[Bug] normalizeSwishNumber does not strip leading '+', breaking Swish payment for +46 numbers #24

New issue

Closed

opened 2026-06-22 11:11:52 +00:00 by hermes · 1 comment

hermes commented

2026-06-22 11:11:52 +00:00

Collaborator

Context

Identified during advisory review of #17 (guest checkout).

Problem

normalizeSwishNumber in payment.ts:52 does not strip a leading +. If app.payment.swish-number is stored as +46..., the + leaks into the sw param (URL-encoded as %2B), which Swish rejects - the entire Swish payment link breaks.

This bug is pre-existing in payment.ts (not introduced by the guest PR) but is now exercised by the guest flow.

Severity

Warning (payment-link generation failure)

Suggested fix

Before the prefix checks, add: trimmed.replace(/^\+/, '') so the normalized number is always digits only.

References

PR: #17

## Context Identified during advisory review of #17 (guest checkout). ## Problem `normalizeSwishNumber` in `payment.ts:52` does not strip a leading `+`. If `app.payment.swish-number` is stored as `+46...`, the `+` leaks into the `sw` param (URL-encoded as `%2B`), which Swish rejects - the entire Swish payment link breaks. This bug is pre-existing in `payment.ts` (not introduced by the guest PR) but is now exercised by the guest flow. ## Severity Warning (payment-link generation failure) ## Suggested fix Before the prefix checks, add: `trimmed.replace(/^\+/, '')` so the normalized number is always digits only. ## References - PR: https://srvr.nu/git/jocke/bilhej/pulls/17

hermes commented

2026-07-18 11:31:12 +00:00

Author

Collaborator

Already fixed on master in commit 573153b (fix(payment): make Swish QR code scannable by the Swish app).

The normalizeSwishNumber function in payment.ts now strips a leading + via /[\s+]/g before any prefix checks, so +46... numbers normalize correctly to 46....

Verified by the existing test buildSwishPaymentUrl('+467****4567', 49, 'test') in payment.spec.ts (8/8 tests pass). The shared helper is used by both PaymentRedirect.vue and GuestPaymentRedirect.vue, so both auth and guest paths are covered.

Already fixed on master in commit 573153b (`fix(payment): make Swish QR code scannable by the Swish app`). The `normalizeSwishNumber` function in `payment.ts` now strips a leading `+` via `/[\s+]/g` before any prefix checks, so `+46...` numbers normalize correctly to `46...`. Verified by the existing test `buildSwishPaymentUrl('+467****4567', 49, 'test')` in `payment.spec.ts` (8/8 tests pass). The shared helper is used by both `PaymentRedirect.vue` and `GuestPaymentRedirect.vue`, so both auth and guest paths are covered.

hermes closed this issue

2026-07-18 11:31:12 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: jocke/bilhej#24

No description provided.