Compare commits
1 Commits
issue-259-
...
84c58a97ab
| Author | SHA1 | Date | |
|---|---|---|---|
| 84c58a97ab |
@@ -1,49 +0,0 @@
|
||||
name: e2e
|
||||
on: [push]
|
||||
|
||||
# The browser end-to-end suites, one job per browser, deliberately kept out
|
||||
# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
|
||||
# script/cibuild is a plain `docker build .` whose Dockerfile runs
|
||||
# make check, so folding a browser suite into either would blow that cap
|
||||
# and slow the local fast path. Before this workflow every browser-level
|
||||
# guarantee in this repo held only when a human remembered to run it.
|
||||
#
|
||||
# One job per browser rather than two steps in one job, so a Chrome failure
|
||||
# does not hide the Firefox result.
|
||||
#
|
||||
# Each job is one script and nothing else. Both scripts need docker and
|
||||
# nothing else — they deliver the repo to the daemon as a build context and
|
||||
# build the extension inside the pinned image — which is what makes them
|
||||
# runnable here at all: the runner executes the job in a container against
|
||||
# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
|
||||
# by the host daemon and mounts an empty directory, and the runner image's
|
||||
# node is too old to install this repo's dependencies.
|
||||
#
|
||||
# These jobs REPORT, they do not gate. Whether a check blocks a merge is
|
||||
# Gitea branch protection, which this repo does not configure, so a failure
|
||||
# here is a red mark a reviewer has to account for rather than a hard
|
||||
# block. Making e2e-chrome a required check is blocked on the measured
|
||||
# flake in the dApp signing wait -- two of six runs of unmutated code on a
|
||||
# loaded machine -- tracked as
|
||||
# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
|
||||
# random teaches people to merge past red.
|
||||
#
|
||||
# Nothing here may pass vacuously. There is no continue-on-error and no
|
||||
# `|| true`. Both scripts exit non-zero when docker is missing, when the
|
||||
# image build fails, and when the browser fails to start; the Chrome
|
||||
# harness aborts the suite outright if its network interception is not in
|
||||
# effect.
|
||||
jobs:
|
||||
e2e-chrome:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/test-e2e
|
||||
|
||||
e2e-firefox:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/test-e2e-firefox
|
||||
63
README.md
63
README.md
@@ -83,11 +83,10 @@ provide:
|
||||
git pre-commit hook
|
||||
- `script/projectname` — print the project name (used for the Docker image tag)
|
||||
- `script/test` — run the test suite (jest)
|
||||
- `script/test-e2e` — run the Chrome browser end-to-end suite (docker is the
|
||||
only prerequisite: it builds a pinned image that carries the repo and a fresh
|
||||
extension build, see [End-to-End Tests](#end-to-end-tests))
|
||||
- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (same,
|
||||
against an image with a pinned Firefox and geckodriver, see
|
||||
- `script/test-e2e` — run the Chrome browser end-to-end suite (docker required;
|
||||
see [End-to-End Tests](#end-to-end-tests))
|
||||
- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (docker
|
||||
required; builds its own pinned image, see
|
||||
[End-to-End Tests](#end-to-end-tests))
|
||||
- `script/lint` — run the linter
|
||||
- `script/fmt` — format all files (writes)
|
||||
@@ -137,12 +136,11 @@ are outside `make check`.
|
||||
|
||||
`make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
|
||||
Chrome**, loaded as an unpacked MV3 extension inside a pinned
|
||||
`mcr.microsoft.com/playwright` container (pinned by digest in
|
||||
`tests/e2e/Dockerfile`, which is also where the extension is built; docker is
|
||||
required and the suite fails loudly rather than skipping if it is unavailable).
|
||||
The suite lives in `tests/e2e/` and is driven by `playwright-core`, whose
|
||||
version must stay matched to the container's Playwright version — the browsers
|
||||
ship inside the image.
|
||||
`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
|
||||
docker is required and the suite fails loudly rather than skipping if it is
|
||||
unavailable). The suite lives in `tests/e2e/` and is driven by
|
||||
`playwright-core`, whose version must stay matched to the container's Playwright
|
||||
version — the browsers ship inside the image.
|
||||
|
||||
It covers popup load, WebAssembly compilation under the shipped CSP (see
|
||||
[Content Security Policy](#content-security-policy)), wallet creation through
|
||||
@@ -322,46 +320,9 @@ Two limits are worth knowing, both real differences from the Chrome suite:
|
||||
Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
|
||||
`make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
|
||||
suite does not fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot
|
||||
pick it up either. Run them locally before changing anything under
|
||||
`src/popup/views/`.
|
||||
|
||||
### In CI
|
||||
|
||||
`.gitea/workflows/e2e.yml` runs both suites on every push, as two jobs —
|
||||
`e2e-chrome` and `e2e-firefox` — separate from the `check` workflow, so the
|
||||
20-second `make test` cap and the local fast path are untouched. Each job is a
|
||||
checkout and the matching `script/` entrypoint, nothing else.
|
||||
|
||||
Docker is the only thing either job needs from the runner, and that is not an
|
||||
accident. The runner executes a job inside a container against the **host's**
|
||||
docker daemon, so a `docker run -v "$PWD:/work"` source path is resolved by the
|
||||
host and mounts an empty directory, and the runner image's node is too old to
|
||||
install this repo's dependencies. Both suites therefore ship the repo to the
|
||||
daemon as a build context and build the extension inside the image, which works
|
||||
identically on a laptop.
|
||||
|
||||
The jobs **report, they do not gate.** A failure is a red mark against the
|
||||
commit that a reviewer has to account for, not a hard block: whether a check
|
||||
blocks a merge is Gitea branch protection, which this repo does not configure.
|
||||
|
||||
That is not only a statement about configuration. The Chrome suite is
|
||||
**measurably flaky under load** — two of six runs of unmutated code on a busy
|
||||
machine lost the approval popup out from under the dApp signing wait, always in
|
||||
the `#183` section, tracked as
|
||||
[#287](https://git.eeqj.de/sneak/AutistMask/issues/287). So a red `e2e-chrome`
|
||||
has to be read before it is believed, and that flake is the blocker to ever
|
||||
making this a required check. Do not answer it with a retry wrapper: a suite
|
||||
that reruns until it is green stops being evidence.
|
||||
|
||||
Nothing in either job can pass vacuously. There is no `continue-on-error` and no
|
||||
`|| true`; both scripts exit non-zero when docker is missing, when the image
|
||||
build fails, and when the browser fails to start; the Chrome harness aborts the
|
||||
suite outright if its network interception is not in effect.
|
||||
|
||||
Measured on this repo's runner: `e2e-chrome` about 1m55s cold, almost all of it
|
||||
the one-time pull of the pinned ~800MB Playwright layer, and well under a minute
|
||||
once that layer is cached. `e2e-firefox` about 1m05s cold, and it caches its
|
||||
Firefox and geckodriver downloads the same way.
|
||||
pick it up either. Neither is wired into the Gitea workflow yet —
|
||||
docker-in-docker in CI is a separate question. Run them locally before changing
|
||||
anything under `src/popup/views/`.
|
||||
|
||||
## Rationale
|
||||
|
||||
|
||||
53
TODO.md
53
TODO.md
@@ -33,8 +33,7 @@ The backlog lives on the
|
||||
authoritative; this file does not duplicate it. Full policy file set present.
|
||||
Real-browser end-to-end suites (`make test-e2e` for Chrome,
|
||||
`make test-e2e-firefox` for Firefox) now sit alongside `make check`, which
|
||||
cannot see a runtime `ReferenceError` in a popup view, and
|
||||
`.gitea/workflows/e2e.yml` runs both of them on every push.
|
||||
cannot see a runtime `ReferenceError` in a popup view.
|
||||
|
||||
# Next Step
|
||||
|
||||
@@ -46,38 +45,6 @@ undefined identifiers, which is how
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
|
||||
runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
|
||||
push, separate from `check`, so `make check` and its 20-second `make test` cap
|
||||
are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
|
||||
check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
|
||||
gate, the dApp approval round trips — was enforced only when a human
|
||||
remembered to run it by hand. The suites could not run on the runner as they
|
||||
stood: the runner executes a job in a container against the host's docker
|
||||
daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
|
||||
and the runner image's node cannot install this repo's dependencies. Both
|
||||
suites now ship the repo to the daemon as a build context and build the
|
||||
extension inside the pinned image, so docker is the only prerequisite on a
|
||||
runner or a laptop, and both run the image by ID rather than by tag so
|
||||
concurrent clones cannot swap it. The jobs report rather than gate — this repo
|
||||
configures no branch protection, and the Chrome suite is measurably flaky
|
||||
under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
|
||||
rather than papered over
|
||||
([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
|
||||
- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
|
||||
rebuilt every failure as `new Error(error.message)`, so the code the
|
||||
background produced and the content script relayed intact was dropped in the
|
||||
last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
|
||||
the user deliberately declined was indistinguishable from one that broke. The
|
||||
provider now rejects with a `ProviderRpcError` carrying `code` and, where the
|
||||
boundary sent one, `data`, passed through verbatim rather than matched against
|
||||
a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
|
||||
here. An error the background sent with no code stays a plain `Error` with no
|
||||
`code` property, and `message` is unchanged in every case. All four request
|
||||
entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
|
||||
`tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
|
||||
now requires it on the page's Error as well as on the wire, for all four
|
||||
rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
|
||||
- 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
|
||||
it. A reopened popup renders the wallet list and the one screen it restores
|
||||
onto, so every screen further down the stack was still the blank template from
|
||||
@@ -95,20 +62,6 @@ undefined identifiers, which is how
|
||||
and by three end-to-end cases against the real popup, each demonstrated
|
||||
failing on the unfixed build
|
||||
([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
|
||||
- 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
|
||||
that bear it, not to one of them. A ticker is not unique: seven of the 512
|
||||
bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
|
||||
share a symbol with another bundled entry at a different real contract, and
|
||||
the table, built from the list first-wins, kept only the earlier one. The
|
||||
other seven were judged spoofs of their own symbol at their own address and
|
||||
hidden from the balance list, the history and the send selector, so a holder
|
||||
could not spend them. Both contracts of each pair come from the same CoinGecko
|
||||
fetch of 2026-02-27, so neither was stale and neither was dropped.
|
||||
`isSpoofedSymbol()` asks set membership instead of equality, which does not
|
||||
loosen the rule — a contract outside the set is still a spoof — and a test now
|
||||
walks `TOKENS` asserting no bundled token is filtered at its own address,
|
||||
which is the walk the suite lacked
|
||||
([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
|
||||
- 2026-08-12: The dApp approval round trips are driven end to end in the
|
||||
browser. A test page served by the harness speaks EIP-1193 to the real inpage
|
||||
provider through the real content script, background worker and approval popup
|
||||
@@ -387,5 +340,9 @@ tracker.
|
||||
- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
|
||||
input validation) before any 1.0rc tag. Individual filed issues are parts of
|
||||
it, but the review is broader than any of them.
|
||||
- Decide whether docker-in-docker makes `make test-e2e` and
|
||||
`make test-e2e-firefox` runnable in the Gitea workflow. Extending the Chrome
|
||||
suite itself is tracked as
|
||||
[#183](https://git.eeqj.de/sneak/AutistMask/issues/183).
|
||||
- Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
|
||||
land.
|
||||
|
||||
@@ -7,29 +7,17 @@
|
||||
# caps make test at 20 seconds and a browser suite does not fit. Run it
|
||||
# yourself before touching popup views; it is the only check that can see
|
||||
# a used-but-not-imported identifier blow up at runtime.
|
||||
# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
|
||||
# from check so that cap and the local fast path both stay intact.
|
||||
#
|
||||
# Docker is the only prerequisite. The repo reaches the container as a
|
||||
# build context and the extension is built inside it (see
|
||||
# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
|
||||
# on the machine that starts the run. That is not a convenience: a bind
|
||||
# mount cannot work under Gitea Actions, and the runner image's node is too
|
||||
# old to install this repo's dependencies.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
|
||||
|
||||
IIDFILE=""
|
||||
|
||||
cleanup() {
|
||||
if [ -n "$IIDFILE" ]; then
|
||||
rm -f "$IIDFILE"
|
||||
fi
|
||||
}
|
||||
# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
|
||||
#
|
||||
# The playwright-core devDependency is pinned to the matching Playwright
|
||||
# version (1.56.0) and the two must be bumped together: the browsers ship
|
||||
# inside this image, and playwright-core looks for the exact browser
|
||||
# revision its own version expects. A mismatch fails at launch.
|
||||
IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
@@ -39,23 +27,14 @@ main() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IIDFILE="$(mktemp)"
|
||||
trap cleanup EXIT
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
|
||||
echo "Building the Chrome e2e image (extension included)..."
