Compare commits
1 Commits
issue-280-
...
13d444c3aa
| Author | SHA1 | Date | |
|---|---|---|---|
| 13d444c3aa |
61
TODO.md
61
TODO.md
@@ -45,53 +45,6 @@ undefined identifiers, which is how
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-08-14: A background message handler that throws now rejects the page
|
||||
instead of hanging it. `handleRpc(...).then(sendResponse)` had no `.catch()`,
|
||||
and `sendResponse` is the only thing that settles the dApp's
|
||||
`window.ethereum.request()` promise — so any throw inside `handleRpc` left
|
||||
that promise pending forever, with no error and no timeout, indistinguishable
|
||||
from a slow wallet. It now answers `{ code: -32603, message }` (the JSON-RPC
|
||||
internal error EIP-1474 defines and EIP-1193 defers to; no EIP-1193 4xxx code
|
||||
describes "the wallet broke" and none was invented) and logs the method and
|
||||
the throw to the background console rather than swallowing them. The two async
|
||||
IIFEs behind `AUTISTMASK_TX_RESPONSE` and `AUTISTMASK_SIGN_RESPONSE` were the
|
||||
same shape one level down — every statement inside a `try`, but a throw out of
|
||||
a `catch` block escaping unhandled — and each got a last-resort `.catch()`
|
||||
settling the approval through `settleApproval()` and answering the popup; the
|
||||
transaction one reports the broadcast stage, because it cannot tell whether
|
||||
the transaction reached the network. Every other handler on the path is
|
||||
synchronous. All three are driven by real failures — a rejecting storage read,
|
||||
and a failure classifier that throws while classifying a genuine verification
|
||||
failure — and were demonstrated failing first, the RPC one with `sendResponse`
|
||||
at zero calls ([#280](https://git.eeqj.de/sneak/AutistMask/issues/280)).
|
||||
- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
|
||||
rebuilt every failure as `new Error(error.message)`, so the code the
|
||||
background produced and the content script relayed intact was dropped in the
|
||||
last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
|
||||
the user deliberately declined was indistinguishable from one that broke. The
|
||||
provider now rejects with a `ProviderRpcError` carrying `code` and, where the
|
||||
boundary sent one, `data`, passed through verbatim rather than matched against
|
||||
a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
|
||||
here. An error the background sent with no code stays a plain `Error` with no
|
||||
`code` property, and `message` is unchanged in every case. All four request
|
||||
entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
|
||||
`tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
|
||||
now requires it on the page's Error as well as on the wire, for all four
|
||||
rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
|
||||
- 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
|
||||
that bear it, not to one of them. A ticker is not unique: seven of the 512
|
||||
bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
|
||||
share a symbol with another bundled entry at a different real contract, and
|
||||
the table, built from the list first-wins, kept only the earlier one. The
|
||||
other seven were judged spoofs of their own symbol at their own address and
|
||||
hidden from the balance list, the history and the send selector, so a holder
|
||||
could not spend them. Both contracts of each pair come from the same CoinGecko
|
||||
fetch of 2026-02-27, so neither was stale and neither was dropped.
|
||||
`isSpoofedSymbol()` asks set membership instead of equality, which does not
|
||||
loosen the rule — a contract outside the set is still a spoof — and a test now
|
||||
walks `TOKENS` asserting no bundled token is filtered at its own address,
|
||||
which is the walk the suite lacked
|
||||
([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
|
||||
- 2026-08-12: The dApp approval round trips are driven end to end in the
|
||||
browser. A test page served by the harness speaks EIP-1193 to the real inpage
|
||||
provider through the real content script, background worker and approval popup
|
||||
@@ -103,20 +56,6 @@ undefined identifiers, which is how
|
||||
that gives [#157](https://git.eeqj.de/sneak/AutistMask/issues/157) a permanent
|
||||
floor. This does not discharge a real dApp with real funds against mainnet
|
||||
([#183](https://git.eeqj.de/sneak/AutistMask/issues/183)).
|
||||
- 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
|
||||
sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
|
||||
character that paints nothing removed (the format and default-ignorable
|
||||
characters, plus U+007F), then trimmed — so `" ETH "`, a no-break space, a
|
||||
zero-width space, a Hangul filler, a variation selector, a DELETE and a
|
||||
fullwidth `ＥＴＨ` are all caught on the balance list, the history and the
|
||||
send selector at once. Confusables that are distinct letters (Cyrillic `Е`),
|
||||
bidi reordering and the visible C0/C1 controls — which measure 48.00px, a box,
|
||||
in the pinned e2e Chromium where an invisible prefix measures 32.00px — stay
|
||||
knowingly open and are asserted as open in the suite. No bundled symbol
|
||||
contains whitespace or a non-ASCII character, so nothing legitimate is newly
|
||||
filtered; the balance list's token-type gate also became case-insensitive,
|
||||
which no longer drops a real holding if an explorer writes `erc-20`
|
||||
([#260](https://git.eeqj.de/sneak/AutistMask/issues/260)).
|
||||
- 2026-08-12: A containerized Firefox end-to-end harness
|
||||
(`make test-e2e-firefox`) drives the real popup in a real Firefox with the MV2
|
||||
build installed as a temporary add-on. Zero npm dependencies — a WebDriver
|
||||
|
||||
@@ -57,16 +57,6 @@ const connectedSites = {};
|
||||
// Pending approval requests: { id: { origin, hostname, resolve } }
|
||||
const pendingApprovals = {};
|
||||
|
||||
// What the page is told when a request failed in a way the wallet has no
|
||||
// specific answer for. -32603 is the JSON-RPC internal error EIP-1474 defines
|
||||
// and EIP-1193 defers to for RPC-layer failures; no EIP-1193 4xxx code
|
||||
// describes "the wallet broke", and one is not invented here. The cause is
|
||||
// logged rather than put in the message: the page gets a stable sentence, the
|
||||
// background console gets the throw.
|
||||
const INTERNAL_ERROR_CODE = -32603;
|
||||
const INTERNAL_ERROR_MESSAGE =
|
||||
"AutistMask could not complete this request because of an internal error.";
|
||||
|
||||
async function getState() {
|
||||
const result = await storageApi.get("autistmask");
|
||||
return (
|
||||
@@ -875,26 +865,9 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
// keep fallback
|
||||
}
|
||||
}
|
||||
handleRpc(msg.method, msg.params, trustedOrigin)
|
||||
.then((response) => {
|
||||
sendResponse(response);
|
||||
})
|
||||
.catch((err) => {
|
||||
// Without this the page's window.ethereum.request() promise
|
||||
// stays pending forever: no response is sent, the content
|
||||
// script posts nothing back, and the dApp cannot tell the
|
||||
// failure from a slow wallet. handleRpc does real work —
|
||||
// state loads, provider calls, transaction population — so
|
||||
// "it does not throw today" is not a property anyone is
|
||||
// maintaining.
|
||||
log.errorf("RPC request failed:", msg.method, err);
|
||||
sendResponse({
|
||||
error: {
|
||||
code: INTERNAL_ERROR_CODE,
|
||||
message: INTERNAL_ERROR_MESSAGE,
|
||||
},
|
||||
});
|
||||
});
|
||||
handleRpc(msg.method, msg.params, trustedOrigin).then((response) => {
|
||||
sendResponse(response);
|
||||
});
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -1078,31 +1051,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
stage: TX_STAGE_BROADCAST,
|
||||
});
|
||||
}
|
||||
})().catch((e) => {
|
||||
// Every statement above is inside a try, but a throw from one of
|
||||
// the catch blocks escapes as an unhandled rejection and neither
|
||||
// the popup nor the page is ever answered. Settle both, through
|
||||
// the same chokepoint as every other retirement. The stage is
|
||||
// broadcast because this cannot tell whether the transaction
|
||||
// reached the network, and that is the wording that does not
|
||||
// invite a second send.
