Description

Due to the usage of an improper regular expression in processing QR-code data, the app may identify a malicious URL such as https://rclm.link.evil.example.com as the shortened URL of a legitimate proof request.

This issue occurs in reclaim-app/src/components/QRScanner/index.tsx:

const RECLAIM_SHORTENED_URL_REGEX = /^https:\/\/rclm\.link/

const retrieveDataType = (data: string): RetreivedDataType => {
  if (data.match(RECLAIM_SHARE_REGEX) || data.match(RECLAIM_SHORTENED_URL_REGEX)) {
    return 'requested-proofs'
  }

Impact

Users can be more susceptible to phishing since the URL looks trusted and the JSON payload is hidden.

Recommendations

The Reclaim app should properly validate the host of the URL by ensuring the link starts with https://rclm.link/.

Remediation