fix(siwe): reject a comma in the scheme

`[a-zA-Z0-9+-.]` reads `+-.` as a character range, so it matches `+ , - .`.
The intended set is the RFC 3986 one, `+`, `-` and `.`, so a comma was allowed
in a SIWE scheme by both sides:

    createSiweMessage({ ..., scheme: 'ht,tps' })   // accepted
    parseSiweMessage('ht,tps://example.com ...')   // scheme: 'ht,tps'

createSiweMessage validates the scheme specifically to enforce RFC 3986 3.1,
and its own error message says so, so accepting a comma is not intentional
leniency. siwe/utils.ts already writes the same class correctly as
`[a-z0-9+\\-.]` in isUri.

Escape the hyphen in both. The domain class is left as it is: RFC 3986
reg-name does allow a comma via sub-delims, and parseSiweMessage is
deliberately lenient there.

Author: pucedoteth

.changeset/siwe-scheme-comma-range.md

@@ -0,0 +1,5 @@
+---
+"viem": patch
+---
+
+Fixed the SIWE scheme check accepting a comma. `[a-zA-Z0-9+-.]` reads `+-.` as a character range (`+` `,` `-` `.`), so `createSiweMessage` did not reject a scheme such as `ht,tps` despite validating against RFC 3986, and `parseSiweMessage` returned it as `scheme`.

src/utils/siwe/createSiweMessage.test.ts

@@ -348,6 +348,30 @@ test('behavior: invalid scheme', () => {
   `)
 })
 
+test('behavior: invalid scheme (comma)', () => {
+  // `[a-zA-Z0-9+-.]` reads `+-.` as a range (+ , - .), so a comma slipped past the
+  // RFC 3986 scheme check this error is about.
+  expect(() =>
+    createSiweMessage({ ...message, scheme: 'ht,tps' }),
+  ).toThrowErrorMatchingInlineSnapshot(`
+    [SiweInvalidMessageFieldError: Invalid Sign-In with Ethereum message field "scheme".
+
+    - Scheme must be an RFC 3986 URI scheme.
+    - See https://www.rfc-editor.org/rfc/rfc3986#section-3.1
+
+    Provided value: ht,tps
+
+    Version: viem@x.y.z]
+  `)
+})
+
+test('behavior: valid scheme punctuation is still accepted', () => {
+  // RFC 3986 §3.1: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
+  for (const scheme of ['https', 'a+b', 'a-b', 'a.b']) {
+    expect(() => createSiweMessage({ ...message, scheme })).not.toThrow()
+  }
+})
+
 test('behavior: invalid statement', () => {
   expect(() =>
     createSiweMessage({ ...message, statement: 'foo\nbar' }),

src/utils/siwe/createSiweMessage.ts

@@ -175,4 +175,4 @@ const ipRegex =
   /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(:[0-9]{1,5})?$/
 const localhostRegex = /^localhost(:[0-9]{1,5})?$/
 const nonceRegex = /^[a-zA-Z0-9]{8,}$/
-const schemeRegex = /^([a-zA-Z][a-zA-Z0-9+-.]*)$/
+const schemeRegex = /^([a-zA-Z][a-zA-Z0-9+\-.]*)$/

src/utils/siwe/parseSiweMessage.test.ts

@@ -41,6 +41,37 @@ Issued At: 2023-02-01T00:00:00.000Z`
   expect(parsed.scheme).toMatchInlineSnapshot(`"https"`)
 })
 
+test('behavior: scheme with a comma is not a scheme', () => {
+  // `[a-zA-Z0-9+-.]` reads `+-.` as a range, which also matches `,`. RFC 3986 §3.1
+  // allows only `+`, `-` and `.` after the leading letter, so this is not a scheme
+  // and the prefix does not parse.
+  const message = `ht,tps://example.com wants you to sign in with your Ethereum account:
+0xA0Cf798816D4b9b9866b5330EEa46a18382f251e
+
+URI: https://example.com/path
+Version: 1
+Chain ID: 1
+Nonce: foobarbaz
+Issued At: 2023-02-01T00:00:00.000Z`
+  const parsed = parseSiweMessage(message)
+  expect(parsed.scheme).toBeUndefined()
+  expect(parsed.domain).toBeUndefined()
+})
+
+test('behavior: schemes using the punctuation RFC 3986 does allow', () => {
+  for (const scheme of ['https', 'a+b', 'a-b', 'a.b']) {
+    const message = `${scheme}://example.com wants you to sign in with your Ethereum account:
+0xA0Cf798816D4b9b9866b5330EEa46a18382f251e
+
+URI: https://example.com/path
+Version: 1
+Chain ID: 1
+Nonce: foobarbaz
+Issued At: 2023-02-01T00:00:00.000Z`
+    expect(parseSiweMessage(message).scheme).toBe(scheme)
+  }
+})
+
 test('behavior: domain with port', () => {
   const message = `example.com:8080 wants you to sign in with your Ethereum account:
 0xA0Cf798816D4b9b9866b5330EEa46a18382f251e

src/utils/siwe/parseSiweMessage.ts

@@ -65,7 +65,7 @@ export function parseSiweMessage(
 
 // https://regexr.com/80gdj
 const prefixRegex =
-  /^(?:(?<scheme>[a-zA-Z][a-zA-Z0-9+-.]*):\/\/)?(?<domain>[a-zA-Z0-9+-.]*(?::[0-9]{1,5})?) (?:wants you to sign in with your Ethereum account:\n)(?<address>0x[a-fA-F0-9]{40})\n\n(?:(?<statement>.*)\n\n)?/
+  /^(?:(?<scheme>[a-zA-Z][a-zA-Z0-9+\-.]*):\/\/)?(?<domain>[a-zA-Z0-9+-.]*(?::[0-9]{1,5})?) (?:wants you to sign in with your Ethereum account:\n)(?<address>0x[a-fA-F0-9]{40})\n\n(?:(?<statement>.*)\n\n)?/
 
 // https://regexr.com/80gf9
 const suffixRegex =