Compare commits
1 Commits
issue-308-
...
e94afc4c5e
| Author | SHA1 | Date | |
|---|---|---|---|
| e94afc4c5e |
@@ -1,49 +0,0 @@
|
||||
name: e2e
|
||||
on: [push]
|
||||
|
||||
# The browser end-to-end suites, one job per browser, deliberately kept out
|
||||
# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
|
||||
# script/cibuild is a plain `docker build .` whose Dockerfile runs
|
||||
# make check, so folding a browser suite into either would blow that cap
|
||||
# and slow the local fast path. Before this workflow every browser-level
|
||||
# guarantee in this repo held only when a human remembered to run it.
|
||||
#
|
||||
# One job per browser rather than two steps in one job, so a Chrome failure
|
||||
# does not hide the Firefox result.
|
||||
#
|
||||
# Each job is one script and nothing else. Both scripts need docker and
|
||||
# nothing else — they deliver the repo to the daemon as a build context and
|
||||
# build the extension inside the pinned image — which is what makes them
|
||||
# runnable here at all: the runner executes the job in a container against
|
||||
# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
|
||||
# by the host daemon and mounts an empty directory, and the runner image's
|
||||
# node is too old to install this repo's dependencies.
|
||||
#
|
||||
# These jobs REPORT, they do not gate. Whether a check blocks a merge is
|
||||
# Gitea branch protection, which this repo does not configure, so a failure
|
||||
# here is a red mark a reviewer has to account for rather than a hard
|
||||
# block. Making e2e-chrome a required check is blocked on the measured
|
||||
# flake in the dApp signing wait -- two of six runs of unmutated code on a
|
||||
# loaded machine -- tracked as
|
||||
# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
|
||||
# random teaches people to merge past red.
|
||||
#
|
||||
# Nothing here may pass vacuously. There is no continue-on-error and no
|
||||
# `|| true`. Both scripts exit non-zero when docker is missing, when the
|
||||
# image build fails, and when the browser fails to start; the Chrome
|
||||
# harness aborts the suite outright if its network interception is not in
|
||||
# effect.
|
||||
jobs:
|
||||
e2e-chrome:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/test-e2e
|
||||
|
||||
e2e-firefox:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/test-e2e-firefox
|
||||
27
Dockerfile
27
Dockerfile
@@ -1,21 +1,8 @@
|
||||
# node:22-slim (22.x LTS), 2026-02-24
|
||||
FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS base
|
||||
FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Marks "already inside the lint container" for script/lint, which otherwise
|
||||
# shells out to docker to build the lint stage below. Nothing outside this
|
||||
# image sets it.
|
||||
ENV AUTISTMASK_LINT_NATIVE=1
|
||||
|
||||
# script/test's default 30s bound is the host figure, against a suite that
|
||||
# runs in about 8s there. In here the same suite starts on a cold jest cache
|
||||
# and shares the runner with the rest of the build, so 30s is marginal rather
|
||||
# than a bound — it killed a healthy suite at 30.6s on a cold CI cache. 180s
|
||||
# still catches a hang in three minutes and cannot be tripped by a suite that
|
||||
# is merely running on contended hardware.
|
||||
ENV AUTISTMASK_TEST_TIMEOUT=180
|
||||
|
||||
# script/bootstrap installs all prerequisites (make via apt here; node
|
||||
# is already in the base image, yarn comes via corepack) and runs
|
||||
# yarn install --frozen-lockfile. Dependency manifests are copied first
|
||||
@@ -26,17 +13,5 @@ RUN script/bootstrap
|
||||
|
||||
COPY . .
|
||||
|
||||
# Lint stage — fail fast on static analysis and formatting, before the tests
|
||||
# and the build. This is also the stage script/lint builds from a host, which
|
||||
# is how linting stays on the pinned ESLint rather than the host's.
|
||||
FROM base AS lint
|
||||
RUN make lint
|
||||
|
||||
# Full check and build. The COPY --from is a no-op file copy whose only job is
|
||||
# to make BuildKit finish the lint stage before this one starts; without it the
|
||||
# stages run in parallel and a lint failure would not fail the build early.
|
||||
FROM base AS check
|
||||
COPY --from=lint /app/package.json /dev/null
|
||||
|
||||
RUN make check
|
||||
RUN make build
|
||||
|
||||
9
LICENSE
9
LICENSE
@@ -682,14 +682,7 @@ under their own licenses. They are NOT covered by the GPL-3.0 license above.
|
||||
|
||||
---------------------------------------------------------------------------
|
||||
File: src/shared/phishingBlocklist.json
|
||||
Source: the eth-phishing-detect community blocklist (src/config.json).
|
||||
The file here is derived from it, not a copy of it: only the
|
||||
blacklist is carried over, and each entry is stored as a truncated
|
||||
digest rather than a domain name. script/vendor-blocklist records
|
||||
the exact upstream URL, the commit it is pinned to and the hash of
|
||||
the bytes that commit serves, and is what regenerates this file.
|
||||
The URL previously cited here, under a different organisation,
|
||||
returns 404: that repository is gone.
|
||||
Source: https://github.com/AugurProject/eth-phishing-detect (config.json)
|
||||
Copyright: Copyright (c) 2018 kumavis
|
||||
License: Don't Be a Dick Public License (DBAD), Version 1.2
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
21
Makefile
21
Makefile
@@ -1,4 +1,4 @@
|
||||
.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug verify-build vendor-blocklist clean dev
|
||||
.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
|
||||
|
||||
# Standard targets are thin shims; the implementations live in script/
|
||||
# per the scripts-to-rule-them-all pattern (see the Entrypoints section
|
||||
@@ -16,13 +16,10 @@ install:
|
||||
test:
|
||||
@script/test
|
||||
|
||||
# Browser end-to-end suites. Both require docker; neither is part of check.
|
||||
# Browser end-to-end suite. Requires docker; not part of check.
|
||||
test-e2e:
|
||||
@script/test-e2e
|
||||
|
||||
test-e2e-firefox:
|
||||
@script/test-e2e-firefox
|
||||
|
||||
lint:
|
||||
@script/lint
|
||||
|
||||
@@ -35,12 +32,6 @@ fmt-check:
|
||||
check:
|
||||
@script/check
|
||||
|
||||
# Assert that the competitor name appears nowhere but its documented
|
||||
# exceptions. Part of check, and re-run against dist/ at the end of a build;
|
||||
# separate target for re-running it alone.
|
||||
check-censored:
|
||||
@script/check-censored
|
||||
|
||||
docker:
|
||||
@script/docker
|
||||
|
||||
@@ -51,7 +42,6 @@ build:
|
||||
@echo "Building extension..."
|
||||
@yarn run build 2>&1
|
||||
@script/verify-build
|
||||
@script/check-censored --require-dist
|
||||
|
||||
# Development-only build: enables the red DEBUG / INSECURE banner and makes
|
||||
# the hardcoded test recovery phrase the output of wallet creation. Never
|
||||
@@ -60,19 +50,12 @@ build-debug:
|
||||
@echo "Building extension (DEBUG)..."
|
||||
@AUTISTMASK_DEBUG=1 yarn run build 2>&1
|
||||
@AUTISTMASK_DEBUG=1 script/verify-build
|
||||
@script/check-censored --require-dist
|
||||
|
||||
# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
|
||||
# the end of build and build-debug; separate target for re-running it alone.
|
||||
verify-build:
|
||||
@script/verify-build
|
||||
|
||||
# Refresh src/shared/phishingBlocklist.json from its hash-pinned upstream.
|
||||
# Run deliberately, land the diff: the extension does no runtime fetching, so
|
||||
# the shipped list is as fresh as the last vendoring run that was released.
|
||||
vendor-blocklist:
|
||||
@script/vendor-blocklist
|
||||
|
||||
clean:
|
||||
@rm -rf dist/
|
||||
|
||||
|
||||
547
README.md
547
README.md
@@ -18,10 +18,9 @@ don't implement any crypto, and don't send user-specific data anywhere but a
|
||||
extension contacts three user-configurable services: the configured RPC node for
|
||||
blockchain interactions, a public CoinDesk API (no API key) for realtime price
|
||||
information, and a Blockscout block-explorer API for transaction history and
|
||||
token balances. It also performs best-effort Etherscan address label lookups
|
||||
during transaction confirmation. A community-maintained phishing domain
|
||||
blocklist is built into the extension at build time and checked locally; nothing
|
||||
is fetched for it at runtime.
|
||||
token balances. It also fetches a community-maintained phishing domain blocklist
|
||||
periodically and performs best-effort Etherscan address label lookups during
|
||||
transaction confirmation.
|
||||
|
||||
In the extension is a hardcoded list of the top ERC20 contract addresses. You
|
||||
can add any ERC20 contract by contract address if you wish, but the hardcoded
|
||||
@@ -84,36 +83,12 @@ provide:
|
||||
git pre-commit hook
|
||||
- `script/projectname` — print the project name (used for the Docker image tag)
|
||||
- `script/test` — run the test suite (jest)
|
||||
- `script/test-e2e` — run the Chrome browser end-to-end suite (docker is the
|
||||
only prerequisite: it builds a pinned image that carries the repo and a fresh
|
||||
extension build, see [End-to-End Tests](#end-to-end-tests))
|
||||
- `script/test-e2e-firefox` — run the Firefox browser end-to-end suite (same,
|
||||
against an image with a pinned Firefox and geckodriver, see
|
||||
- `script/test-e2e` — run the browser end-to-end suite (docker required; see
|
||||
[End-to-End Tests](#end-to-end-tests))
|
||||
- `script/lint` — run ESLint (`eslint.config.js`) and then `prettier --check`,
|
||||
failing on either. It never writes: `--fix` is not in this path, so
|
||||
`make check` stays non-mutating. Linting runs in the container — the script
|
||||
builds the Dockerfile's `lint` stage — because an ESLint result that depends
|
||||
on whichever ESLint the host happens to have is not a result. Docker is
|
||||
therefore required to lint; inside that image `AUTISTMASK_LINT_NATIVE=1` makes
|
||||
the same script lint in place instead of recursing.
|
||||
- `script/lint` — run the linter
|
||||
- `script/fmt` — format all files (writes)
|
||||
- `script/fmt-check` — check formatting (read-only)
|
||||
- `script/check` — run test, test-verify-build, check-censored, lint, and
|
||||
fmt-check
|
||||
- `script/check-censored` — assert the competitor name RULES.md bars appears
|
||||
nowhere in the working tree or under `dist/` outside its documented
|
||||
exceptions: the pinned source reference in `script/vendor-blocklist`, the two
|
||||
provider-shim identifiers in `src/content/inpage.js`, and one ERC-20's
|
||||
on-chain name in `src/shared/tokenList.js`. Each is scoped to that path and
|
||||
fails anywhere else. Part of `make check`, which inspects `dist/` when there
|
||||
is one and says loudly when there is not; `make build` re-runs it with
|
||||
`--require-dist`, so a build artifact is always covered
|
||||
- `script/vendor-blocklist` — refresh `src/shared/phishingBlocklist.json` from
|
||||
its upstream, pinned to a commit and to the sha256 of the bytes that commit
|
||||
serves. Run deliberately, never as part of a build: the output is committed
|
||||
and there is no runtime fetch, so the shipped list is as fresh as the last
|
||||
vendoring run that was released
|
||||
- `script/check` — run test, test-verify-build, lint, and fmt-check
|
||||
- `script/verify-build` — assert the compiled `DEBUG` state of the bundles in
|
||||
`dist/`: every bundle containing `src/shared/constants.js` must have `DEBUG`
|
||||
off, or on when `AUTISTMASK_DEBUG=1`. Run automatically at the end of
|
||||
@@ -148,22 +123,13 @@ The Makefile shims to those. It also carries a few targets that have no
|
||||
|
||||
## End-to-End Tests
|
||||
|
||||
There are two suites, one per browser, and they share no code. Chrome runs on
|
||||
Playwright; Firefox has its own WebDriver client, because Playwright cannot
|
||||
observe errors on a Firefox extension page at all — see
|
||||
[Firefox](#firefox-make-test-e2e-firefox) below. Both require docker, and both
|
||||
are outside `make check`.
|
||||
|
||||
### Chrome (`make test-e2e`)
|
||||
|
||||
`make test-e2e` builds `dist/chrome/` and drives the **real popup in a real
|
||||
Chrome**, loaded as an unpacked MV3 extension inside a pinned
|
||||
`mcr.microsoft.com/playwright` container (pinned by digest in
|
||||
`tests/e2e/Dockerfile`, which is also where the extension is built; docker is
|
||||
required and the suite fails loudly rather than skipping if it is unavailable).
|
||||
The suite lives in `tests/e2e/` and is driven by `playwright-core`, whose
|
||||
version must stay matched to the container's Playwright version — the browsers
|
||||
ship inside the image.
|
||||
`mcr.microsoft.com/playwright` container (pinned by digest in `script/test-e2e`;
|
||||
docker is required and the suite fails loudly rather than skipping if it is
|
||||
unavailable). The suite lives in `tests/e2e/` and is driven by
|
||||
`playwright-core`, whose version must stay matched to the container's Playwright
|
||||
version — the browsers ship inside the image.
|
||||
|
||||
It covers popup load, WebAssembly compilation under the shipped CSP (see
|
||||
[Content Security Policy](#content-security-policy)), wallet creation through
|
||||
@@ -180,65 +146,6 @@ fixtures in `tests/e2e/network.js`, so the run is deterministic and fully
|
||||
offline; unrecognised outbound requests are reported as failures rather than
|
||||
silently allowed.
|
||||
|
||||
It also covers the **Settings screen**, which holds the densest run of element
|
||||
id lookups in the codebase and where one wrong id leaves the whole popup blank
|
||||
rather than only degrading Settings: that the screen renders populated — the
|
||||
About well and the wallet list are read back, so a `show()` that stopped early
|
||||
is caught rather than merely a view that failed to appear — that the four Token
|
||||
Spam Protection controls are real checkboxes defaulted on, and that the theme
|
||||
and network selectors offer exactly the choices `src/shared/networks.js` and
|
||||
`index.html` define. What the selectors persist is then driven through the UI to
|
||||
`dark` and `sepolia` and reasserted after a popup reopen before being restored
|
||||
the same way; neither value is its selector's first `<option>`, so neither can
|
||||
be read back from the markup with no JavaScript having run. One spam filter is
|
||||
likewise toggled off and back on across a reopen each way, which exercises the
|
||||
change handler, `saveState()`, `loadState()` and the assignment `init()` makes.
|
||||
Each group of these assertions records a coverage key and a final case demands
|
||||
the exact set, so a section that silently stopped running reddens the suite
|
||||
instead of quietly shrinking it.
|
||||
|
||||
It also covers the confirmation screen, for both a native ETH send and an ERC-20
|
||||
send: Send disabled while the fee estimate is in flight, enabled once it lands,
|
||||
the fee block quoting the expected cost and the reserve separately, the distinct
|
||||
message for an estimate that failed, and the view height staying constant across
|
||||
every one of those transitions. The load-bearing one is that the spend gate uses
|
||||
the **reserve** and not the displayed **estimate** — the two are stubbed far
|
||||
apart on purpose, and the funded and refused sends sit on opposite sides of the
|
||||
reserve while sitting on the same side of the estimate, so swapping the two in
|
||||
`src/popup/views/confirmTx.js` fails the suite instead of passing it. That is
|
||||
what [#154](https://git.eeqj.de/sneak/AutistMask/issues/154) was, and it was
|
||||
previously correct by reading only.
|
||||
|
||||
It also covers the **dApp approval round trips** — the one place where the
|
||||
content script, the inpage provider, the background worker and the approval
|
||||
popup all have to work together. A local test page is served by the route
|
||||
handler on a reserved-TLD origin, gets `window.ethereum` from the shipped
|
||||
`MAIN`-world content script like any other page, and drives
|
||||
`eth_requestAccounts`, `personal_sign`, `eth_signTypedData_v4` and
|
||||
`eth_sendTransaction` through the real prompts. Every signature is recovered in
|
||||
the runner and compared against the active address, the transaction assertions
|
||||
run against the raw signed transaction captured at `eth_sendRawTransaction`
|
||||
rather than against anything the extension reported, rejecting each prompt is
|
||||
required to return a rejection to the page rather than hang or resolve, and the
|
||||
password is required to be absent from every message the approval window sends
|
||||
to the background — with the message that would carry it required to be present,
|
||||
so that check cannot pass by observing nothing. That last one is the standing
|
||||
floor under [#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
|
||||
|
||||
Two limits of that coverage, neither of them papered over. The RPC is stubbed
|
||||
throughout, so this is **not** a real dApp against a real network with real
|
||||
funds; that remains a human pass before 1.0.0. The site-connection prompt is
|
||||
raised through `chrome.action.openPopup()`, and headless Chromium's
|
||||
browser-action popup is not a page Playwright can see or click, so that one
|
||||
prompt is driven at the URL the extension itself puts on the action — the same
|
||||
page and the same approval id, but whether a real toolbar click shows it is not
|
||||
observable here.
|
||||
|
||||
Any test that drives a failure path on purpose declares the `console.error` it
|
||||
is about to provoke, via `errors.expect()`. That is not a mute: the declaration
|
||||
consumes exactly one matching record, and a declaration nothing matched fails
|
||||
its test just as an undeclared error does.
|
||||
|
||||
That reporting has one bound worth knowing. Observation ends when the browser
|
||||
context is torn down, and nothing can watch traffic after that, so the run keeps
|
||||
collecting for a fixed grace period after the last test returns
|
||||
@@ -253,16 +160,16 @@ That interception covers the MV3 background service worker as well as the popup
|
||||
page, which it does not by default — `script/test-e2e` sets
|
||||
`PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1` for it. Because that flag is
|
||||
experimental, the harness does not take it on trust. At launch it waits for the
|
||||
background worker to exist, asks it for one throwaway `fetch()` of its own, and
|
||||
requires that request to arrive in the route handler within 30 seconds or aborts
|
||||
the entire suite (`tests/e2e/harness.js`). The anchor used to be the worker's
|
||||
own startup traffic — the phishing blocklist fetch — and there is no longer any:
|
||||
the blocklist is vendored at build time and the extension contacts nobody when
|
||||
it starts. An earlier synthetic probe was rejected because evaluating in an
|
||||
extension service worker immediately after launch killed the worker outright;
|
||||
waiting for the worker to be handed over first, and issuing a `fetch()` that is
|
||||
not awaited, does not. Failing the probe fails closed — the suite refuses to run
|
||||
rather than passing quietly.
|
||||
background worker's **own** startup request — the phishing blocklist fetch that
|
||||
`src/background/index.js` issues on startup, which on the suite's throwaway
|
||||
profile always happens because no previous fetch timestamp is persisted — to
|
||||
arrive in the route handler, and aborts the entire suite if none does within 30
|
||||
seconds (`tests/e2e/harness.js`). The check is passive on purpose: a synthetic
|
||||
probe fetched from inside the worker via `worker.evaluate()` was tried first and
|
||||
rejected, because evaluating in an extension service worker that early kills the
|
||||
worker outright, destroying the thing being measured. Observing traffic the
|
||||
extension already generates perturbs nothing. Losing the race fails closed — the
|
||||
suite refuses to run rather than passing quietly.
|
||||
|
||||
As defence in depth, Chrome is also started with
|
||||
`--host-resolver-rules=MAP * ~NOTFOUND`, so a request that ever did slip past
|
||||
@@ -272,184 +179,17 @@ being intercepted, run with `E2E_TRACE_NETWORK=1` and every routed request is
|
||||
printed, tagged `[sw]` or `[page]`.
|
||||
|
||||
**Any uncaught page error or `console.error` fails the run.** That is the point:
|
||||
this suite exists because a `ReferenceError` from a used-but-not-imported
|
||||
identifier shipped twice, fatal in a browser and invisible to a `make check`
|
||||
that was `prettier --check` only. ESLint's `no-undef` now catches that exact
|
||||
class before a browser is involved, so this suite is no longer the only thing
|
||||
standing between it and a release — but a static rule only sees identifiers, and
|
||||
the runtime errors this suite catches are broader than one rule.
|
||||
a `ReferenceError` from a used-but-not-imported identifier is invisible to
|
||||
`make check` (`script/lint` is only `prettier --check`) but fatal in a browser,
|
||||
and this suite exists because exactly that class of bug shipped twice.
|
||||
|
||||
### Firefox (`make test-e2e-firefox`)
|
||||
|
||||
`make test-e2e-firefox` builds `dist/firefox/` and drives the **real popup in a
|
||||
real Firefox**, installed as an unpacked MV2 temporary add-on via geckodriver.
|
||||
It covers popup load, wallet creation through the UI, the Add Token screen, and
|
||||
the four dApp round trips — `eth_requestAccounts`, `personal_sign`,
|
||||
`eth_sendTransaction`, and a closed approval window rejecting with EIP-1193 4001
|
||||
— driven through the real content script, background page and approval windows.
|
||||
|
||||
The suite lives in `tests/e2e/firefox/`. Its WebDriver client (`driver.js`) has
|
||||
**no npm dependencies at all**: it is built on global `fetch` and
|
||||
`child_process` against geckodriver's HTTP API. The dApp fixture (`dapp.js`) and
|
||||
the assertions do use `ethers`, and have to — a signature is recovered in the
|
||||
runner rather than believed from the extension, and the stub node has to answer
|
||||
`eth_sendRawTransaction` with the hash `ethers` computes for the artifact it
|
||||
sent, or `provider.broadcastTransaction()` refuses the answer.
