taler-typescript-core

commit 69ce816b345284c10bbaab6217c66e6e5c8db354
parent 778e31da67785fe48d9bd77b4b8f823a11a0b4fc
Author: Florian Dold <dold@taler.net>
Date:   Tue, 21 Jul 2026 00:40:41 +0200

util: fail closed on unknown account restriction types

checkAccountRestriction had no default case, so an unrecognized restriction
type allowed the account, and a malformed regex from the exchange escaped as
an uncaught SyntaxError.

Diffstat:
M
packages/taler-util/src/account-restrictions.ts
 | 
16
+++++++++++++++-

1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/packages/taler-util/src/account-restrictions.ts b/packages/taler-util/src/account-restrictions.ts
@@ -26,7 +26,17 @@ export function checkAccountRestriction(
       case "deny":
         return { ok: false };
       case "regex": {
-        const regex = new RegExp(myRestriction.payto_regex);
+        let regex: RegExp;
+        try {
+          regex = new RegExp(myRestriction.payto_regex);
+        } catch (e) {
+          // A pattern we cannot compile is a restriction we cannot honour.
+          return {
+            ok: false,
+            hint: myRestriction.human_hint,
+            hintI18n: myRestriction.human_hint_i18n,
+          };
+        }
         if (!regex.test(paytoUri)) {
           return {
             ok: false,
@@ -34,7 +44,11 @@ export function checkAccountRestriction(
             hintI18n: myRestriction.human_hint_i18n,
           };
         }
+        break;
       }
+      default:
+        // Fail closed, as the C implementation does.
+        return { ok: false };
     }
   }
   return {