|
||||
docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
|
||||
echo "Building extension for e2e..."
|
||||
yarn run build 2>&1
|
||||
|
||||
echo "Running e2e suite in the pinned Playwright container..."
|
||||
# The image is run by ID, not by tag: where two clones of this repo run
|
||||
# the suite at once, the other build can move the tag between this
|
||||
# build and this run, and the suite would then silently test the other
|
||||
# checkout.
|
||||
#
|
||||
# --ipc=host: Chromium's shared-memory needs more than the default
|
||||
# 64MB /dev/shm or renderers crash.
|
||||
# HOME=/tmp: the image's root home is not a reliable place for the
|
||||
# browser profile.
|
||||
# --user: keep files the suite touches owned by the caller, not root.
|
||||
# HOME=/tmp: the mapped uid has no home directory in the image.
|
||||
# PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
|
||||
# ctx.route() intercepts page requests only, and every fetch made by
|
||||
# the MV3 background service worker — including the phishing
|
||||
@@ -72,10 +51,13 @@ main() {
|
||||
# on a deliberate bump.
|
||||
docker run --rm \
|
||||
--ipc=host \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
-e HOME=/tmp \
|
||||
-e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
|
||||
-e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
|
||||
"$(cat "$IIDFILE")" \
|
||||
-v "$ROOT:/work" \
|
||||
-w /work \
|
||||
"$IMAGE" \
|
||||
node tests/e2e/run.js
|
||||
}
|
||||
|
||||
|
||||
@@ -5,17 +5,12 @@
|
||||
#
|
||||
# Deliberately NOT called by script/check or script/test, for the same
|
||||
# reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
|
||||
# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
|
||||
# on every push, in a job separate from check.
|
||||
# and a browser suite does not fit.
|
||||
#
|
||||
# Unlike script/test-e2e this builds its base image locally, because no
|
||||
# Unlike script/test-e2e this builds its image locally, because no
|
||||
# published image carries both a pinned Firefox and a matching geckodriver.
|
||||
# All three external artifacts are pinned by digest inside the Dockerfile;
|
||||
# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
|
||||
# the extension build are baked into the image rather than mounted.
|
||||
#
|
||||
# Docker is the only prerequisite: nothing here depends on the node, yarn
|
||||
# or make on the machine that starts the run.
|
||||
# see tests/e2e/firefox/Dockerfile.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
@@ -23,14 +18,6 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
|
||||
|
||||
IIDFILE=""
|
||||
|
||||
cleanup() {
|
||||
if [ -n "$IIDFILE" ]; then
|
||||
rm -f "$IIDFILE"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
@@ -39,20 +26,16 @@ main() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IIDFILE="$(mktemp)"
|
||||
trap cleanup EXIT
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
echo "Building extension for e2e..."
|
||||
yarn run build 2>&1
|
||||
|
||||
echo "Building the pinned Firefox e2e image (extension included)..."
|
||||
docker build --iidfile "$IIDFILE" -t "$IMAGE" \
|
||||
-f tests/e2e/firefox/Dockerfile .
|
||||
# The build context is tests/e2e/firefox/ and holds nothing but the
|
||||
# Dockerfile: the harness itself arrives over the bind mount below, so
|
||||
# editing it never invalidates an image layer.
|
||||
echo "Building the pinned Firefox e2e image..."
|
||||
docker build -t "$IMAGE" "$ROOT/tests/e2e/firefox"
|
||||
|
||||
echo "Running the Firefox e2e suite..."
|
||||
# The image is run by ID, not by tag: where two clones of this repo run
|
||||
# the suite at once, the other build can move the tag between this
|
||||
# build and this run, and the suite would then silently test the other
|
||||
# checkout.
|
||||
#
|
||||
# --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
|
||||
# --network none: the suite stubs nothing, so this is what keeps the
|
||||
# run offline and deterministic. The extension swallows its own
|
||||
@@ -60,8 +43,8 @@ main() {
|
||||
# network note in README.md. Weaker than the Chrome suite's
|
||||
# fixture interception, and honestly so — it proves no request
|
||||
# escaped, but it cannot report which ones were attempted.
|
||||
# HOME=/tmp: the image's root home is not a reliable place for the
|
||||
# browser profile.
|
||||
# --user: keep files the suite touches owned by the caller, not root.
|
||||
# HOME=/tmp: the mapped uid has no home directory in the image.
|
||||
#
|
||||
# No --privileged. Firefox's sandbox logs
|
||||
# "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
|
||||
@@ -69,8 +52,11 @@ main() {
|
||||
docker run --rm \
|
||||
--shm-size=1g \
|
||||
--network none \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
-e HOME=/tmp \
|
||||
"$(cat "$IIDFILE")" \
|
||||
-v "$ROOT:/work" \
|
||||
-w /work \
|
||||
"$IMAGE" \
|
||||
node tests/e2e/firefox/run.js dist/firefox
|
||||
}
|
||||
|
||||
|
||||
@@ -11,39 +11,6 @@
|
||||
let nextId = 1;
|
||||
const pending = {};
|
||||
|
||||
// EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
|
||||
// rather than properties bolted onto an Error because this object crosses
|
||||
// no boundary after construction — it is built in the page's own realm and
|
||||
// handed straight to the caller's catch — so the prototype survives and
|
||||
// `error.name` is a stable thing for a dApp to see.
|
||||
class ProviderRpcError extends Error {
|
||||
constructor(code, message, data) {
|
||||
super(message);
|
||||
this.name = "ProviderRpcError";
|
||||
this.code = code;
|
||||
if (data !== undefined) this.data = data;
|
||||
}
|
||||
}
|
||||
|
||||
// Rebuild a boundary error as the error the page catches, carrying the
|
||||
// code (and data) the extension reported. Without this a dApp cannot tell
|
||||
// a user's refusal (4001) from a wallet that broke, and retries or shows
|
||||
// an error instead of accepting the refusal.
|
||||
//
|
||||
// Whatever code arrived is passed through verbatim rather than being
|
||||
// matched against a list: the extension emits 4001, 4100 and 4902 today,
|
||||
// and a code this file has never heard of is still the truth about what
|
||||
// happened. An error reported with no code at all stays a plain Error —
|
||||
// a ProviderRpcError whose `code` is undefined would advertise a
|
||||
// conformance it does not have. `message` is untouched in every case.
|
||||
function toPageError(error) {
|
||||
const message = (error && error.message) || "Request failed";
|
||||
if (error && error.code !== undefined && error.code !== null) {
|
||||
return new ProviderRpcError(error.code, message, error.data);
|
||||
}
|
||||
return new Error(message);
|
||||
}
|
||||
|
||||
// Listen for responses from the content script
|
||||
window.addEventListener("message", function onUuid(event) {
|
||||
if (event.source !== window) return;
|
||||
@@ -53,7 +20,7 @@
|
||||
if (!p) return;
|
||||
delete pending[id];
|
||||
if (error) {
|
||||
p.reject(toPageError(error));
|
||||
p.reject(new Error(error.message || "Request failed"));
|
||||
} else {
|
||||
p.resolve(result);
|
||||
}
|
||||
|
||||
@@ -8,19 +8,12 @@
|
||||
// either verdict alone, because the balance list is where the user forms
|
||||
// their belief about what they own (issue #235).
|
||||
//
|
||||
// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
|
||||
// that may bear it, or to null. Null means the symbol belongs to the native
|
||||
// asset, which has no contract at all, so no contract may bear it and every
|
||||
// one that does is a spoof. "ETH" is the only such entry today; the rule is
|
||||
// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
|
||||
// bear it, or to null. Null means the symbol belongs to the native asset,
|
||||
// which has no contract at all, so no contract may bear it and every one
|
||||
// that does is a spoof. "ETH" is the only such entry today; the rule is
|
||||
// written so that a second one needs no change here or at any call site.
|
||||
//
|
||||
// The value is a set because a ticker is not unique: seven symbols in the
|
||||
// bundled list belong to two real contracts each, and answering with one of
|
||||
// them hid the other one's holders' money (issue #276). Membership, not
|
||||
// equality, is therefore the question — but it is the same question, asked of
|
||||
// a table that can now state the truth. Every address in a set is one the
|
||||
// wallet ships as a real token; a contract outside the set is still a spoof.
|
||||
//
|
||||
// The symbol is attacker-controlled — it is whatever the ERC-20 contract
|
||||
// returns — so the lookup is done on a normalized form (issue #260): the
|
||||
// question is whether the symbol reaches the user's eye as a known one,
|
||||
@@ -100,7 +93,7 @@ function isSpoofedSymbol(symbol, contractAddress) {
|
||||
if (!KNOWN_SYMBOLS.has(sym)) return false;
|
||||
const legit = KNOWN_SYMBOLS.get(sym);
|
||||
if (legit === null) return true;
|
||||
return !legit.has(contract);
|
||||
return contract !== normalizeAddress(legit);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
|
||||
@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
|
||||
TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
|
||||
}
|
||||
|
||||
// Build a map of symbol (uppercased) -> the set of contract addresses
|
||||
// (lowercased) that legitimately bear it. Used for spoofed-symbol detection.
|
||||
// "ETH" maps to null: the native asset has no contract, so no contract may
|
||||
// bear its symbol.
|
||||
//
|
||||
// The value is a set and not a single address because tickers are not unique
|
||||
// and the list above proves it: seven of these 512 tokens share a symbol with
|
||||
// another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
|
||||
// different real contracts each, all of them from the same source fetch. A
|
||||
// one-address-per-symbol table can only answer that by picking a winner, and
|
||||
// the loser is then a token in our own bundled list that the spoof filter
|
||||
// hides from the balance list, the history and the send selector at its own
|
||||
// address, so the user cannot spend it (issue #276). Naming every address
|
||||
// that bears the symbol is the only shape that says what is true; it does not
|
||||
// loosen the rule, because a contract outside the set is still a spoof.
|
||||
// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
|
||||
// Used for spoofed-symbol detection. "ETH" maps to null (native token).
|
||||
const KNOWN_SYMBOLS = new Map();
|
||||
KNOWN_SYMBOLS.set("ETH", null);
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!KNOWN_SYMBOLS.has(upper)) {
|
||||
KNOWN_SYMBOLS.set(upper, new Set());
|
||||
}
|
||||
const addresses = KNOWN_SYMBOLS.get(upper);
|
||||
// A null entry is the native asset and stays null: an ERC-20 that reports
|
||||
// the native symbol does not thereby become entitled to it.
|
||||
if (addresses !== null) {
|
||||
addresses.add(t.address.toLowerCase());
|
||||
KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,34 +0,0 @@
|
||||
# Chrome end-to-end image: the pinned Playwright image with this repo and a
|
||||
# freshly built extension inside it, built by script/test-e2e. The suite is
|
||||
# still started with `docker run`, so every runtime flag the harness needs
|
||||
# (--ipc=host in particular) applies as before.
|
||||
#
|
||||
# The repo is baked in rather than bind-mounted because a bind mount does
|
||||
# not resolve under Gitea Actions: the runner runs the job in a container
|
||||
# against the HOST's docker socket, so the source side of a -v is resolved
|
||||
# by the host daemon while the job's checkout lives on a docker volume that
|
||||
# is not a host path -- the mount silently succeeds and /work is empty. A
|
||||
# build context is streamed to the daemon and so works from anywhere.
|
||||
# Building the extension here too means the machine starting a run needs
|
||||
# docker and nothing else.
|
||||
|
||||
# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
|
||||
#
|
||||
# The playwright-core devDependency is pinned to the matching Playwright
|
||||
# version (1.56.0) and the two must be bumped together: the browsers ship
|
||||
# inside this image, and playwright-core looks for the exact browser
|
||||
# revision its own version expects. A mismatch fails at launch.
|
||||
FROM mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2
|
||||
|
||||
WORKDIR /work
|
||||
|
||||
# Same layering as the root Dockerfile: script/bootstrap installs the
|
||||
# prerequisites and the dependencies, and the manifests are copied first so
|
||||
# that layer is cached until they change.
|
||||
COPY script/ script/
|
||||
COPY package.json yarn.lock ./
|
||||
RUN script/bootstrap
|
||||
|
||||
COPY . .
|
||||
|
||||
RUN make build
|
||||
@@ -1,24 +1,10 @@
|
||||
# Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
|
||||
# with this repo and a freshly built extension inside it, built by
|
||||
# script/test-e2e-firefox. The harness itself has no dependencies, so
|
||||
# nothing is installed for it.
|
||||
# built by script/test-e2e-firefox. The repo is bind-mounted at /work; the
|
||||
# harness itself has no dependencies, so nothing is installed for it.
|
||||
#
|
||||
# The build context is the repo root. The repo is baked in rather than
|
||||
# bind-mounted because a bind mount does not resolve under Gitea Actions:
|
||||
# the runner runs the job in a container against the HOST's docker socket,
|
||||
# so the source side of a -v is resolved by the host daemon while the job's
|
||||
# checkout lives on a docker volume that is not a host path -- the mount
|
||||
# silently succeeds and /work is empty. Baking the build in is also the
|
||||
# only way this suite can have both a built extension and the
|
||||
# `--network none` it runs under, since a container with no network cannot
|
||||
# install anything.
|
||||
#
|
||||
# All three external artifacts are pinned by digest, and are fetched in
|
||||
# layers above the repo copy, so editing the harness or any source file
|
||||
# re-runs only the two cheap layers at the bottom. The Firefox version in
|
||||
# particular must not float: -remote-allow-system-access is mandatory on
|
||||
# 153 and was not on 142, so the flag the harness passes is
|
||||
# version-coupled.
|
||||
# All three external artifacts are pinned by digest. The Firefox version in
|
||||
# particular must not float: -remote-allow-system-access is mandatory on 153
|
||||
# and was not on 142, so the flag the harness passes is version-coupled.
|
||||
|
||||
# node:22-bookworm-slim, 2026-08-12
|
||||
FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
|
||||
@@ -62,16 +48,4 @@ ENV FIREFOX_BIN=/opt/firefox/firefox
|
||||
ENV GECKODRIVER=/usr/local/bin/geckodriver
|
||||
|
||||
WORKDIR /work
|
||||
|
||||
# Same layering as the root Dockerfile: script/bootstrap installs the
|
||||
# prerequisites and the dependencies, and the manifests are copied first so
|
||||
# that layer is cached until they change.
|
||||
COPY script/ script/
|
||||
COPY package.json yarn.lock ./
|
||||
RUN script/bootstrap
|
||||
|
||||
COPY . .
|
||||
|
||||
RUN make build
|
||||
|
||||
CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]
|
||||
|
||||
@@ -86,11 +86,9 @@ const DAPP_URL = DAPP_ORIGIN + "/";
|
||||
// never drive the popup that has to settle it; start() files the promise
|
||||
// under a key and settle() collects it once the prompt has been dealt with.
|
||||
//
|
||||
// The rejection branch records the whole observable shape of the error as it
|
||||
// arrives — name, message, and whether a `code` is present at all as distinct
|
||||
// from its value. EIP-1193 says a user rejection is a ProviderRpcError
|
||||
// carrying code 4001; what the page can actually see is recorded here rather
|
||||
// than assumed, and asserted in run.js.
|
||||
// The rejection branch records `code` as it arrives. EIP-1193 says a user
|
||||
// rejection is a ProviderRpcError carrying code 4001; what the page can
|
||||
// actually see is recorded here rather than assumed, and asserted in run.js.
|
||||
//
|
||||
// The message log is the page's half of the boundary observation: every
|
||||
// AUTISTMASK_* message that crosses between this page and the content
|
||||
@@ -122,7 +120,6 @@ const DAPP_HTML = [
|
||||
" return {",
|
||||
" settled: 'rejected',",
|
||||
" message: String((error && error.message) || error),",
|
||||
" name: error ? error.name : undefined,",
|
||||
" hasCode: !!error && 'code' in Object(error),",
|
||||
" code: error ? error.code : undefined,",
|
||||
" };",
|
||||
|
||||
@@ -1757,14 +1757,15 @@ async function lastResponseError(page) {
|
||||
}
|
||||
|
||||
// A rejected prompt, asserted at both ends: the page's promise rejected
|
||||
// rather than hanging or resolving, and EIP-1193 code 4001 is present both
|
||||
// on the wire and on the Error the calling page catches.
|
||||
// rather than hanging or resolving, and the response that crossed the
|
||||
// boundary carried EIP-1193 code 4001.
|
||||
//
|
||||
// Both ends matter because they used to disagree. The code crossed the
|
||||
// boundary correctly and src/content/inpage.js then threw it away, rebuilding
|
||||
// every rejection as `new Error(error.message)` — so a dApp branching on
|
||||
// `err.code === 4001` saw undefined and could not tell a refusal from a
|
||||
// failure (#274). Asserting only the wire would leave that gap invisible.
|
||||
// The code is asserted on the wire because that is the only place it
|
||||
// survives. src/content/inpage.js rebuilds the rejection as `new
|
||||
// Error(error.message)`, so the Error the calling page catches carries the
|
||||
// message and no code. That is reported rather than asserted either way —
|
||||
// locking in the current behaviour would make the gap permanent, and
|
||||
// asserting the code on the Error would fail today.