|
||||
|
||||
Both suites build their own image, each with the repo and a fresh extension
|
||||
build baked in; what differs is the base. The Chrome image layers those on top
|
||||
of a published Playwright image, whereas this one is assembled from a `node`
|
||||
base, because no published image carries both a pinned Firefox and a matching
|
||||
geckodriver. `tests/e2e/firefox/Dockerfile` pins all three external artifacts by
|
||||
digest — the `node` base image, the Firefox 153.0.3 tarball, and geckodriver
|
||||
0.36.0 — and the Firefox version in particular must not float:
|
||||
`-remote-allow-system-access` is **mandatory** on 153 and was not on 142.
|
||||
Without that flag, both navigating to `moz-extension://` and running
|
||||
chrome-context script fail with `unsupported operation`. The flag grants the
|
||||
driver full chrome privileges over that browser, which is acceptable only
|
||||
because it is a throwaway container.
|
||||
|
||||
The popup's `moz-extension://` uuid is **pinned, not discovered**: the profile
|
||||
pref `extensions.webextensions.uuids` maps the extension id that
|
||||
`manifest/firefox.json` already declares to a fixed uuid, so the popup URL is
|
||||
deterministic. Navigation uses **classic** WebDriver `POST /session/{id}/url`,
|
||||
because BiDi's `browsingContext.navigate` refuses `moz-extension://` outright.
|
||||
|
||||
**Any uncaught error from a `moz-extension://` source fails the run**, including
|
||||
errors from the background page, which the suite never navigates to: a `throw`
|
||||
at the top of `src/background/index.js` kills the background page and fails
|
||||
step 1. Content scripts **are** exercised now — the dApp steps drive a page
|
||||
served from loopback, which survives `--network none` — but the _capture_ of a
|
||||
content-script error by this route is still unproven: no probe has forced a
|
||||
throw inside one and watched it fail the run, so it remains an expectation
|
||||
rather than a demonstrated fact. Errors from add-on install and background
|
||||
startup are folded into step 1 rather than discarded.
|
||||
|
||||
An **unhandled promise rejection counts as an uncaught error** on both suites,
|
||||
which matters because a good deal of popup code is now `async` and called
|
||||
without an `await`. Demonstrated, not assumed: a `throw` placed past the first
|
||||
`await` of `approval.show()` — which nothing awaits — turns the
|
||||
`eth_requestAccounts` step red on Firefox
|
||||
(`uncaught extension errors during this step`, from the console-service drain)
|
||||
and on Chrome (`pageerror`), with the rest of the run unaffected because the
|
||||
approval view had already rendered.
|
||||
|
||||
One error is tolerated rather than fatal, listed in `ALLOWED_ERRORS` in
|
||||
`tests/e2e/firefox/run.js` with the issue that will delete it, and printed on
|
||||
every occurrence so the concession stays visible in the run output. It is
|
||||
Firefox reporting the site-approval popup's unawaited `sendMessage` settling
|
||||
after `window.close()` unloaded the context — the same teardown ordering as
|
||||
[#275](https://git.eeqj.de/sneak/AutistMask/issues/275), and unsuppressable from
|
||||
the calling code, because `BaseContext.wrapPromise` reports it whether or not a
|
||||
handler is attached. Errors are read from the privileged `nsIConsoleService` in
|
||||
Marionette's chrome context and filtered to non-warning entries whose
|
||||
`sourceName` is the extension origin. That mechanism is not a stylistic choice.
|
||||
WebDriver BiDi's `log.entryAdded` delivers **nothing** for extension pages: on a
|
||||
plain `http://` page it reports uncaught errors with stack traces, and on the
|
||||
`moz-extension://` popup it reports zero events, because Firefox's remote agent
|
||||
excludes extension browsing contexts from BiDi observation. Any harness built on
|
||||
Playwright-BiDi or Puppeteer-BiDi would therefore see nothing and report
|
||||
success, which is exactly the vacuous check this repo has already shipped twice.
|
||||
Do not migrate this suite to BiDi.
|
||||
|
||||
Two limits are worth knowing, both real differences from the Chrome suite:
|
||||
|
||||
- **Error capture is poll-based, not event-streamed.** The console is drained at
|
||||
each step boundary, so an error is attributed to the step it was drained
|
||||
after, not to a moment within it. The window that is drained runs from add-on
|
||||
install to **≈1.5s** after the last step returns — a 500ms settle, a 1000ms
|
||||
tail sleep and two drain round trips — and then the browser is torn down. That
|
||||
cut-off is not a hard boundary: with throws scheduled at fixed offsets, three
|
||||
runs reported everything up to +1.5s and one of the three also reported +1.6s,
|
||||
so an error landing near it may or may not be seen, and anything well past it
|
||||
is not. Inside the window there is no race — each drain reads and clears the
|
||||
console in a single chrome round trip, so an error logged mid-drain lands in
|
||||
that batch or the next rather than being destroyed unread — but there is a
|
||||
**capacity limit**: `nsIConsoleService` keeps a ring buffer of 250 messages
|
||||
and silently evicts the oldest, so more than 250 console messages between two
|
||||
drains destroys the excess unread. 400 throws inside one step are reported as
|
||||
exactly the newest 250, three runs running. That buffer is shared with
|
||||
Firefox's own console noise; a clean run peaks at 4 of 250 at the install
|
||||
drain and 0 at every later drain, so the three steps here have wide headroom,
|
||||
but a step that logs heavily could evict unread errors. What poll-based costs
|
||||
is location, not coverage: an error cannot be placed within a step the way the
|
||||
Chrome suite's `pageerror` events place it.
|
||||
- **Almost nothing is stubbed, which inverts the coverage of network-dependent
|
||||
code.** The container still runs with `--network none`, so the run is offline
|
||||
and no request can escape. The one thing it can reach is the loopback fixture
|
||||
in `tests/e2e/firefox/dapp.js`, which serves the dApp page and a JSON-RPC node
|
||||
and which the extension's `rpcUrl` is pointed at for the dApp steps; a
|
||||
JSON-RPC method that fixture does not model fails the run rather than
|
||||
answering `null`. Everything else — Blockscout, the price feed, the phishing
|
||||
blocklist — has no fixture and simply fails, and the extension swallows its
|
||||
own fetch failures, so only the _failure_ branches of that code are ever
|
||||
executed. A `ReferenceError` in the success path of `renderTransactions`, or
|
||||
of price rendering, passes this suite green. The offline run is also weaker
|
||||
than the Chrome suite's interception for those calls: it proves nothing got
|
||||
out, but it cannot report which requests were attempted.
|
||||
|
||||
Neither `make test-e2e` nor `make test-e2e-firefox` is part of `make check` or
|
||||
`make test`. `REPO_POLICIES.md` caps `make test` at 20 seconds and a browser
|
||||
suite does not fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot
|
||||
pick it up either. Run them locally before changing anything under
|
||||
`make test-e2e` is deliberately **not** part of `make check` or `make test`.
|
||||
`REPO_POLICIES.md` caps `make test` at 20 seconds and a browser suite does not
|
||||
fit; nothing in `tests/e2e/` is named `*.test.js`, so jest cannot pick it up
|
||||
either. It is also not wired into the Gitea workflow yet — docker-in-docker in
|
||||
CI is a separate question. Run it locally before changing anything under
|
||||
`src/popup/views/`.
|
||||
|
||||
### In CI
|
||||
|
||||
`.gitea/workflows/e2e.yml` runs both suites on every push, as two jobs —
|
||||
`e2e-chrome` and `e2e-firefox` — separate from the `check` workflow, so the
|
||||
20-second `make test` cap and the local fast path are untouched. Each job is a
|
||||
checkout and the matching `script/` entrypoint, nothing else.
|
||||
|
||||
Docker is the only thing either job needs from the runner, and that is not an
|
||||
accident. The runner executes a job inside a container against the **host's**
|
||||
docker daemon, so a `docker run -v "$PWD:/work"` source path is resolved by the
|
||||
host and mounts an empty directory, and the runner image's node is too old to
|
||||
install this repo's dependencies. Both suites therefore ship the repo to the
|
||||
daemon as a build context and build the extension inside the image, which works
|
||||
identically on a laptop.
|
||||
|
||||
The jobs **report, they do not gate.** A failure is a red mark against the
|
||||
commit that a reviewer has to account for, not a hard block: whether a check
|
||||
blocks a merge is Gitea branch protection, which this repo does not configure.
|
||||
|
||||
That is not only a statement about configuration. The Chrome suite is
|
||||
**measurably flaky under load** — two of six runs of unmutated code on a busy
|
||||
machine lost the approval popup out from under the dApp signing wait, always in
|
||||
the `#183` section, tracked as
|
||||
[#287](https://git.eeqj.de/sneak/AutistMask/issues/287). So a red `e2e-chrome`
|
||||
has to be read before it is believed, and that flake is the blocker to ever
|
||||
making this a required check. Do not answer it with a retry wrapper: a suite
|
||||
that reruns until it is green stops being evidence.
|
||||
|
||||
Nothing in either job can pass vacuously. There is no `continue-on-error` and no
|
||||
`|| true`; both scripts exit non-zero when docker is missing, when the image
|
||||
build fails, and when the browser fails to start; the Chrome harness aborts the
|
||||
suite outright if its network interception is not in effect.
|
||||
|
||||
Measured on this repo's runner: `e2e-chrome` about 1m55s cold, almost all of it
|
||||
the one-time pull of the pinned ~800MB Playwright layer, and well under a minute
|
||||
once that layer is cached. `e2e-firefox` about 1m05s cold, and it caches its
|
||||
Firefox and geckodriver downloads the same way.
|
||||
|
||||
### Element id guard (part of `make check`)
|
||||
|
||||
`tests/popupElementIds.test.js` asserts statically that every element id the
|
||||
popup looks up — `$("...")`, `document.getElementById("...")`,
|
||||
`showError()`/`hideError()`, and the `view-<name>` a literal `showView("...")`
|
||||
resolves to — exists in `src/popup/index.html`, and that `index.html` defines no
|
||||
id twice. A wrong id is valid JavaScript naming a defined function, so neither
|
||||
jest (node environment, no DOM) nor a linter objects to it; at runtime `$()`
|
||||
returns `null` and the next property access throws, which inside a view's
|
||||
`init()` aborts the rest of `src/popup/index.js` `init()` and leaves the popup
|
||||
blank.
|
||||
|
||||
It runs with no browser, so unlike the e2e suites it fits inside `make check`,
|
||||
and it covers every view rather than the ones some test happens to open. It only
|
||||
sees literal arguments: a call like `$(containerId)` is invisible to it, and a
|
||||
lookup naming the wrong existing element is valid by construction. Both of those
|
||||
are the browser suites' job.
|
||||
|
||||
## Rationale
|
||||
|
||||
Common popular EVM wallets have become bloated with swap UIs, portfolio
|
||||
@@ -511,46 +251,60 @@ on the next event. Two consequences shape every recurring job in the background:
|
||||
|
||||
- `setInterval` and `setTimeout` are useless. They are destroyed with the
|
||||
worker, so a job scheduled that way runs until the first idle period and never
|
||||
again. The one recurring job — the 60-second balance refresh — is scheduled
|
||||
through the extension alarms API (`src/shared/alarms.js`) instead. The browser
|
||||
holds the schedule and wakes the worker to deliver it. Alarm periods are
|
||||
clamped to a one-minute minimum, so the balance refresh is expressed as
|
||||
exactly one minute and nothing is silently slowed down.
|
||||
again. Both recurring jobs — the 60-second balance refresh and the 24-hour
|
||||
phishing blocklist refresh — are scheduled through the extension alarms API
|
||||
(`src/shared/alarms.js`) instead. The browser holds the schedule and wakes the
|
||||
worker to deliver it. Alarm periods are clamped to a one-minute minimum, so
|
||||
the balance refresh is expressed as exactly one minute and nothing is silently
|
||||
slowed down.
|
||||
- Module-level variables do not survive either. Anything that must be remembered
|
||||
across a restart goes in extension storage. `localStorage` does not exist in a
|
||||
service worker at all — the one remaining user of it, `src/shared/ens.js`,
|
||||
runs only in the popup and is marked as such.
|
||||
across a restart goes in extension storage, including the timestamp of the
|
||||
last phishing list fetch: without it a revived worker would either re-fetch on
|
||||
every wake or, with a naive in-memory guard, never notice that an update is
|
||||
due. `localStorage` does not exist in a service worker at all — the one
|
||||
remaining user of it, `src/shared/ens.js`, runs only in the popup and is
|
||||
marked as such.
|
||||
|
||||
The job also carries a freshness guard, and a guard must never be timed to the
|
||||
alarm period it gates. The guard is measured from the moment the last run
|
||||
Both jobs also carry a freshness guard, and a guard must never be timed to the
|
||||
alarm period it gates. Each guard is measured from the moment the last run
|
||||
finished, which is one run-duration after the alarm that started it, so a guard
|
||||
of exactly one period vetoes the very next tick and the real cadence becomes two
|
||||
periods. The balance refresh guard exists to skip work an open popup has already
|
||||
done — the popup refreshes every 10 seconds and stamps the same field — and that
|
||||
has to keep applying on the scheduled tick, so the guard is shortened to half
|
||||
the alarm period rather than bypassed: comfortably above the popup's 10 seconds,
|
||||
so an open popup still suppresses the background job, and comfortably below the
|
||||
60-second period, so the schedule always wins.
|
||||
periods. The two jobs solve this differently, because their guards exist for
|
||||
different reasons:
|
||||
|
||||
Retiring a job means clearing its alarm, not just deleting its handler. The
|
||||
browser keeps an alarm until something removes it, so an install that once ran
|
||||
the version which created it goes on being woken on that schedule forever. Names
|
||||
that are no longer handled are listed in `OBSOLETE_ALARMS` and cleared on every
|
||||
start; the 24-hour phishing blocklist refresh is there, retired when the runtime
|
||||
fetch was removed.
|
||||
- The phishing refresh has a 24-hour cache TTL whose job is to keep the worker
|
||||
off the network on the wakes between scheduled refreshes — Chrome revives the
|
||||
worker every ~30 seconds while the browser is busy, and every revival runs the
|
||||
startup path. The scheduled alarm tick is not one of those wakes, so it
|
||||
bypasses the TTL and fetches unconditionally. Shortening the TTL instead would
|
||||
not work: the startup path re-checks it on every wake, so a shorter TTL simply
|
||||
becomes the real refresh rate.
|
||||
- The balance refresh guard exists to skip work an open popup has already done —
|
||||
the popup refreshes every 10 seconds and stamps the same field. That has to
|
||||
keep applying on the scheduled tick, so the guard is shortened to half the
|
||||
alarm period instead of bypassed: comfortably above the popup's 10 seconds, so
|
||||
an open popup still suppresses the background job, and comfortably below the
|
||||
60-second period, so the schedule always wins.
|
||||
|
||||
The startup path (`ensureRecurringAlarms()`) runs on `onInstalled`, on
|
||||
`onStartup`, and at the top level of the worker, so every way the background
|
||||
context can start re-establishes the schedule. On a fresh install more than one
|
||||
of those fires, so they share a single in-flight run rather than racing. It is
|
||||
idempotent: an alarm that already exists with the period the code asks for is
|
||||
left alone, because re-creating one restarts its schedule and a busy extension
|
||||
would push the next fire out indefinitely. An alarm carrying a different period
|
||||
— one created by an earlier version — is re-created once, or a period changed in
|
||||
a new release would never reach an existing install.
|
||||
Two timestamps are persisted for the phishing list, not one. `lastFetchTime`
|
||||
records a fetch that produced a usable delta and drives the TTL.
|
||||
`lastAttemptTime` records that the network was contacted at all, and is written
|
||||
even when the result is unusable — a failed request, or a delta over the 256 KiB
|
||||
cap. Without it those cases leave no freshness mark and the worker re-downloads
|
||||
the full blocklist on every wake, indefinitely; with it, unscheduled retries are
|
||||
floored at one hour. Both are discarded on load if they are in the future, since
|
||||
a stamp from a skewed clock or a restored backup would otherwise suppress
|
||||
updates until that time arrives, permanently and with no way out.
|
||||
|
||||
Nothing is fetched when the worker starts. A wake costs no network traffic at
|
||||
all, which is what the phishing blocklist being vendored at build time bought.
|
||||
The startup path (`ensureRecurringAlarms()` plus the phishing list init) runs on
|
||||
`onInstalled`, on `onStartup`, and at the top level of the worker, so every way
|
||||
the background context can start re-establishes the schedule. On a fresh install
|
||||
more than one of those fires, so they share a single in-flight run rather than
|
||||
racing. It is idempotent: an alarm that already exists with the period the code
|
||||
asks for is left alone, because re-creating one restarts its schedule and a busy
|
||||
extension would push the next fire out indefinitely. An alarm carrying a
|
||||
different period — one created by an earlier version — is re-created once, or a
|
||||
period changed in a new release would never reach an existing install.
|
||||
|
||||
Firefox uses Manifest V2 with a persistent background page, where timers would
|
||||
survive. Both browsers are built from one bundle and both take the alarm path,
|
||||
@@ -653,27 +407,6 @@ Both are click-copyable. Truncating to 4 decimals in summary views is acceptable
|
||||
for scannability, but the detail view must never discard precision — it is the
|
||||
one place the user can always use to verify exact details.
|
||||
|
||||
#### Partial USD totals
|
||||
|
||||
Prices are fetched for the top 25 tokens only, so an address can hold assets the
|
||||
extension has no price for. Worth zero and worth an unknown amount are different
|
||||
facts and are never collapsed into one number. `getAddressValue()` in
|
||||
`src/shared/prices.js` returns `{ usd, partial }` — the value of the priced
|
||||
holdings, and whether an unpriced holding was left out of it — and every screen
|
||||
renders it through `formatAddressTotal()`, so the wording cannot drift:
|
||||
|
||||
- Nothing knowable (testnet, or before the first price fetch): no total line.
|
||||
- Everything priced: `Total: $5,500.00`.
|
||||
- Part priced: `Total: $3,000.00 plus unpriced tokens` — the figure is real as
|
||||
far as it goes and is kept, named as a floor rather than the total.
|
||||
- Nothing priced but something held: `Total: unpriced tokens only`. No figure,
|
||||
because the only figure available would be the `$0.00` sum of an empty set,
|
||||
and on the address-removal confirmation that sits directly under "This address
|
||||
holds a balance."
|
||||
|
||||
The per-token balance lines are unaffected: each shows its quantity, and a USD
|
||||
column that is blank for a token with no price.
|
||||
|
||||
#### Language & Labeling
|
||||
|
||||
All user-facing text avoids unnecessary jargon wherever possible:
|
||||
@@ -771,21 +504,6 @@ ExportPrivKey and ShowRecoveryPhrase — are deliberately absent from that list,
|
||||
so the popup can never reopen onto one of them with no password prompt in front
|
||||
of it.
|
||||
|
||||
A reopened popup renders the wallet list and the one screen it restores onto,
|
||||
and nothing else, so every screen on the stack behind that one is still the
|
||||
blank template from `index.html`. "Back" therefore renders its target rather
|
||||
than only unhiding it, through the same dispatch and data guards as the restore
|
||||
(`src/popup/viewRouter.js`), and falls back to Home when the state the target
|
||||
would render is gone.
|
||||
|
||||
It renders only a screen this page load has not rendered yet. Forward navigation
|
||||
renders as it goes, and `viewRouter.js` records every screen that reaches
|
||||
`showView()`, so "Back" onto a screen already on the page unhides it and nothing
|
||||
more — rendering it a second time would re-fetch and overwrite what it holds,
|
||||
such as an edit typed into Settings and not yet saved. Home is the one screen
|
||||
"Back" always re-renders, so the wallet list reflects anything that changed
|
||||
while the user was away from it.
|
||||
|
||||
Every screen that holds secret material in the page registers a cleanup with
|
||||
`onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
|
||||
exit from that screen rather than only on its "Back" button, so nothing secret
|
||||
@@ -809,9 +527,7 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
|
||||
- **When**: At least one wallet exists. This is the root screen.