|
||||
log.errorf("transaction approval response failed:", e);
|
||||
settleApproval(
|
||||
msg.id,
|
||||
{
|
||||
error: {
|
||||
code: INTERNAL_ERROR_CODE,
|
||||
message: INTERNAL_ERROR_MESSAGE,
|
||||
},
|
||||
},
|
||||
{ holdsClaim: true },
|
||||
);
|
||||
sendResponse({
|
||||
error: INTERNAL_ERROR_MESSAGE,
|
||||
retryable: false,
|
||||
stage: TX_STAGE_BROADCAST,
|
||||
});
|
||||
});
|
||||
})();
|
||||
return true;
|
||||
}
|
||||
|
||||
@@ -1186,25 +1135,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
}
|
||||
sendResponse({ error: errMsg, retryable });
|
||||
}
|
||||
})().catch((e) => {
|
||||
// Same shape as the transaction path: a throw out of the catch
|
||||
// block above would leave the popup and the page both waiting.
|
||||
log.errorf("sign approval response failed:", e);
|
||||
settleApproval(
|
||||
msg.id,
|
||||
{
|
||||
error: {
|
||||
code: INTERNAL_ERROR_CODE,
|
||||
message: INTERNAL_ERROR_MESSAGE,
|
||||
},
|
||||
},
|
||||
{ holdsClaim: true },
|
||||
);
|
||||
sendResponse({
|
||||
error: INTERNAL_ERROR_MESSAGE,
|
||||
retryable: false,
|
||||
});
|
||||
});
|
||||
})();
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
@@ -11,39 +11,6 @@
|
||||
let nextId = 1;
|
||||
const pending = {};
|
||||
|
||||
// EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
|
||||
// rather than properties bolted onto an Error because this object crosses
|
||||
// no boundary after construction — it is built in the page's own realm and
|
||||
// handed straight to the caller's catch — so the prototype survives and
|
||||
// `error.name` is a stable thing for a dApp to see.
|
||||
class ProviderRpcError extends Error {
|
||||
constructor(code, message, data) {
|
||||
super(message);
|
||||
this.name = "ProviderRpcError";
|
||||
this.code = code;
|
||||
if (data !== undefined) this.data = data;
|
||||
}
|
||||
}
|
||||
|
||||
// Rebuild a boundary error as the error the page catches, carrying the
|
||||
// code (and data) the extension reported. Without this a dApp cannot tell
|
||||
// a user's refusal (4001) from a wallet that broke, and retries or shows
|
||||
// an error instead of accepting the refusal.
|
||||
//
|
||||
// Whatever code arrived is passed through verbatim rather than being
|
||||
// matched against a list: the extension emits 4001, 4100 and 4902 today,
|
||||
// and a code this file has never heard of is still the truth about what
|
||||
// happened. An error reported with no code at all stays a plain Error —
|
||||
// a ProviderRpcError whose `code` is undefined would advertise a
|
||||
// conformance it does not have. `message` is untouched in every case.
|
||||
function toPageError(error) {
|
||||
const message = (error && error.message) || "Request failed";
|
||||
if (error && error.code !== undefined && error.code !== null) {
|
||||
return new ProviderRpcError(error.code, message, error.data);
|
||||
}
|
||||
return new Error(message);
|
||||
}
|
||||
|
||||
// Listen for responses from the content script
|
||||
window.addEventListener("message", function onUuid(event) {
|
||||
if (event.source !== window) return;
|
||||
@@ -53,7 +20,7 @@
|
||||
if (!p) return;
|
||||
delete pending[id];
|
||||
if (error) {
|
||||
p.reject(toPageError(error));
|
||||
p.reject(new Error(error.message || "Request failed"));
|
||||
} else {
|
||||
p.resolve(result);
|
||||
}
|
||||
|
||||
@@ -66,12 +66,7 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
|
||||
const balances = [];
|
||||
for (const item of items) {
|
||||
// Case-insensitive: the token type is an explorer's label, not a
|
||||
// protocol value, and an exact comparison silently drops a real
|
||||
// holding if one ever writes "erc-20". Which types are admitted
|
||||
// is unchanged.
|
||||
const type = String(item.token?.type || "").toUpperCase();
|
||||
if (type !== "ERC-20") continue;
|
||||
if (item.token?.type !== "ERC-20") continue;
|
||||
const decimals = parseInt(item.token.decimals || "18", 10);
|
||||
const bal = formatTokenBalance(item.value || "0", decimals);
|
||||
if (bal === "0.0") continue;
|
||||
|
||||
@@ -8,23 +8,11 @@
|
||||
// either verdict alone, because the balance list is where the user forms
|
||||
// their belief about what they own (issue #235).
|
||||
//
|
||||
// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
|
||||
// that may bear it, or to null. Null means the symbol belongs to the native
|
||||
// asset, which has no contract at all, so no contract may bear it and every
|
||||
// one that does is a spoof. "ETH" is the only such entry today; the rule is
|
||||
// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
|
||||
// bear it, or to null. Null means the symbol belongs to the native asset,
|
||||
// which has no contract at all, so no contract may bear it and every one
|
||||
// that does is a spoof. "ETH" is the only such entry today; the rule is
|
||||
// written so that a second one needs no change here or at any call site.
|
||||
//
|
||||
// The value is a set because a ticker is not unique: seven symbols in the
|
||||
// bundled list belong to two real contracts each, and answering with one of
|
||||
// them hid the other one's holders' money (issue #276). Membership, not
|
||||
// equality, is therefore the question — but it is the same question, asked of
|
||||
// a table that can now state the truth. Every address in a set is one the
|
||||
// wallet ships as a real token; a contract outside the set is still a spoof.
|
||||
//
|
||||
// The symbol is attacker-controlled — it is whatever the ERC-20 contract
|
||||
// returns — so the lookup is done on a normalized form (issue #260): the
|
||||
// question is whether the symbol reaches the user's eye as a known one,
|
||||
// since that is what the user acts on.
|
||||
|
||||
const { KNOWN_SYMBOLS } = require("./tokenList");
|
||||
|
||||
@@ -34,59 +22,6 @@ function normalizeAddress(addr) {
|
||||
return (addr || "").toLowerCase();
|
||||
}
|
||||
|
||||
// Fold a symbol onto what a user actually sees, and no further:
|
||||
//
|
||||
// NFKC collapses compatibility variants that render as the ASCII
|
||||
// letters they imitate — fullwidth ETH, styled mathematical
|
||||
// letters — and maps the non-ASCII spaces onto U+0020.
|
||||
// strip drops what paints nothing: \p{Cf} plus
|
||||
// \p{Default_Ignorable_Code_Point} plus U+007F. That covers
|
||||
// the format characters (zero-width space, joiner and
|
||||
// non-joiner, word joiner, soft hyphen, byte-order mark, bidi
|
||||
// marks and overrides), the variation selectors, the Hangul
|
||||
// fillers, and DELETE. Removed everywhere, not merely at the
|
||||
// ends.
|
||||
// trim removes surrounding whitespace, which HTML collapses:
|
||||
// `" ETH "` is painted next to the user's real ETH as `ETH`.
|
||||
// toUpperCase makes the comparison case-insensitive, as before.
|
||||
//
|
||||
// The rule is "strip what paints nothing". The Unicode classes are how
|
||||
// that is spelled, not what it means, which is why U+007F is named on its
|
||||
// own: it is a control rather than a default-ignorable character, so no
|
||||
// class here reaches it, yet it paints nothing all the same. Measured in
|
||||
// the repo's pinned e2e Chromium (16px sans-serif, plain `ETH` = 32.00px,
|
||||
// so an invisible prefix leaves 32.00px):
|
||||
//
|
||||
// U+007F, U+3164, U+115F, U+FE0F, U+FE00 32.00px — invisible
|
||||
// U+FFA0 40.00px — a box
|
||||
// U+1160 48.00px — a box
|
||||
// U+0001, U+0085, U+0090 48.00px — a box
|
||||
//
|
||||
// U+1160 and U+FFA0 are `Default_Ignorable_Code_Point` members that font
|
||||
// fallback nonetheless draws, and they are stripped anyway: erring toward
|
||||
// hiding a token that does not look like `ETH` is the harmless direction of
|
||||
// the two. The other controls are left alone for the same reason read the
|
||||
// other way — a symbol carrying a visible box does not reach the eye as
|
||||
// `ETH`, so filtering it would hide a token the user could not have
|
||||
// confused with the native asset.
|
||||
//
|
||||
// Deliberately not folded, and asserted as open in tests/symbolSpoof.test.js:
|
||||
// interior whitespace (`E T H` renders as `E T H`, so folding it would filter
|
||||
// a token nobody could confuse with the native asset), confusables that are
|
||||
// distinct letters rather than compatibility variants (Cyrillic capital Ie,
|
||||
// U+0415; Greek capital Epsilon, U+0395), bidi reordering, which needs the
|
||||
// bidi algorithm rather than a character filter, and the visible controls.
|
||||
//
|
||||
// This decides only how the question is asked. Nothing here changes what a
|
||||
// surface displays; a token still shows the symbol it reports.
|
||||
function normalizeSymbol(symbol) {
|
||||
return String(symbol || "")
|
||||
.normalize("NFKC")
|
||||
.replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}\x7F]/gu, "")
|
||||
.trim()
|
||||
.toUpperCase();
|
||||
}
|
||||
|
||||
// True when a token bearing `symbol` from contract `contractAddress` is
|
||||
// impersonating a known symbol.
|
||||
//
|
||||
@@ -96,11 +31,11 @@ function normalizeSymbol(symbol) {
|
||||
function isSpoofedSymbol(symbol, contractAddress) {
|
||||
const contract = normalizeAddress(contractAddress);
|
||||
if (!contract) return false;
|
||||
const sym = normalizeSymbol(symbol);
|
||||
const sym = (symbol || "").toUpperCase();
|
||||
if (!KNOWN_SYMBOLS.has(sym)) return false;
|
||||
const legit = KNOWN_SYMBOLS.get(sym);
|
||||
if (legit === null) return true;
|
||||
return !legit.has(contract);
|
||||
return contract !== normalizeAddress(legit);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
|
||||
@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
|
||||
TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
|
||||
}
|
||||
|
||||
// Build a map of symbol (uppercased) -> the set of contract addresses
|
||||
// (lowercased) that legitimately bear it. Used for spoofed-symbol detection.
|
||||
// "ETH" maps to null: the native asset has no contract, so no contract may
|
||||
// bear its symbol.
|
||||
//
|
||||
// The value is a set and not a single address because tickers are not unique
|
||||
// and the list above proves it: seven of these 512 tokens share a symbol with
|
||||
// another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
|
||||
// different real contracts each, all of them from the same source fetch. A
|
||||
// one-address-per-symbol table can only answer that by picking a winner, and
|
||||
// the loser is then a token in our own bundled list that the spoof filter
|
||||
// hides from the balance list, the history and the send selector at its own
|
||||
// address, so the user cannot spend it (issue #276). Naming every address
|
||||
// that bears the symbol is the only shape that says what is true; it does not
|
||||
// loosen the rule, because a contract outside the set is still a spoof.
|
||||
// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
|
||||
// Used for spoofed-symbol detection. "ETH" maps to null (native token).
|
||||
const KNOWN_SYMBOLS = new Map();
|
||||
KNOWN_SYMBOLS.set("ETH", null);
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!KNOWN_SYMBOLS.has(upper)) {
|
||||
KNOWN_SYMBOLS.set(upper, new Set());
|
||||
}
|
||||
const addresses = KNOWN_SYMBOLS.get(upper);
|
||||
// A null entry is the native asset and stays null: an ERC-20 that reports
|
||||
// the native symbol does not thereby become entitled to it.
|
||||
if (addresses !== null) {
|
||||
addresses.add(t.address.toLowerCase());
|
||||
KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -133,14 +133,6 @@ function loadBackground(options) {
|
||||
ensureRecurringAlarms: jest.fn(async () => {}),
|
||||
registerAlarmHandlers: jest.fn(),
|
||||
}));
|
||||
// The real verification module, except where a test replaces one export
|
||||
// with a throw to drive the handler's own error handling into failing.
|
||||
if (opts.approvalVerify) {
|
||||
jest.doMock("../src/shared/approvalVerify", () => ({
|
||||
...jest.requireActual("../src/shared/approvalVerify"),
|
||||
...opts.approvalVerify,
|
||||
}));
|
||||
}
|
||||
|
||||
const persisted = {
|
||||
wallets: [
|
||||
@@ -160,10 +152,7 @@ function loadBackground(options) {
|
||||
global.chrome = {
|
||||
storage: {
|
||||
local: {
|
||||
get: jest.fn(
|
||||
opts.storageGet ||
|
||||
(async () => ({ autistmask: persisted })),
|
||||
),
|
||||
get: jest.fn(async () => ({ autistmask: persisted })),
|
||||
set: jest.fn(async () => {}),
|
||||
},
|
||||
},
|
||||
@@ -291,25 +280,6 @@ async function settle() {
|
||||
for (let i = 0; i < 50; i++) await Promise.resolve();
|
||||
}
|
||||
|
||||
// Node aborts the worker process on an unhandled rejection; an extension
|
||||
// service worker does not — the promise is simply never settled, nothing is
|
||||
// sent back, and the page's window.ethereum.request() waits forever. Recording
|
||||
// them instead of dying on them keeps that difference visible: the assertion
|
||||
// that the page WAS answered is what reports the failure, and the recording is
|
||||
// asserted empty alongside it.
|
||||
const unhandledRejections = [];
|
||||
process.on("unhandledRejection", (reason) => {
|
||||
unhandledRejections.push(reason);
|
||||
});
|
||||
|
||||
// Node reports an unhandled rejection on the macrotask turn after the promise
|
||||
// was left unhandled, which is past everything settle() waits for.
|
||||
async function settleIncludingRejections() {
|
||||
await settle();
|
||||
await new Promise((resolve) => setImmediate(resolve));
|
||||
await new Promise((resolve) => setImmediate(resolve));
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
delete global.chrome;
|
||||
jest.resetModules();
|
||||
@@ -1064,147 +1034,6 @@ describe("a claimed approval outlives every other retirement path", () => {
|
||||
});
|
||||
});
|
||||
|
||||
// A handler that throws must still answer. `sendResponse` is the only thing
|
||||
// that settles the page's window.ethereum.request() promise, so a throw that
|
||||
// escapes a handler leaves that promise pending forever — no error, no
|
||||
// timeout, indistinguishable from a slow wallet. Each case below drives a real
|
||||
// throw out of a handler rather than asserting the catch block exists.
|
||||
describe("a handler that throws still settles the page", () => {
|
||||
const INTERNAL_ERROR = {
|
||||
code: -32603,
|
||||
message:
|
||||
"AutistMask could not complete this request because of an internal error.",
|
||||
};
|
||||
|
||||
let errorLog;
|
||||
beforeEach(() => {
|
||||
errorLog = jest.spyOn(console, "error").mockImplementation(() => {});
|
||||
unhandledRejections.length = 0;
|
||||
});
|
||||
afterEach(() => {
|
||||
errorLog.mockRestore();
|
||||
});
|
||||
|
||||
// getState() awaits extension storage unguarded, and every read path in
|
||||
// handleRpc goes through it. A storage read that rejects is the whole
|
||||
// failure — no hook in the handler itself.
|
||||
test("a rejected handleRpc rejects the page instead of hanging it", async () => {
|
||||
const bg = loadBackground({
|
||||
storageGet: async () => {
|
||||
throw new Error("storage unavailable");
|
||||
},
|
||||
});
|
||||
|
||||
const answer = bg.send(
|
||||
{ type: "AUTISTMASK_RPC", method: "eth_accounts", params: [] },
|
||||
{ origin: ORIGIN },
|
||||
);
|
||||
await settleIncludingRejections();
|
||||
|
||||
// The channel is held open for the async answer, and the answer
|
||||
// arrives.
|
||||
expect(answer.kept).toBe(true);
|
||||
expect(answer.sendResponse).toHaveBeenCalledWith({
|
||||
error: INTERNAL_ERROR,
|
||||
});
|
||||
expect(unhandledRejections).toEqual([]);
|
||||
// Not swallowed: the throw is on the background console, which is how
|
||||
// this class gets caught in future.
|
||||
expect(errorLog).toHaveBeenCalledWith(
|
||||
"[AutistMask]",
|
||||
"RPC request failed:",
|
||||
"eth_accounts",
|
||||
expect.objectContaining({ message: "storage unavailable" }),
|
||||
);
|
||||
});
|
||||
|
||||
// The transaction response handler wraps every statement in a try, so what
|
||||
// escapes it is a throw from inside one of its catch blocks. Here the
|
||||
// failure classifier itself throws while classifying a real verification
|
||||
// failure — the approval is left claimed, so nothing else can settle it.
|
||||
test("a throw while handling a failed transaction settles both the page and the popup", async () => {
|
||||
const bg = loadBackground({
|
||||
approvalVerify: {
|
||||
describeTxFailure: () => {
|
||||
throw new Error("classifier broke");
|
||||
},
|
||||
},
|
||||
});
|
||||
const pending = bg.requestTx();
|
||||
await settle();
|
||||
const id = pending.id();
|
||||
|
||||
// A real verification failure: the artifact is signed at a nonce the
|
||||
// approval never displayed.
|
||||
const answer = bg.send(
|
||||
{
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id,
|
||||
approved: true,
|
||||
rawSignedTx: await signedAtNonce(NONCE + 1),
|
||||
},
|
||||
{ url: bg.fromPopup.url },
|
||||
);
|
||||
await settleIncludingRejections();
|
||||
|
||||
expect(bg.broadcastTransaction).not.toHaveBeenCalled();
|
||||
expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
|
||||
expect(answer.sendResponse).toHaveBeenCalledWith({
|
||||
error: INTERNAL_ERROR.message,
|
||||
retryable: false,
|
||||
// The handler cannot tell whether the transaction reached the
|
||||
// network, so the popup must not say "start again from the site".
|
||||
stage: "broadcast",
|
||||
});
|
||||
expect(unhandledRejections).toEqual([]);
|
||||
expect(errorLog).toHaveBeenCalledWith(
|
||||
"[AutistMask]",
|
||||
"transaction approval response failed:",
|
||||
expect.objectContaining({ message: "classifier broke" }),
|
||||
);
|
||||
});
|
||||
|
||||
test("a throw while handling a failed signature settles both the page and the popup", async () => {
|
||||
const bg = loadBackground({
|
||||
approvalVerify: {
|
||||
failureIsRetryable: () => {
|
||||
throw new Error("classifier broke");
|
||||
},
|
||||
},
|
||||
});
|
||||
const pending = bg.requestSign();
|
||||
await settle();
|
||||
|
||||
// A real verification failure: the active address moved after the
|
||||
// approval was raised.
|
||||
bg.setActiveAddress(other.address);
|
||||
const answer = bg.send(
|
||||
{
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: pending.id(),
|
||||
approved: true,
|
||||
signature: await signer.signMessage(
|
||||
Buffer.from(MESSAGE.slice(2), "hex"),
|
||||
),
|
||||
},
|
||||
{ url: bg.fromPopup.url },
|
||||
);
|
||||
await settleIncludingRejections();
|
||||
|
||||
expect(pending.result()).toEqual({ error: INTERNAL_ERROR });
|
||||
expect(answer.sendResponse).toHaveBeenCalledWith({
|
||||
error: INTERNAL_ERROR.message,
|
||||
retryable: false,
|
||||
});
|
||||
expect(unhandledRejections).toEqual([]);
|
||||
expect(errorLog).toHaveBeenCalledWith(
|
||||
"[AutistMask]",
|
||||
"sign approval response failed:",
|
||||
expect.objectContaining({ message: "classifier broke" }),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
describe("popup-only messages", () => {
|
||||
test("a page sender cannot answer an approval", async () => {
|
||||
const bg = loadBackground();
|
||||
|
||||
@@ -86,11 +86,9 @@ const DAPP_URL = DAPP_ORIGIN + "/";
|
||||
// never drive the popup that has to settle it; start() files the promise
|
||||
// under a key and settle() collects it once the prompt has been dealt with.
|
||||
//
|
||||
// The rejection branch records the whole observable shape of the error as it
|
||||
// arrives — name, message, and whether a `code` is present at all as distinct
|
||||
// from its value. EIP-1193 says a user rejection is a ProviderRpcError
|
||||
// carrying code 4001; what the page can actually see is recorded here rather
|
||||
// than assumed, and asserted in run.js.
|
||||
// The rejection branch records `code` as it arrives. EIP-1193 says a user
|
||||
// rejection is a ProviderRpcError carrying code 4001; what the page can
|
||||
// actually see is recorded here rather than assumed, and asserted in run.js.
|
||||
//
|
||||
// The message log is the page's half of the boundary observation: every
|
||||
// AUTISTMASK_* message that crosses between this page and the content
|
||||
@@ -122,7 +120,6 @@ const DAPP_HTML = [
|
||||
" return {",
|
||||
" settled: 'rejected',",
|
||||
" message: String((error && error.message) || error),",
|
||||
" name: error ? error.name : undefined,",
|
||||
" hasCode: !!error && 'code' in Object(error),",
|
||||
" code: error ? error.code : undefined,",
|
||||
" };",
|
||||
|
||||
@@ -1591,14 +1591,15 @@ async function lastResponseError(page) {
|
||||
}
|
||||
|
||||
// A rejected prompt, asserted at both ends: the page's promise rejected
|
||||
// rather than hanging or resolving, and EIP-1193 code 4001 is present both
|
||||
// on the wire and on the Error the calling page catches.
|
||||
// rather than hanging or resolving, and the response that crossed the
|
||||
// boundary carried EIP-1193 code 4001.
|
||||
//
|
||||
// Both ends matter because they used to disagree. The code crossed the
|
||||
// boundary correctly and src/content/inpage.js then threw it away, rebuilding
|
||||
// every rejection as `new Error(error.message)` — so a dApp branching on
|
||||
// `err.code === 4001` saw undefined and could not tell a refusal from a
|
||||
// failure (#274). Asserting only the wire would leave that gap invisible.
|
||||
// The code is asserted on the wire because that is the only place it
|
||||
// survives. src/content/inpage.js rebuilds the rejection as `new
|
||||
// Error(error.message)`, so the Error the calling page catches carries the
|
||||
// message and no code. That is reported rather than asserted either way —
|
||||
// locking in the current behaviour would make the gap permanent, and
|
||||
// asserting the code on the Error would fail today.
|
||||
async function assertUserRejection(page, key, label) {
|
||||
const outcome = await settleRequest(page, key);
|
||||
assert(
|
||||
@@ -1620,32 +1621,15 @@ async function assertUserRejection(page, key, label) {
|
||||
" did not carry EIP-1193 code 4001 across the boundary: " +
|
||||
JSON.stringify(error),
|
||||
);
|
||||
assert(
|
||||
outcome.hasCode,
|
||||
label +
|
||||
" reached the page as an error with no code property at all, so a " +
|
||||
"dApp cannot tell the user's refusal from a failure: " +
|
||||
JSON.stringify(outcome),
|
||||
);
|
||||
assert(
|
||||
outcome.code === 4001,
|
||||
label +
|
||||
" reached the page with code " +
|
||||
JSON.stringify(outcome.code) +
|
||||
" rather than EIP-1193 4001",
|
||||
);
|
||||
assert(
|
||||
outcome.name === "ProviderRpcError",
|
||||
label +
|
||||
" reached the page as " +
|
||||
JSON.stringify(outcome.name) +
|
||||
" rather than an EIP-1193 ProviderRpcError",
|
||||
);
|
||||
console.log(
|
||||
"# " +
|
||||
label +
|
||||
": code 4001 on the wire and on the page's " +
|
||||
outcome.name,
|
||||
": boundary code=" +
|
||||
error.code +
|
||||
" page Error.code=" +
|
||||
JSON.stringify(outcome.code) +
|
||||
" page Error carries a code=" +
|
||||
outcome.hasCode,
|
||||
);
|
||||
return outcome;
|
||||
}
|
||||
|
||||
@@ -1,310 +0,0 @@
|
||||
// The EIP-1193 error the page actually catches (src/content/inpage.js).
|
||||
//
|
||||
// The bug this pins down (issue #274): the provider rebuilt every failure as
|
||||
// `new Error(error.message)`, so the `code` the background produced and the
|
||||
// content script relayed intact was thrown away in the last hop. A dApp
|
||||
// checking `err.code === 4001` — the standard way to tell "the user said no"
|
||||
// from "the wallet broke" — saw undefined, and well-behaved sites showed an
|
||||
// error or retried instead of accepting the refusal.
|
||||
//
|
||||
// inpage.js is a bare IIFE injected into the page's JS context, not a module:
|
||||
// it takes no import and exports nothing, and reaches for `window` at load.
|
||||
// So it is evaluated here the way the browser evaluates it, against a stub
|
||||
// window, and the provider is collected from `window.ethereum`. The globals it
|
||||
// touches are passed in as function parameters rather than assigned to
|
||||
// globalThis: nothing leaks between tests, and the source is compiled in this
|
||||
// realm, so the errors it constructs are comparable against this file's own
|
||||
// `Error` — which a second realm's intrinsics would silently defeat.
|
||||
//
|
||||
// There is no jsdom in this repo; see tests/txStatus.test.js.
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
const { webcrypto } = require("crypto");
|
||||
|
||||
const SOURCE = fs.readFileSync(
|
||||
path.join(__dirname, "..", "src", "content", "inpage.js"),
|
||||
"utf8",
|
||||
);
|
||||
|
||||
const loadInto = new Function(
|
||||
"window",
|
||||
"self",
|
||||
"crypto",
|
||||
"Event",
|
||||
"CustomEvent",
|
||||
SOURCE,
|
||||
);
|
||||
|
||||
class StubEvent {
|
||||
constructor(type) {
|
||||
this.type = type;
|
||||
}
|
||||
}
|
||||
|
||||
class StubCustomEvent extends StubEvent {
|
||||
constructor(type, init) {
|
||||
super(type);
|
||||
this.detail = init && init.detail;
|
||||
}
|
||||
}
|
||||
|
||||
// Every code the background emits on the RPC path today, read out of
|
||||
// src/background/index.js. The provider must not know this list — it passes
|
||||
// through whatever arrived — but the cases below are the real ones.
|
||||
const REJECTED = 4001; // user rejected the request
|
||||
const UNAUTHORIZED = 4100; // site not connected / wrong address
|
||||
const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
|
||||
|
||||
// A stub window with the four things inpage.js touches: message listeners,
|
||||
// postMessage out to the content script, window.ethereum, and dispatchEvent
|
||||
// for the EIP-6963 announcement.
|
||||
function loadProvider() {
|
||||
const messageListeners = [];
|
||||
const posted = [];
|
||||
|
||||
const win = {
|
||||
addEventListener(type, fn) {
|
||||
if (type === "message") messageListeners.push(fn);
|
||||
},
|
||||
removeEventListener(type, fn) {
|
||||
const i = messageListeners.indexOf(fn);
|
||||
if (type === "message" && i !== -1) messageListeners.splice(i, 1);
|
||||
},
|
||||
postMessage(data) {
|
||||
posted.push(data);
|
||||
},
|
||||
dispatchEvent() {
|
||||
return true;
|
||||
},
|
||||
};
|
||||
win.window = win;
|
||||
|
||||
loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
|
||||
|
||||
// Deliver the content script's answer to an outstanding request. The id is
|
||||
// read back off the wire rather than assumed: inpage.js issues its own
|
||||
// eth_chainId at load, so the first id a test sees is not 1.
|
||||
function respond(response) {
|
||||
const request = posted
|
||||
.filter((m) => m.type === "AUTISTMASK_REQUEST")
|
||||
.pop();
|
||||
expect(request).toBeDefined();
|
||||
const event = {
|
||||
source: win,
|
||||
data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
|
||||
};
|
||||
for (const fn of messageListeners.slice()) fn(event);
|
||||
}
|
||||
|
||||
return { provider: win.ethereum, posted, respond };
|
||||
}
|
||||
|
||||
// Start a request, answer it with `response`, and hand back the rejection.
|
||||
// Fails the test if the call resolves instead.
|
||||
async function rejectionFrom(start, response) {
|
||||
const { provider, respond } = loadProvider();
|
||||
const settled = start(provider).then(
|
||||
(result) => ({ resolved: result }),
|
||||
(error) => ({ error }),
|
||||
);
|
||||
// The provider posts synchronously, so the request is already on the wire.
|
||||
respond(response);
|
||||
const outcome = await settled;
|
||||
expect(outcome).not.toHaveProperty("resolved");
|
||||
return outcome.error;
|
||||
}
|
||||
|
||||
describe("an EIP-1193 code reaches the page", () => {
|
||||
test("a user rejection arrives as code 4001", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
expect(err.message).toBe("User rejected the request.");
|
||||
});
|
||||
|
||||
test("it is a ProviderRpcError, and an Error", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err).toBeInstanceOf(Error);
|
||||
expect(err.name).toBe("ProviderRpcError");
|
||||
});
|
||||
|
||||
test("4100 unauthorized arrives intact", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "personal_sign", params: ["0x00"] }),
|
||||
{ error: { code: UNAUTHORIZED, message: "Unauthorized" } },
|
||||
);
|
||||
expect(err.code).toBe(UNAUTHORIZED);
|
||||
expect(err.message).toBe("Unauthorized");
|
||||
});
|
||||
|
||||
test("4902 unrecognized chain arrives intact", async () => {
|
||||
const message =
|
||||
"AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "wallet_switchEthereumChain" }),
|
||||
{ error: { code: UNRECOGNIZED_CHAIN, message } },
|
||||
);
|
||||
expect(err.code).toBe(UNRECOGNIZED_CHAIN);
|
||||
expect(err.message).toBe(message);
|
||||
});
|
||||
|
||||
// The provider is not allowed to know the list above: a code added to the
|
||||
// background later must reach the page without this file being edited.
|
||||
test("a code the provider has never heard of is passed through", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_accounts" }),
|
||||
{ error: { code: 4900, message: "Disconnected" } },
|
||||
);
|
||||
expect(err.code).toBe(4900);
|
||||
});
|
||||
|
||||
test("data is carried when the boundary sent it", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_call" }),
|
||||
{
|
||||
error: {
|
||||
code: -32000,
|
||||
message: "execution reverted",
|
||||
data: "0x08c379a0",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err.code).toBe(-32000);
|
||||
expect(err.data).toBe("0x08c379a0");
|
||||
});
|
||||
|
||||
test("no data property is invented when the boundary sent none", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect("data" in err).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("the message is untouched", () => {
|
||||
test("a coded error keeps the message byte for byte", async () => {
|
||||
const message =
|
||||
"This site asked to sign as an address that is not " +
|
||||
"the active one.";
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "personal_sign" }),
|
||||
{ error: { code: UNAUTHORIZED, message } },
|
||||
);
|
||||
expect(err.message).toBe(message);
|
||||
});
|
||||
|
||||
test("an error the background sent with no code keeps its message", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { message: "No accounts available" } },
|
||||
);
|
||||
expect(err.message).toBe("No accounts available");
|
||||
});
|
||||
|
||||
// A ProviderRpcError whose code is undefined would claim a conformance it
|
||||
// does not have, and `'code' in err` is exactly what a careful dApp asks.
