feat: sanitize input for hidden control characters and whitespace (#271)

.github/workflows/ci-dart.yml

@@ -6,19 +6,23 @@ on:
       - "packages/core-dart/**"
       - "spec/**"
     # `verify-parity` owns this file's CI surface; skip here to avoid
-    # duplicate runs on vectors-only PRs.
+    # duplicate Runs on vectors-only PRS.
     paths-ignore:
       - "spec/vectors.json"
-    # Note: paths + paths-ignore combine as an AND across all changed files.
-    # If a PR changes spec/vectors.json *together with* packages/core-dart/**,
-    # this workflow is skipped; verify-parity.yml still runs the identical
-    # commands, so functional coverage is preserved under a different check.
+
+  # Note: paths + paths-ignore combine as an AND across all changed files.
+  # If a PR changes spec/vectors.json *together with* packages/core-dart/**,
+  # this workflow is skipped; verify-parity.yml still runs the identical
+  # commands, so functional coverage is preserved under a different check.
 
 jobs:
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - name: Sanitize hidden control characters and whitespace
+        run: |
+          find spec packages/core-dart -type f \( -name '*.dart' -o -name '*.json' -o -name '*.yaml' -o -name '*.md' \) -exec perl -CSD -pi -e 's/\r\n/\n/g; s/\r/\n/g; s/[^\P{C}\t\n]//g; s/[ \t]+$//' {} +
       - uses: dart-lang/setup-dart@v1
       - id: setup-chrome
         uses: browser-actions/setup-chrome@v1

.github/workflows/ci-go.yml

@@ -1,4 +1,4 @@
-name: ci-go
+name: ci-g
 
 on:
   pull_request:
@@ -10,7 +10,7 @@ on:
     paths-ignore:
       - "spec/vectors.json"
     # Note: paths + paths-ignore combine as an AND across all changed files.
-    # If a PR changes spec/vectors.json *together with* packages/core-go/**,
+    # If a PR changes spec/vectors.json *together* with packages/core-go/**,
     # this workflow is skipped; verify-parity.yml still runs the identical
     # commands, so functional coverage is preserved under a different check.
 
@@ -22,4 +22,15 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: "1.21"
+      - name: Sanitize input (hidden control chars and whitespace)
+        run: |
+          # Fail if Go files contain hidden control characters or trailing whitespace
+          if grep -rP '[\x00-\x08\x0B-\x1F\x7F]' packages/core-go --include='*.go' >/dev/null; then
+            echo "::error::Hidden control characters found in Go source files. Remove or replace them."
+            exit 1
+          fi
+          if grep -rP '[ \t]+$' packages/core-go --include='*.go' >/dev/null; then
+            echo "::error::Trailing whitespace found in Go source files. Remove it."
+            exit 1
+          fi
       - run: cd packages/core-go && go test ./...

.github/workflows/ci-ts.yml

@@ -1,5 +1,4 @@
 name: ci-ts
-
 on:
   pull_request:
     paths:
@@ -27,4 +26,4 @@ jobs:
           node-version: 20
           cache: "pnpm"
       - run: pnpm install
-      - run: pnpm --filter stellar-address-kit test
+      - run: pnpm --filter ./packages/core-ts test

packages/core-dart/lib/src/address/codes.dart

@@ -66,6 +66,9 @@ abstract final class WarningCode {
 
   /// The destination is a smart contract, which is invalid for classic payments.
   static const invalidDestination = 'INVALID_DESTINATION';
+
+  /// Hidden control characters or whitespace were stripped from the destination address.
+  static const sanitizedHiddenChars = 'SANITIZED_HIDDEN_CHARS';
 }
 
 /// Represents a warning encountered during address parsing or routing.

packages/core-dart/lib/src/routing/extract.dart

@@ -20,15 +20,24 @@ import 'safe_routing_id.dart';
 /// For future compatibility with async network checks (Federation, SEP-0029),
 /// use [extractRouting] instead.
 RoutingResult extractRoutingSync(RoutingInput input) {
-  final trimmed = input.destination.trim();
-  if (trimmed.isEmpty) {
-    throw const ExtractRoutingException('Invalid input: destination must be a non-empty string.');
+  final sanitized = input.destination.replaceAll(
+    RegExp(
+      r'[\x00-\x1F\x7F-\x9F\u200B-\u200F\u2028-\u202F\u2060-\u206F\uFEFF\u00AD\uFFF9-\uFFFB\s]',
+    ),
+    '',
+  );
+  final wasSanitized = sanitized != input.destination;
+
+  if (sanitized.isEmpty) {
+    throw const ExtractRoutingException(
+      'Invalid input: destination must be a non-empty string.',
+    );
   }
 