|
||||
- **Elements**:
|
||||
- Active address ETH balance (large) + USD value in parentheses
|
||||
- "Total:" USD value across ETH and every token shown for the active
|
||||
address, written by `formatAddressTotal()` — see
|
||||
[Partial USD totals](#partial-usd-totals)
|
||||
- "Total:" USD value across ETH and every token shown for the active address
|
||||
- Active address (color dot, full address, etherscan link, tap to copy)
|
||||
- Send / Receive quick-action buttons, both acting on the active address
|
||||
- ETH/USD price display
|
||||
@@ -873,7 +589,7 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
|
||||
- Title: "Wallet Name — Address N"
|
||||
- ENS name (if resolved, bold above the address)
|
||||
- Full address (color dot, etherscan link, tap to copy)
|
||||
- USD total for address (see [Partial USD totals](#partial-usd-totals))
|
||||
- USD total for address
|
||||
- Balance list: ETH + the ERC-20 tokens shown for this address (4 decimal
|
||||
places, USD inline). Each balance row is clickable → **AddressToken**
|
||||
- Send / Receive / + Token buttons and a "···" menu button
|
||||
@@ -992,13 +708,6 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
|
||||
- **Transitions**:
|
||||
- "Sign & Send" (correct password) → broadcast tx → **WaitTx**
|
||||
- "Sign & Send" (correct password) → broadcast fails → **ErrorTx**
|
||||
- "Sign & Send" on an ERC-20 whose contract answers `decimals()` with a
|
||||
different number than the amount above was displayed with → nothing is
|
||||
signed → **ErrorTx** naming both numbers. The transfer is encoded from the
|
||||
decimals the screen rendered, carried forward on the pending transaction;
|
||||
the contract's own answer is read at signing time only to be compared with
|
||||
it, and a disagreement is a refusal rather than a preference for either
|
||||
value (`src/shared/transferAmount.js`)
|
||||
- "Sign & Send" (wrong password) → "Wrong password." on the password error
|
||||
line, no screen change
|
||||
- "Back" → **Send**
|
||||
@@ -1148,12 +857,7 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
|
||||
- "Hide fake tokens impersonating a known symbol" checkbox
|
||||
- "Hide tokens with fewer than 1,000 holders" checkbox
|
||||
- "Hide transactions from detected fraud contracts" checkbox
|
||||
- "Hide dust transactions below N gwei" checkbox + threshold input. The
|
||||
threshold is plain decimal digits, a whole number of gwei, zero or
|
||||
greater (zero hides nothing). Anything else — a fraction, a negative,
|
||||
a value carrying its unit, hex (`0x10`) or exponent (`1e3`) notation —
|
||||
is refused with a flash message and the field snaps back to the stored
|
||||
threshold, so a number the user did not type is never stored.
|
||||
- "Hide dust transactions below N gwei" checkbox + threshold input
|
||||
- Allowed Sites: list with remove buttons
|
||||
- Denied Sites: list with remove buttons
|
||||
- About: project link, license, author, version, release date, and the
|
||||
@@ -1246,13 +950,11 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
|
||||
xprv wallet has no recovery phrase to re-import.
|
||||
- A warning when the address holds anything, ETH or any tracked ERC-20,
|
||||
followed by the holdings themselves via `balanceLinesForAddress()` and the
|
||||
USD total via `formatAddressTotal()` (see
|
||||
[Partial USD totals](#partial-usd-totals)). The sentence names no figure
|
||||
of its own: the lines round to four decimals, so a sentence built from a
|
||||
rounded number would report `0.0000 ETH` for an address holding real
|
||||
money. The predicate is `addressHoldsFunds()` in
|
||||
`src/popup/views/helpers.js`, unrounded and token-aware. A balance is a
|
||||
warning, never a refusal.
|
||||
USD total via `getAddressValueUsd()`. The sentence names no figure of its
|
||||
own: the lines round to four decimals, so a sentence built from a rounded
|
||||
number would report `0.0000 ETH` for an address holding real money. The
|
||||
predicate is `addressHoldsFunds()` in `src/popup/views/helpers.js`,
|
||||
unrounded and token-aware. A balance is a warning, never a refusal.
|
||||
- The rule that a wallet always keeps at least one address, and that
|
||||
removing the last one means deleting the wallet from Settings
|
||||
- Error line
|
||||
@@ -1317,16 +1019,7 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
|
||||
- **When**: A connected website requests a transaction via
|
||||
`eth_sendTransaction`. Always opened in a separate popup window by the
|
||||
background script (`windows.create()`), because the request is triggered
|
||||
programmatically rather than by a user gesture. The background populates the
|
||||
transaction (nonce, gas limit, fees, chain id) against the RPC node _before_
|
||||
opening the window, so the screen shows a complete transaction and the signed
|
||||
artifact can be compared with it field for field. A request that cannot be
|
||||
populated — unreachable node, reverting gas estimate — opens no window and is
|
||||
failed back to the site. Only one transaction approval exists at a time:
|
||||
populating fixes the nonce, so a second `eth_sendTransaction` arriving while
|
||||
one is unanswered is refused with EIP-1193 code `-32002` rather than being
|
||||
populated at the same nonce. It opens no window and takes no nonce, and the
|
||||
site can send it again once the pending one is answered.
|
||||
programmatically rather than by a user gesture.
|
||||
- **Elements**:
|
||||
- "Transaction Request" heading
|
||||
- Phishing warning banner (shown when the hostname is on the phishing
|
||||
@@ -1338,16 +1031,13 @@ on ConfirmTx, DeleteWallet, ApproveTx and ApproveSign.
|
||||
- Contract: color dot + full address + etherscan link (or "contract
|
||||
creation"), token symbol label if known
|
||||
- Value: amount in ETH (4 decimal places, USD in parentheses)
|
||||
- Network fee (max): gas limit × fee per gas in ETH (4 decimal places, USD
|
||||
in parentheses), with the gas limit and the fee per gas in gwei below it
|
||||
- Network and nonce
|
||||
- Raw data: full calldata displayed inline (shown if present)
|
||||
- Password input and an error line
|
||||
- "Confirm" / "Reject" buttons
|
||||
- **Transitions**:
|
||||
- "Confirm" (correct password) → decrypts and signs the transaction it was
|
||||
shown, exactly as shown, hands the signed transaction to the background to
|
||||
broadcast, then → **WaitTx** in the same popup window
|
||||
- "Confirm" (correct password) → decrypts and signs in the popup, hands the
|
||||
signed transaction to the background to broadcast, then → **WaitTx** in
|
||||
the same popup window
|
||||
- "Confirm" (wrong password) → error line, no screen change
|
||||
- "Reject" → closes popup (returns rejection to background)
|
||||
- Popup window closed without answering → the request is rejected with
|
||||
@@ -1420,6 +1110,17 @@ What the extension does NOT do:
|
||||
In addition to the three user-configurable services above (RPC endpoint,
|
||||
CoinDesk price API, and Blockscout API), AutistMask also contacts:
|
||||
|
||||
- **Phishing domain blocklist**: A community-maintained phishing domain
|
||||
blocklist is vendored into the extension at build time. At runtime, the
|
||||
extension fetches the live list once every 24 hours to detect newly added
|
||||
domains, plus once on a start where the list is more than 24 hours old. Only
|
||||
the delta (domains not already in the vendored list) is kept in memory,
|
||||
keeping runtime memory usage small. The delta and the timestamp of the fetch
|
||||
that produced it are persisted to extension storage if the record is under 256
|
||||
KiB; an oversized delta is dropped along with its timestamp, so a later start
|
||||
fetches again rather than claiming freshness for data it no longer holds. A
|
||||
fetch that fails, or one whose delta was too large to store, is not retried
|
||||
more than once an hour outside the 24-hour schedule.
|
||||
- **Etherscan address labels**: When confirming a transaction, the extension
|
||||
performs a best-effort lookup of the recipient address on Etherscan to check
|
||||
for phishing/scam labels. This is a direct page fetch with no API key; the
|
||||
@@ -1690,25 +1391,17 @@ indexes it as a real token transfer.
|
||||
|
||||
AutistMask protects users from known phishing sites when they connect their
|
||||
wallet or approve transactions/signatures. A community-maintained domain
|
||||
blocklist is vendored into the extension at build time and checked entirely
|
||||
locally: no network request is made for it, ever, so nobody learns which sites
|
||||
the user connects to and no third party decides what this wallet warns about.
|
||||
blocklist is vendored into the extension at build time, providing immediate
|
||||
protection without any network requests. At runtime, the extension fetches the
|
||||
live list once every 24 hours and keeps only the delta (newly added domains not
|
||||
in the vendored list) in memory. This architecture keeps runtime memory usage
|
||||
small while ensuring fresh coverage of new phishing domains.
|
||||
|
||||
The trade is freshness. The shipped list is exactly as current as the last
|
||||
vendoring run that was released, so a domain added upstream reaches users in the
|
||||
next release rather than within a day. Refreshing it is `make vendor-blocklist`,
|
||||
which fetches a hash-pinned upstream commit, verifies the sha256 of the bytes it
|
||||
was served, and rewrites `src/shared/phishingBlocklist.json`; the diff is
|
||||
committed and ships with the next version.
|
||||
|
||||
The artifact holds digests, not domain names: sha256 truncated to 64 bits, one
|
||||
entry per 16 hex characters, concatenated in sorted order into a single string
|
||||
(`src/shared/domainHash.js`). A lookup hashes the hostname and its parent
|
||||
domains and binary-searches that string, so nothing is built at module load —
|
||||
which matters on MV3, where the worker re-evaluates the module on every wake —
|
||||
and the file is 1.7 MB rather than 8.7 MB. Storing digests is also what makes a
|
||||
list assembled elsewhere shippable here at all: the extension carries no
|
||||
plaintext list of anyone's domain names.
|
||||
The 24-hour cadence is an alarm, not a timer; the alarm tick fetches
|
||||
unconditionally rather than re-checking the 24-hour cache TTL that gates the
|
||||
startup path; and the fetch timestamps live in extension storage rather than in
|
||||
module variables — see [Background scheduling](#background-scheduling) for why
|
||||
all three are required.
|
||||
|
||||
When a dApp on a blocklisted domain requests a wallet connection, transaction
|
||||
approval, or signature, the approval popup displays a prominent red warning
|
||||
@@ -1804,24 +1497,18 @@ This repository includes data files from third-party projects that are not
|
||||
covered by the GPL-3.0 license above. These files, their copyright holders, and
|
||||
their licenses are:
|
||||
|
||||
| File | Source | Copyright | License |
|
||||
| ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
|
||||
| `src/shared/phishingBlocklist.json` | `eth-phishing-detect` community-maintained phishing domain blocklist, derived from its `src/config.json` | Copyright (c) 2018 kumavis | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
|
||||
| `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json` | Copyright (c) 2020 MyEtherWallet | MIT |
|
||||
| `src/shared/scamlist.js` (address data from EtherScamDB) | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml` | Copyright (c) 2018 Luit Hollander | MIT |
|
||||
| File | Source | Copyright | License |
|
||||
| ---------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- |
|
||||
| `src/shared/phishingBlocklist.json` | `eth-phishing-detect` community-maintained phishing domain blocklist, vendored from its `src/config.json` | Copyright (c) 2018 kumavis | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) |
|
||||
| `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json` | Copyright (c) 2020 MyEtherWallet | MIT |
|
||||
| `src/shared/scamlist.js` (address data from EtherScamDB) | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml` | Copyright (c) 2018 Luit Hollander | MIT |
|
||||
|
||||
The full license texts for these third-party files are included in the
|
||||
[LICENSE](LICENSE) file. The `eth-phishing-detect` row carries no repository
|
||||
link because the upstream is hosted under a competitor's organization name,
|
||||
which project policy keeps out of code and documentation.
|
||||
`script/vendor-blocklist` is the single definition and the only file that spells
|
||||
the name in prose: it is build-time tooling, never shipped, and it records the
|
||||
exact URL, the commit it is pinned to and the sha256 of the bytes that commit
|
||||
serves, because a source reference nobody can verify is not a source reference.
|
||||
`script/check-censored` reads the name back out of that one file and fails the
|
||||
build wherever else it appears, save for three shipped-code literals it cannot
|
||||
avoid — each permitted only at the one path that carries it, and listed in that
|
||||
script's header.
|
||||
which project policy keeps out of code and documentation; the vendored copy and
|
||||
the runtime refresh both come from that upstream, whose URL is the
|
||||
`BLOCKLIST_URL` constant in `src/shared/phishingDomains.js`.
|
||||
|
||||
## Author
|
||||
|
||||
|
||||
419
TODO.md
419
TODO.md
@@ -30,416 +30,20 @@ compiled off.
|
||||
|
||||
The backlog lives on the
|
||||
[Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
|
||||
authoritative; this file does not duplicate it. Full policy file set present.
|
||||
Real-browser end-to-end suites (`make test-e2e` for Chrome,
|
||||
`make test-e2e-firefox` for Firefox) sit alongside `make check`, which now does
|
||||
static analysis as well as formatting, and `.gitea/workflows/e2e.yml` runs both
|
||||
of them on every push.
|
||||
authoritative; this file does not duplicate it. Full policy file set present. A
|
||||
real-browser end-to-end suite (`make test-e2e`) now sits alongside `make check`,
|
||||
which cannot see a runtime `ReferenceError` in a popup view.
|
||||
|
||||
# Next Step
|
||||
|
||||
Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
|
||||
input validation) before any 1.0rc tag. Individual filed issues are parts of it,
|
||||
but the review is broader than any of them.
|
||||
Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
|
||||
`script/lint`. `make check` is `prettier --check` only today and cannot catch
|
||||
undefined identifiers, which is how
|
||||
[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
|
||||
[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-08-20: A web page can no longer switch the wallet's chain, and switching
|
||||
no longer destroys the user's endpoints
|
||||
([#308](https://git.eeqj.de/sneak/AutistMask/issues/308)).
|
||||
`wallet_switchEthereumChain` was answered for any origin at all, with no
|
||||
connection check and no prompt: any page could clear the `[TESTNET]` banner
|
||||
under a user who believed they were on Sepolia. It now takes the same
|
||||
`allowedSites`/`connectedSites` gate the signing methods take, ahead of the
|
||||
same-chain and unsupported-chain answers, and refuses an unconnected origin
|
||||
with `4100`. The switch itself also overwrote `state.rpcUrl` and
|
||||
`state.blockscoutUrl` with the network defaults, so a user running their own
|
||||
node lost that url permanently and silently to a public endpoint that then
|
||||
sees every address they hold. Endpoints are now remembered per network in
|
||||
`state.networkEndpoints`, snapshotted from the network being left and restored
|
||||
for the network being entered; `state.rpcUrl` stays the live value for the
|
||||
active network, so no reader changed. A profile written before the map existed
|
||||
has its stored pair adopted for the network it was stored under, and loses
|
||||
nothing. The handler now loads state before it switches
|
||||
([#316](https://git.eeqj.de/sneak/AutistMask/issues/316)): the service worker
|
||||
populates nothing at module scope, so a worker revived by the page's own
|
||||
message held `DEFAULT_STATE`, and the switch persisted every field of it —
|
||||
wiping every wallet, every site approval and every tracked token from storage
|
||||
along with the endpoint.
|
||||
- 2026-08-20: The wallet's own ERC-20 send signs the amount it displayed
|
||||
([#305](https://git.eeqj.de/sneak/AutistMask/issues/305)). The confirmation
|
||||
screen renders from the block explorer's cached decimals; the transfer was
|
||||
encoded from `decimals()` read off the contract at signing time, and nothing
|
||||
compared the two, so a token whose on-chain scale disagreed — an upgradeable
|
||||
or proxy token, a stale explorer entry, a compromised Blockscout — signed an
|
||||
amount that was never on screen, off by a power of ten per decimal place of
|
||||
disagreement. The scale is now carried forward on the pending transaction from
|
||||
the same balance entry the screen's amount, balance and symbol come from, and
|
||||
the contract's answer is read at signing time only to be compared with it: a
|
||||
disagreement is a refusal naming both numbers, never a preference for either
|
||||
(`src/shared/transferAmount.js`, the `confirmTx` counterpart to
|
||||
`approvalVerify.js`). The gas estimate encodes from the same carried value and
|
||||
no longer reads `decimals()` at all. Nothing in the e2e suite had ever clicked
|
||||
`#btn-confirm-send`, which is how this shipped: the popup's own Send →
|
||||
ConfirmTx → Sign & Send → WaitTx path now runs end to end to a broadcast, with
|
||||
the `transfer()` amount decoded out of the raw signed bytes and asserted
|
||||
against what the screen displayed, and a companion case where the contract
|
||||
starts answering a different scale after the screen was built and nothing
|
||||
reaches the RPC. Reverting only the signing-side comparison turns that second
|
||||
case red and leaves the other 53 green.
|
||||
- 2026-08-17: The Settings screen is driven in a browser, and every element id
|
||||
the popup looks up is checked statically. Nothing exercised Settings in the
|
||||
e2e suite, and jest runs with no DOM, so the densest run of `$("...")` lookups
|
||||
in the codebase was unverified at runtime. Seven new cases in
|
||||
`tests/e2e/run.js` reach Settings, assert the About well and the wallet list
|
||||
were actually written, assert the four Token Spam Protection checkboxes are
|
||||
real checkboxes defaulted on, and assert the theme and network selectors offer
|
||||
the choices `src/shared/networks.js` and `index.html` define. The selectors
|
||||
are then driven to `dark` and `sepolia` — neither is the first `<option>`, so
|
||||
neither can be read back from the markup with no JavaScript involved — and
|
||||
reasserted after a popup reopen before being restored the same way, and one
|
||||
spam filter is toggled off and back on across a reopen each way. Those round
|
||||
trips run the change handler, `saveState()`, `loadState()` and the
|
||||
`init()`/`show()` assignments rather than just looking at the screen. `show()`
|
||||
no longer guards its `settings-network` lookup with `if (networkSelect)`: a
|
||||
missing element must fail loudly, which is the whole failure mode this unit
|
||||
exists to catch. Each group records a coverage key and a final case demands
|
||||
the exact set, so a shortened or skipped section reddens the run instead of
|
||||
shrinking it. `tests/popupElementIds.test.js` is the general half and runs in
|
||||
`make check` with no browser: every literal id reached through `$()`,
|
||||
`document.getElementById()`, `showError()`/`hideError()` and `showView()` must
|
||||
exist in `src/popup/index.html`, which no id in `index.html` may define twice.
|
||||
Demonstrated on four deliberate breaks — a typo'd id (both halves red), a
|
||||
handler bound to the wrong but existing element (only the functional e2e case
|
||||
red), a typo in a view no browser suite opens (only the static guard red), and
|
||||
the deletion of both persisted-value assignments in `settings.js` (only the
|
||||
selector round-trip case red)
|
||||
([#229](https://git.eeqj.de/sneak/AutistMask/issues/229)).
|
||||
- 2026-08-17: The phishing blocklist is vendored at build time and censored, and
|
||||
the runtime fetch is gone
|
||||
([#219](https://git.eeqj.de/sneak/AutistMask/issues/219)).
|
||||
`script/vendor-blocklist` fetches upstream at a pinned commit, verifies the
|
||||
sha256 of the bytes it was served, and writes
|
||||
`src/shared/phishingBlocklist.json` as truncated sha256 digests rather than
|
||||
domain names — which is what removes the competitor's name from a list that
|
||||
carried it 6,475 times, without dropping a single one of those domains.
|
||||
`script/check-censored` runs in `make check` and again against `dist/` at the
|
||||
end of every build, each permitted occurrence scoped to the one path allowed
|
||||
to carry it; the name now appears only in the vendoring script, which defines
|
||||
it once, in the provider-shim identifiers in `src/content/inpage.js`, and in
|
||||
one ERC-20's on-chain name in `src/shared/tokenList.js`. Removing the fetch
|
||||
retired the delta, the persistence and the 24-hour alarm from
|
||||
[#158](https://git.eeqj.de/sneak/AutistMask/issues/158), and retired alarms
|
||||
are now cleared rather than left running on existing installs. Two
|
||||
consequences, both deliberate: the list no longer self-updates, so it is as
|
||||
fresh as the last vendoring run that was released; and re-vendoring from
|
||||
current upstream took it from 231,357 stale entries to 105,721 current ones,
|
||||
because upstream prunes and the vendored snapshot never did. `dist/` fell from
|
||||
18.9 MB to 8.9 MB. The e2e suite now drives the warning end to end from a real
|
||||
blocklisted origin, and its service-worker interception canary has a new
|
||||
anchor, because the startup fetch it used to watch for no longer exists.
|
||||
- 2026-08-17: One wording for an empty password field on every screen that asks
|
||||
for one. The private key export screen said "Password is required." where the
|
||||
other five say "Please enter your password.", the same one-condition-two-
|
||||
wordings split that [#172](https://git.eeqj.de/sneak/AutistMask/issues/172)
|
||||
closed for a rejected password. Strings only, no behaviour change.
|
||||
`tests/passwordMessages.test.js` now pins the empty-field guard per call site
|
||||
as well as the decrypt handler, anchored on the `decryptWithPassword` sites so
|
||||
the wallet-creation screen — where an empty field means a password being
|
||||
chosen, a different condition — stays out of the set. Every error container
|
||||
measured at a 360px viewport in the pinned Playwright container: the export
|
||||
screen's container holds at 20px with the following section at the same offset
|
||||
for the old string, the new string and the empty reserved state
|
||||
([#265](https://git.eeqj.de/sneak/AutistMask/issues/265)).
