fix: bundler URL validation

src/eth/erc4337/types.test.ts

@@ -1,6 +1,6 @@
 import { assert } from 'superstruct';
 
-import { EthUserOperationStruct } from './types';
+import { EthUserOperationStruct, EthBaseUserOperationStruct } from './types';
 
 describe('types', () => {
   it('is a valid UserOperation', () => {
@@ -76,4 +76,73 @@ describe('types', () => {
       'At path: nonce -- Expected a value of type `EthUint256`, but received: `"0x01"`',
     );
   });
+
+  describe('EthBaseUserOperationStruct', () => {
+    it('is a valid BaseUserOperation', () => {
+      const userOp = {
+        nonce: '0x1',
+        initCode: '0x',
+        callData: '0x70641a22000000000000000000000000',
+        gasLimits: {
+          callGasLimit: '0x58a83',
+          verificationGasLimit: '0xe8c4',
+          preVerificationGas: '0xc57c',
+        },
+        dummyPaymasterAndData: '0x1234',
+        dummySignature: '0x1234',
+        bundlerUrl: 'https://example.com',
+      };
+      expect(() => assert(userOp, EthBaseUserOperationStruct)).not.toThrow();
+    });
+
+    it('has an invalid BaseUserOperation with an incorrect url string', () => {
+      const userOp = {
+        nonce: '0x1',
+        initCode: '0x',
+        callData: '0x70641a22000000000000000000000000',
+        gasLimits: {
+          callGasLimit: '0x58a83',
+          verificationGasLimit: '0xe8c4',
+          preVerificationGas: '0xc57c',
+        },
+        dummyPaymasterAndData: '0x1234',
+        dummySignature: '0x1234',
+        bundlerUrl: 'random string',
+      };
+      expect(() => assert(userOp, EthBaseUserOperationStruct)).toThrow(
+        'At path: bundlerUrl -- Expected a value of type `string`, but received: `"random string"`',
+      );
+    });
+
+    it('cannot have an empty bundler url', () => {
+      const userOp = {
+        nonce: '0x1',
+        initCode: '0x',
+        callData: '0x70641a22000000000000000000000000',
+        gasLimits: {
+          callGasLimit: '0x58a83',
+          verificationGasLimit: '0xe8c4',
+          preVerificationGas: '0xc57c',
+        },
+        dummyPaymasterAndData: '0x1234',
+        dummySignature: '0x1234',
+        bundlerUrl: '',
+      };
+      expect(() => assert(userOp, EthBaseUserOperationStruct)).toThrow(
+        'At path: bundlerUrl -- Expected a value of type `string`, but received: `""`',
+      );
+    });
+
+    it('does not throw if gasLimits are undefined', () => {
+      const userOp = {
+        nonce: '0x1',
+        initCode: '0x',
+        callData: '0x70641a22000000000000000000000000',
+        dummyPaymasterAndData: '0x1234',
+        dummySignature: '0x1234',
+        bundlerUrl: 'https://example.com',
+      };
+      expect(() => assert(userOp, EthBaseUserOperationStruct)).not.toThrow();
+    });
+  });
 });

src/eth/erc4337/types.ts

@@ -1,7 +1,12 @@
-import { string, type Infer } from 'superstruct';
+import { type Infer } from 'superstruct';
 
 import { exactOptional, object } from '../../superstruct';
-import { EthAddressStruct, EthBytesStruct, EthUint256Struct } from '../types';
+import {
+  BundlerUrlStruct,
+  EthAddressStruct,
+  EthBytesStruct,
+  EthUint256Struct,
+} from '../types';
 
 /**
  * Struct of a UserOperation as defined by ERC-4337.
@@ -59,7 +64,7 @@ export const EthBaseUserOperationStruct = object({
   ),
   dummyPaymasterAndData: EthBytesStruct,
   dummySignature: EthBytesStruct,
-  bundlerUrl: string(),
+  bundlerUrl: BundlerUrlStruct,
 });
 
 export type EthBaseUserOperation = Infer<typeof EthBaseUserOperationStruct>;

src/eth/types.test.ts

@@ -0,0 +1,30 @@
+import { BundlerUrlStruct } from './types';
+
+describe('types', () => {
+  it('is a valid BundlerUrl', () => {
+    const url = 'https://api.example.com';
+    expect(() => BundlerUrlStruct.assert(url)).not.toThrow();
+  });
+
+  it('is a valid BundlerUrl with query parameters', () => {
+    const url = 'https://api.example.com?foo=bar';
+    expect(() => BundlerUrlStruct.assert(url)).not.toThrow();
+  });
+
+  it('accepts path parameters', () => {
+    const url = 'https://api.example.com/foo/bar';
+    expect(() => BundlerUrlStruct.assert(url)).not.toThrow();
+  });
+
+  it('fails if it does not start with http or https', () => {
+    const url = 'ftp://api.example.com';
+    expect(() => BundlerUrlStruct.assert(url)).toThrow(
+      'Expected a value of type `string`, but received: `"ftp://api.example.com"`',
+    );
+  });
+
+  it('has to start with http or https', () => {
+    const url = 'http://api.example.com';
+    expect(() => BundlerUrlStruct.assert(url)).not.toThrow();
+  });
+});

src/eth/types.ts

@@ -1,3 +1,5 @@
+import { refine, string } from 'superstruct';
+
 import { definePattern } from '../superstruct';
 
 export const EthBytesStruct = definePattern('EthBytes', /^0x[0-9a-f]*$/iu);
@@ -11,3 +13,19 @@ export const EthUint256Struct = definePattern(
   'EthUint256',
   /^0x([1-9a-f][0-9a-f]*|0)$/iu,
 );
+
+export const BundlerUrlStruct = refine(
+  string(),
+  'BundlerUrl',
+  (value: string) => {
+    let url;
+
+    try {
+      url = new URL(value);
+    } catch (_) {
+      return false;
+    }
+
+    return url.protocol === 'http:' || url.protocol === 'https:';
+  },
+);