';' delimiter)", () => {
+    const str = "sourceAccount:X,operations[0].sourceAccount:Y";
+    expect(() => sep7ReplacementsFromString(str)).toThrow(Sep7InvalidUriError);
+  });
+
+  it("sep7ReplacementsFromString() throws on single replacement without hints", () => {
+    const str = "sourceAccount:X";
+    expect(() => sep7ReplacementsFromString(str)).toThrow(Sep7InvalidUriError);
+  });
+
+  it("sep7ReplacementsFromString() throws on unbalanced identifiers", () => {
+    // Spec example: {X} on left but {Y} on right should be rejected
+    const str = "sourceAccount:X;Y:The account";
+    expect(() => sep7ReplacementsFromString(str)).toThrow(Sep7InvalidUriError);
+  });
+
+  it("sep7ReplacementsFromString() throws when replace string exceeds URI_REPLACE_MAX_LENGTH", () => {
+    const longPath = "a".repeat(URI_REPLACE_MAX_LENGTH);
+    const str = `${longPath}:X;X:hint`;
+    expect(str.length).toBeGreaterThan(URI_REPLACE_MAX_LENGTH);
+    expect(() => sep7ReplacementsFromString(str)).toThrow(Sep7InvalidUriError);
+    expect(() => sep7ReplacementsFromString(str)).toThrow(
+      "the 'replace' parameter exceeds the maximum allowed length",
+    );
+  });
+
+  it("sep7ReplacementsFromString() returns empty array for undefined/empty input", () => {
+    expect(sep7ReplacementsFromString(undefined)).toEqual([]);
+    expect(sep7ReplacementsFromString("")).toEqual([]);
+  });
+
+  it("Sep7Tx.getReplacements() throws on replace param missing hints", () => {
+    const uri = new Sep7Tx(
+      `web+stellar:tx?xdr=test&replace=${encodeURIComponent("sourceAccount:X")}`,
+    );
+
+    expect(() => uri.getReplacements()).toThrow(Sep7InvalidUriError);
+  });
+
   it("sep7ReplacementsToString outputs the right string", () => {
     const expected =
       "sourceAccount:X,operations[0].sourceAccount:Y,operations[1].destination:Y;X:account from where you want to pay fees,Y:account that needs the trustline and which will receive the new tokens";