|
||||
async function assertUserRejection(page, key, label) {
|
||||
const outcome = await settleRequest(page, key);
|
||||
assert(
|
||||
@@ -1786,32 +1787,15 @@ async function assertUserRejection(page, key, label) {
|
||||
" did not carry EIP-1193 code 4001 across the boundary: " +
|
||||
JSON.stringify(error),
|
||||
);
|
||||
assert(
|
||||
outcome.hasCode,
|
||||
label +
|
||||
" reached the page as an error with no code property at all, so a " +
|
||||
"dApp cannot tell the user's refusal from a failure: " +
|
||||
JSON.stringify(outcome),
|
||||
);
|
||||
assert(
|
||||
outcome.code === 4001,
|
||||
label +
|
||||
" reached the page with code " +
|
||||
JSON.stringify(outcome.code) +
|
||||
" rather than EIP-1193 4001",
|
||||
);
|
||||
assert(
|
||||
outcome.name === "ProviderRpcError",
|
||||
label +
|
||||
" reached the page as " +
|
||||
JSON.stringify(outcome.name) +
|
||||
" rather than an EIP-1193 ProviderRpcError",
|
||||
);
|
||||
console.log(
|
||||
"# " +
|
||||
label +
|
||||
": code 4001 on the wire and on the page's " +
|
||||
outcome.name,
|
||||
": boundary code=" +
|
||||
error.code +
|
||||
" page Error.code=" +
|
||||
JSON.stringify(outcome.code) +
|
||||
" page Error carries a code=" +
|
||||
outcome.hasCode,
|
||||
);
|
||||
return outcome;
|
||||
}
|
||||
|
||||
@@ -1,310 +0,0 @@
|
||||
// The EIP-1193 error the page actually catches (src/content/inpage.js).
|
||||
//
|
||||
// The bug this pins down (issue #274): the provider rebuilt every failure as
|
||||
// `new Error(error.message)`, so the `code` the background produced and the
|
||||
// content script relayed intact was thrown away in the last hop. A dApp
|
||||
// checking `err.code === 4001` — the standard way to tell "the user said no"
|
||||
// from "the wallet broke" — saw undefined, and well-behaved sites showed an
|
||||
// error or retried instead of accepting the refusal.
|
||||
//
|
||||
// inpage.js is a bare IIFE injected into the page's JS context, not a module:
|
||||
// it takes no import and exports nothing, and reaches for `window` at load.
|
||||
// So it is evaluated here the way the browser evaluates it, against a stub
|
||||
// window, and the provider is collected from `window.ethereum`. The globals it
|
||||
// touches are passed in as function parameters rather than assigned to
|
||||
// globalThis: nothing leaks between tests, and the source is compiled in this
|
||||
// realm, so the errors it constructs are comparable against this file's own
|
||||
// `Error` — which a second realm's intrinsics would silently defeat.
|
||||
//
|
||||
// There is no jsdom in this repo; see tests/txStatus.test.js.
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
const { webcrypto } = require("crypto");
|
||||
|
||||
const SOURCE = fs.readFileSync(
|
||||
path.join(__dirname, "..", "src", "content", "inpage.js"),
|
||||
"utf8",
|
||||
);
|
||||
|
||||
const loadInto = new Function(
|
||||
"window",
|
||||
"self",
|
||||
"crypto",
|
||||
"Event",
|
||||
"CustomEvent",
|
||||
SOURCE,
|
||||
);
|
||||
|
||||
class StubEvent {
|
||||
constructor(type) {
|
||||
this.type = type;
|
||||
}
|
||||
}
|
||||
|
||||
class StubCustomEvent extends StubEvent {
|
||||
constructor(type, init) {
|
||||
super(type);
|
||||
this.detail = init && init.detail;
|
||||
}
|
||||
}
|
||||
|
||||
// Every code the background emits on the RPC path today, read out of
|
||||
// src/background/index.js. The provider must not know this list — it passes
|
||||
// through whatever arrived — but the cases below are the real ones.
|
||||
const REJECTED = 4001; // user rejected the request
|
||||
const UNAUTHORIZED = 4100; // site not connected / wrong address
|
||||
const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
|
||||
|
||||
// A stub window with the four things inpage.js touches: message listeners,
|
||||
// postMessage out to the content script, window.ethereum, and dispatchEvent
|
||||
// for the EIP-6963 announcement.
|
||||
function loadProvider() {
|
||||
const messageListeners = [];
|
||||
const posted = [];
|
||||
|
||||
const win = {
|
||||
addEventListener(type, fn) {
|
||||
if (type === "message") messageListeners.push(fn);
|
||||
},
|
||||
removeEventListener(type, fn) {
|
||||
const i = messageListeners.indexOf(fn);
|
||||
if (type === "message" && i !== -1) messageListeners.splice(i, 1);
|
||||
},
|
||||
postMessage(data) {
|
||||
posted.push(data);
|
||||
},
|
||||
dispatchEvent() {
|
||||
return true;
|
||||
},
|
||||
};
|
||||
win.window = win;
|
||||
|
||||
loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
|
||||
|
||||
// Deliver the content script's answer to an outstanding request. The id is
|
||||
// read back off the wire rather than assumed: inpage.js issues its own
|
||||
// eth_chainId at load, so the first id a test sees is not 1.
|
||||
function respond(response) {
|
||||
const request = posted
|
||||
.filter((m) => m.type === "AUTISTMASK_REQUEST")
|
||||
.pop();
|
||||
expect(request).toBeDefined();
|
||||
const event = {
|
||||
source: win,
|
||||
data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
|
||||
};
|
||||
for (const fn of messageListeners.slice()) fn(event);
|
||||
}
|
||||
|
||||
return { provider: win.ethereum, posted, respond };
|
||||
}
|
||||
|
||||
// Start a request, answer it with `response`, and hand back the rejection.
|
||||
// Fails the test if the call resolves instead.
|
||||
async function rejectionFrom(start, response) {
|
||||
const { provider, respond } = loadProvider();
|
||||
const settled = start(provider).then(
|
||||
(result) => ({ resolved: result }),
|
||||
(error) => ({ error }),
|
||||
);
|
||||
// The provider posts synchronously, so the request is already on the wire.