|
||||
- 2026-08-17: One shared extension-API module,
|
||||
[`src/shared/browserApi.js`](src/shared/browserApi.js), is the only place in
|
||||
the tree that names `browser` or `chrome`. Every call site returns a promise;
|
||||
`runtime.lastError` is gone. The same commit gives the Firefox suite the four
|
||||
dApp round trips — `eth_requestAccounts`, `personal_sign`,
|
||||
`eth_sendTransaction` and a closed approval window rejecting with EIP-1193
|
||||
4001 — against a page and a JSON-RPC node served from loopback, which survives
|
||||
`--network none`. **The premise of
|
||||
[#153](https://git.eeqj.de/sneak/AutistMask/issues/153) does not survive that
|
||||
harness**: Firefox's `browser.*` honours a trailing Chrome-style callback and
|
||||
populates `runtime.lastError`, both measured directly on Firefox 153.0.3, and
|
||||
all four flows pass against the unconverted code. What landed is a uniformity
|
||||
and coverage change, not a repair of a broken target. `storageGet()` and
|
||||
`storageSet()` **reject** where `storage.local` is absent rather than
|
||||
resolving `{}` and a no-op write — they carry the wallet, and defaulting would
|
||||
read an existing wallet back as none. The one caller that genuinely degraded,
|
||||
[`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), took
|
||||
`storageLocal()` directly and kept its own null check; it stores nothing at
|
||||
all as of [#219](https://git.eeqj.de/sneak/AutistMask/issues/219) above.
|
||||
- 2026-08-17: An address total no longer reports `$0.00` for holdings it cannot
|
||||
price. Prices exist for the top 25 tokens only, so the priced-only sum was
|
||||
printed as the total and an address holding nothing but unpriced ERC-20s was
|
||||
shown as worth nothing — directly under "This address holds a balance." on the
|
||||
address-removal confirmation. `getAddressValue()` in `src/shared/prices.js`
|
||||
now returns `{ usd, partial }`, keeping worth-zero and worth-an-unknown-amount
|
||||
apart the way an absent `holders_count` is kept apart from a count of zero,
|
||||
and every screen renders it through the one `formatAddressTotal()`: the figure
|
||||
when it covers everything, the figure marked `plus unpriced tokens` when it
|
||||
covers part, and `Total: unpriced tokens only` when it would cover nothing.
|
||||
Home, AddressDetail and the removal confirmation all read it, and
|
||||
`getWalletValue()`/`getTotalValue()` carry `partial` up. Covered by
|
||||
`tests/addressValue.test.js` — the only-unpriced, genuinely-zero and
|
||||
fully-priced cases at the helper and at both call sites that return their
|
||||
markup — demonstrated failing first
|
||||
([#261](https://git.eeqj.de/sneak/AutistMask/issues/261)).
|
||||
- 2026-08-17: `README.md` no longer advertises a defect the wallet does not
|
||||
have. The End-to-End Tests section listed the EIP-1193 code being dropped in
|
||||
the last hop into the page as a standing limit of the dApp coverage; that
|
||||
stopped being true when
|
||||
[#274](https://git.eeqj.de/sneak/AutistMask/issues/274) landed and did not
|
||||
touch the README. The paragraph is deleted and the two remaining limits — the
|
||||
stubbed RPC and the unobservable toolbar popup — were checked against the
|
||||
current `src/content/inpage.js` and `tests/e2e/` and left as they are
|
||||
([#285](https://git.eeqj.de/sneak/AutistMask/issues/285)).
|
||||
- 2026-08-17: One transaction approval at a time. Populating in the background
|
||||
before the window opens is what makes the displayed object the verified
|
||||
object, and it also fixes the nonce: two `eth_sendTransaction` calls populated
|
||||
concurrently took the same nonce from a node that had seen neither broadcast,
|
||||
and the second could then never be sent, because the only way to give it a
|
||||
fresh nonce is to populate it again after the user has read the old one off
|
||||
the screen. A second request is now refused with EIP-1193 `-32002` while one
|
||||
is unanswered — the slot is taken immediately before population, after the
|
||||
authorization checks, so no second nonce is allocated, no second window opens,
|
||||
and a page the wallet refuses anyway cannot hold the slot against the
|
||||
connected site. The slot is freed at `settleApproval()`, the single point an
|
||||
approval is retired, so every path that ends an approval ends the hold with
|
||||
it; an approval whose window is gone and whose attempt has failed is settled
|
||||
there rather than left waiting on a window that no longer exists, and an
|
||||
approval window that could not be opened at all is answered with `-32603`
|
||||
instead of holding the page's promise open. Signature approvals are not gated,
|
||||
consuming no nonce. A collision that does happen is also reported accurately
|
||||
now: a broadcast the node refused for the nonce, and an approval carrying a
|
||||
nonce this worker has already broadcast for that address on that chain (caught
|
||||
before the node is asked at all), both say the transaction did not reach the
|
||||
network and to send it again, instead of warning that it may have sent. The
|
||||
record is keyed by chain as well as address, because nonce spaces are per
|
||||
chain and low nonces overlap across them. `already known` deliberately keeps
|
||||
the ambiguous wording, because a node that says it has the transaction has it
|
||||
([#271](https://git.eeqj.de/sneak/AutistMask/issues/271)).
|
||||
- 2026-08-14: The parts of the
|
||||
[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
|
||||
[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the
|
||||
e2e suite did not cover are asserted. It had only shown that the two screens
|
||||
open without throwing. Now: the Add Token round trip leaves the navigation
|
||||
stack exactly as it found it, read out of extension storage rather than
|
||||
inferred from which screen is up, so an orphaned entry — the second-order
|
||||
damage of #150 — is caught where it happens rather than one Back press later;
|
||||
a common-token quick-pick puts its contract address in the field; the native
|
||||
ETH detail path renders with its own type, value and raw quantity and with the
|
||||
token contract row still hidden, against a new `seedNativeTransfer` fixture,
|
||||
since the normal-transactions endpoint answered `[]` unconditionally and there
|
||||
was no non-ERC-20 row to open; and tapping the token contract address puts it
|
||||
on the real clipboard, read back after a sentinel write. Each of the four was
|
||||
demonstrated failing against a deliberately broken build
|
||||
([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
|
||||
- 2026-08-14: `make check` does static analysis. `script/lint` ran
|
||||
`prettier --check .`, byte-identical to `script/fmt-check`, so a wallet with
|
||||
two shipped used-but-not-imported crashes behind it was green. ESLint is now
|
||||
pinned in `package.json` with `@eslint/js` recommended as the base, flat
|
||||
config in `eslint.config.js`, `no-undef` and `no-unused-vars` error-level, and
|
||||
globals declared per tree — browser for the popup and content scripts, service
|
||||
worker for `src/background/` and `src/shared/`, jest for `tests/`, node for
|
||||
`build.js`. It found 41 unused bindings and 53 undefined identifiers; all are
|
||||
fixed, and dropping a call to an unimported `foo()` into any `src/` file fails
|
||||
`make lint`. Linting is also containerized now: `script/lint` builds the
|
||||
Dockerfile's new `lint` stage, so the ESLint that decides whether this repo is
|
||||
green is the pinned one and not the host's. The lint stage roughly doubles the
|
||||
image build, so `script/test`'s hard timeout is now a bound on a hung suite
|
||||
rather than a wall-clock budget: 30s on the host, where the suite runs in
|
||||
about 8s, and `AUTISTMASK_TEST_TIMEOUT` raises it inside the image, where a
|
||||
cold build pays install and contention costs the policy budget never described
|
||||
([#152](https://git.eeqj.de/sneak/AutistMask/issues/152)).
|
||||
- 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
|
||||
runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
|
||||
push, separate from `check`, so `make check` and its 20-second `make test` cap
|
||||
are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
|
||||
check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
|
||||
gate, the dApp approval round trips — was enforced only when a human
|
||||
remembered to run it by hand. The suites could not run on the runner as they
|
||||
stood: the runner executes a job in a container against the host's docker
|
||||
daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
|
||||
and the runner image's node cannot install this repo's dependencies. Both
|
||||
suites now ship the repo to the daemon as a build context and build the
|
||||
extension inside the pinned image, so docker is the only prerequisite on a
|
||||
runner or a laptop, and both run the image by ID rather than by tag so
|
||||
concurrent clones cannot swap it. The jobs report rather than gate — this repo
|
||||
configures no branch protection, and the Chrome suite is measurably flaky
|
||||
under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
|
||||
rather than papered over
|
||||
([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
|
||||
- 2026-08-14: A background message handler that throws now rejects the page
|
||||
instead of hanging it. `handleRpc(...).then(sendResponse)` had no `.catch()`,
|
||||
and `sendResponse` is the only thing that settles the dApp's
|
||||
`window.ethereum.request()` promise — so any throw inside `handleRpc` left
|
||||
that promise pending forever, with no error and no timeout, indistinguishable
|
||||
from a slow wallet. It now answers `{ code: -32603, message }` (the JSON-RPC
|
||||
internal error EIP-1474 defines and EIP-1193 defers to; no EIP-1193 4xxx code
|
||||
describes "the wallet broke" and none was invented) and logs the method and
|
||||
the throw to the background console rather than swallowing them. The two async
|
||||
IIFEs behind `AUTISTMASK_TX_RESPONSE` and `AUTISTMASK_SIGN_RESPONSE` were the
|
||||
same shape one level down — every statement inside a `try`, but a throw out of
|
||||
a `catch` block escaping unhandled — and each got a last-resort `.catch()`
|
||||
settling the approval through `settleApproval()` and answering the popup. The
|
||||
transaction one tracks which phase it escaped from and reports that, so an
|
||||
escape before `broadcastTransaction()` says the request is gone rather than
|
||||
that it may still have reached the network. Every other handler on the path is
|
||||
synchronous. All four are driven by real failures — a rejecting storage read,
|
||||
and a failure classifier that throws while classifying a genuine verification
|
||||
or broadcast failure — and were demonstrated failing first, the RPC one with
|
||||
`sendResponse` at zero calls
|
||||
([#280](https://git.eeqj.de/sneak/AutistMask/issues/280)).
|
||||
- 2026-08-14: Approving a site connection is no longer a race against the popup
|
||||
closing. The decision now rides the approval port the popup already holds,
|
||||
which is the same channel the close disconnects, so it is delivered ahead of
|
||||
that disconnect however fast the teardown is; `windows.onRemoved` no longer
|
||||
decides a site approval whose port is connected, since that event is ordered
|
||||
against nothing either. Rejecting and closing without deciding both still
|
||||
report a rejection, and the popup delays its own close by nothing. The e2e
|
||||
harness's deferred-`window.close()` accommodation is gone with it, so the two
|
||||
site-prompt tests now drive the shipped decide-then-close in a real Chromium;
|
||||
against the unfixed code the approval came back to the page as
|
||||
`{"settled":"rejected","code":4001}`
|
||||
([#275](https://git.eeqj.de/sneak/AutistMask/issues/275)).
|
||||
- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
|
||||
rebuilt every failure as `new Error(error.message)`, so the code the
|
||||
background produced and the content script relayed intact was dropped in the
|
||||
last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
|
||||
the user deliberately declined was indistinguishable from one that broke. The
|
||||
provider now rejects with a `ProviderRpcError` carrying `code` and, where the
|
||||
boundary sent one, `data`, passed through verbatim rather than matched against
|
||||
a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
|
||||
here. An error the background sent with no code stays a plain `Error` with no
|
||||
`code` property, and `message` is unchanged in every case. All four request
|
||||
entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
|
||||
`tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
|
||||
now requires it on the page's Error as well as on the wire, for all four
|
||||
rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
|
||||
- 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
|
||||
it. A reopened popup renders the wallet list and the one screen it restores
|
||||
onto, so every screen further down the stack was still the blank template from
|
||||
`index.html`, and Back walked straight onto it — an empty address, no
|
||||
balances, no QR code. The Back path now goes through the same per-view
|
||||
dispatch and data guards as the restore (`src/popup/viewRouter.js`, shared
|
||||
with `restoreView()`), falling back to Home when the state the target would
|
||||
render is gone. It renders only a view this page load has not rendered yet:
|
||||
`viewRouter.js` records every view that reaches `showView()`, which is where
|
||||
forward navigation and the restore both end, so Back onto a view already on
|
||||
the page unhides it and nothing more. That is what keeps a second render from
|
||||
re-fetching and overwriting what the view holds — an unsaved edit in Settings,
|
||||
a transaction list already loaded. Home is the exception and is always
|
||||
re-rendered, as it was before. Covered by unit tests on the real `goBack()`
|
||||
and by three end-to-end cases against the real popup, each demonstrated
|
||||
failing on the unfixed build
|
||||
([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
|
||||
- 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
|
||||
that bear it, not to one of them. A ticker is not unique: seven of the 512
|
||||
bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
|
||||
share a symbol with another bundled entry at a different real contract, and
|
||||
the table, built from the list first-wins, kept only the earlier one. The
|
||||
other seven were judged spoofs of their own symbol at their own address and
|
||||
hidden from the balance list, the history and the send selector, so a holder
|
||||
could not spend them. Both contracts of each pair come from the same CoinGecko
|
||||
fetch of 2026-02-27, so neither was stale and neither was dropped.
|
||||
`isSpoofedSymbol()` asks set membership instead of equality, which does not
|
||||
loosen the rule — a contract outside the set is still a spoof — and a test now
|
||||
walks `TOKENS` asserting no bundled token is filtered at its own address,
|
||||
which is the walk the suite lacked
|
||||
([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
|
||||
- 2026-08-12: The dApp approval round trips are driven end to end in the
|
||||
browser. A test page served by the harness speaks EIP-1193 to the real inpage
|
||||
provider through the real content script, background worker and approval popup
|
||||
for `eth_requestAccounts`, `personal_sign`, `eth_signTypedData_v4` and
|
||||
`eth_sendTransaction`. Every signature is recovered and compared against the
|
||||
active address, the transaction is checked against the bytes handed to the
|
||||
stubbed RPC, each rejection must reach the page as a rejection, and the
|
||||
password must appear in no message the approval window sends — the assertion
|
||||
that gives [#157](https://git.eeqj.de/sneak/AutistMask/issues/157) a permanent
|
||||
floor. This does not discharge a real dApp with real funds against mainnet
|
||||
([#183](https://git.eeqj.de/sneak/AutistMask/issues/183)).
|
||||
- 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
|
||||
sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
|
||||
character that paints nothing removed (the format and default-ignorable
|
||||
characters, plus U+007F), then trimmed — so `" ETH "`, a no-break space, a
|
||||
zero-width space, a Hangul filler, a variation selector, a DELETE and a
|
||||
fullwidth `ＥＴＨ` are all caught on the balance list, the history and the
|
||||
send selector at once. Confusables that are distinct letters (Cyrillic `Е`),
|
||||
bidi reordering and the visible C0/C1 controls — which measure 48.00px, a box,
|
||||
in the pinned e2e Chromium where an invisible prefix measures 32.00px — stay
|
||||
knowingly open and are asserted as open in the suite. No bundled symbol
|
||||
contains whitespace or a non-ASCII character, so nothing legitimate is newly
|
||||
filtered; the balance list's token-type gate also became case-insensitive,
|
||||
which no longer drops a real holding if an explorer writes `erc-20`
|
||||
([#260](https://git.eeqj.de/sneak/AutistMask/issues/260)).
|
||||
- 2026-08-12: A containerized Firefox end-to-end harness
|
||||
(`make test-e2e-firefox`) drives the real popup in a real Firefox with the MV2
|
||||
build installed as a temporary add-on. Zero npm dependencies — a WebDriver
|
||||
client over `fetch` against geckodriver — with `node`, Firefox 153.0.3 and
|
||||
geckodriver 0.36.0 all pinned by digest. Uncaught errors are read from the
|
||||
privileged console service in Marionette's chrome context, because BiDi
|
||||
`log.entryAdded` reports nothing at all for extension pages; each drain reads
|
||||
and clears the console in one chrome round trip, so no error is destroyed
|
||||
unread by the drain itself, and errors logged during add-on install and
|
||||
background startup are folded into step 1 instead of being cleared. The two
|
||||
measured limits are documented rather than claimed away: the console ring
|
||||
buffer holds 250 messages (a clean run peaks at 4), and the drained window
|
||||
ends ≈1.5s after the last step returns. Demonstrated discriminating by exiting
|
||||
1 on a `throw` at the top of `src/background/index.js`, on a build with one
|
||||
import removed, on a `setTimeout` throw whose UI assertions all pass, on an
|
||||
unhandled `Promise.reject` and on an undefined identifier in `home.js`, and 0
|
||||
on the branch as it stands
|
||||
([#184](https://git.eeqj.de/sneak/AutistMask/issues/184)).
|
||||
- 2026-08-12: The transaction a dApp asks for is now populated in the background
|
||||
before the approval window opens, so the object the user is shown is the
|
||||
object the signed artifact is verified against — nonce, gas limit and every
|
||||
fee field are compared exactly instead of being left to the ceilings, which
|
||||
stay as a backstop against what a lying RPC node can talk the wallet into
|
||||
displaying. The approval also pins the address it was raised for, so an
|
||||
address switch between approval and signing refuses rather than signing from
|
||||
an account the screen never named, and a request naming an address that is not
|
||||
the active one is refused outright. The approval screen now shows the fee, gas
|
||||
limit, network and nonce it vouches for
|
||||
([#216](https://git.eeqj.de/sneak/AutistMask/issues/216)).
|
||||
- 2026-08-12: The restored navigation stack is filtered against
|
||||
`RESTORABLE_VIEWS` on load, truncated at the first entry the popup would not
|
||||
render so that every surviving entry keeps the Back target it had. Back after
|
||||
reopening can no longer land on a view the popup declined to restore, such as
|
||||
`export-privkey` or `show-phrase`
|
||||
([#224](https://git.eeqj.de/sneak/AutistMask/issues/224)). Restorable views in
|
||||
the stack are still unhidden without being re-rendered; that is tracked
|
||||
separately in ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
|
||||
- 2026-08-12: One wording for a rejected password on every screen that asks for
|
||||
one — the send confirmation and the delete-wallet confirmation no longer say
|
||||
"Wrong password." (a fragment, which `RULES.md` Language & Labeling forbids)
|
||||
and the two reveal screens no longer say "not correct", so all five
|
||||
`decryptWithPassword` call sites now show the sentence the dApp approval paths
|
||||
introduced. Strings only, no behaviour change, and each error container
|
||||
measured at a 360px viewport in the pinned Playwright container
|
||||
([#172](https://git.eeqj.de/sneak/AutistMask/issues/172)).
|
||||
- 2026-08-12: Closed the empty-array hole in the end-to-end unstubbed-request
|
||||
guard. `batch.every()` is vacuously true on `[]`, so a POST with body `[]` was
|
||||
answered `200 []` instead of failing the suite; the guard now rejects an empty
|
||||
batch, demonstrated green-before/red-after with a throwaway probe. The comment
|
||||
claiming `postData()` returns `null` for undecodable bodies was corrected to
|
||||
the two real paths — an absent or empty body decodes to `null`, a binary body
|
||||
decodes lossily into invalid JSON
|
||||
([#187](https://git.eeqj.de/sneak/AutistMask/issues/187)).
|
||||
- 2026-08-12: The transaction confirmation screen has browser coverage. The
|
||||
end-to-end suite reaches ConfirmTx for both the native ETH and the ERC-20 path
|
||||
off a funded-balance fixture, and asserts the pending, funded, over-balance
|
||||
and estimate-failed states, the fee block quoting the estimate and the reserve
|
||||
separately, and a constant view height across every one of those transitions.
|
||||
The load-bearing assertion is that the spend gate reads the reserve and not
|
||||
the displayed estimate: swapping the two fails the suite
|
||||
([#238](https://git.eeqj.de/sneak/AutistMask/issues/238)).
|
||||
- 2026-08-12: The dust threshold field now explains a rejection instead of
|
||||
snapping back in silence, with the parse in a pure, unit-tested module that
|
||||
accepts plain decimal digits only — hex and exponent notation are refused
|
||||
rather than read as 16 and 1000
|
||||
([#233](https://git.eeqj.de/sneak/AutistMask/issues/233)).
|
||||
- 2026-08-12: Approval verification became an allowlist — transaction type
|
||||
restricted to 0/1/2 so an EIP-7702 delegation can no longer ride along on an
|
||||
approved transfer, every consequential field compared, the artifact
|
||||
@@ -624,5 +228,12 @@ but the review is broader than any of them.
|
||||
Only work that has no issue of its own belongs here; everything else is on the
|
||||
tracker.
|
||||
|
||||
- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
|
||||
input validation) before any 1.0rc tag. Individual filed issues are parts of
|
||||
it, but the review is broader than any of them.
|
||||
- Decide whether docker-in-docker makes `make test-e2e` runnable in the Gitea
|
||||
workflow. Extending the suite itself is tracked as
|
||||
[#183](https://git.eeqj.de/sneak/AutistMask/issues/183) and
|
||||
[#184](https://git.eeqj.de/sneak/AutistMask/issues/184).
|
||||
- Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
|
||||
land.
|
||||
|
||||
4
build.js
4
build.js
@@ -63,7 +63,7 @@ function getBuildInfo() {
|
||||
commitHash = execSync("git rev-parse --short HEAD", {
|
||||
encoding: "utf8",
|
||||
}).trim();
|
||||
} catch {
|
||||
} catch (_) {
|
||||
// not a git repo or git not available
|
||||
}
|
||||
let commitHashFull = "unknown";
|
||||
@@ -71,7 +71,7 @@ function getBuildInfo() {
|
||||
commitHashFull = execSync("git rev-parse HEAD", {
|
||||
encoding: "utf8",
|
||||
}).trim();
|
||||
} catch {
|
||||
} catch (_) {
|
||||
// not a git repo or git not available
|
||||
}
|
||||
return {
|
||||
|
||||
@@ -120,6 +120,25 @@ What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
|
||||
balances, no identifying information. As with any request, CoinDesk sees your IP
|
||||
address.
