coinos-server.git/routes/lnurl.ts, branch regtest-fulcrum

lnurl: SSRF-guard user-supplied URL fetches + validate zap events

2026-06-16T06:35:50Z

The /lnurl/proxy, /decode and /encode handlers fetched an arbitrary user-supplied URL via got() and returned the body — an unauthenticated SSRF reaching internal services. Route those fetches through a new safeGot() that rejects hosts resolving to loopback/private/link-local/ CGNAT/metadata ranges, re-validates on each redirect hop, restricts the scheme to http(s), and caps timeout + response size. Also validate the NIP-57 zap request (kind 9734 + signature) before storing it, instead of trusting the client-supplied event. These endpoints can't be removed — they back lightning-address/LNURL parsing and resolution in the wallet UI. Co-Authored-By: Claude Opus 4.8 (1M context)

lnurl proxy

2026-03-28T06:41:08Z

fix lnurl description_hash mismatch

2026-02-25T20:05:46Z

Co-Authored-By: Claude Opus 4.6

consult archive for older payments

2026-01-30T20:31:59Z

rotate server key

2025-09-30T04:50:57Z

only record invoice if amount is defined

2025-08-01T04:45:58Z

always define minSendable and maxSendable

2025-08-01T04:39:54Z

leave minSendable undefined if no amount

2025-08-01T04:17:04Z

respect null tips

2025-07-20T05:55:10Z

record prompt setting for lnurl invoices

2025-07-19T15:42:13Z