I encountered a bitcoin-uri fuzzing crash that could just be expected behavior within the spec that just is a little weird.
Parsing this uri Bitcoin:12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX6=q3Ҁf&pj=\u{3}\0\0\0\0\0\0http\r\r\r\r\r\r\r\r\r:\r\r\\.onion\\\\\\\\\\q3 and then re-serializing it in a roundtrip results in a loss of data. Resulting uri bitcoin:12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX?pj=HTTP://.ONION/////q3 my question is whether it is expected that uris may not always be able to be de-serialized in a roundtrip and end up the same, especially when considering unknown or unsupported data.
It is my intuition that a uri should retain the unknown data so that it is not lost just because payjoin does not understand how to parse it but maybe it is just expected that an external uri should be cloned or passed as a ref into parsing programs.
Here is a basic unittest to show how this happens.
#[test]
fn test_fuzz_crash() {
use Uri;
let valid_uri = "bitcoin:12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX?amount=0.01&pjos=0&pj=HTTPS://EXAMPLE.COM/%23OH1QYPM5JXYNS754Y4R45QWE336QFX6ZR8DQGVQCULVZTV20TFVEYDMFQC";
let round_trip = valid_uri.parse::<Uri<_>>().unwrap().assume_checked().to_string();
println!("{}\n", valid_uri.parse::<Uri<_>>().unwrap().assume_checked().to_string());
assert_eq!(valid_uri, round_trip);
let uri = "Bitcoin:12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX?6=q3Ҁf&pj=\u{3}\0\0\0\0\0\0http\r\r\r\r\r\r\r\r\r:\r\r\\.onion\\\\\\\\\\q3";
let round_trip = uri.parse::<Uri<_>>().unwrap().assume_checked().to_string();
println!("{}", uri.parse::<Uri<_>>().unwrap().assume_checked().to_string());
assert_eq!(uri, round_trip);
}
I encountered a bitcoin-uri fuzzing crash that could just be expected behavior within the spec that just is a little weird.
Parsing this uri
Bitcoin:12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX6=q3Ҁf&pj=\u{3}\0\0\0\0\0\0http\r\r\r\r\r\r\r\r\r:\r\r\\.onion\\\\\\\\\\q3and then re-serializing it in a roundtrip results in a loss of data. Resulting uribitcoin:12c6DSiU4Rq3P4ZxziKxzrL5LmMBrzjrJX?pj=HTTP://.ONION/////q3my question is whether it is expected that uris may not always be able to be de-serialized in a roundtrip and end up the same, especially when considering unknown or unsupported data.It is my intuition that a uri should retain the unknown data so that it is not lost just because payjoin does not understand how to parse it but maybe it is just expected that an external uri should be cloned or passed as a ref into parsing programs.
Here is a basic unittest to show how this happens.