|
||||
|
||||
**Phishing domain blocklist** (`raw.githubusercontent.com`)
|
||||
|
||||
A community-maintained list of phishing domains, used to warn you when a site
|
||||
that asks to connect, or to have a transaction or signature approved, is a known
|
||||
scam. A copy is bundled into the extension at build time, so the protection
|
||||
works before any network request happens. At runtime the extension fetches the
|
||||
live list to pick up newly added domains, keeping only the entries not already
|
||||
in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
|
||||
user-configurable.
|
||||
|
||||
When it is contacted: when the background script starts, if the last fetch was
|
||||
more than 24 hours ago, and every 24 hours after that. The time of the last
|
||||
fetch is remembered across browser and background restarts, so restarting does
|
||||
not cause a re-download. If a fetch fails, or the list is too large to keep, the
|
||||
extension waits an hour before trying again outside that 24-hour schedule rather
|
||||
than retrying on every restart. It is a plain download of a public file —
|
||||
nothing about you is sent, but the host sees your IP address. If the fetch
|
||||
fails, the bundled copy is still used.
|
||||
|
||||
**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
|
||||
|
||||
When you review a send, AutistMask fetches the recipient's public Etherscan
|
||||
@@ -292,15 +311,10 @@ pages. When a site requests access to your wallet:
|
||||
time.
|
||||
|
||||
When a connected site requests a transaction, a separate approval popup appears
|
||||
showing the transaction details (from, to, value, data, network fee, network and
|
||||
nonce). Every one of those values is checked against the transaction that is
|
||||
actually signed before anything is broadcast, so what you read on that screen is
|
||||
what goes out or nothing does. The popup appears once the wallet has worked out
|
||||
the fee and gas from the network, which takes a moment; if that fails, no popup
|
||||
appears and the site is told the transaction could not be prepared. You must
|
||||
enter your password and click "Confirm" to authorize it. Message and typed-data
|
||||
signature requests work the same way, with a "Sign" button, and also require
|
||||
your password.
|
||||
showing the transaction details (from, to, value, data). You must enter your
|
||||
password and click "Confirm" to authorize it. Message and typed-data signature
|
||||
requests work the same way, with a "Sign" button, and also require your
|
||||
password.
|
||||
|
||||
If the requesting site's domain is on the phishing blocklist, all three approval
|
||||
screens show a red phishing warning before you decide.
|
||||
@@ -348,12 +362,8 @@ confirmation screen. It contains only addresses involved in fraud -- it is not a
|
||||
sanctions list.
|
||||
|
||||
**Phishing domain warnings.** Sites asking to connect or to have something
|
||||
approved are checked against a community-maintained list of known phishing
|
||||
domains, and flagged with a red banner if they match. The list is built into the
|
||||
extension: the check is entirely local, so nobody is told which sites you visit,
|
||||
and it works offline. It is also only as current as the release you are running
|
||||
— a domain added to the list upstream reaches you in the next version of the
|
||||
extension, not the same day.
|
||||
approved are checked against the phishing domain blocklist described under
|
||||
External Services, and flagged with a red banner if they match.
|
||||
|
||||
The first four filters can be individually disabled in Settings if you prefer to
|
||||
see everything unfiltered.
|
||||
|
||||
162
eslint.config.js
162
eslint.config.js
@@ -1,162 +0,0 @@
|
||||
// ESLint flat config. Static analysis for make check; formatting stays with
|
||||
// prettier (script/fmt-check), so nothing here touches style.
|
||||
//
|
||||
// The sources are CommonJS and are bundled per entrypoint by build.js, so the
|
||||
// globals differ by tree and are declared per tree below. Getting that wrong in
|
||||
// either direction defeats the point: too few globals buries a real no-undef in
|
||||
// false positives, too many hides the next unimported identifier.
|
||||
|
||||
const js = require("@eslint/js");
|
||||
const globals = require("globals");
|
||||
|
||||
// The extension APIs. MV3 Chrome exposes `chrome`; Firefox exposes both, and
|
||||
// the code feature-detects between them.
|
||||
const extensionGlobals = {
|
||||
chrome: "readonly",
|
||||
browser: "readonly",
|
||||
};
|
||||
|
||||
const commonjs = {
|
||||
ecmaVersion: 2024,
|
||||
sourceType: "commonjs",
|
||||
};
|
||||
|
||||
module.exports = [
|
||||
{
|
||||
ignores: ["dist/", "node_modules/"],
|
||||
},
|
||||
|
||||
js.configs.recommended,
|
||||
|
||||
{
|
||||
rules: {
|
||||
// The two rules this config exists for. Both are already
|
||||
// error-level in the recommended set; restated so a future
|
||||
// recommended-set change cannot silently downgrade them.
|
||||
"no-undef": "error",
|
||||
// `_`-prefixed arguments are the deliberate "present for the
|
||||
// interface, unused here" marker: the popup views share one
|
||||
// init(ctx) signature and three of the eight do not read ctx.
|
||||
// An unused catch binding is written `catch {`, which the repo
|
||||
// already does, so caught errors stay checked.
|
||||
"no-unused-vars": ["error", { argsIgnorePattern: "^_" }],
|
||||
|
||||
// Off tree-wide: it requires every rethrow to carry `{ cause }`,
|
||||
// at 3 sites today (src/shared/balances.js 207 and 215,
|
||||
// tests/e2e/firefox/run.js 131). That is a change to what the
|
||||
// wallet's error paths actually throw, and it is a decision of its
|
||||
// own rather than a side effect of turning a linter on — so it is
|
||||
// off everywhere, including for new code, until that decision is
|
||||
// made. Unlike no-useless-assignment below, this is not an
|
||||
// accommodation of particular sites and must not be scoped to
|
||||
// them.
|
||||
"preserve-caught-error": "off",
|
||||
},
|
||||
},
|
||||
|
||||
// no-useless-assignment stays on everywhere except the two files that
|
||||
// wipe decrypted key material: the `password = null` and
|
||||
// `decryptedSecret = null` assignments after use are dead by construction
|
||||
// — that is what a best-effort wipe is — and the rule's fix is to delete
|
||||
// the wipe. 9 sites: approval.js 582, 593, 618, 648, 692, 703, 728, 764
|
||||
// and confirmTx.js 459. Everything else in the tree is still checked, so
|
||||
// an ordinary dead store elsewhere is still an error.
|
||||
{
|
||||
files: ["src/popup/views/approval.js", "src/popup/views/confirmTx.js"],
|
||||
rules: {
|
||||
"no-useless-assignment": "off",
|
||||
},
|
||||
},
|
||||
|
||||
// Popup and content scripts: page/window context.
|
||||
{
|
||||
files: ["src/popup/**/*.js", "src/content/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.browser, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// MV3 background: a service worker, with no window and no document.
|
||||
{
|
||||
files: ["src/background/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.serviceworker, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// src/shared is bundled into both, so it may only use what both provide:
|
||||
// the service worker globals are the intersection, plus the extension APIs.
|
||||
{
|
||||
files: ["src/shared/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.serviceworker, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// src/shared/ens.js is the documented exception to the line above: its own
|
||||
// header says POPUP ONLY, it caches in localStorage, and only popup views
|
||||
// require it. Linting it as a service worker would be wrong about the file.
|
||||
{
|
||||
files: ["src/shared/ens.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.browser, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// Unit tests: jest on node.
|
||||
{
|
||||
files: ["tests/**/*.test.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node, ...globals.jest },
|
||||
},
|
||||
},
|
||||
|
||||
// The build script is a plain node program.
|
||||
{
|
||||
files: ["build.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
|
||||
// The helpers the script/ entrypoints call: plain node programs too, run
|
||||
// from a shell script rather than from yarn, and never bundled.
|
||||
{
|
||||
files: ["script/lib/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
|
||||
// The e2e harnesses are node programs that also carry, inline, the
|
||||
// callbacks they ship into the browser via page.evaluate — so both
|
||||
// contexts really are present in the same file and both sets of globals
|
||||
// are in scope somewhere in it.
|
||||
{
|
||||
files: ["tests/e2e/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: {
|
||||
...globals.node,
|
||||
...globals.browser,
|
||||
...extensionGlobals,
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
// This config file itself.
|
||||
{
|
||||
files: ["eslint.config.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
];
|
||||
@@ -9,16 +9,13 @@
|
||||
"test": "jest --forceExit",
|
||||
"test:verbose": "jest --forceExit --verbose",
|
||||
"build": "node build.js",
|
||||
"lint": "eslint . && prettier --check .",
|
||||
"lint": "prettier --check .",
|
||||
"fmt": "prettier --write .",
|
||||
"fmt-check": "prettier --check ."
|
||||
},
|
||||
"devDependencies": {
|
||||
"@eslint/js": "10.0.1",
|
||||
"@tailwindcss/cli": "^4.2.1",
|
||||
"esbuild": "^0.27.3",
|
||||
"eslint": "10.8.1",
|
||||
"globals": "17.11.0",
|
||||
"jest": "^30.2.0",
|
||||
"playwright-core": "1.56.0",
|
||||
"prettier": "^3.8.1",
|
||||
|
||||
@@ -8,7 +8,6 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
main() {
|
||||
"$SCRIPT_DIR/test"
|
||||
"$SCRIPT_DIR/test-verify-build"
|
||||
"$SCRIPT_DIR/check-censored"
|
||||
"$SCRIPT_DIR/lint"
|
||||
"$SCRIPT_DIR/fmt-check"
|
||||
}
|
||||
|
||||
@@ -1,301 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/check-censored: assert that the competitor name RULES.md bars appears
|
||||
# nowhere in this repo, and nowhere in the built extension, except where it is
|
||||
# deliberate. Our own extension to scripts-to-rule-them-all, run from
|
||||
# script/check and from make build.
|
||||
#
|
||||
# Where the name is allowed, and why each one is not negotiable away:
|
||||
#
|
||||
# - script/vendor-blocklist. Build-time tooling, never shipped. A pinned
|
||||
# source reference that does not say what the source is cannot be verified
|
||||
# by anyone, so it names it. Whole-file exemption.
|
||||
# - the two provider-shim identifiers in src/content/inpage.js. Protocol
|
||||
# identifiers dApps feature-detect on; renaming them does not rename them in
|
||||
# their code, it only stops this wallet working on their sites.
|
||||
# - the on-chain name of the MUSD ERC-20 in src/shared/tokenList.js. It is not
|
||||
# what backs symbol-spoof detection — that reads symbol and address — but
|
||||
# the wallet already surfaces the on-chain name of any token the user holds
|
||||
# (src/shared/balances.js), and this contract's on-chain name is that
|
||||
# string, so censoring the repo cannot stop the wallet displaying it.
|
||||
# Dropping the entry instead would cost the user MUSD spoof detection.
|
||||
#
|
||||
# Everything else fails, in the working tree and under dist/. The last two are
|
||||
# literals rather than whole files, so they are enforced by counting, and each
|
||||
# literal is scoped to the path allowed to carry it: a file may contain the name
|
||||
# only as many times as it contains the literals permitted *there*, and zero
|
||||
# times anywhere else. The emitted bundles carry them too, so a plain "the name
|
||||
# must not appear in dist/" could never have passed.
|
||||
#
|
||||
# The name itself is not written in this file. script/vendor-blocklist is the
|
||||
# one place in this repo that defines it, and this reads it back out of there —
|
||||
# so the repo-wide grep this check exists to enforce keeps returning exactly the
|
||||
# files named above, and this file is not one of them.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Absolute path to this script, resolved before anything cd's anywhere: the
|
||||
# scan half runs in a re-invocation through xargs, so that the paths it works on
|
||||
# arrive as arguments and cannot be reshaped by field splitting on the way in.
|
||||
SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
|
||||
|
||||
# Internal re-entry flag. Not part of the command-line interface.
|
||||
SCAN_FLAG="--scan-paths"
|
||||
|
||||
VENDOR_SCRIPT="$ROOT/script/vendor-blocklist"
|
||||
|
||||
# Set by extract_name / make_literals_file.
|
||||
NAME=""
|
||||
ALLOWED_LITERALS_FILE=""
|
||||
|
||||
FAILED=0
|
||||
|
||||
cleanup() {
|
||||
[ -z "$ALLOWED_LITERALS_FILE" ] || rm -f "$ALLOWED_LITERALS_FILE"
|
||||
}
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
fail() {
|
||||
echo "check-censored: FAIL: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
# The name, taken from the single place that defines it. A check scanning for a
|
||||
# pattern it failed to read would pass against anything, so this refuses to
|
||||
# continue unless it got something that looks like the definition.
|
||||
extract_name() {
|
||||
[ -f "$VENDOR_SCRIPT" ] ||
|
||||
fail "$VENDOR_SCRIPT is missing, and it is where the name being
|
||||
checked for is defined. Nothing was scanned."
|
||||
|
||||
NAME="$(grep -m1 '^UPSTREAM_ORG=' "$VENDOR_SCRIPT" | cut -d'"' -f2)" ||
|
||||
fail "could not read UPSTREAM_ORG from $VENDOR_SCRIPT. Nothing was
|
||||
scanned."
|
||||
|
||||
case "$NAME" in
|
||||
"" | *[!A-Za-z0-9]*)
|
||||
fail "UPSTREAM_ORG in $VENDOR_SCRIPT did not yield a plain name
|
||||
(got: '$NAME'). Scanning for that would prove nothing. Nothing was
|
||||
scanned."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
make_literals_file() {
|
||||
ALLOWED_LITERALS_FILE="$(mktemp \
|
||||
"${TMPDIR:-/tmp}/autistmask-censored.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so nothing was scanned."
|
||||
}
|
||||
|
||||
# The literals $1 may carry, and nothing else may. Each contains the name
|
||||
# exactly once, which is what makes counting them sound; each is scoped to its
|
||||
# path, so a file with no business carrying the name fails even when it spells
|
||||
# it the way shipped code has to. Scoping is the point: permitting these
|
||||
# literals in any file is what once let this check pass its own prose.
|
||||
#
|
||||
# The emitted paths are listed next to the sources they come from. If the
|
||||
# bundler moves one, this goes red and the new path gets added deliberately,
|
||||
# rather than a wildcard over dist/ covering whatever lands there.
|
||||
allowed_literals_for() {
|
||||
: >"$ALLOWED_LITERALS_FILE"
|
||||
case "$1" in
|
||||
src/content/inpage.js | dist/*/src/content/inpage.js)
|
||||
printf 'is%s\n_%s\n' "$NAME" "$NAME" >"$ALLOWED_LITERALS_FILE"
|
||||
;;
|
||||
src/shared/tokenList.js | dist/*/src/background/index.js | \
|
||||
dist/*/src/popup/index.js)
|
||||
printf '%s USD\n' "$NAME" >"$ALLOWED_LITERALS_FILE"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# How many times does $1 contain the name (TOTAL), and how many of those are one
|
||||
# of the allowed literals (ALLOWED)? Same discipline the rest of this repo's
|
||||
# shell checks apply to grep: exit 0 and 1 are answers about the file, anything
|
||||
# else means the file was not searched and is not an answer at all.
|
||||
count_matches() {
|
||||
_cm_status=0
|
||||
_cm_out="$(grep -a -o -i -F -e "$NAME" -- "$1")" || _cm_status=$?
|
||||
case "$_cm_status" in
|
||||
0) TOTAL="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
|
||||
1) TOTAL=0 ;;
|
||||
*)
|
||||
fail "grep exited $_cm_status reading $1, so the file was never
|
||||
searched and nothing was established about it. That is a permissions or I/O
|
||||
fault, not a clean file. Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "$TOTAL" -eq 0 ]; then
|
||||
ALLOWED=0
|
||||
return 0
|
||||
fi
|
||||
|
||||
# No literal is permitted at this path, so every occurrence is a violation.
|
||||
# Handled here rather than by grep, which is not required to say anything
|
||||
# useful about an empty pattern file.
|
||||
if [ ! -s "$ALLOWED_LITERALS_FILE" ]; then
|
||||
ALLOWED=0
|
||||
return 0
|
||||
fi
|
||||
|
||||
_cm_status=0
|
||||
_cm_out="$(grep -a -o -i -F -f "$ALLOWED_LITERALS_FILE" -- "$1")" ||
|
||||
_cm_status=$?
|
||||
case "$_cm_status" in
|
||||
0) ALLOWED="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
|
||||
1) ALLOWED=0 ;;
|
||||
*)
|
||||
fail "grep exited $_cm_status matching the allowed literals in $1.
|
||||
Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# The per-path half, run in a re-invocation of this script so it uses the same
|
||||
# counting as everything else rather than a second copy of it.
|
||||
scan_paths() {
|
||||
for _file in "$@"; do
|
||||
# dist/ arrives absolute (find) and the worktree relative (git
|
||||
# ls-files). The allowlist is keyed on repo-relative paths, so both
|
||||
# forms are reduced to one before anything is decided about them.
|
||||
_rel="$_file"
|
||||
case "$_rel" in
|
||||
"$ROOT"/*) _rel="${_rel#"$ROOT"/}" ;;
|
||||
esac
|
||||
|
||||
case "$_rel" in
|
||||
script/vendor-blocklist) continue ;;
|
||||
esac
|
||||
[ -f "$_file" ] || continue
|
||||
|
||||
allowed_literals_for "$_rel"
|
||||
count_matches "$_file"
|
||||
[ "$TOTAL" -gt "$ALLOWED" ] || continue
|
||||
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "check-censored: $_rel: $TOTAL occurrence(s) of the name," \
|
||||
"$ALLOWED of them allowed at this path" >&2
|
||||
grep -a -n -i -F -e "$NAME" -- "$_file" | cut -c1-140 | head -5 >&2
|
||||
done
|
||||
[ "$FAILED" -eq 0 ]
|
||||
}
|
||||
|
||||
# Hand a NUL-delimited listing to the scan half. Returns non-zero if any path
|
||||
# failed, or if the scan could not be run at all.
|
||||
scan_listing() {
|
||||
xargs -0 "$SELF" "$SCAN_FLAG" <"$1"
|
||||
}
|
||||
|
||||
# Every file git tracks, plus everything untracked and not ignored: the working
|
||||
# tree as a reviewer would see it, and never node_modules or dist/ (both are
|
||||
# ignored; dist/ is walked separately below).
|
||||
check_worktree() {
|
||||
_list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-tree.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so nothing was scanned."
|
||||
_status=0
|
||||
git ls-files -z --cached --others --exclude-standard >"$_list" ||
|
||||
_status=$?
|
||||
[ "$_status" -eq 0 ] || {
|
||||
rm -f "$_list"
|
||||
fail "git ls-files exited $_status, so the working tree was never
|
||||
enumerated and nothing was established about it."
|
||||
}
|
||||
|
||||
# Repo-relative paths. The scan half cd's to the repo root before it opens
|
||||
# anything, so they reach it intact and unjoined.
|
||||
WORKTREE_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
|
||||
|
||||
_status=0
|
||||
scan_listing "$_list" || _status=$?
|
||||
rm -f "$_list"
|
||||
return "$_status"
|
||||
}
|
||||
|
||||
check_dist() {
|
||||
_list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-dist.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so dist/ was not scanned."
|
||||
_status=0
|
||||
find "$ROOT/dist" -type f -print0 >"$_list" || _status=$?
|
||||
[ "$_status" -eq 0 ] || {
|
||||
rm -f "$_list"
|
||||
fail "find exited $_status enumerating dist/, so part of the emitted
|
||||
tree was never walked and an unchecked file there went unchecked. Refusing
|
||||
to report success."
|
||||
}
|
||||
|
||||
DIST_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
|
||||
|
||||
_status=0
|
||||
scan_listing "$_list" || _status=$?
|
||||
rm -f "$_list"
|
||||
return "$_status"
|
||||
}
|
||||
|
||||
usage() {
|
||||
echo "usage: script/check-censored [--require-dist]" >&2
|
||||
exit 2
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
# Internal re-entry from scan_listing's xargs.
|
||||
if [ "${1-}" = "$SCAN_FLAG" ]; then
|
||||
shift
|
||||
extract_name
|
||||
make_literals_file
|
||||
scan_paths "$@"
|
||||
return $?
|
||||
fi
|
||||
|
||||
require_dist=no
|
||||
case "${1-}" in
|
||||
"") ;;
|
||||
--require-dist) require_dist=yes ;;
|
||||
*) usage ;;
|
||||
esac
|
||||
|
||||
extract_name
|
||||
make_literals_file
|
||||
|
||||
echo "Checking for censored names..."
|
||||
|
||||
tree_status=0
|
||||
check_worktree || tree_status=$?
|
||||
|
||||
dist_status=0
|
||||
dist_inspected=no
|
||||
DIST_COUNT=0
|
||||
if [ -d "$ROOT/dist" ]; then
|
||||
dist_inspected=yes
|
||||
check_dist || dist_status=$?
|
||||
fi
|
||||
|
||||
if [ "$tree_status" -ne 0 ] || [ "$dist_status" -ne 0 ]; then
|
||||
fail "the name appears outside the deliberate exceptions (reported
|
||||
above). See the header of script/check-censored for what is allowed and
|
||||
why."