-  final prefix = trimmed[0].toUpperCase();
+  final prefix = sanitized[0].toUpperCase();
   if (prefix != 'G' && prefix != 'M') {
     throw ExtractRoutingException(
-      'Invalid destination: expected a G or M address, got "${input.destination}".',
+      'Invalid destination: expected a G or M address, got "$sanitized".',
     );
   }
 
@@ -46,12 +55,21 @@ RoutingResult extractRoutingSync(RoutingInput input) {
     }
   }
 
-  final parsed = parse(input.destination);
+  final parsed = parse(sanitized);
 
   if (parsed.kind == null) {
     return RoutingResult(
       source: RoutingSource.none,
-      warnings: [],
+      warnings: wasSanitized
+          ? [
+              const RoutingWarning(
+                code: codes.WarningCode.sanitizedHiddenChars,
+                severity: 'info',
+                message:
+                    'Destination address contained non-printable characters or whitespace that were stripped.',
+              ),
+            ]
+          : [],
       destinationError: parsed.error != null
           ? DestinationError(
               code: parsed.error!.code,
@@ -62,6 +80,16 @@ RoutingResult extractRoutingSync(RoutingInput input) {
   }
 
   final warnings = <RoutingWarning>[];
+  if (wasSanitized) {
+    warnings.add(
+      const RoutingWarning(
+        code: codes.WarningCode.sanitizedHiddenChars,
+        severity: 'info',
+        message:
+            'Destination address contained non-printable characters or whitespace that were stripped.',
+      ),
+    );
+  }
   for (final w in parsed.warnings) {
     warnings.add(RoutingWarning(
       code: w.code,

packages/core-dart/test/extract_routing_test.dart

@@ -165,5 +165,22 @@ void main() {
         throwsA(isA<ExtractRoutingException>()),
       );
     });
+
+    test('sanitizes invisible Unicode characters and whitespace', () async {
+      final dirtyG = '\u200B\uFEFF  \r\n$baseG \t\u200D\u2060\n';
+      final result = await extractRouting(RoutingInput(
+        destination: dirtyG,
+        memoType: 'id',
+        memoValue: '100',
+      ));
+
+      expect(result.destinationBaseAccount, baseG);
+      expect(result.id, BigInt.from(100));
+      expect(result.source, RoutingSource.memo);
+      expect(result.warnings.length, 1);
+      expect(result.warnings[0].code, WarningCode.sanitizedHiddenChars);
+      expect(result.warnings[0].severity, 'info');
+    });
   });
 }
+

packages/core-go/address/warnings.go

@@ -18,6 +18,7 @@ const (
 	WarnMemoIDInvalidFormat    WarningCode = "MEMO_ID_INVALID_FORMAT"
 	WarnUnsupportedMemoType    WarningCode = "UNSUPPORTED_MEMO_TYPE"
 	WarnInvalidDestination     WarningCode = "INVALID_DESTINATION"
+	WarnSanitizedHiddenChars   WarningCode = "SANITIZED_HIDDEN_CHARS"
 	WarnMissingRequiredMemo    WarningCode = "MISSING_REQUIRED_MEMO"
 )
 
@@ -303,4 +304,4 @@ func validateContextFields(code WarningCode, ctx *WarningContext) error {
 	}
 
 	return nil
-}
+}

packages/core-go/routing/extract.go

@@ -3,11 +3,45 @@ package routing
 import (
 	"strconv"
 	"strings"
+	"unicode"
 
 	"github.com/Boxkit-Labs/stellar-address-kit/packages/core-go/address"
 	"github.com/Boxkit-Labs/stellar-address-kit/packages/core-go/muxed"
 )
 
+func isHiddenOrWhitespace(r rune) bool {
+	if unicode.IsSpace(r) || unicode.IsControl(r) {
+		return true
+	}
+	switch {
+	case r == 0xFEFF, r == 0x00AD:
+		return true
+	case r >= 0x200B && r <= 0x200F:
+		return true
+	case r >= 0x2028 && r <= 0x202F:
+		return true
+	case r >= 0x2060 && r <= 0x206F:
+		return true
+	case r >= 0xFFF9 && r <= 0xFFFB:
+		return true
+	}
+	return false
+}
+
+func sanitizeDestination(dest string) (string, bool) {
+	if !strings.ContainsFunc(dest, isHiddenOrWhitespace) {
+		return dest, false
+	}
+	var sb strings.Builder
+	sb.Grow(len(dest))
+	for _, r := range dest {
+		if !isHiddenOrWhitespace(r) {
+			sb.WriteRune(r)
+		}
+	}
+	return sb.String(), true
+}
+
 // normalizeUnsupportedMemoType canonicalizes a memo type string by lower-casing it
 // and stripping underscores and hyphens, then maps it to a known unsupported type.
 // Uses strings.Builder to avoid intermediate string allocations from chained ReplaceAll/ToLower.
@@ -59,11 +93,29 @@ func ExtractRouting(input RoutingInput) RoutingResult {
 		}
 	}
 