|
||||
respond(response);
|
||||
const outcome = await settled;
|
||||
expect(outcome).not.toHaveProperty("resolved");
|
||||
return outcome.error;
|
||||
}
|
||||
|
||||
describe("an EIP-1193 code reaches the page", () => {
|
||||
test("a user rejection arrives as code 4001", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
expect(err.message).toBe("User rejected the request.");
|
||||
});
|
||||
|
||||
test("it is a ProviderRpcError, and an Error", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err).toBeInstanceOf(Error);
|
||||
expect(err.name).toBe("ProviderRpcError");
|
||||
});
|
||||
|
||||
test("4100 unauthorized arrives intact", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "personal_sign", params: ["0x00"] }),
|
||||
{ error: { code: UNAUTHORIZED, message: "Unauthorized" } },
|
||||
);
|
||||
expect(err.code).toBe(UNAUTHORIZED);
|
||||
expect(err.message).toBe("Unauthorized");
|
||||
});
|
||||
|
||||
test("4902 unrecognized chain arrives intact", async () => {
|
||||
const message =
|
||||
"AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "wallet_switchEthereumChain" }),
|
||||
{ error: { code: UNRECOGNIZED_CHAIN, message } },
|
||||
);
|
||||
expect(err.code).toBe(UNRECOGNIZED_CHAIN);
|
||||
expect(err.message).toBe(message);
|
||||
});
|
||||
|
||||
// The provider is not allowed to know the list above: a code added to the
|
||||
// background later must reach the page without this file being edited.
|
||||
test("a code the provider has never heard of is passed through", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_accounts" }),
|
||||
{ error: { code: 4900, message: "Disconnected" } },
|
||||
);
|
||||
expect(err.code).toBe(4900);
|
||||
});
|
||||
|
||||
test("data is carried when the boundary sent it", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_call" }),
|
||||
{
|
||||
error: {
|
||||
code: -32000,
|
||||
message: "execution reverted",
|
||||
data: "0x08c379a0",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err.code).toBe(-32000);
|
||||
expect(err.data).toBe("0x08c379a0");
|
||||
});
|
||||
|
||||
test("no data property is invented when the boundary sent none", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect("data" in err).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("the message is untouched", () => {
|
||||
test("a coded error keeps the message byte for byte", async () => {
|
||||
const message =
|
||||
"This site asked to sign as an address that is not " +
|
||||
"the active one.";
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "personal_sign" }),
|
||||
{ error: { code: UNAUTHORIZED, message } },
|
||||
);
|
||||
expect(err.message).toBe(message);
|
||||
});
|
||||
|
||||
test("an error the background sent with no code keeps its message", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { message: "No accounts available" } },
|
||||
);
|
||||
expect(err.message).toBe("No accounts available");
|
||||
});
|
||||
|
||||
// A ProviderRpcError whose code is undefined would claim a conformance it
|
||||
// does not have, and `'code' in err` is exactly what a careful dApp asks.
|
||||
test("an error with no code gets no code property at all", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { message: "No accounts available" } },
|
||||
);
|
||||
expect(err).toBeInstanceOf(Error);
|
||||
expect("code" in err).toBe(false);
|
||||
});
|
||||
|
||||
test("an error with no message keeps the generic fallback", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { code: REJECTED } },
|
||||
);
|
||||
expect(err.message).toBe("Request failed");
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
});
|
||||
|
||||
// Every entry point the provider exposes, not just eth_requestAccounts. They
|
||||
// all funnel through the same response listener, and this is what says so.
|
||||
describe("every request path carries the code", () => {
|
||||
const rejection = {
|
||||
error: { code: REJECTED, message: "User rejected the request." },
|
||||
};
|
||||
|
||||
test("request()", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("enable()", async () => {
|
||||
const err = await rejectionFrom((p) => p.enable(), rejection);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("send(method, params)", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.send("eth_requestAccounts", []),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("send({ method, params })", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.send({ method: "personal_sign", params: ["0x00"] }),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("sendAsync() hands the code to its callback", async () => {
|
||||
const { provider, respond } = loadProvider();
|
||||
const called = new Promise((resolve) => {
|
||||
provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
|
||||
resolve(e),
|
||||
);
|
||||
});
|
||||
respond(rejection);
|
||||
const err = await called;
|
||||
expect(err.name).toBe("ProviderRpcError");
|
||||
expect(err.code).toBe(REJECTED);
|
||||
expect(err.message).toBe("User rejected the request.");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the success path is unchanged", () => {
|
||||
test("a result still resolves", async () => {
|
||||
const { provider, respond } = loadProvider();
|
||||
const settled = provider.request({ method: "eth_requestAccounts" });
|
||||
respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
|
||||
await expect(settled).resolves.toEqual([
|
||||
"0xb61264DEFB0c4B8afb3D73724be15310036743a5",
|
||||
]);
|
||||
expect(provider.selectedAddress).toBe(
|
||||
"0xb61264DEFB0c4B8afb3D73724be15310036743a5",
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -56,7 +56,7 @@ global.chrome = {
|
||||
};
|
||||
|
||||
const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
|
||||
const { TOKENS, KNOWN_SYMBOLS } = require("../src/shared/tokenList");
|
||||
const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
|
||||
const { filterTransactions } = require("../src/shared/transactions");
|
||||
const {
|
||||
fetchTokenBalances,
|
||||
@@ -284,137 +284,11 @@ describe("the shared rule: symbols that render as a known symbol", () => {
|
||||
// asserts the claim it stands for — `[ -~]` would admit an interior
|
||||
// space and let a whitespace-bearing entry through the guard.
|
||||
test("no bundled symbol is touched by the normalization", () => {
|
||||
for (const [symbol, addresses] of KNOWN_SYMBOLS) {
|
||||
for (const [symbol, address] of KNOWN_SYMBOLS) {
|
||||
expect(symbol).toBe(symbol.trim());
|
||||
expect(symbol).toMatch(/^[!-~]+$/);
|
||||
if (addresses === null) continue;
|
||||
for (const address of addresses) {
|
||||
expect(isSpoofedSymbol(symbol, address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Issue #276: the guard that was missing. The suite walked KNOWN_SYMBOLS,
|
||||
// which is built from TOKENS, so it could only ever assert that the table
|
||||
// agrees with itself. Seven symbols appear twice in the bundled list at two
|
||||
// different real contracts, and the table kept whichever came first, so the
|
||||
// other seven contracts — tokens in our own shipped list, at their own
|
||||
// addresses — were judged spoofs and hidden from the balance list, the
|
||||
// history and the send selector. That is the over-filtering direction: it
|
||||
// hides a holding the user cannot then spend.
