Bitcoin URL Handling

Update Bitcoin URL handling to reject URLs with duplicate keys

issue: #649

gui/qt/main_window.py

@@ -948,7 +948,11 @@ class ElectrumWindow(QMainWindow):
 
 
     def set_url(self, url):
+        try:
             address, amount, label, message, signature, identity, url = util.parse_url(url)
+        except Exception:
+            QMessageBox.warning(self, _('Error'), _('Invalid bitcoin URL'), _('OK'))
+            return
 
         try:
             if amount and self.base_unit() == 'mBTC': amount = str( 1000* Decimal(amount))

lib/util.py

@@ -37,7 +37,6 @@ def print_json(obj):
     sys.stdout.write(s + "\n")
     sys.stdout.flush()
 
-
 def user_dir():
     if "HOME" in os.environ:
         return os.path.join(os.environ["HOME"], ".electrum")
@@ -166,27 +165,31 @@ def parse_url(url):
     else:
         params = []
 
+    kv = {}
+
     amount = label = message = signature = identity = ''
     for p in params:
         k,v = p.split('=')
         uv = urldecode(v)
-        if k == 'amount': 
-            amount = uv
-            m = re.match('([0-9\.]+)X([0-9])', uv)
+        if k in kv:
+            raise Exception('Duplicate Keys')
+        kv[k] = uv
+
+    if 'amount' in kv:
+        am = kv['amount']
+        m = re.match('([0-9\.]+)X([0-9])', am)
         if m:
             k = int(m.group(2)) - 8
             amount = Decimal(m.group(1)) * pow(  Decimal(10) , k)
         else:
-                amount = Decimal(uv)
-        elif k == 'message': 
-            message = uv
-        elif k == 'label': 
-            label = uv
-        elif k == 'signature':
-            identity, signature = uv.split(':')
-            url = url.replace('&%s=%s'%(k,v),'')
-        else: 
-            print k,v
+            amount = Decimal(am)
+    if 'message' in kv:
+        message = kv['message']
+    if 'label' in kv:
+        label = kv['label']
+    if 'signature' in kv:
+        identity, signature = kv['signature'].split(':')
+        url = url.replace('&%s=%s'%('signature',kv['signature']),'')
 
     return address, amount, label, message, signature, identity, url