|
||||
fi
|
||||
|
||||
if [ "$dist_inspected" = no ]; then
|
||||
if [ "$require_dist" = yes ]; then
|
||||
fail "there is no dist/ to inspect and this run was asked to
|
||||
require one. Run make build."
|
||||
fi
|
||||
cat <<EOF
|
||||
################################################################################
|
||||
## WARNING: dist/ WAS NOT INSPECTED BY THIS RUN AND IS NOT PROVEN CLEAN BY IT.
|
||||
## There is no dist/ in this tree. The working tree is clean, but a build can
|
||||
## carry text no source file does — a dependency's, or a bundler's. Every
|
||||
## make build runs this check again with dist/ required, so a release artifact
|
||||
## is always covered; this run simply had none to look at.
|
||||
################################################################################
|
||||
EOF
|
||||
fi
|
||||
|
||||
echo "check-censored: $WORKTREE_COUNT tracked file(s) inspected," \
|
||||
"$DIST_COUNT file(s) under dist/"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,147 +0,0 @@
|
||||
// The transform half of script/vendor-blocklist: upstream's config.json in,
|
||||
// src/shared/phishingBlocklist.json out. Build-time repo tooling; nothing here
|
||||
// is shipped to users.
|
||||
//
|
||||
// Usage: node script/lib/build-blocklist.js <source.json> <output.json>
|
||||
//
|
||||
// What it does, and why each step is here:
|
||||
//
|
||||
// - only the blacklist is carried over. The extension matches a hostname and
|
||||
// its parent domains against that one list; upstream's whitelist, fuzzylist
|
||||
// and version metadata are read by nothing here, so shipping them would add
|
||||
// megabytes of dead weight to every install.
|
||||
// - entries are lowercased and de-duplicated, because that is the form
|
||||
// isPhishingDomain() compares against.
|
||||
// - entries that cannot be a hostname are dropped and counted. Upstream
|
||||
// carries the odd URL-shaped entry (a path, a scheme); hostname matching can
|
||||
// never match one, and once the artifact is hashes nobody can see that it is
|
||||
// in there, so it is reported at vendoring time instead.
|
||||
// - entries are hashed (see src/shared/domainHash.js) and sorted, and the
|
||||
// digests are concatenated into one fixed-width string. Sorted is what makes
|
||||
// the runtime lookup a binary search over that string, with no set to build
|
||||
// on every service-worker wake; one string rather than an array of 100k+ is
|
||||
// what keeps the file, the bundle and the JSON parse small.
|
||||
//
|
||||
// Deterministic by construction: same input bytes, same output bytes.
|
||||
|
||||
"use strict";
|
||||
|
||||
const fs = require("fs");
|
||||
|
||||
const {
|
||||
HASH_ALGORITHM,
|
||||
HASH_HEX_CHARS,
|
||||
hashDomain,
|
||||
} = require("../../src/shared/domainHash");
|
||||
|
||||
// A blocklist that has collapsed to a handful of entries is a broken fetch or a
|
||||
// changed upstream shape, not a quiet day in phishing. Vendoring it would
|
||||
// disarm the feature, so it fails instead and a human decides.
|
||||
const MIN_ENTRIES = 10000;
|
||||
|
||||
function fail(message) {
|
||||
process.stderr.write("build-blocklist: " + message + "\n");
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// A hostname, as the matcher understands one: dot-separated labels of letters,
|
||||
// digits, hyphens and underscores. Anything else — a path, a scheme, a space,
|
||||
// an empty string, a non-ASCII label a browser would have punycoded before it
|
||||
// ever reached isPhishingDomain() — cannot be produced by the hostname variants
|
||||
// the extension looks up, so it could only ever sit in the artifact unused.
|
||||
//
|
||||
// Underscores are deliberate. They are not legal in a hostname per RFC 1123,
|
||||
// but DNS carries them and browsers resolve them, and upstream lists 141 entries
|
||||
// that use one — real phishing sites on shared subdomain hosts. A stricter
|
||||
// pattern silently drops every one of them.
|
||||
const HOSTNAME_RE =
|
||||
/^[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?(\.[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?)+$/;
|
||||
|
||||
function main(argv) {
|
||||
const [source, output] = argv;
|
||||
if (!source || !output) {
|
||||
fail("usage: build-blocklist.js <source.json> <output.json>");
|
||||
}
|
||||
|
||||
let config;
|
||||
try {
|
||||
config = JSON.parse(fs.readFileSync(source, "utf8"));
|
||||
} catch (e) {
|
||||
fail("could not read " + source + " as JSON: " + e.message);
|
||||
}
|
||||
|
||||
if (!Array.isArray(config.blacklist)) {
|
||||
fail(
|
||||
"the source has no blacklist array, so its shape is not the one " +
|
||||
"this transform understands. Refusing to write an artifact.",
|
||||
);
|
||||
}
|
||||
|
||||
const seen = new Set();
|
||||
let dropped = 0;
|
||||
for (const raw of config.blacklist) {
|
||||
if (typeof raw !== "string") {
|
||||
dropped++;
|
||||
continue;
|
||||
}
|
||||
const domain = raw.trim().toLowerCase();
|
||||
if (!HOSTNAME_RE.test(domain)) {
|
||||
dropped++;
|
||||
continue;
|
||||
}
|
||||
seen.add(domain);
|
||||
}
|
||||
|
||||
if (seen.size < MIN_ENTRIES) {
|
||||
fail(
|
||||
"the source yielded " +
|
||||
seen.size +
|
||||
" usable entries, below the " +
|
||||
MIN_ENTRIES +
|
||||
" floor. That is a broken source or a changed upstream " +
|
||||
"shape, and vendoring it would disarm phishing detection. " +
|
||||
"Refusing to write an artifact.",
|
||||
);
|
||||
}
|
||||
|
||||
const hashes = [];
|
||||
for (const domain of seen) hashes.push(hashDomain(domain));
|
||||
hashes.sort();
|
||||
|
||||
// Truncation makes collisions possible; they are harmless (both entries are
|
||||
// blocked either way) but they must not inflate the count the artifact
|
||||
// claims, which the runtime cross-checks against the string length.
|
||||
const unique = [];
|
||||
for (const hash of hashes) {
|
||||
if (unique.length === 0 || unique[unique.length - 1] !== hash) {
|
||||
unique.push(hash);
|
||||
}
|
||||
}
|
||||
|
||||
const artifact = {
|
||||
algorithm: HASH_ALGORITHM,
|
||||
hashHexChars: HASH_HEX_CHARS,
|
||||
count: unique.length,
|
||||
hashes: unique.join(""),
|
||||
};
|
||||
|
||||
// Four-space JSON with a trailing newline: what prettier emits for this
|
||||
// shape, so a vendored artifact passes make fmt-check untouched.
|
||||
fs.writeFileSync(output, JSON.stringify(artifact, null, 4) + "\n");
|
||||
|
||||
process.stdout.write(
|
||||
"build-blocklist: " +
|
||||
config.blacklist.length +
|
||||
" source entries -> " +
|
||||
seen.size +
|
||||
" usable domains -> " +
|
||||
unique.length +
|
||||
" digests (" +
|
||||
dropped +
|
||||
" not hostnames, " +
|
||||
(seen.size - unique.length) +
|
||||
" digest collisions)\n",
|
||||
);
|
||||
}
|
||||
|
||||
main(process.argv.slice(2));
|
||||
44
script/lint
44
script/lint
@@ -1,51 +1,13 @@
|
||||
#!/bin/sh
|
||||
# script/lint: run the linter (eslint, then prettier --check).
|
||||
#
|
||||
# Linting is containerized. ESLint results depend on the ESLint version, and
|
||||
# the pinned one is the one in the image; a host's own install must not be
|
||||
# able to decide whether this repo is green. From a host this therefore builds
|
||||
# the Dockerfile's `lint` stage, which runs this same script inside the image.
|
||||
#
|
||||
# AUTISTMASK_LINT_NATIVE is set only in that image (see the Dockerfile) and is
|
||||
# what stops the recursion, so `make check` inside the CI build lints in place
|
||||
# instead of trying to reach a docker daemon it does not have.
|
||||
# script/lint: run the linter.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
case "${AUTISTMASK_LINT_NATIVE:-}" in
|
||||
1)
|
||||
echo "Linting..."
|
||||
yarn run lint 2>&1
|
||||
return 0
|
||||
;;
|
||||
"") ;;
|
||||
*)
|
||||
# Set but not recognized: say so rather than silently taking the
|
||||
# docker path, which would look like the variable had no effect.
|
||||
echo "lint: AUTISTMASK_LINT_NATIVE is set to" \
|
||||
"'${AUTISTMASK_LINT_NATIVE}'; the only recognized value is 1" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "lint: docker is required; linting does not run on the host" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Linting in the pinned container..."
|
||||
# --progress=plain: the default progress renderer collapses the lint
|
||||
# output on success, and a lint run whose output cannot be seen is not
|
||||
# evidence that it ran.
|
||||
#
|
||||
# --output=type=cacheonly: the exit status is the whole result; exporting
|
||||
# an image afterwards costs about ten times the lint itself.
|
||||
docker build --progress=plain --target lint \
|
||||
--output=type=cacheonly . 2>&1
|
||||
echo "Linting..."
|
||||
yarn run lint 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
44
script/test
44
script/test
@@ -1,49 +1,19 @@
|
||||
#!/bin/sh
|
||||
# script/test: run the test suite.
|
||||
#
|
||||
# The timeout bounds a hung suite; it is not a performance budget. On a
|
||||
# developer host the suite finishes in about 8s and REPO_POLICIES' 30s cap is
|
||||
# the bound. Inside the image the same suite also pays a cold jest cache and
|
||||
# shares the runner with the rest of the build, which is not what that budget
|
||||
# describes, so the Dockerfile raises the bound through
|
||||
# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
|
||||
# produces a red that means nothing, and teaches "just run it again".
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
TIMEOUT="${AUTISTMASK_TEST_TIMEOUT:-30}"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Running tests (timeout ${TIMEOUT}s)..."
|
||||
|
||||
status=0
|
||||
timeout "$TIMEOUT" yarn run test 2>&1 || status=$?
|
||||
[ "$status" -eq 0 ] && return 0
|
||||
|
||||
# 124 is timeout(1) killing the suite. Say so: a kill is not a failed
|
||||
# assertion, and the verbose rerun would only spend the same wall clock
|
||||
# to be killed again.
|
||||
if [ "$status" -eq 124 ]; then
|
||||
echo "tests: TIMED OUT after ${TIMEOUT}s (no assertion failed)" >&2
|
||||
echo "tests: raise AUTISTMASK_TEST_TIMEOUT if the suite is healthy" >&2
|
||||
echo "Running tests..."
|
||||
timeout 30 yarn run test 2>&1 || {
|
||||
echo "--- Rerunning with --verbose for details ---"
|
||||
timeout 30 yarn run test:verbose 2>&1 || true
|
||||
# Always fail: the first run already proved the tests are broken, so a
|
||||
# flaky pass on the rerun must not turn the build green.
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 125 is timeout(1) itself failing, which here means AUTISTMASK_TEST_TIMEOUT
|
||||
# is not a duration it accepts. The suite never ran, so it neither timed out
|
||||
# nor failed, and the verbose rerun would only reprint the same complaint.
|
||||
if [ "$status" -eq 125 ]; then
|
||||
echo "tests: DID NOT RUN: timeout(1) rejected AUTISTMASK_TEST_TIMEOUT=\"${TIMEOUT}\"" >&2
|
||||
echo "tests: set it to a duration such as 30 or 180 (see timeout(1))" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "--- Rerunning with --verbose for details ---"
|
||||
timeout "$TIMEOUT" yarn run test:verbose 2>&1 || true
|
||||
# Always fail: the first run already proved the tests are broken, so a
|
||||
# flaky pass on the rerun must not turn the build green.
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
@@ -5,32 +5,19 @@
|
||||
#
|
||||
# Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
|
||||
# caps make test at 20 seconds and a browser suite does not fit. Run it
|
||||
# yourself before touching popup views. ESLint's no-undef now catches a
|
||||
# used-but-not-imported identifier in make check, but only this suite sees
|
||||
# what a view actually does when it runs.
|
||||
# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
|
||||
# from check so that cap and the local fast path both stay intact.
|
||||
#
|
||||
# Docker is the only prerequisite. The repo reaches the container as a
|
||||
# build context and the extension is built inside it (see
|
||||
# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
|
||||
# on the machine that starts the run. That is not a convenience: a bind
|
||||
# mount cannot work under Gitea Actions, and the runner image's node is too
|
||||
# old to install this repo's dependencies.
|
||||
# yourself before touching popup views; it is the only check that can see
|
||||
# a used-but-not-imported identifier blow up at runtime.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
|
||||
|
||||
IIDFILE=""
|
||||
|
||||
cleanup() {
|
||||
if [ -n "$IIDFILE" ]; then
|
||||
rm -f "$IIDFILE"
|
||||
fi
|
||||
}
|
||||
# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
|
||||
#
|
||||
# The playwright-core devDependency is pinned to the matching Playwright
|
||||
# version (1.56.0) and the two must be bumped together: the browsers ship
|
||||
# inside this image, and playwright-core looks for the exact browser
|
||||
# revision its own version expects. A mismatch fails at launch.
|
||||
IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
@@ -40,31 +27,22 @@ main() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IIDFILE="$(mktemp)"
|
||||
trap cleanup EXIT
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
|
||||
echo "Building the Chrome e2e image (extension included)..."
|
||||
docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
|
||||
echo "Building extension for e2e..."
|
||||
yarn run build 2>&1
|
||||
|
||||
echo "Running e2e suite in the pinned Playwright container..."
|
||||
# The image is run by ID, not by tag: where two clones of this repo run
|
||||
# the suite at once, the other build can move the tag between this
|
||||
# build and this run, and the suite would then silently test the other
|
||||
# checkout.
|
||||
#
|
||||
# --ipc=host: Chromium's shared-memory needs more than the default
|
||||
# 64MB /dev/shm or renderers crash.
|
||||
# HOME=/tmp: the image's root home is not a reliable place for the
|
||||
# browser profile.
|
||||
# --user: keep files the suite touches owned by the caller, not root.
|
||||
# HOME=/tmp: the mapped uid has no home directory in the image.
|
||||
# PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
|
||||
# ctx.route() intercepts page requests only, and every fetch made by
|
||||
# the MV3 background service worker — the JSON-RPC calls behind
|
||||
# every approval the suite drives among them — goes to the real
|
||||
# internet. The flag is experimental and Playwright may drop or
|
||||
# rename it. It cannot break silently: the harness asks the worker
|
||||
# for one request of its own at launch and aborts the whole suite
|
||||
# if it does not reach the route handler (see the interception
|
||||
# the MV3 background service worker — including the phishing
|
||||
# blocklist fetch that src/background/index.js issues at worker
|
||||
# startup — goes to the real internet. The flag is experimental and
|
||||
# Playwright may drop or rename it. It cannot break silently: the
|
||||
# harness probes service-worker interception at launch and aborts
|
||||
# the whole suite if it is not in effect (see the interception
|
||||
# canary in tests/e2e/harness.js). If a future Playwright removes
|
||||
# the flag, that probe is what will fail, and the fix is either a
|
||||
# replacement mechanism or an honest downgrade of the isolation
|
||||
@@ -73,10 +51,13 @@ main() {
|
||||
# on a deliberate bump.
|
||||
docker run --rm \
|
||||
--ipc=host \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
-e HOME=/tmp \
|
||||
-e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
|
||||
-e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
|
||||
"$(cat "$IIDFILE")" \
|
||||
-v "$ROOT:/work" \
|
||||
-w /work \
|
||||
"$IMAGE" \
|
||||
node tests/e2e/run.js
|
||||
}
|
||||
|
||||
|
||||
@@ -1,77 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test-e2e-firefox: build the extension and drive the real popup in
|
||||
# a real Firefox inside a pinned container. The Firefox counterpart to
|
||||
# script/test-e2e. Our own extension to scripts-to-rule-them-all.
|
||||
#
|
||||
# Deliberately NOT called by script/check or script/test, for the same
|
||||
# reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
|
||||
# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
|
||||
# on every push, in a job separate from check.
|
||||
#
|
||||
# Unlike script/test-e2e this builds its base image locally, because no
|
||||
# published image carries both a pinned Firefox and a matching geckodriver.
|
||||
# All three external artifacts are pinned by digest inside the Dockerfile;
|
||||
# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
|
||||
# the extension build are baked into the image rather than mounted.
|
||||
#
|
||||
# Docker is the only prerequisite: nothing here depends on the node, yarn
|
||||
# or make on the machine that starts the run.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
|
||||
|
||||
IIDFILE=""
|
||||
|
||||
cleanup() {
|
||||
if [ -n "$IIDFILE" ]; then
|
||||
rm -f "$IIDFILE"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "test-e2e-firefox: docker is required to run the e2e suite" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IIDFILE="$(mktemp)"
|
||||
trap cleanup EXIT
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
|
||||
echo "Building the pinned Firefox e2e image (extension included)..."
|
||||
docker build --iidfile "$IIDFILE" -t "$IMAGE" \
|
||||
-f tests/e2e/firefox/Dockerfile .
|
||||
|
||||
echo "Running the Firefox e2e suite..."
|
||||
# The image is run by ID, not by tag: where two clones of this repo run
|
||||
# the suite at once, the other build can move the tag between this
|
||||
# build and this run, and the suite would then silently test the other
|
||||
# checkout.
|
||||
#
|
||||
# --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
|
||||
# --network none: the suite stubs nothing, so this is what keeps the
|
||||
# run offline and deterministic. The extension swallows its own
|
||||
# fetch failures, so the popup flows work unchanged; see the
|
||||
# network note in README.md. Weaker than the Chrome suite's
|
||||
# fixture interception, and honestly so — it proves no request
|
||||
# escaped, but it cannot report which ones were attempted.
|
||||
# HOME=/tmp: the image's root home is not a reliable place for the
|
||||
# browser profile.
|
||||
#
|
||||
# No --privileged. Firefox's sandbox logs
|
||||
# "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
|
||||
# it is cosmetic and headless Firefox runs fine without it.
|
||||
docker run --rm \
|
||||
--shm-size=1g \
|
||||
--network none \
|
||||
-e HOME=/tmp \
|
||||
"$(cat "$IIDFILE")" \
|
||||
node tests/e2e/firefox/run.js dist/firefox
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,105 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/vendor-blocklist: refresh the vendored phishing blocklist at
|
||||
# src/shared/phishingBlocklist.json from its upstream source. Our own extension
|
||||
# to scripts-to-rule-them-all.
|
||||
#
|
||||
# This is build-time repo tooling and is not shipped. It is the one place in
|
||||
# this repo that names the upstream project, because a source reference that
|
||||
# does not say what the source is cannot be verified by anyone; the artifact it
|
||||
# writes carries no names at all (see src/shared/domainHash.js).
|
||||
# script/check-censored reads the name back out of this file rather than
|
||||
# repeating it, so it stays defined exactly once.
|
||||
#
|
||||
# Run it deliberately, not on every build: the output is committed, and the
|
||||
# extension does no runtime fetching, so the shipped list is exactly as fresh as
|
||||
# the last time someone ran this and landed the result. Re-run it, land the
|
||||
# diff, cut a release; that is the whole refresh path.
|
||||
#
|
||||
# Pinned by content hash, twice over, as REPO_POLICIES.md requires. The commit
|
||||
# below is an immutable ref — the upstream default branch moves several times a
|
||||
# day and cannot be pinned — and UPSTREAM_SHA256 is the sha256 of the bytes that
|
||||
# commit serves. A mismatch is a hard failure: a vendoring step that accepts
|
||||
# whatever it is handed is a supply-chain hole, and this one feeds a security
|
||||
# warning shown to users.
|
||||
#
|
||||
# To move the pin: pick the new commit, run this with the new UPSTREAM_COMMIT
|
||||
# and an UPSTREAM_SHA256 you have not yet updated, and it will print the hash it
|
||||
# actually got. Verify that hash against the source independently before
|
||||
# recording it. Never copy the "actual" line in on trust.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Upstream, pinned 2026-08-17.
|
||||
UPSTREAM_ORG="MetaMask"
|
||||
UPSTREAM_REPO="eth-phishing-detect"
|
||||
UPSTREAM_COMMIT="6dddf74a87da3e1a0841f7ae0d1cb31aaf2c05db"
|
||||
UPSTREAM_FILE="src/config.json"
|
||||
UPSTREAM_SHA256="166d5b3504e8f4ed52eae37d3dd20c1a56efa0502bfb3dc957044ff8b5f1283f"
|
||||
|
||||
OUTPUT="src/shared/phishingBlocklist.json"
|
||||
|
||||
WORK=""
|
||||
|
||||
cleanup() {
|
||||
[ -z "$WORK" ] || rm -rf "$WORK"
|
||||
}
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
fail() {
|
||||
echo "vendor-blocklist: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
sha256_of() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
sha256sum "$1" | cut -d' ' -f1
|
||||
elif command -v shasum >/dev/null 2>&1; then
|
||||
shasum -a 256 "$1" | cut -d' ' -f1
|
||||
else
|
||||
fail "neither sha256sum nor shasum is available, so the fetched
|
||||
source cannot be verified. Refusing to vendor unverified content."
