taler-typescript-core

commit cea0d5c2d7c607cecabdc42d353c2353340bb34b
parent 9eaae59b79fdaf8385e84c944383e7e7571d721b
Author: Florian Dold <dold@taler.net>
Date:   Tue, 21 Jul 2026 11:44:05 +0200

util: build the full payto by concatenation, not through a URL parser

new URL resolves dot segments, strips control characters and re-encodes the
query, so the string covered by H_PAYTO and the string submitted for the
wire transfer could name different accounts.

Diffstat:
M
packages/taler-util/src/payto.ts
 | 
10
+++++++---

1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/packages/taler-util/src/payto.ts b/packages/taler-util/src/payto.ts
@@ -243,10 +243,14 @@ export namespace Paytos {
    */
   export function toFullString(p: URI): FullPaytoString {
     const target = p.targetType ?? (p as PaytoUnsupported).target;
-    const url = new URL(`${PAYTO_PREFIX}${target}/${p.fullPath}`);
     const paramList = !p.params ? [] : Object.entries(p.params);
-    url.search = createSearchParams(paramList);
-    return url.href as FullPaytoString;
+    const search = createSearchParams(paramList);
+    // Concatenate directly rather than via a URL parser, as
+    // toNormalizedString does: `new URL` resolves dot segments, strips tab,
+    // LF and CR and re-encodes the query, so the full payto would stop being
+    // the string TALER_full_payto_hash covers.
+    const query = search ? `?${search}` : "";
+    return `${PAYTO_PREFIX}${target}/${p.fullPath}${query}` as FullPaytoString;
   }
 
   export function parseReservePub(