|
||||
test("an error with no code gets no code property at all", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { message: "No accounts available" } },
|
||||
);
|
||||
expect(err).toBeInstanceOf(Error);
|
||||
expect("code" in err).toBe(false);
|
||||
});
|
||||
|
||||
test("an error with no message keeps the generic fallback", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { code: REJECTED } },
|
||||
);
|
||||
expect(err.message).toBe("Request failed");
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
});
|
||||
|
||||
// Every entry point the provider exposes, not just eth_requestAccounts. They
|
||||
// all funnel through the same response listener, and this is what says so.
|
||||
describe("every request path carries the code", () => {
|
||||
const rejection = {
|
||||
error: { code: REJECTED, message: "User rejected the request." },
|
||||
};
|
||||
|
||||
test("request()", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("enable()", async () => {
|
||||
const err = await rejectionFrom((p) => p.enable(), rejection);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("send(method, params)", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.send("eth_requestAccounts", []),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("send({ method, params })", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.send({ method: "personal_sign", params: ["0x00"] }),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("sendAsync() hands the code to its callback", async () => {
|
||||
const { provider, respond } = loadProvider();
|
||||
const called = new Promise((resolve) => {
|
||||
provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
|
||||
resolve(e),
|
||||
);
|
||||
});
|
||||
respond(rejection);
|
||||
const err = await called;
|
||||
expect(err.name).toBe("ProviderRpcError");
|
||||
expect(err.code).toBe(REJECTED);
|
||||
expect(err.message).toBe("User rejected the request.");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the success path is unchanged", () => {
|
||||
test("a result still resolves", async () => {
|
||||
const { provider, respond } = loadProvider();
|
||||
const settled = provider.request({ method: "eth_requestAccounts" });
|
||||
respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
|
||||
await expect(settled).resolves.toEqual([
|
||||
"0xb61264DEFB0c4B8afb3D73724be15310036743a5",
|
||||
]);
|
||||
expect(provider.selectedAddress).toBe(
|
||||
"0xb61264DEFB0c4B8afb3D73724be15310036743a5",
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -56,7 +56,7 @@ global.chrome = {
|
||||
};
|
||||
|
||||
const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
|
||||
const { TOKENS, KNOWN_SYMBOLS } = require("../src/shared/tokenList");
|
||||
const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
|
||||
const { filterTransactions } = require("../src/shared/transactions");
|
||||
const {
|
||||
fetchTokenBalances,
|
||||
@@ -124,301 +124,6 @@ describe("the shared rule", () => {
|
||||
});
|
||||
});
|
||||
|
||||
// Issue #260: the symbol is whatever the ERC-20 contract returns, and HTML
|
||||
// collapses leading and trailing whitespace, so a token calling itself
|
||||
// `" ETH "` reaches the user's eye as `ETH` while missing a raw
|
||||
// KNOWN_SYMBOLS lookup. Normalizing inside the shared rule fixes all three
|
||||
// surfaces at once, which is what consolidating the rule bought.
|
||||
//
|
||||
// Every character under test here is built from its code point rather than
|
||||
// pasted in: most of them are invisible, and an invisible character in a
|
||||
// test file is unreviewable.
|
||||
const cp = (...codes) => String.fromCodePoint(...codes);
|
||||
const NBSP = cp(0x00a0); // no-break space
|
||||
const FIGURE_SPACE = cp(0x2007);
|
||||
const IDEOGRAPHIC_SPACE = cp(0x3000);
|
||||
const ZWSP = cp(0x200b); // zero-width space
|
||||
const BOM = cp(0xfeff); // zero-width no-break space
|
||||
const WORD_JOINER = cp(0x2060);
|
||||
const SOFT_HYPHEN = cp(0x00ad);
|
||||
const LRM = cp(0x200e); // left-to-right mark
|
||||
const RLO = cp(0x202e); // right-to-left override
|
||||
const HANGUL_FILLER = cp(0x3164);
|
||||
const CHOSEONG_FILLER = cp(0x115f);
|
||||
const VS16 = cp(0xfe0f); // variation selector-16
|
||||
const VS1 = cp(0xfe00); // variation selector-1
|
||||
const NEL = cp(0x0085); // next line, a C1 control
|
||||
const DEL = cp(0x007f);
|
||||
const FULLWIDTH_ETH = cp(0xff25, 0xff34, 0xff28);
|
||||
const FULLWIDTH_USDC = cp(0xff55, 0xff53, 0xff44, 0xff43); // lowercase
|
||||
const CYRILLIC_CAPITAL_IE = cp(0x0415);
|
||||
|
||||
describe("the shared rule: symbols that render as a known symbol", () => {
|
||||
test("ASCII padding does not buy a pass", () => {
|
||||
expect(isSpoofedSymbol(" ETH ", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(isSpoofedSymbol("\tETH\n", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(isSpoofedSymbol(" usdc ", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
test("non-breaking and other Unicode spaces do not either", () => {
|
||||
expect(isSpoofedSymbol(NBSP + "ETH" + NBSP, FAKE_ETH_CONTRACT)).toBe(
|
||||
true,
|
||||
);
|
||||
expect(
|
||||
isSpoofedSymbol(
|
||||
FIGURE_SPACE + "ETH" + IDEOGRAPHIC_SPACE,
|
||||
FAKE_ETH_CONTRACT,
|
||||
),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
// These render as nothing at all, in any position, so they are removed
|
||||
// wherever they sit rather than only at the ends.
|
||||
test("zero-width characters are stripped wherever they sit", () => {
|
||||
expect(isSpoofedSymbol("E" + ZWSP + "TH", FAKE_ETH_CONTRACT)).toBe(
|
||||
true,
|
||||
);
|
||||
expect(isSpoofedSymbol(BOM + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(
|
||||
isSpoofedSymbol("ET" + WORD_JOINER + "H", FAKE_ETH_CONTRACT),
|
||||
).toBe(true);
|
||||
expect(
|
||||
isSpoofedSymbol("E" + SOFT_HYPHEN + "TH", FAKE_ETH_CONTRACT),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
// An LRM is invisible and, in all-Latin text, moves nothing: dropping it
|
||||
// leaves exactly the string the user saw.
|
||||
test("an invisible bidi mark does not hide a known symbol", () => {
|
||||
expect(isSpoofedSymbol(LRM + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
// Invisibility is not confined to \p{Cf}. A Hangul filler is Lo and a
|
||||
// variation selector is Mn, yet each of these four measures 32.00px in
|
||||
// the repo's pinned e2e Chromium at 16px sans-serif — exactly the width
|
||||
// of a plain `ETH` — so each reaches the user's eye as `ETH`. They are
|
||||
// caught by \p{Default_Ignorable_Code_Point}, not by \p{Cf}.
|
||||
test("invisible non-format characters are stripped too", () => {
|
||||
expect(isSpoofedSymbol(HANGUL_FILLER + "ETH", FAKE_ETH_CONTRACT)).toBe(
|
||||
true,
|
||||
);
|
||||
expect(
|
||||
isSpoofedSymbol(CHOSEONG_FILLER + "ETH", FAKE_ETH_CONTRACT),
|
||||
).toBe(true);
|
||||
expect(isSpoofedSymbol("ETH" + VS16, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(isSpoofedSymbol("E" + VS1 + "TH", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
// Nor is it confined to the Unicode classes. U+007F is a control (Cc)
|
||||
// and is not default-ignorable, so neither class reaches it, but it
|
||||
// measures 32.00px in the same browser — it paints nothing, so a
|
||||
// symbol carrying it reaches the eye as `ETH`. It is named on its own
|
||||
// in the strip for exactly that reason.
|
||||
test("U+007F paints nothing and is stripped", () => {
|
||||
expect(isSpoofedSymbol(DEL + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
// The other side of the boundary, which is not the class boundary but
|
||||
// the visibility one: the remaining C0 and C1 controls render as a
|
||||
// visible 48.00px box in the same browser, so a symbol carrying one
|
||||
// does not look like `ETH` and must not be judged a spoof. Widening
|
||||
// the strip to \p{Cc} — the obvious over-correction once U+007F is in
|
||||
// it — fails this test.