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
command -v curl >/dev/null 2>&1 ||
|
||||
fail "curl is required to fetch the upstream list"
|
||||
command -v node >/dev/null 2>&1 ||
|
||||
fail "node is required to build the artifact; run script/bootstrap"
|
||||
|
||||
WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-vendor-blocklist.XXXXXX")" ||
|
||||
fail "could not create a working directory"
|
||||
|
||||
url="https://raw.githubusercontent.com/$UPSTREAM_ORG/$UPSTREAM_REPO/$UPSTREAM_COMMIT/$UPSTREAM_FILE"
|
||||
echo "Fetching $url"
|
||||
curl -fsSL --proto '=https' --tlsv1.2 -o "$WORK/source.json" "$url" ||
|
||||
fail "the fetch failed, so nothing was vendored"
|
||||
|
||||
actual="$(sha256_of "$WORK/source.json")"
|
||||
if [ "$actual" != "$UPSTREAM_SHA256" ]; then
|
||||
fail "sha256 mismatch on the fetched source.
|
||||
expected: $UPSTREAM_SHA256
|
||||
actual: $actual
|
||||
The pinned commit is immutable, so the same commit serving different bytes
|
||||
means the content was substituted somewhere between upstream and here.
|
||||
Nothing was written. Do not update the expectation to match unless you have
|
||||
verified the new bytes independently."
|
||||
fi
|
||||
echo "Verified sha256 $actual"
|
||||
|
||||
node script/lib/build-blocklist.js "$WORK/source.json" "$WORK/out.json" ||
|
||||
fail "the transform failed, so nothing was written"
|
||||
|
||||
if [ -f "$OUTPUT" ] && cmp -s "$WORK/out.json" "$OUTPUT"; then
|
||||
echo "vendor-blocklist: $OUTPUT is already up to date"
|
||||
return 0
|
||||
fi
|
||||
|
||||
cp "$WORK/out.json" "$OUTPUT"
|
||||
echo "vendor-blocklist: wrote $OUTPUT (sha256 $(sha256_of "$OUTPUT"))"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,20 +1,12 @@
|
||||
// AutistMask content script — bridges between inpage (window.ethereum)
|
||||
// and the background service worker via extension messaging.
|
||||
|
||||
const {
|
||||
hasBrowserNamespace,
|
||||
runtimeApi,
|
||||
sendMessage,
|
||||
storageGet,
|
||||
storageSet,
|
||||
} = require("../shared/browserApi");
|
||||
|
||||
// In Chrome (MV3), inpage.js runs as a MAIN-world content script declared
|
||||
// in the manifest, so no injection is needed here. In Firefox (MV2), the
|
||||
// "world" key is not supported, so we inject via a <script> tag.
|
||||
if (hasBrowserNamespace()) {
|
||||
if (typeof browser !== "undefined") {
|
||||
const script = document.createElement("script");
|
||||
script.src = runtimeApi().getURL("src/content/inpage.js");
|
||||
script.src = browser.runtime.getURL("src/content/inpage.js");
|
||||
script.onload = function () {
|
||||
this.remove();
|
||||
};
|
||||
@@ -22,27 +14,23 @@ if (hasBrowserNamespace()) {
|
||||
}
|
||||
|
||||
// Send the persisted EIP-6963 provider UUID to the inpage script.
|
||||
// Generated once at install time and stored in extension storage.
|
||||
(async function sendProviderUuid() {
|
||||
let uuid = null;
|
||||
try {
|
||||
const items = await storageGet("eip6963Uuid");
|
||||
uuid = items?.eip6963Uuid;
|
||||
// Generated once at install time and stored in chrome.storage.local.
|
||||
(function sendProviderUuid() {
|
||||
const storage =
|
||||
typeof browser !== "undefined"
|
||||
? browser.storage.local
|
||||
: chrome.storage.local;
|
||||
storage.get("eip6963Uuid", (items) => {
|
||||
let uuid = items?.eip6963Uuid;
|
||||
if (!uuid) {
|
||||
uuid = crypto.randomUUID();
|
||||
await storageSet({ eip6963Uuid: uuid });
|
||||
storage.set({ eip6963Uuid: uuid });
|
||||
}
|
||||
} catch {
|
||||
// Storage was unavailable or refused the write. The announcement
|
||||
// still has to go out — a provider that never announces is invisible
|
||||
// to every EIP-6963 dApp — so it goes under a fresh uuid that this
|
||||
// page load will not outlive.
|
||||
if (!uuid) uuid = crypto.randomUUID();
|
||||
}
|
||||
window.postMessage(
|
||||
{ type: "AUTISTMASK_PROVIDER_UUID", uuid },
|
||||
location.origin,
|
||||
);
|
||||
window.postMessage(
|
||||
{ type: "AUTISTMASK_PROVIDER_UUID", uuid },
|
||||
location.origin,
|
||||
);
|
||||
});
|
||||
})();
|
||||
|
||||
// Relay requests from the page to the background script
|
||||
@@ -51,31 +39,27 @@ window.addEventListener("message", (event) => {
|
||||
if (event.data?.type !== "AUTISTMASK_REQUEST") return;
|
||||
const { id, method, params } = event.data;
|
||||
|
||||
sendMessage({
|
||||
type: "AUTISTMASK_RPC",
|
||||
id,
|
||||
method,
|
||||
params,
|
||||
origin: location.origin,
|
||||
})
|
||||
.then((response) => {
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
runtime.sendMessage(
|
||||
{ type: "AUTISTMASK_RPC", id, method, params, origin: location.origin },
|
||||
(response) => {
|
||||
if (response) {
|
||||
window.postMessage(
|
||||
{ type: "AUTISTMASK_RESPONSE", id, ...response },
|
||||
"*",
|
||||
);
|
||||
}
|
||||
})
|
||||
.catch(() => {
|
||||
// No receiver: the background context is gone. The page's promise
|
||||
// stays pending, which is what it did before this was a promise
|
||||
// at all; turning it into a rejection here is a change to what
|
||||
// dApps see and belongs to its own issue.
|
||||
});
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
// Listen for events pushed from the background (e.g. accountsChanged)
|
||||
runtimeApi().onMessage.addListener((msg) => {
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
runtime.onMessage.addListener((msg) => {
|
||||
if (msg.type === "AUTISTMASK_EVENT") {
|
||||
window.postMessage(
|
||||
{
|
||||
|
||||
@@ -11,39 +11,6 @@
|
||||
let nextId = 1;
|
||||
const pending = {};
|
||||
|
||||
// EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
|
||||
// rather than properties bolted onto an Error because this object crosses
|
||||
// no boundary after construction — it is built in the page's own realm and
|
||||
// handed straight to the caller's catch — so the prototype survives and
|
||||
// `error.name` is a stable thing for a dApp to see.
|
||||
class ProviderRpcError extends Error {
|
||||
constructor(code, message, data) {
|
||||
super(message);
|
||||
this.name = "ProviderRpcError";
|
||||
this.code = code;
|
||||
if (data !== undefined) this.data = data;
|
||||
}
|
||||
}
|
||||
|
||||
// Rebuild a boundary error as the error the page catches, carrying the
|
||||
// code (and data) the extension reported. Without this a dApp cannot tell
|
||||
// a user's refusal (4001) from a wallet that broke, and retries or shows
|
||||
// an error instead of accepting the refusal.
|
||||
//
|
||||
// Whatever code arrived is passed through verbatim rather than being
|
||||
// matched against a list: the extension emits 4001, 4100 and 4902 today,
|
||||
// and a code this file has never heard of is still the truth about what
|
||||
// happened. An error reported with no code at all stays a plain Error —
|
||||
// a ProviderRpcError whose `code` is undefined would advertise a
|
||||
// conformance it does not have. `message` is untouched in every case.
|
||||
function toPageError(error) {
|
||||
const message = (error && error.message) || "Request failed";
|
||||
if (error && error.code !== undefined && error.code !== null) {
|
||||
return new ProviderRpcError(error.code, message, error.data);
|
||||
}
|
||||
return new Error(message);
|
||||
}
|
||||
|
||||
// Listen for responses from the content script
|
||||
window.addEventListener("message", function onUuid(event) {
|
||||
if (event.source !== window) return;
|
||||
@@ -53,7 +20,7 @@
|
||||
if (!p) return;
|
||||
delete pending[id];
|
||||
if (error) {
|
||||
p.reject(toPageError(error));
|
||||
p.reject(new Error(error.message || "Request failed"));
|
||||
} else {
|
||||
p.resolve(result);
|
||||
}
|
||||
@@ -79,7 +46,7 @@
|
||||
for (const cb of cbs) {
|
||||
try {
|
||||
cb(data);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
// ignore listener errors
|
||||
}
|
||||
}
|
||||
@@ -179,8 +146,7 @@
|
||||
return this;
|
||||
},
|
||||
|
||||
// Some dApps (wagmi) probe this object to decide whether the provider
|
||||
// supports the de-facto standard extras. The name is theirs, not ours.
|
||||
// Some dApps (wagmi) check this to confirm MetaMask-like behavior
|
||||
_metamask: {
|
||||
isUnlocked() {
|
||||
return Promise.resolve(provider.selectedAddress !== null);
|
||||
|
||||
@@ -1,42 +0,0 @@
|
||||
// Parsing for the dust threshold field in Settings.
|
||||
//
|
||||
// Pure: no DOM, no state, so the accepted set can be unit tested directly
|
||||
// instead of through the settings view.
|
||||
//
|
||||
// Accepted input is plain decimal digits only, meaning a whole number of
|
||||
// gwei, zero or greater. Zero is a real setting: it hides nothing.
|
||||
//
|
||||
// Deliberately rejected, not coerced:
|
||||
// "" nothing to save
|
||||
// "-1" a negative threshold has no meaning
|
||||
// "1.5" fractional gwei is not a threshold the filter can use
|
||||
// "100 gwei" the unit is already printed beside the field
|
||||
// "0x10" hex, which Number() would silently read as 16
|
||||
// "1e3" exponent notation, which Number() would silently read as 1000
|
||||
//
|
||||
// The last two are the reason this is a digit test and not a Number() test.
|
||||
// Number() accepts both, and accepting them would put a number in the field
|
||||
// that the user did not type — the same silent substitution the visible
|
||||
// rejection message exists to end.
|
||||
|
||||
// Must render on ONE line of #flash-msg, whose reserved height
|
||||
// (min-h-[1.25rem]) is exactly one line at text-xs. A string long enough to
|
||||
// wrap to two lines pushes the settings view down, which the No Layout Shift
|
||||
// policy forbids. Do not lengthen this without re-running the layout test in
|
||||
// tests/e2e/run.js, which measures the flash line and goes red on a shift.
|
||||
const DUST_THRESHOLD_MESSAGE =
|
||||
"Please enter a whole number of gwei, zero or greater.";
|
||||
|
||||
// Returns the threshold in gwei, or null if the input is not one.
|
||||
function parseDustThresholdGwei(raw) {
|
||||
if (typeof raw !== "string") return null;
|
||||
const trimmed = raw.trim();
|
||||
if (!/^[0-9]+$/.test(trimmed)) return null;
|
||||
const val = Number(trimmed);
|
||||
// A run of digits long enough to exceed Number's exact integer range
|
||||
// would round on the way in, so it is not a threshold we can store.
|
||||
if (!Number.isSafeInteger(val)) return null;
|
||||
return val;
|
||||
}
|
||||
|
||||
module.exports = { DUST_THRESHOLD_MESSAGE, parseDustThresholdGwei };
|
||||
@@ -1496,33 +1496,6 @@
|
||||
<div class="text-xs text-muted mb-1">Value</div>
|
||||
<div id="approve-tx-value" class="text-xs font-bold"></div>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<div class="text-xs text-muted mb-1">Network fee (max)</div>
|
||||
<div
|
||||
id="approve-tx-fee"
|
||||
class="text-xs font-bold min-h-[1rem]"
|
||||
></div>
|
||||
<div
|
||||
id="approve-tx-fee-detail"
|
||||
class="text-xs text-muted min-h-[1rem]"
|
||||
></div>
|
||||
</div>
|
||||
<div class="mb-3 flex justify-between">
|
||||
<div>
|
||||
<div class="text-xs text-muted mb-1">Network</div>
|
||||
<div
|
||||
id="approve-tx-network"
|
||||
class="text-xs min-h-[1rem]"
|
||||
></div>
|
||||
</div>
|
||||
<div>
|
||||
<div class="text-xs text-muted mb-1">Nonce</div>
|
||||
<div
|
||||
id="approve-tx-nonce"
|
||||
class="text-xs min-h-[1rem]"
|
||||
></div>
|
||||
</div>
|
||||
</div>
|
||||
<div id="approve-tx-data-section" class="mb-3 hidden">
|
||||
<div class="text-xs text-muted mb-1">Raw data</div>
|
||||
<div id="approve-tx-data" class="text-xs break-all"></div>
|
||||
|
||||
@@ -9,16 +9,16 @@ const {
|
||||
$,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
setBackRenderer,
|
||||
setRenderMain,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
} = require("./views/helpers");
|
||||
const { applyTheme } = require("./theme");
|
||||
// Renders a view the popup lands on without having navigated to it forward:
|
||||
// on restore here, and on Back. Only the views that can be fully re-rendered
|
||||
// from persisted state (RESTORABLE_VIEWS, src/popup/restorableViews.js) go
|
||||
// through it; anything else falls back to the nearest restorable parent.
|
||||
const { renderView, makeBackRenderer } = require("./viewRouter");
|
||||
// Views that can be fully re-rendered from persisted state. All others fall
|
||||
// back to the nearest restorable parent; see the module for why the
|
||||
// secret-bearing views are absent.
|
||||
const { RESTORABLE_VIEWS } = require("./restorableViews");
|
||||
|
||||
const home = require("./views/home");
|
||||
const welcome = require("./views/welcome");
|
||||
@@ -108,22 +108,91 @@ const ctx = {
|
||||
},
|
||||
};
|
||||
|
||||
// The view modules the router renders through, keyed as it expects them.
|
||||
const viewModules = {
|
||||
main: { show: () => fallbackView() },
|
||||
addressDetail,
|
||||
addressToken,
|
||||
receive,
|
||||
settings,
|
||||
settingsAddToken,
|
||||
confirmTx,
|
||||
transactionDetail,
|
||||
txStatus,
|
||||
};
|
||||
function needsAddress(view) {
|
||||
return (
|
||||
view === "address" ||
|
||||
view === "address-token" ||
|
||||
view === "receive" ||
|
||||
view === "transaction"
|
||||
);
|
||||
}
|
||||
|
||||
function hasValidAddress() {
|
||||
return (
|
||||
state.selectedWallet !== null &&
|
||||
state.selectedAddress !== null &&
|
||||
state.wallets[state.selectedWallet] &&
|
||||
state.wallets[state.selectedWallet].addresses[state.selectedAddress]
|
||||
);
|
||||
}
|
||||
|
||||
function restoreView() {
|
||||
if (!renderView(state.currentView, state, viewModules)) {
|
||||
fallbackView();
|
||||
const view = state.currentView;
|
||||
if (!view || !RESTORABLE_VIEWS.has(view)) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
if (needsAddress(view) && !hasValidAddress()) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
if (view === "address-token" && !state.selectedToken) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
switch (view) {
|
||||
case "address":
|
||||
addressDetail.show();
|
||||
break;
|
||||
case "address-token":
|
||||
addressToken.show();
|
||||
break;
|
||||
case "receive":
|
||||
receive.show();
|
||||
break;
|
||||
case "settings":
|
||||
settings.show();
|
||||
break;
|
||||
case "settings-addtoken":
|
||||
settingsAddToken.show();
|
||||
break;
|
||||
case "confirm-tx":
|
||||
if (state.viewData && state.viewData.pendingTx) {
|
||||
confirmTx.restore();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "transaction":
|
||||
if (state.viewData && state.viewData.tx) {
|
||||
transactionDetail.render();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "wait-tx":
|
||||
// Resumes the receipt poll from the persisted broadcast time.
|
||||
if (!txStatus.restoreWait()) {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "success-tx":
|
||||
if (state.viewData && state.viewData.hash) {
|
||||
txStatus.renderSuccess();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "error-tx":
|
||||
if (state.viewData && state.viewData.message) {
|
||||
txStatus.renderError();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
default:
|
||||
fallbackView();
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -160,12 +229,6 @@ async function init() {
|
||||
const params = new URLSearchParams(window.location.search);
|
||||
const approvalId = params.get("approval");
|
||||
if (approvalId) {
|
||||
// Deliberately not awaited, and deliberately not .catch()ed. show()
|
||||
// is async, so a throw past its first await surfaces as an unhandled
|
||||
// rejection rather than an uncaught error — measured as still failing
|
||||
// the run on both harnesses (Playwright `pageerror`, and the Firefox
|
||||
// driver's console-service drain), so nothing is lost by leaving it
|
||||
// on that path.
|
||||
approval.show(approvalId);
|
||||
showView("approve-site");
|
||||
return;
|
||||
@@ -184,7 +247,7 @@ async function init() {
|
||||
settings.show();
|
||||
});
|
||||
|
||||
setBackRenderer(makeBackRenderer(state, viewModules));
|
||||
setRenderMain(renderWalletList);
|
||||
|
||||
welcome.init(ctx);
|
||||
addWallet.init(ctx);
|
||||
|
||||
@@ -1,167 +0,0 @@
|
||||
// Rendering a view the popup lands on without having navigated to it
|
||||
// forward: on restore, and on Back. In both cases the view may never have
|
||||
// been rendered in this page load — a reopened popup renders only the
|
||||
// wallet list and the view it restores onto, so every other view is still
|
||||
// the blank static template from index.html — so unhiding it is not enough.
|
||||
//
|
||||
// Forward navigation renders as it goes and must NOT come through here:
|
||||
// rendering a second time would re-fetch and clobber whatever the view has
|
||||
// in flight.
|
||||
//
|
||||
// The view modules are injected and nothing here touches the DOM, so the
|
||||
// dispatch and its data guards can be tested directly; src/popup/index.js
|
||||
// cannot be required outside a browser.
|
||||
|
||||
const { RESTORABLE_VIEWS } = require("./restorableViews");
|
||||
|
||||
// The views this page load has rendered.
|
||||
//
|
||||
// The Back path cannot otherwise tell its two cases apart. A view the popup
|
||||
// never rendered is still the blank template from index.html and has to be
|
||||
// rendered; a view already on the page must NOT be rendered again, because
|
||||
// a second render re-fetches and overwrites whatever the user has typed
|
||||
// into it and not yet saved.
|
||||
//
|
||||
// Registration is showView() in views/helpers.js, which is the last thing
|
||||
// every render path runs — restoreView()'s, the Back path's, and every
|
||||
// forward show(). That is the point of putting it there rather than in the
|
||||
// individual views: a view added later registers itself with no one having
|
||||
// to remember it, so this cannot decay.
|
||||
//
|
||||
// Module scope is page-load scope: the popup loads this module once per
|
||||
// page load, and a reopened popup gets a fresh, empty set — which is
|
||||
// exactly the state that makes the Back path render.
|
||||
const renderedViews = new Set();
|
||||
|
||||
function markViewRendered(view) {
|
||||
if (view) renderedViews.add(view);
|
||||
}
|
||||
|
||||
// Begin a fresh page-load scope. The popup gets one by being loaded; the
|
||||
// unit tests, which simulate several page loads against one module
|
||||
// instance, ask for one.
|
||||
function resetRenderedViews() {
|
||||
renderedViews.clear();
|
||||
}
|
||||
|
||||
// Home is the exception: Back re-renders it every time, which is what the
|
||||
// popup did before this router existed (index.js registered
|
||||
// renderWalletList() as setRenderMain(), and goBack() called it on every
|
||||
// Back onto "main"). It must stay that way — the wallet list has to reflect
|
||||
// what changed while the user was away from it, such as a wallet renamed or
|
||||
// an address removed in Settings — and Home holds no unsaved input to lose.
|
||||
const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
|
||||
|
||||
// Views that render an address the user picked and cannot be rendered
|
||||
// without one.
|
||||
const ADDRESS_VIEWS = new Set([
|
||||
"address",
|
||||
"address-token",
|
||||
"receive",
|
||||
"transaction",
|
||||
]);
|
||||
|
||||
function needsAddress(view) {
|
||||
return ADDRESS_VIEWS.has(view);
|
||||
}
|
||||
|
||||
function hasValidAddress(state) {
|
||||
return Boolean(
|
||||
state.selectedWallet !== null &&
|
||||
state.selectedAddress !== null &&
|
||||
state.wallets[state.selectedWallet] &&
|
||||
state.wallets[state.selectedWallet].addresses[state.selectedAddress],
|
||||
);
|
||||
}
|
||||
|
||||
// Render `view` from persisted state. Each view module shows itself, so a
|
||||
// true return means the view is both rendered and on screen.
|
||||
//
|
||||
// Returns false when the view is not one the popup renders from state, or
|
||||
// when the state it would render is gone — a token no longer selected, a
|
||||
// transaction no longer persisted. The caller falls back rather than
|
||||
// putting an empty template on screen.
