MetaMask / MetaMask/metamask-mobile

Allow to receive any data from scanned QR code via wallet_scanQRCode API

Open
#5,141 0 comments 0 reactions 0 assignees View on GitHub
feature-request
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

I think it would be really useful to enable `wallet_scanQRCode` API to return URL. Some QR codes that could be found out in the world contains URLs and if someone wants to develop application to scan QR codes and use data stored in them, it cannot, as currently when `wallet_scanQRCode` is called, it opens camera, however if content of QR code is URL it automatically redirects user to that page, instead of returning data of the QR code. These QR codes may be from 3rd party vendors to which dev team does not have access or cannot issue request for changing content of QR code to be something else

I looked trough the source code and it looks like you are using already implemented component for scanning which has its own behavior which is ok, but from the DApps point of view, I think that is not right behavior and if DApp requested to scan QR code it should get that content no matter what. I think some flag should be added when navigating to QRScanner component to tell it to bypass all the checks and just return content of QR code.

I think that this RPC is really great feature that DApps can use, and grants access to camera. Otherwise developers needs to resort to javascript and html libraries for camera which often have issues with focus and cannot read codes if they are too small. I do not know if this poses any risks but would like to here if it does. Also if it is great risk, QRScanner component should act on its own if it scans URL that is related to MetaMask (like if it reads deep link)...

Contributor guide

Open the contributing guide

Research direction

Trace the wallet_scanQRCode API to the QRScanner component and review the existing URL and deep-link handling. Resolve whether raw QR content or a bypass option is appropriate, including the security implications mentioned in the issue. Done means the behavior is specified and existing QR and deep-link flows remain accounted for.

Written by the indexing model from the issue text.

Assessment

Tech stack
react-native, typescript
Domain
api, mobile-dev, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.