|
||||
test("visible control characters do not make a symbol a spoof", () => {
|
||||
expect(isSpoofedSymbol(NEL + "ETH", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
expect(isSpoofedSymbol(cp(0x0001) + "ETH", FAKE_ETH_CONTRACT)).toBe(
|
||||
false,
|
||||
);
|
||||
expect(isSpoofedSymbol(cp(0x0090) + "ETH", FAKE_ETH_CONTRACT)).toBe(
|
||||
false,
|
||||
);
|
||||
});
|
||||
|
||||
test("compatibility forms fold onto the symbol they imitate", () => {
|
||||
expect(isSpoofedSymbol(FULLWIDTH_ETH, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
// The two knowingly open classes, asserted here so that the boundary is
|
||||
// a fact in the suite and not a claim in a PR body. A Cyrillic capital
|
||||
// Ie is a distinct letter rather than a compatibility variant, so NFKC
|
||||
// leaves it alone; and a right-to-left override reverses the rendering
|
||||
// of what follows it, which dropping the control character does not
|
||||
// undo. Closing either needs a confusables table or a bidi resolver,
|
||||
// and both are a separate change from this one.
|
||||
test("a Cyrillic homoglyph is knowingly still not caught", () => {
|
||||
expect(
|
||||
isSpoofedSymbol(CYRILLIC_CAPITAL_IE + "TH", FAKE_ETH_CONTRACT),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
test("a bidi-reordered symbol is knowingly still not caught", () => {
|
||||
expect(isSpoofedSymbol(RLO + "HTE", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
});
|
||||
|
||||
// Normalization does not reach the native-asset exemption, which turns
|
||||
// on the absence of a contract address and never on the symbol.
|
||||
test("a padded symbol with no contract is still not a spoof", () => {
|
||||
expect(isSpoofedSymbol(" ETH ", null)).toBe(false);
|
||||
expect(isSpoofedSymbol(NBSP + "ETH", "")).toBe(false);
|
||||
});
|
||||
|
||||
test("a genuine contract still bears its own padded symbol", () => {
|
||||
expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT)).toBe(false);
|
||||
expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT)).toBe(false);
|
||||
});
|
||||
|
||||
// Normalization must not invent a match. Interior ASCII whitespace is
|
||||
// left alone: `E T H` renders as `E T H`, not as `ETH`, so folding it
|
||||
// would filter a token no user could confuse with the native asset.
|
||||
test("a symbol that renders differently is not judged a spoof", () => {
|
||||
expect(isSpoofedSymbol("E T H", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
expect(isSpoofedSymbol("ETH2", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
expect(isSpoofedSymbol("MY ETH", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
});
|
||||
|
||||
// The false-positive question, answered against the shipped data rather
|
||||
// than by assertion: no bundled symbol carries whitespace or a
|
||||
// non-ASCII character, so the normalization cannot newly filter one.
|
||||
// The character class starts at `!` rather than at the space so that it
|
||||
// asserts the claim it stands for — `[ -~]` would admit an interior
|
||||
// space and let a whitespace-bearing entry through the guard.
|
||||
test("no bundled symbol is touched by the normalization", () => {
|
||||
for (const [symbol, addresses] of KNOWN_SYMBOLS) {
|
||||
expect(symbol).toBe(symbol.trim());
|
||||
expect(symbol).toMatch(/^[!-~]+$/);
|
||||
if (addresses === null) continue;
|
||||
for (const address of addresses) {
|
||||
expect(isSpoofedSymbol(symbol, address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Issue #276: the guard that was missing. The suite walked KNOWN_SYMBOLS,
|
||||
// which is built from TOKENS, so it could only ever assert that the table
|
||||
// agrees with itself. Seven symbols appear twice in the bundled list at two
|
||||
// different real contracts, and the table kept whichever came first, so the
|
||||
// other seven contracts — tokens in our own shipped list, at their own
|
||||
// addresses — were judged spoofs and hidden from the balance list, the
|
||||
// history and the send selector. That is the over-filtering direction: it
|
||||
// hides a holding the user cannot then spend.
|
||||
//
|
||||
// This walk is over TOKENS, the data the wallet actually ships, so it fails
|
||||
// whenever a bundled token would be filtered at its own address no matter
|
||||
// which side of the table the mistake is on.
|
||||
describe("the shipped token list", () => {
|
||||
test("no bundled token is filtered at its own address", () => {
|
||||
const filtered = TOKENS.filter((t) =>
|
||||
isSpoofedSymbol(t.symbol, t.address),
|
||||
).map((t) => t.symbol + " @ " + t.address);
|
||||
expect(filtered).toEqual([]);
|
||||
});
|
||||
|
||||
// The third failure mode the issue asks about: a symbol whose table entry
|
||||
// names an address that is in neither the table nor the list would be a
|
||||
// contract we vouch for and do not ship. There is none, and the table is
|
||||
// built from the list, so this asserts the derivation has not acquired a
|
||||
// hand-written entry.
|
||||
test("every address the table vouches for is a bundled token", () => {
|
||||
const bundled = new Set(TOKENS.map((t) => t.address.toLowerCase()));
|
||||
for (const [symbol, addresses] of KNOWN_SYMBOLS) {
|
||||
if (addresses === null) continue;
|
||||
expect(addresses.size).toBeGreaterThan(0);
|
||||
for (const address of addresses) {
|
||||
expect(address).toBe(address.toLowerCase());
|
||||
expect(bundled.has(address)).toBe(true);
|
||||
// And it is the token that actually reports that symbol.
|
||||
const token = TOKENS.find(
|
||||
(t) => t.address.toLowerCase() === address,
|
||||
);
|
||||
expect(token.symbol.toUpperCase()).toBe(symbol);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// Both contracts behind a shared ticker must pass, from either side: a
|
||||
// rule that admits only the one the table happens to visit first is the
|
||||
// bug, not the fix.
|
||||
test("both contracts behind a shared ticker are admitted", () => {
|
||||
const bySymbol = new Map();
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!bySymbol.has(upper)) bySymbol.set(upper, []);
|
||||
bySymbol.get(upper).push(t);
|
||||
}
|
||||
const shared = [...bySymbol].filter(([, list]) => list.length > 1);
|
||||
// The shared tickers are a fact about the shipped data; if a future
|
||||
// list has none, this test would silently assert nothing.
|
||||
expect(shared.length).toBeGreaterThan(0);
|
||||
for (const [, list] of shared) {
|
||||
for (const t of list) {
|
||||
expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// The seven from issue #276, named so that the reconciliation is a fact
|
||||
// in the suite: each is two real contracts from the same source fetch,
|
||||
// and the table now holds both rather than the one that came first.
|
||||
test("the seven shared tickers each name both bundled contracts", () => {
|
||||
const expected = {
|
||||
TON: [
|
||||
"0x582d872a1b094fc48f5de31d3b73f2d9be47def1", // Toncoin
|
||||
"0x2be5e8c109e2197d077d13a82daead6a9b3433c5", // Tokamak Network
|
||||
],
|
||||
FRAX: [
|
||||
"0x853d955acef822db058eb8505911ed77f175b99e", // Legacy Frax Dollar
|
||||
"0x3432b6a60d23ca0dfca7761b7ab56459d9c964d0", // Frax (prev. FXS)
|
||||
],
|
||||
REUSD: [
|
||||
"0x5086bf358635b81d8c47c66d1c8b9e567db70c72", // Re Protocol reUSD
|
||||
"0x57ab1e0003f623289cd798b1824be09a793e4bec", // Resupply USD
|
||||
],
|
||||
EURE: [
|
||||
"0x39b8b6385416f4ca36a20319f70d28621895279d", // Monerium EUR emoney
|
||||
"0x3231cb76718cdef2155fc47b5286d82e6eda273f", // Monerium EUR emoney [OLD]
|
||||
],
|
||||
MSUSD: [
|
||||
"0x4ba01f22827018b4772cd326c7627fb4956a7c00", // Main Street USD
|
||||
"0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
|
||||
],
|
||||
MUSD: [
|
||||
"0xaca92e438df0b2401ff60da7e4337b687a2435da", // MetaMask USD
|
||||
"0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
|
||||
],
|
||||
JPYC: [
|
||||
"0x431d5dff03120afa4bdf332c61a6e1766ef37bdb", // JPY Coin
|
||||
"0x2370f9d504c7a6e775bf6e14b3f12846b594cd53", // JPY Coin v1
|
||||
],
|
||||
};
|
||||
for (const [symbol, addresses] of Object.entries(expected)) {
|
||||
expect([...KNOWN_SYMBOLS.get(symbol)].sort()).toEqual(
|
||||
[...addresses].sort(),
|
||||
);
|
||||
for (const address of addresses) {
|
||||
expect(isSpoofedSymbol(symbol, address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// The other direction, on the same symbols: widening the table to hold
|
||||
// every bundled address for a ticker must not turn it into a pass for
|
||||
// any other contract.
