scanner: reject duplicate BIP21 parameter keys (#63)

src/modules/scanner/implementation.rs

@@ -317,18 +317,17 @@ impl Scanner {
 
         let address = parts[0].to_string();
 
-        let params = if parts.len() > 1 {
-            parts[1]
-                .split('&')
-                .filter_map(|param| {
-                    param
-                        .split_once('=')
-                        .map(|(k, v)| (k.to_string(), v.to_string()))
-                })
-                .collect::<HashMap<String, String>>()
-        } else {
-            HashMap::new()
-        };
+        let mut params = HashMap::new();
+        if parts.len() > 1 {
+            for param in parts[1].split('&') {
+                if let Some((k, v)) = param.split_once('=') {
+                    if params.contains_key(k) {
+                        return Err(DecodingError::InvalidFormat);
+                    }
+                    params.insert(k.to_string(), v.to_string());
+                }
+            }
+        }
 
         let amount_satoshis = params
             .get("amount")

src/modules/scanner/tests.rs

@@ -199,8 +199,19 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_invalid_lightning_invoice() {
+    fn test_invalid_lightning_invoice_sync() {
         let invoice = "lnbc1invalid".to_string();
+        assert!(matches!(
+            Scanner::decode_onchain(&invoice),
+            Err(DecodingError::InvalidFormat)
+        ));
+    }
+
+    #[tokio::test]
+    async fn test_duplicate_bip21_params_fails() {
+        let invoice =
+            "bitcoin:bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq?amount=0.000035&amount=0.00005"
+                .to_string();
         assert!(matches!(
             Scanner::decode(invoice).await,
             Err(DecodingError::InvalidFormat)