Skip to content

Security: validate keystore nicknames - #651

Merged
rem1niscence merged 3 commits into
developmentfrom
fix/validate-keystore-nickname
Nov 10, 2026
Merged

rem1niscence merged 3 commits into
developmentfrom
fix/validate-keystore-nickname

Conversation

@rem1niscence

Copy link
Copy Markdown
Collaborator

Description

Validates keystore nicknames on import. A nickname is now required and may only contain letters, digits, - and _.

Related Issues

Closes: #N/A

Changes Made

  • Added crypto.ValidateNickname(), backed by the ^[a-zA-Z0-9_-]+$ regex
  • Added tests for valid and invalid nicknames, and for both import paths rejecting bad input without changing the keystore

Checklist

  • I have tested the changes locally and verified they work as intended.
  • I have appropriately titled my branch issue-#<issue-number>.
  • I have run re-built the web-wallet and/or block explorer (if applicable).
  • I have run npm run prettier to format the web-wallet and/or block explorer (if applicable)
  • I have updated documentation (if applicable).
  • I have included tests for the changes (if applicable).

Additional Notes

Breaking change: imports with an empty nickname now fail. Callers that relied on importing keys without a nickname (CLI keystore-import, keystore-import-raw, keystore-new-key, and the wallet) must now provide a valid one. Nicknames already stored in a keystore are not re-validated.

@rem1niscence
rem1niscence merged commit a526604 into development Nov 10, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants