Skip to content

Parse only the query component in uriSchemePresentment() - #2033

Open
kthrtty wants to merge 1 commit into
openwallet-foundation:mainfrom
kthrtty:fix/uri-scheme-query-parsing
Open

kthrtty wants to merge 1 commit into
openwallet-foundation:mainfrom
kthrtty:fix/uri-scheme-query-parsing

Conversation

@kthrtty

@kthrtty kthrtty commented Sep 24, 2026

Copy link
Copy Markdown
Contributor

Fixes #2032

parseUrlEncodedParameters() splits on & and then on the first =, with no notion of a scheme or a ?, so handing it a whole URI folds the scheme into the first key. openid4vp://?request_uri=... yielded the single key openid4vp://?request_uri and the lookup threw No request_uri.

The call only worked when some other parameter preceded request_uri. Even then client_id itself was unreadable for the same reason, its key being openid4vp://?client_id; it simply went unused, which is why this stayed hidden.

OpenID4VP 1.0 puts client_id inside the signed request object and section 5.10 lets the Authorization Request reference it by request_uri, so a verifier that signs its request has no obligation to repeat client_id in the outer query. request_uri on its own is a request a conforming verifier may send.

Approach

Takes the substring after the first ? rather than going through Url, whose handling of a custom scheme with an empty authority is less obvious in this context. A URI with no ? yields no parameters, which reaches the same No request_uri as before.

The helper is internal so the parsing can be tested on its own; uriSchemePresentment() itself needs an HTTP client and a PresentmentSource.

Verification

UriSchemeQueryParsingTest covers five cases: request_uri alone, request_uri after client_id, the resulting key names, request_uri_method, and a URI with no query.

Three of them fail against the previous implementation, so they hold the regression rather than merely passing:

FAIL  requestUriAsOnlyParameter
FAIL  requestUriAfterClientId
FAIL  schemeIsNotFoldedIntoTheFirstKey
ok    requestUriMethodIsRead
ok    noQueryYieldsNoParameters

Ran :multipaz:jvmTest and detektMetadataCommonMain.

Found while wiring the iOS wallet's custom URL schemes (openwallet-foundation/multipaz-wallet#35).

Not included

No CHANGELOG entry: the 0.102.0 section lists feature-sized items and this is a small parsing fix. Happy to add one if you consider it notable.

parseUrlEncodedParameters() splits on & and then on the first =, with no
notion of a scheme or a ?, so handing it a whole URI folds the scheme into the
first key. openid4vp://?request_uri=... yielded the single key
openid4vp://?request_uri and the lookup threw "No request_uri". The call only
worked when some other parameter preceded it, and even then client_id itself
was unreadable for the same reason -- it just went unused.

OpenID4VP 1.0 puts client_id inside the signed request object and section 5.10
lets the Authorization Request reference it by request_uri, so a verifier that
signs its request has no obligation to repeat client_id in the outer query.
request_uri on its own is a request a conforming verifier may send.

Takes the substring after the first ? rather than going through Url, whose
handling of a custom scheme with an empty authority is less obvious here. A
URI with no ? yields no parameters, which reaches the same "No request_uri".

Test: added UriSchemeQueryParsingTest, five cases covering request_uri alone,
request_uri after client_id, the key names, request_uri_method, and a URI with
no query. Confirmed three of them fail against the previous implementation.
Ran detektMetadataCommonMain.

Signed-off-by: Tatsuya Katsuhara <kthrtty@gmail.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

uriSchemePresentment() parses the whole URI as a query string, so a leading request_uri is not found

1 participant