Skip to content

Frontend: QueuePage looksLikeStellar regex admits invalid base32 characters — 0,1,8,9 accepted #188

Description

@k-deejah

Difficulty: Advanced

Problem

1. looksLikeStellar regex uses [A-Z0-9] instead of the correct Stellar base32 alphabet [A-Z2-7]
frontend/src/pages/QueuePage.tsx line 20: const looksLikeStellar = (v: string) => /^G[A-Z0-9]{55}$/.test(v).

Stellar public keys use Strkey encoding which is base32 using the alphabet A-Z2-7. The regex allows 0, 1, 8, and 9 which are not valid base32 characters. A key containing these characters would pass frontend validation, be submitted to the API, and then fail Stellar SDK validation downstream — producing a confusing error far from the input site.

2. The same incorrect regex pattern may be copied elsewhere
The validateStellarAddress middleware in backend/src/middleware/validateStellarAddress.ts uses /^G[A-Z2-7]{55}$/ (correct). But the frontend duplicates the validation logic with the wrong pattern. This divergence means frontend and backend validation allow different character sets.

3. No tests for the frontend regex — invalid characters silently pass
There are no frontend tests (issue #16 covers adding a test suite) but this specific regex bug would not be caught even once tests are added unless a regression test is written for it.

Impact: Users can submit malformed keys that appear valid in the UI, pass frontend validation, fail at the API layer, and receive a confusing HTTP 400 error with no clear indication that the key format was wrong at input time.

Proposed Solution

  • Fix the regex to /^G[A-Z2-7]{55}$/ matching the correct Stellar Strkey base32 alphabet.
  • Extract this regex into a shared constant in frontend/src/utils/stellar.ts (or reuse validateAddress from @lineproof/sdk) to prevent future divergence.
  • Apply the same fix to the DashboardPage public key input (which also has manual key entry).
  • Add a test case in the frontend test suite (once issue Frontend: No UI for enrollment cancellation, escrow management, or post-enrollment status #16 is resolved) for the regex.

Acceptance Criteria

  • looksLikeStellar regex changed to /^G[A-Z2-7]{55}$/
  • Shared isValidStellarAddress(s) utility created in frontend/src/utils/stellar.ts
  • QueuePage and DashboardPage both use the shared utility
  • Characters 0, 1, 8, 9 in a key now produce the input validation error
  • Valid Stellar public keys (all uppercase A-Z and 2-7) still pass
  • Frontend regex matches the backend validateStellarAddress regex exactly

Contributor Note

If assigned, your PR must show at least three invalid keys that were previously accepted (containing 0,1,8,9) and confirm they now produce the validation error. Also confirm valid test keys still pass.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignbugSomething isn't workingfrontendsecurity

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions