Wallets & Identity / Developer Tools
In Brief
BSV Desktop has merged a security update that restricts how its wallet retrieves information from external applications. The changes are designed to prevent application requests from directing the wallet toward private network addresses or other unintended destinations.
The protections are confirmed in the project’s merged source code. Whether they are included in the latest downloadable BSV Desktop release has not yet been established.
New Report
The BSV Desktop project has merged Pull Request #135, titled Harden manifest fetching against SSRF, into its main development branch.
Submitted by developer TruthMachine and merged by sirdeggen, the change strengthens the process used to retrieve application manifests.
A manifest is a small file that describes an application connecting to the wallet. It can provide information displayed when the wallet asks a user to approve access or permissions.
Because BSV Desktop retrieves this information on behalf of applications, the process needs to distinguish legitimate public websites from addresses that could expose internal network resources.
The update addresses a security issue known as server-side request forgery, or SSRF. This occurs when an application is persuaded to make a network request to a destination that the requesting party should not be able to access directly.
What the Security Update Changes
The merged changes introduce several restrictions on manifest requests.
BSV Desktop now requires HTTPS addresses, rejects URLs containing embedded credentials or nonstandard ports, and restricts acceptable paths to application manifest files.
The implementation also checks whether a requested hostname resolves to a publicly accessible internet address. Requests targeting local, private, reserved, or other nonpublic network addresses are rejected.
Another change disables automatic redirects. This prevents an initially acceptable website from redirecting the wallet’s request to a different destination without undergoing the intended restrictions.
The privileged manifest-fetching function is confined to the application’s main process. The update also prevents the user-interface component from attempting an unrestricted request if the protected fetching process refuses one.
Finally, manifest responses are limited to 1 MiB, including cases where a server does not provide the expected response-size information. This reduces the risk of unexpectedly large responses consuming excessive application memory.
Together, these controls narrow the destinations and responses that BSV Desktop will accept when retrieving information about connected applications.
Testing and Remaining Limitations
The pull request reports that 32 focused tests passed across the manifest-security and fetching components. It also reports a successful Electron TypeScript compilation check.
The implementation acknowledges several limitations.
One concerns DNS rebinding, in which a hostname can resolve to a different network address between an initial safety check and the subsequent request. The developer notes that the new validation does not completely eliminate this possibility.
The stricter rules may also affect legitimate applications. Websites that redirect manifest requests must provide a directly accessible final URL, while manifest files larger than 1 MiB will be rejected.
These are documented consequences of the tighter security controls rather than evidence of an application malfunction.
The pull request does not establish that the earlier behavior had been exploited or that BSV Desktop users experienced a confirmed security incident. The change should be understood as preventive security hardening.
Downloadable Release Status
The latest version displayed in the supplied GitHub Releases listing is BSV Desktop v3.3.1.
Although PR #135 is merged into the project’s main branch, the available release information does not establish whether that version includes the new protections.
Users should therefore distinguish the security improvement recorded in the development repository from protection confirmed in a particular installed version.
BSV TIMES Read
The importance of this update extends beyond the technical details of network requests.
BSV Desktop is designed to work with external applications through a wallet interface. That interaction allows users to approve actions while retaining control of their wallet, but it also requires clear boundaries between information supplied by websites and operations performed by the wallet itself.
An application manifest may appear to be ordinary descriptive information. However, retrieving it can involve a more privileged component of the desktop application making a network request.
The new restrictions reinforce the distinction between allowing an external application to identify itself and allowing that application to influence where the wallet connects.
The update is also an example of security work becoming more important as wallet software develops broader application interoperability. Permission systems, local processing, network access, and user consent must operate together.
The merged protections strengthen one part of that arrangement, while the documented limitations and unresolved release-version question remain relevant to assessing their practical availability.
Developer Context
BSV Desktop is an open-source wallet application maintained within the BSV Blockchain organization’s GitHub repositories.
Built using Electron, it provides desktop wallet functionality for Windows, macOS, and Linux, including self-custodial operation and application connectivity through the BRC-100 wallet interface.
The project serves as a reference implementation for applications that interact with BSV Blockchain wallets through standardized permissions and methods.
Pull Request #135 was submitted by TruthMachine and merged by sirdeggen. It modifies seven files and includes changes to request validation, privileged application handling, and automated tests.
Source Link
BSV Desktop — Pull Request #135: Harden Manifest Fetching Against SSRF
BSV Desktop — Official Repository
BSV TIMES — BSV Desktop v3.3.1 Releases Live Payments With Receive-Tab Controls
Posted on November 4, 2026 (UTC)
Leave a Reply