fix: gate the chain switch and remember endpoints per network (closes #308)
wallet_switchEthereumChain was answered for any origin at all, with no connection check and no prompt, so any page could move the active chain and clear the [TESTNET] banner under a user who believed they were on Sepolia. It now takes the same allowedSites check the signing methods take and returns 4100 for an unconnected origin. The handler also awaits loadState() before it reads or moves the network. The MV3 worker populates nothing at module scope, so a worker revived by the page's own message held DEFAULT_STATE: the same-chain check compared against the wrong network, and the save wrote empty wallets, empty allowedSites and default endpoints over the user's stored profile, destroying every wallet in the extension. Also fixes #316. Endpoints are now remembered per network in a persisted networkEndpoints map, so a user running a local or private node no longer loses that url permanently to a public endpoint on every switch. A stored map must be an actual object; a primitive previously survived the load and made every switch fall back to the public default with no self-healing. Verified failing first: dropping only the added loadState() fails exactly the two cold-worker cases; reverting only the type guard fails exactly the string and number cases. Reverting both source files to next gives 12 failed / 751 passed.
This commit was merged in pull request #313.
This commit is contained in:
@@ -1193,8 +1193,9 @@ test("the theme and network selectors carry a non-default persisted value (#229)
|
||||
// and a selector stuck on `dark`/`sepolia` would otherwise be
|
||||
// indistinguishable here from one that persists correctly. Switching
|
||||
// the network back also returns state.rpcUrl and state.blockscoutUrl
|
||||
// to the mainnet defaults that onChainSwitch() overwrote, which are
|
||||
// the values src/shared/state.js starts with.
|
||||
// to the mainnet endpoints onChainSwitch() remembered, which this
|
||||
// fixture never customised and so are the mainnet defaults
|
||||
// src/shared/state.js starts with.
|
||||
await env.page.selectOption("#settings-theme", "system");
|
||||
await env.page.selectOption("#settings-network", "mainnet");
|
||||
|
||||
|
||||
Reference in New Issue
Block a user