|
||||
test("a shared ticker from a third contract is still a spoof", () => {
|
||||
const bySymbol = new Map();
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!bySymbol.has(upper)) bySymbol.set(upper, []);
|
||||
bySymbol.get(upper).push(t);
|
||||
}
|
||||
for (const [symbol, list] of bySymbol) {
|
||||
if (list.length < 2) continue;
|
||||
expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("surface 1: the transaction history", () => {
|
||||
function fakeEthTransfer() {
|
||||
return {
|
||||
@@ -442,22 +147,6 @@ describe("surface 1: the transaction history", () => {
|
||||
expect(result.transactions).toEqual([]);
|
||||
});
|
||||
|
||||
// Issue #260 on this surface: the same transfer with a padded symbol.
|
||||
test("a padded fake ETH token transfer is filtered too", () => {
|
||||
const padded = { ...fakeEthTransfer(), symbol: " ETH " };
|
||||
const result = filterTransactions([padded], {
|
||||
hideSpoofedSymbols: true,
|
||||
hideFraudContracts: true,
|
||||
hideLowHolderTokens: true,
|
||||
hideDustTransactions: true,
|
||||
dustThresholdGwei: 100000,
|
||||
});
|
||||
expect(result.transactions).toEqual([]);
|
||||
// The contract is learned as fraudulent, exactly as for the
|
||||
// unpadded symbol: the padding must not cost the blocklist entry.
|
||||
expect(result.newFraudContracts).toEqual([FAKE_ETH_CONTRACT]);
|
||||
});
|
||||
|
||||
test("a real native ETH transfer survives", () => {
|
||||
const native = {
|
||||
hash: "0x" + "2".repeat(64),
|
||||
@@ -512,36 +201,6 @@ describe("surface 2: the Send token selector", () => {
|
||||
expect(select.children).toEqual([]);
|
||||
});
|
||||
|
||||
// Issue #260 on this surface: the option text is rendered into HTML,
|
||||
// which collapses the padding, so an unfiltered padded token would sit
|
||||
// in the selector reading exactly `ETH`.
|
||||
test("a padded fake ETH token is not selectable either", () => {
|
||||
render([
|
||||
{
|
||||
address: FAKE_ETH_CONTRACT,
|
||||
symbol: " ETH ",
|
||||
decimals: 18,
|
||||
balance: "0.005",
|
||||
holders: 900000,
|
||||
},
|
||||
]);
|
||||
expect(select.children).toEqual([]);
|
||||
});
|
||||
|
||||
test("a genuine token with a padded symbol stays selectable", () => {
|
||||
render([
|
||||
{
|
||||
address: USDC_CONTRACT,
|
||||
symbol: " USDC ",
|
||||
decimals: 6,
|
||||
balance: "12.5",
|
||||
holders: 900000,
|
||||
},
|
||||
]);
|
||||
expect(select.children).toHaveLength(1);
|
||||
expect(select.children[0].value).toBe(USDC_CONTRACT);
|
||||
});
|
||||
|
||||
test("native ETH remains the always-present option", () => {
|
||||
render([]);
|
||||
expect(select.innerHTML).toBe('<option value="ETH">ETH</option>');
|
||||
@@ -592,35 +251,6 @@ describe("surface 3: the balance list", () => {
|
||||
expect(balances).toEqual([]);
|
||||
});
|
||||
|
||||
// Issue #260 on this surface: the balance list is where the user forms
|
||||
// their belief about what they own, and it renders the symbol into HTML.
|
||||
test("a padded fake ETH token is filtered too", async () => {
|
||||
respondWith([fakeEthItem({ symbol: " ETH " })]);
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
});
|
||||
|
||||
test("a fake ETH token padded with a no-break space is filtered", async () => {
|
||||
respondWith([fakeEthItem({ symbol: NBSP + "ETH" + NBSP })]);
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
});
|
||||
|
||||
// The false-positive direction on the surface that matters most: a real
|
||||
// holding whose symbol happens to carry padding is still listed, and the
|
||||
// list still shows the symbol the token actually reports.
|
||||
test("a genuine token with a padded symbol is not newly filtered", async () => {
|
||||
respondWith([
|
||||
fakeEthItem({
|
||||
address_hash: USDC_CONTRACT,
|
||||
symbol: " USDC ",
|
||||
name: "USD Coin",
|
||||
decimals: "6",
|
||||
}),
|
||||
]);
|
||||
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
|
||||
expect(balances).toHaveLength(1);
|
||||
expect(balances[0].symbol).toBe(" USDC ");
|
||||
});
|
||||
|
||||
test("a genuine token keeps its place in the list", async () => {
|
||||
respondWith([
|
||||
fakeEthItem({
|
||||
@@ -644,33 +274,6 @@ describe("surface 3: the balance list", () => {
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
});
|
||||
|
||||
// The adjacent finding from the same review as issue #260: the type gate
|
||||
// compared exactly, so an explorer that ever varied the casing would
|
||||
// silently drop a real holding before any filter ran. The comparison is
|
||||
// now case-insensitive, which changes nothing about which types are
|
||||
// admitted.
|
||||
test("a differently-cased ERC-20 type still lists a real holding", async () => {
|
||||
respondWith([
|
||||
fakeEthItem({
|
||||
type: "erc-20",
|
||||
address_hash: USDC_CONTRACT,
|
||||
symbol: "USDC",
|
||||
name: "USD Coin",
|
||||
decimals: "6",
|
||||
}),
|
||||
]);
|
||||
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
|
||||
expect(balances).toHaveLength(1);
|
||||
expect(balances[0].symbol).toBe("USDC");
|
||||
});
|
||||
|
||||
test("case insensitivity does not admit another token type", async () => {
|
||||
respondWith([fakeEthItem({ type: "erc-721" })]);
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
respondWith([fakeEthItem({ type: "ERC-20-EXTRA" })]);
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
});
|
||||
|
||||
// The money test: the user holds real ETH and has been airdropped a fake
|
||||
// ETH ERC-20. The fake is gone from the list of tokens; the real balance
|
||||
// is exactly what the node reported.
|
||||
|
||||
@@ -207,8 +207,8 @@ describe("token list assumptions the fixtures rely on", () => {
|
||||
});
|
||||
|
||||
test("USDC and WETH map to their genuine lowercased contracts", () => {
|
||||
expect([...KNOWN_SYMBOLS.get("USDC")]).toEqual([USDC_CONTRACT]);
|
||||
expect([...KNOWN_SYMBOLS.get("WETH")]).toEqual([WETH_CONTRACT]);
|
||||
expect(KNOWN_SYMBOLS.get("USDC")).toBe(USDC_CONTRACT);
|
||||
expect(KNOWN_SYMBOLS.get("WETH")).toBe(WETH_CONTRACT);
|
||||
});
|
||||
|
||||
test("the spam fixture symbol is not in the known token list", () => {
|
||||
|
||||
Reference in New Issue
Block a user