4 Commits

Include renames

Author	SHA1	Message	Date
sneak	b4ae645695	harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403) ... The signature screen showed only the text a personal message decodes to, with bidirectional, right-to-left and zero-width characters acting on it, so a site could make the message read differently from the bytes that are signed, and a message that was not hex was decoded into NUL characters. The screen now shows the hex as "Raw data" alongside the text, lays the text out left to right in byte order, and shows each control character, line and paragraph separator, and character that paints nothing (the set src/shared/symbolSpoof.js already strips) as a U+XXXX mark. A message is hex when getBytes, which signing uses, reads it; one that is not cannot be signed, so it is shown as plain text with "Sign" disabled. Model: opus-5-5	2026-10-04 19:26:52 +00:00
clawbot	c755a5e944	fix: a shared ticker no longer hides one of its two real tokens (closes #276) ... Seven bundled tokens were filtered as spoofs at their own address, so a user holding FRAX, TON, REUSD, EURE, MSUSD, MUSD or JPYC could not see or spend the one the wallet happened not to pick. The known-symbol table is derived from the bundled token list, first-wins in market-cap order, so a symbol that appears twice silently condemned its second contract. Both are real tokens from the same fetch and neither is stale -- three pairs are one issuer's old and new contract, four are unrelated issuers sharing a ticker. Picking a winner would have been guessing, and dropping the ambiguous symbols would have ended spoof filtering for those tickers entirely. The table now maps a symbol to the set of addresses that legitimately bear it. A contract outside the set is still a spoof, so the check is not weakened: a third contract bearing any of the seven shared tickers is refused, and that is tested. The filter decides what is fake, not what is worth holding, so a legacy contract stays in the set -- it still holds real balances. A test walks the whole bundled list asserting no token is filtered at its own address, which is the guard whose absence let this ship.	2026-08-12 13:31:55 +02:00
clawbot	e4c3708b84	fix: fold invisible characters before the known-symbol spoof check (closes #260) ... A token calling itself " ETH " missed the known-symbol table entirely, so the spoof check reported it was not a spoof -- while HTML collapsed the whitespace and displayed it as ETH next to the user's real ETH. One space defeated the filter. The symbol is now folded before the lookup: NFKC, remove what paints nothing, trim, uppercase. The rule is "remove what paints nothing"; the Unicode classes are how that is spelled, which is why U+007F is named separately -- it is a control, reached by no class, and measures identical to no character at all. Every width in the module comment was measured in the pinned browser rather than reasoned about, and the boundary is pinned from both sides: widening to all control characters fails the visible-controls test, narrowing back fails the invisible-characters test. Two default-ignorable code points do paint a box and are folded anyway, which can only hide a token that does not resemble the symbol it folds to -- the harmless direction, recorded rather than glossed. Confusables that are distinct letters, bidi reordering and interior whitespace are knowingly left open and asserted open by tests.	2026-08-12 13:06:54 +02:00
clawbot	1f41a07df2	fix: filter a fake ETH token from the balance list too (closes #235)	2026-08-12 11:10:38 +02:00