-	parsed, err := address.Parse(input.Destination)
+	sanitizedDest, wasSanitized := sanitizeDestination(input.Destination)
+
+	initWarnings := func(additional ...address.Warning) []address.Warning {
+		capSize := len(additional)
+		if wasSanitized {
+			capSize++
+		}
+		w := make([]address.Warning, 0, capSize)
+		if wasSanitized {
+			w = append(w, address.Warning{
+				Code:     address.WarnSanitizedHiddenChars,
+				Severity: "info",
+				Message:  "Destination address contained non-printable characters or whitespace that were stripped.",
+			})
+		}
+		return append(w, additional...)
+	}
+
+	parsed, err := address.Parse(sanitizedDest)
 	if err != nil {
 		return RoutingResult{
 			RoutingSource: "none",
-			Warnings:      []address.Warning{},
+			Warnings:      initWarnings(),
 			DestinationError: &DestinationError{
 				Code:    address.ErrUnknownPrefix,
 				Message: err.Error(),
@@ -72,16 +124,18 @@ func ExtractRouting(input RoutingInput) RoutingResult {
 	}
 
 	if parsed.Kind == address.KindC {
+		warnings := initWarnings()
+		warnings = append(warnings, address.Warning{
+			Code:     address.WarnInvalidDestination,
+			Severity: "error",
+			Message:  "C address is not a valid destination",
+			Context: &address.WarningContext{
+				DestinationKind: "C",
+			},
+		})
 		return RoutingResult{
 			RoutingSource: "none",
-			Warnings: []address.Warning{{
-				Code:     address.WarnInvalidDestination,
-				Severity: "error",
-				Message:  "C address is not a valid destination",
-				Context: &address.WarningContext{
-					DestinationKind: "C",
-				},
-			}},
+			Warnings:      warnings,
 		}
 	}
 
@@ -90,17 +144,15 @@ func ExtractRouting(input RoutingInput) RoutingResult {
 		if err != nil {
 			return RoutingResult{
 				RoutingSource: "none",
-				Warnings:      []address.Warning{},
+				Warnings:      initWarnings(),
 				DestinationError: &DestinationError{
 					Code:    address.ErrUnknownPrefix,
 					Message: err.Error(),
 				},
 			}
 		}
 
-		// Pre-allocate with capacity for existing warnings plus at most one more.
-		warnings := make([]address.Warning, 0, len(parsed.Warnings)+1)
-		warnings = append(warnings, parsed.Warnings...)
+		warnings := initWarnings(parsed.Warnings...)
 		memoValue := stringValue(input.MemoValue)
 
 		// isAllDigits replaces the regex match to avoid heap allocation.
@@ -128,9 +180,7 @@ func ExtractRouting(input RoutingInput) RoutingResult {
 
 	var routingID *RoutingID
 	routingSource := "none"
-	// Pre-allocate with capacity for existing address warnings plus at most two memo warnings.
-	warnings := make([]address.Warning, 0, len(parsed.Warnings)+2)
-	warnings = append(warnings, parsed.Warnings...)
+	warnings := initWarnings(parsed.Warnings...)
 	memoValue := stringValue(input.MemoValue)
 
 	if input.MemoType == "id" {

packages/core-go/routing/extract_test.go

@@ -331,6 +331,32 @@ func TestExtractRouting_ContractSourceClearsRoutingState(t *testing.T) {
 	})
 }
 
+func TestExtractRouting_SanitizedHiddenChars(t *testing.T) {
+	t.Run("sanitizes-zero-width-and-whitespace", func(t *testing.T) {
+		dirtyG := "\u200B\uFEFF  \r\n" + testBaseG + " \t\u200D\u2060\n"
+		result := ExtractRouting(RoutingInput{
+			Destination: dirtyG,
+			MemoType:    "id",
+			MemoValue:   "100",
+		})
+
+		expected := RoutingResult{
+			DestinationBaseAccount: testBaseG,
+			RoutingID:              NewRoutingID("100"),
+			RoutingSource:          "memo",
+			Warnings: []address.Warning{
+				{
+					Code:     address.WarnSanitizedHiddenChars,
+					Severity: "info",
+					Message:  "Destination address contained non-printable characters or whitespace that were stripped.",
+				},
+			},
+		}
+
+		assertRoutingResult(t, result, expected)
+	})
+}
+
 func assertRoutingResult(t *testing.T, got, want RoutingResult) {
 	t.Helper()