Remove unused fcl_redirect_url redirect and DEEPLINK/RPC strategy

Author: jribbink

.changeset/wild-redirects-validate.md

@@ -0,0 +1,6 @@
+---
+"@onflow/fcl-core": patch
+"@onflow/fcl-react-native": patch
+---
+
+Remove the unused `fcl_redirect_url` redirect path in `sendMsgToFCL` and the `DEEPLINK/RPC` strategy. The redirect passed an attacker-controllable URL to `window.location.href` (DOM-XSS / open-redirect) and was only used by `DEEPLINK/RPC`, which no wallets implement.

packages/fcl-core/src/wallet-utils/send-msg-to-fcl.ts

@@ -1,7 +1,3 @@
-import {
-  FCL_REDIRECT_URL_PARAM_NAME,
-  FCL_RESPONSE_PARAM_NAME,
-} from "../utils/constants"
 import {onMessageFromFCL} from "./on-message-from-fcl"
 
 export interface PollingResponse {
@@ -14,8 +10,8 @@ export interface PollingResponse {
 
 /**
  * @description Sends messages from a wallet or service back to the parent FCL application. This function
- * handles communication between wallet UIs (running in iframes, popups, or redirects) and the main FCL
- * application. It automatically detects the communication method (redirect, iframe, or popup) and sends
+ * handles communication between wallet UIs (running in iframes or popups) and the main FCL
+ * application. It automatically detects the communication method (iframe or popup) and sends
  * the message accordingly.
  *
  * @param type The message type identifier (e.g., "FCL:VIEW:RESPONSE", "FCL:VIEW:READY")
@@ -41,15 +37,7 @@ export interface PollingResponse {
  * })
  */
 export const sendMsgToFCL = (type: string, msg?: PollingResponse): void => {
-  const data = {...msg, type}
-
-  const urlParams = new URLSearchParams(window.location.search)
-  const redirectUrl = urlParams.get(FCL_REDIRECT_URL_PARAM_NAME)
-  if (redirectUrl) {
-    const url = new URL(redirectUrl)
-    url.searchParams.append(FCL_RESPONSE_PARAM_NAME, JSON.stringify(data))
-    window.location.href = url.href
-  } else if (window.location !== window.parent.location) {
+  if (window.location !== window.parent.location) {
     window.parent.postMessage({...msg, type}, "*")
   } else if (window.opener) {
     window.opener.postMessage({...msg, type}, "*")

packages/fcl-react-native/src/utils/react-native/ServiceDiscovery.js

@@ -26,7 +26,7 @@ export const useServiceDiscovery = ({fcl}) => {
       const requestBody = {
         fclVersion: VERSION,
         userAgent: "ReactNative",
-        supportedStrategies: ["WC/RPC", "DEEPLINK/RPC"],
+        supportedStrategies: ["WC/RPC"],
       }
 
       // Fetch wallets from Discovery API

packages/fcl-react-native/src/utils/react-native/coreStrategies.js

@@ -1,12 +1,10 @@
 import {CORE_STRATEGIES, getExecHttpPost} from "@onflow/fcl-core"
 import {execLocal} from "./exec-local"
-import {execDeeplinkRPC} from "./strategies/deeplink-rpc"
 import {execDiscoveryRN} from "./strategies/discovery-rn"
 import {DISCOVERY_RN_METHOD} from "./constants"
 
 export const coreStrategies = {
   [CORE_STRATEGIES["HTTP/RPC"]]: getExecHttpPost(execLocal),
   [CORE_STRATEGIES["HTTP/POST"]]: getExecHttpPost(execLocal),
-  [CORE_STRATEGIES["DEEPLINK/RPC"]]: execDeeplinkRPC,
   [DISCOVERY_RN_METHOD]: execDiscoveryRN,
 }

packages/fcl-react-native/src/utils/react-native/strategies/deeplink-rpc.js

@@ -18,7 +18,7 @@ import {config} from "@onflow/config"
  * 4. This function executes → shows ConnectModal with wallet list
  * 5. User selects wallet
  * 6. Returns {status: "REDIRECT", data: walletService}
- * 7. FCL core executes the wallet service (WC/RPC or DEEPLINK/RPC)
+ * 7. FCL core executes the wallet service (WC/RPC)
  *
  * @param {object} params - Strategy execution parameters
  * @param {object} params.service - The discovery service to execute