|
||||
//
|
||||
// This walk is over TOKENS, the data the wallet actually ships, so it fails
|
||||
// whenever a bundled token would be filtered at its own address no matter
|
||||
// which side of the table the mistake is on.
|
||||
describe("the shipped token list", () => {
|
||||
test("no bundled token is filtered at its own address", () => {
|
||||
const filtered = TOKENS.filter((t) =>
|
||||
isSpoofedSymbol(t.symbol, t.address),
|
||||
).map((t) => t.symbol + " @ " + t.address);
|
||||
expect(filtered).toEqual([]);
|
||||
});
|
||||
|
||||
// The third failure mode the issue asks about: a symbol whose table entry
|
||||
// names an address that is in neither the table nor the list would be a
|
||||
// contract we vouch for and do not ship. There is none, and the table is
|
||||
// built from the list, so this asserts the derivation has not acquired a
|
||||
// hand-written entry.
|
||||
test("every address the table vouches for is a bundled token", () => {
|
||||
const bundled = new Set(TOKENS.map((t) => t.address.toLowerCase()));
|
||||
for (const [symbol, addresses] of KNOWN_SYMBOLS) {
|
||||
if (addresses === null) continue;
|
||||
expect(addresses.size).toBeGreaterThan(0);
|
||||
for (const address of addresses) {
|
||||
expect(address).toBe(address.toLowerCase());
|
||||
expect(bundled.has(address)).toBe(true);
|
||||
// And it is the token that actually reports that symbol.
|
||||
const token = TOKENS.find(
|
||||
(t) => t.address.toLowerCase() === address,
|
||||
);
|
||||
expect(token.symbol.toUpperCase()).toBe(symbol);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// Both contracts behind a shared ticker must pass, from either side: a
|
||||
// rule that admits only the one the table happens to visit first is the
|
||||
// bug, not the fix.
|
||||
test("both contracts behind a shared ticker are admitted", () => {
|
||||
const bySymbol = new Map();
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!bySymbol.has(upper)) bySymbol.set(upper, []);
|
||||
bySymbol.get(upper).push(t);
|
||||
}
|
||||
const shared = [...bySymbol].filter(([, list]) => list.length > 1);
|
||||
// The shared tickers are a fact about the shipped data; if a future
|
||||
// list has none, this test would silently assert nothing.
|
||||
expect(shared.length).toBeGreaterThan(0);
|
||||
for (const [, list] of shared) {
|
||||
for (const t of list) {
|
||||
expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// The seven from issue #276, named so that the reconciliation is a fact
|
||||
// in the suite: each is two real contracts from the same source fetch,
|
||||
// and the table now holds both rather than the one that came first.
|
||||
test("the seven shared tickers each name both bundled contracts", () => {
|
||||
const expected = {
|
||||
TON: [
|
||||
"0x582d872a1b094fc48f5de31d3b73f2d9be47def1", // Toncoin
|
||||
"0x2be5e8c109e2197d077d13a82daead6a9b3433c5", // Tokamak Network
|
||||
],
|
||||
FRAX: [
|
||||
"0x853d955acef822db058eb8505911ed77f175b99e", // Legacy Frax Dollar
|
||||
"0x3432b6a60d23ca0dfca7761b7ab56459d9c964d0", // Frax (prev. FXS)
|
||||
],
|
||||
REUSD: [
|
||||
"0x5086bf358635b81d8c47c66d1c8b9e567db70c72", // Re Protocol reUSD
|
||||
"0x57ab1e0003f623289cd798b1824be09a793e4bec", // Resupply USD
|
||||
],
|
||||
EURE: [
|
||||
"0x39b8b6385416f4ca36a20319f70d28621895279d", // Monerium EUR emoney
|
||||
"0x3231cb76718cdef2155fc47b5286d82e6eda273f", // Monerium EUR emoney [OLD]
|
||||
],
|
||||
MSUSD: [
|
||||
"0x4ba01f22827018b4772cd326c7627fb4956a7c00", // Main Street USD
|
||||
"0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
|
||||
],
|
||||
MUSD: [
|
||||
"0xaca92e438df0b2401ff60da7e4337b687a2435da", // MetaMask USD
|
||||
"0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
|
||||
],
|
||||
JPYC: [
|
||||
"0x431d5dff03120afa4bdf332c61a6e1766ef37bdb", // JPY Coin
|
||||
"0x2370f9d504c7a6e775bf6e14b3f12846b594cd53", // JPY Coin v1
|
||||
],
|
||||
};
|
||||
for (const [symbol, addresses] of Object.entries(expected)) {
|
||||
expect([...KNOWN_SYMBOLS.get(symbol)].sort()).toEqual(
|
||||
[...addresses].sort(),
|
||||
);
|
||||
for (const address of addresses) {
|
||||
expect(isSpoofedSymbol(symbol, address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// The other direction, on the same symbols: widening the table to hold
|
||||
// every bundled address for a ticker must not turn it into a pass for
|
||||
// any other contract.
|
||||
test("a shared ticker from a third contract is still a spoof", () => {
|
||||
const bySymbol = new Map();
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!bySymbol.has(upper)) bySymbol.set(upper, []);
|
||||
bySymbol.get(upper).push(t);
|
||||
}
|
||||
for (const [symbol, list] of bySymbol) {
|
||||
if (list.length < 2) continue;
|
||||
expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
if (address === null) continue;
|
||||
expect(isSpoofedSymbol(symbol, address)).toBe(false);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -207,8 +207,8 @@ describe("token list assumptions the fixtures rely on", () => {
|
||||
});
|
||||
|
||||
test("USDC and WETH map to their genuine lowercased contracts", () => {
|
||||
expect([...KNOWN_SYMBOLS.get("USDC")]).toEqual([USDC_CONTRACT]);
|
||||
expect([...KNOWN_SYMBOLS.get("WETH")]).toEqual([WETH_CONTRACT]);
|
||||
expect(KNOWN_SYMBOLS.get("USDC")).toBe(USDC_CONTRACT);
|
||||
expect(KNOWN_SYMBOLS.get("WETH")).toBe(WETH_CONTRACT);
|
||||
});
|
||||
|
||||
test("the spam fixture symbol is not in the known token list", () => {
|
||||
|
||||
Reference in New Issue
Block a user