|
||||
function renderView(view, state, views) {
|
||||
if (!view || !RESTORABLE_VIEWS.has(view)) return false;
|
||||
if (needsAddress(view) && !hasValidAddress(state)) return false;
|
||||
if (view === "address-token" && !state.selectedToken) return false;
|
||||
|
||||
const data = state.viewData || {};
|
||||
switch (view) {
|
||||
case "main":
|
||||
views.main.show();
|
||||
return true;
|
||||
case "address":
|
||||
views.addressDetail.show();
|
||||
return true;
|
||||
case "address-token":
|
||||
views.addressToken.show();
|
||||
return true;
|
||||
case "receive":
|
||||
views.receive.show();
|
||||
return true;
|
||||
case "settings":
|
||||
views.settings.show();
|
||||
return true;
|
||||
case "settings-addtoken":
|
||||
views.settingsAddToken.show();
|
||||
return true;
|
||||
case "confirm-tx":
|
||||
if (!data.pendingTx) return false;
|
||||
views.confirmTx.restore();
|
||||
return true;
|
||||
case "transaction":
|
||||
if (!data.tx) return false;
|
||||
views.transactionDetail.render();
|
||||
return true;
|
||||
case "wait-tx":
|
||||
// Resumes the receipt poll from the persisted broadcast time,
|
||||
// and answers false when there is nothing resumable left.
|
||||
return Boolean(views.txStatus.restoreWait());
|
||||
case "success-tx":
|
||||
if (!data.hash) return false;
|
||||
views.txStatus.renderSuccess();
|
||||
return true;
|
||||
case "error-tx":
|
||||
if (!data.message) return false;
|
||||
views.txStatus.renderError();
|
||||
return true;
|
||||
default:
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// The Back-path renderer, registered with setBackRenderer() in
|
||||
// views/helpers.js.
|
||||
//
|
||||
// Returns false — leaving goBack() to unhide the view, as it always did —
|
||||
// in the two cases where the view is known to be on the page already:
|
||||
//
|
||||
// - It is not one the popup renders from persisted state. The restored
|
||||
// stack is filtered against RESTORABLE_VIEWS, so such a view can only
|
||||
// be on the stack from this page load, where forward navigation
|
||||
// rendered it on the way in.
|
||||
// - This page load has rendered it. Re-rendering would re-fetch and
|
||||
// clobber what it holds; Home is rendered anyway, see above.
|
||||
//
|
||||
// What is left is the case the router exists for: a view on the stack that
|
||||
// this page load has never rendered, whose template is still blank.
|
||||
function makeBackRenderer(state, views) {
|
||||
return function renderBack(view) {
|
||||
if (!RESTORABLE_VIEWS.has(view)) return false;
|
||||
if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
|
||||
return false;
|
||||
}
|
||||
if (!renderView(view, state, views)) {
|
||||
views.main.show();
|
||||
}
|
||||
return true;
|
||||
};
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
renderView,
|
||||
makeBackRenderer,
|
||||
markViewRendered,
|
||||
resetRenderedViews,
|
||||
};
|
||||
@@ -194,7 +194,7 @@ async function importPrivateKey(ctx) {
|
||||
let addr;
|
||||
try {
|
||||
addr = addressFromPrivateKey(key);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
showFlash("Invalid private key.");
|
||||
return;
|
||||
}
|
||||
@@ -246,7 +246,7 @@ async function importXprvKey(ctx) {
|
||||
let result;
|
||||
try {
|
||||
result = hdWalletFromXprv(xprv);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
showFlash(
|
||||
"That extended private key is not valid. Please check it and try again.",
|
||||
);
|
||||
|
||||
@@ -12,8 +12,8 @@ const {
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
|
||||
const { state, currentAddress, saveState } = require("../../shared/state");
|
||||
const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
filterTransactions,
|
||||
@@ -44,6 +44,7 @@ function show() {
|
||||
state.selectedToken = null;
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
const addr = wallet.addresses[state.selectedAddress];
|
||||
const wi = state.selectedWallet;
|
||||
const ai = state.selectedAddress;
|
||||
$("address-title").textContent =
|
||||
wallet.name + " \u2014 Address " + (ai + 1);
|
||||
@@ -63,7 +64,7 @@ function show() {
|
||||
});
|
||||
$("address-line").dataset.full = addr.address;
|
||||
attachCopyHandlers($("address-line"));
|
||||
const usdTotal = formatAddressTotal(getAddressValue(addr));
|
||||
const usdTotal = formatUsd(getAddressValueUsd(addr));
|
||||
$("address-usd-total").innerHTML = usdTotal || " ";
|
||||
const ensEl = $("address-ens");
|
||||
// ENS is now shown inside renderAddressHtml, hide the separate element
|
||||
@@ -245,6 +246,7 @@ function renderTransactions(txs) {
|
||||
row.addEventListener("click", () => {
|
||||
const idx = parseInt(row.dataset.tx, 10);
|
||||
const tx = loadedTxs[idx];
|
||||
const counterparty = tx.direction === "sent" ? tx.to : tx.from;
|
||||
tx.fromEns = ensNameMap.get(tx.from) || null;
|
||||
tx.toEns = ensNameMap.get(tx.to) || null;
|
||||
ctx.showTransactionDetail(tx);
|
||||
|
||||
@@ -16,9 +16,13 @@ const {
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { state, currentAddress, saveState } = require("../../shared/state");
|
||||
const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
filterTransactions,
|
||||
|
||||
@@ -9,8 +9,7 @@ const {
|
||||
attachCopyHandlers,
|
||||
onViewLeave,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { networkByChainId } = require("../../shared/networks");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const {
|
||||
formatEther,
|
||||
formatUnits,
|
||||
@@ -24,10 +23,12 @@ const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { walletDefect } = require("../../shared/walletDefects");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { describeSigningFailure } = require("../../shared/approvalVerify");
|
||||
const txStatus = require("./txStatus");
|
||||
const uniswap = require("../../shared/uniswap");
|
||||
const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
const erc20Iface = new Interface(ERC20_ABI);
|
||||
|
||||
@@ -158,61 +159,21 @@ function showPhishingWarning(elementId, isPhishing) {
|
||||
}
|
||||
}
|
||||
|
||||
// The fields of the approved transaction the value and recipient lines do not
|
||||
// already carry: network, gas limit, fee per gas, the most the fee can come to,
|
||||
// and the nonce. The background compares every one of them against the signed
|
||||
// artifact, so every one of them has to be on the screen — a number that is
|
||||
// verified but never displayed is verified against nothing the user agreed to.
|
||||
function showTxFee(approvedTx, ethPrice) {
|
||||
const network = networkByChainId(approvedTx.chainId);
|
||||
$("approve-tx-network").textContent = network
|
||||
? network.name
|
||||
: "Unknown network (chain id " + BigInt(approvedTx.chainId) + ")";
|
||||
|
||||
const gasLimit = BigInt(approvedTx.gasLimit);
|
||||
const feePerGas = BigInt(approvedTx.maxFeePerGas || approvedTx.gasPrice);
|
||||
const maxFeeEth = formatTxValue(formatEther(gasLimit * feePerGas));
|
||||
const usdStr = formatUsd(
|
||||
ethPrice ? parseFloat(maxFeeEth) * ethPrice : null,
|
||||
);
|
||||
$("approve-tx-fee").textContent =
|
||||
maxFeeEth + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
|
||||
|
||||
let detail =
|
||||
gasLimit.toString() +
|
||||
" gas at up to " +
|
||||
formatUnits(feePerGas, 9) +
|
||||
" gwei";
|
||||
if (approvedTx.maxPriorityFeePerGas) {
|
||||
detail +=
|
||||
", " +
|
||||
formatUnits(approvedTx.maxPriorityFeePerGas, 9) +
|
||||
" gwei priority";
|
||||
}
|
||||
$("approve-tx-fee-detail").textContent = detail;
|
||||
$("approve-tx-nonce").textContent = BigInt(approvedTx.nonce).toString();
|
||||
}
|
||||
|
||||
function showTxApproval(details) {
|
||||
showPhishingWarning(
|
||||
"approve-tx-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
|
||||
// The transaction the background populated. It is displayed as it stands,
|
||||
// signed as it stands, and verified against as it stands — the popup fills
|
||||
// nothing in, so there is no number on this screen that the background
|
||||
// cannot compare with the artifact it gets back.
|
||||
pendingTxParams = details.approvedTx;
|
||||
const approvedTx = details.approvedTx;
|
||||
pendingTxParams = details.txParams;
|
||||
|
||||
const toAddr = approvedTx.to;
|
||||
const toAddr = details.txParams.to;
|
||||
const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
|
||||
const ethValue = formatEther(approvedTx.value || "0");
|
||||
const ethValue = formatEther(details.txParams.value || "0");
|
||||
|
||||
// Build txInfo for status screens
|
||||
pendingTxDetails = {
|
||||
from: details.approvedFrom,
|
||||
from: state.activeAddress,
|
||||
to: toAddr || "",
|
||||
amount: formatTxValue(ethValue),
|
||||
token: "ETH",
|
||||
@@ -220,7 +181,7 @@ function showTxApproval(details) {
|
||||
};
|
||||
|
||||
// If this is an ERC-20 call, try to extract the real recipient and amount
|
||||
const decoded = decodeCalldata(approvedTx.data, toAddr || "");
|
||||
const decoded = decodeCalldata(details.txParams.data, toAddr || "");
|
||||
if (decoded && decoded.details) {
|
||||
let decodedTokenAddr = null;
|
||||
let decodedTokenSymbol = null;
|
||||
@@ -258,7 +219,7 @@ function showTxApproval(details) {
|
||||
}
|
||||
|
||||
$("approve-tx-hostname").textContent = details.hostname;
|
||||
$("approve-tx-from").innerHTML = approvalAddressHtml(details.approvedFrom);
|
||||
$("approve-tx-from").innerHTML = approvalAddressHtml(state.activeAddress);
|
||||
|
||||
// Show token symbol next to contract address if known
|
||||
const symbol = toAddr ? tokenLabel(toAddr) : null;
|
||||
@@ -274,7 +235,7 @@ function showTxApproval(details) {
|
||||
}
|
||||
|
||||
const ethValueFormatted = formatTxValue(
|
||||
formatEther(approvedTx.value || "0"),
|
||||
formatEther(details.txParams.value || "0"),
|
||||
);
|
||||
const ethPrice = getPrice("ETH");
|
||||
const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
|
||||
@@ -282,8 +243,6 @@ function showTxApproval(details) {
|
||||
$("approve-tx-value").textContent =
|
||||
ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
|
||||
|
||||
showTxFee(approvedTx, ethPrice);
|
||||
|
||||
// Decode calldata (reuse decoded from above)
|
||||
const decodedEl = $("approve-tx-decoded");
|
||||
if (decoded) {
|
||||
@@ -312,8 +271,8 @@ function showTxApproval(details) {
|
||||
}
|
||||
|
||||
// Always show raw data when present
|
||||
if (approvedTx.data && approvedTx.data !== "0x") {
|
||||
$("approve-tx-data").textContent = approvedTx.data;
|
||||
if (details.txParams.data && details.txParams.data !== "0x") {
|
||||
$("approve-tx-data").textContent = details.txParams.data;
|
||||
$("approve-tx-data-section").classList.remove("hidden");
|
||||
} else {
|
||||
$("approve-tx-data-section").classList.add("hidden");
|
||||
@@ -324,11 +283,7 @@ function showTxApproval(details) {
|
||||
|
||||
showView("approve-tx");
|
||||
attachCopyHandlers("view-approve-tx");
|
||||
gateOnWalletDefect(
|
||||
"approve-tx-error",
|
||||
"btn-approve-tx",
|
||||
details.approvedFrom,
|
||||
);
|
||||
gateOnWalletDefect("approve-tx-error", "btn-approve-tx");
|
||||
}
|
||||
|
||||
function decodeHexMessage(hex) {
|
||||
@@ -387,12 +342,9 @@ function showSignApproval(details) {
|
||||
|
||||
const sp = details.signParams;
|
||||
pendingSignParams = sp;
|
||||
pendingSignFrom = details.approvedFrom;
|
||||
|
||||
$("approve-sign-hostname").textContent = details.hostname;
|
||||
$("approve-sign-from").innerHTML = approvalAddressHtml(
|
||||
details.approvedFrom,
|
||||
);
|
||||
$("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
|
||||
|
||||
const isTyped =
|
||||
sp.method === "eth_signTypedData_v4" ||
|
||||
@@ -431,69 +383,46 @@ function showSignApproval(details) {
|
||||
|
||||
showView("approve-sign");
|
||||
attachCopyHandlers("view-approve-sign");
|
||||
gateOnWalletDefect(
|
||||
"approve-sign-error",
|
||||
"btn-approve-sign",
|
||||
details.approvedFrom,
|
||||
);
|
||||
gateOnWalletDefect("approve-sign-error", "btn-approve-sign");
|
||||
}
|
||||
|
||||
// Awaited by nobody: the popup entry point calls this and moves on. It
|
||||
// therefore has to absorb its own failure, and a background that cannot
|
||||
// describe the approval is the same outcome as an approval that is gone.
|
||||
async function show(id) {
|
||||
function show(id) {
|
||||
approvalId = id;
|
||||
approvalPort = runtimeApi().connect({ name: "approval:" + id });
|
||||
|
||||
let details = null;
|
||||
try {
|
||||
details = await sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id });
|
||||
} catch {
|
||||
details = null;
|
||||
}
|
||||
|
||||
if (!details) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
if (details.type === "tx") {
|
||||
showTxApproval(details);
|
||||
return;
|
||||
}
|
||||
if (details.type === "sign") {
|
||||
showSignApproval(details);
|
||||
return;
|
||||
}
|
||||
// Site connection approval
|
||||
showPhishingWarning(
|
||||
"approve-site-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
$("approve-hostname").textContent = details.hostname;
|
||||
$("approve-address").innerHTML = approvalAddressHtml(state.activeAddress);
|
||||
attachCopyHandlers("view-approve-site");
|
||||
$("approve-remember").checked = state.rememberSiteChoice;
|
||||
runtime.connect({ name: "approval:" + id });
|
||||
runtime.sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id }, (details) => {
|
||||
if (!details) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
if (details.type === "tx") {
|
||||
showTxApproval(details);
|
||||
return;
|
||||
}
|
||||
if (details.type === "sign") {
|
||||
showSignApproval(details);
|
||||
return;
|
||||
}
|
||||
// Site connection approval
|
||||
showPhishingWarning(
|
||||
"approve-site-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
$("approve-hostname").textContent = details.hostname;
|
||||
$("approve-address").innerHTML = approvalAddressHtml(
|
||||
state.activeAddress,
|
||||
);
|
||||
attachCopyHandlers("view-approve-site");
|
||||
$("approve-remember").checked = state.rememberSiteChoice;
|
||||
});
|
||||
}
|
||||
|
||||
let approvalId = null;
|
||||
// The port this approval was opened on. Closing this window disconnects it,
|
||||
// and the background treats that disconnect as "closed without deciding" for a
|
||||
// site connection — so the decision goes out on this same port and not as a
|
||||
// one-off message. One channel is ordered: a message posted on it is delivered
|
||||
// before its own disconnect, however immediately the close follows. Two
|
||||
// channels were not, and the close won, reporting a user who approved as
|
||||
// having refused.
|
||||
let approvalPort = null;
|
||||
let pendingTxDetails = null;
|
||||
// The exact objects shown to the user, kept so the popup signs what it
|
||||
// displayed rather than re-fetching or re-populating anything at approval
|
||||
// time. All are repopulated by show() when the popup is closed and reopened.
|
||||
// The exact parameters shown to the user, kept so the popup signs what it
|
||||
// displayed rather than re-fetching anything at approval time. Both are
|
||||
// repopulated by show() when the popup is closed and reopened.
|
||||
let pendingTxParams = null;
|
||||
let pendingSignParams = null;
|
||||
// The address the approval was raised for. Signing uses this rather than the
|
||||
// active address, so that an address switch since the approval fails here
|
||||
// instead of producing a signature from an account the screen never named.
|
||||
let pendingSignFrom = null;
|
||||
|
||||
// Approve buttons stay disabled and muted while the popup derives the key and
|
||||
// signs, which is slow enough (Argon2id) that a double click is likely.
|
||||
@@ -508,13 +437,12 @@ function setSignButtonBusy(busy) {
|
||||
}
|
||||
|
||||
// Say so on the approval screen itself, and disable the approve button, when
|
||||
// the address the approval was raised for belongs to a wallet whose keys
|
||||
// cannot be derived. Without this the screen would take a password and fail
|
||||
// after deriving it. Reject stays available; the wallet is not touched.
|
||||
// Returns true when it gated.
|
||||
function gateOnWalletDefect(errorId, buttonId, address) {
|
||||
const owner = findWalletFor(address);
|
||||
const defect = owner ? walletDefect(owner.wallet) : null;
|
||||
// the active address belongs to a wallet whose keys cannot be derived. Without
|
||||
// this the screen would take a password and fail after deriving it. Reject
|
||||
// stays available; the wallet is not touched. Returns true when it gated.
|
||||
function gateOnWalletDefect(errorId, buttonId) {
|
||||
const active = findActiveWallet();
|
||||
const defect = active ? walletDefect(active.wallet) : null;
|
||||
if (!defect) return false;
|
||||
showError(errorId, defect.shortMessage);
|
||||
$(buttonId).disabled = true;
|
||||
@@ -522,14 +450,12 @@ function gateOnWalletDefect(errorId, buttonId, address) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Locate the wallet and the address index owning an address. Returns null when
|
||||
// no wallet holds it. Approvals look up the address they were raised for, not
|
||||
// whichever address is active now: the approval named one account, and signing
|
||||
// with another is what verification refuses.
|
||||
function findWalletFor(address) {
|
||||
// Locate the wallet and the address index owning the currently active
|
||||
// address. Returns null when no wallet holds it.
|
||||
function findActiveWallet() {
|
||||
for (const wallet of state.wallets) {
|
||||
for (let i = 0; i < wallet.addresses.length; i++) {
|
||||
if (wallet.addresses[i].address === address) {
|
||||
if (wallet.addresses[i].address === state.activeAddress) {
|
||||
return { wallet, addrIndex: i };
|
||||
}
|
||||
}
|
||||
@@ -551,29 +477,7 @@ function clearSignPassword() {
|
||||
hideError("approve-sign-error");
|
||||
}
|
||||
|
||||
// Answer a site-connection approval and close. The decision goes out on the
|
||||
// approval port — see approvalPort above for why — and carries no approval id,
|
||||
// because the port name already names the approval the background will settle.
|
||||
// The post is guarded because a throw must not cost the close: posting on a
|
||||
// port whose background worker has been torn down throws, and the approval it
|
||||
// would have settled died with that worker, so the only thing left to do is
|
||||
// what the user asked for — go away.
|
||||
function decideSite(approved) {
|
||||
if (approvalPort) {
|
||||
try {
|
||||
approvalPort.postMessage({
|
||||
type: "AUTISTMASK_APPROVAL_DECISION",
|
||||
approved,
|
||||
remember: $("approve-remember").checked,
|
||||
});
|
||||
} catch {
|
||||
// Nothing to report it to; the window closes either way.
|
||||
}
|
||||
}
|
||||
window.close();
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
function init(ctx) {
|
||||
onViewLeave("approve-tx", clearTxPassword);
|
||||
onViewLeave("approve-sign", clearSignPassword);
|
||||
|
||||
@@ -583,11 +487,25 @@ function init(_ctx) {
|
||||
});
|
||||
|
||||
$("btn-approve").addEventListener("click", () => {
|
||||
decideSite(true);
|
||||
const remember = $("approve-remember").checked;
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_APPROVAL_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
remember,
|
||||
});
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-reject").addEventListener("click", () => {
|
||||
decideSite(false);
|
||||
const remember = $("approve-remember").checked;
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_APPROVAL_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
remember,
|
||||
});
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-approve-tx").addEventListener("click", async () => {
|
||||
@@ -599,12 +517,12 @@ function init(_ctx) {
|
||||
hideError("approve-tx-error");
|
||||
setTxButtonBusy(true);
|
||||
|
||||
const active = findWalletFor(pendingTxParams.from);
|
||||
const active = findActiveWallet();
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-tx-error",
|
||||
"No wallet was found for the address this transaction was approved for.",
|
||||
"No wallet was found for the active address.",
|
||||
);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
@@ -651,16 +569,15 @@ function init(_ctx) {
|
||||
active.addrIndex,
|
||||
decryptedSecret,
|
||||
);
|
||||
// Sign the approved transaction exactly as it was displayed. The
|
||||
// background populated it before this screen was drawn and checks
|
||||
// the artifact against it field for field, so there is nothing to
|
||||
// fill in here and no provider to fill it in from. The copy is
|
||||
// because ethers may strip `from` off what it is handed, and the
|
||||
// approval has to survive a retry intact; keeping `from` on it
|
||||
// makes ethers refuse a key that is not the approved address.
|
||||
payload.rawSignedTx = await signer.signTransaction({
|
||||
...pendingTxParams,
|
||||
});
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const connected = signer.connect(provider);
|
||||
// This is the sequence ethers' own sendTransaction() runs
|
||||
// internally, so nonce, gas, fee and chain id population are
|
||||
// identical to when the background did the signing.
|
||||
const populated =
|
||||
await connected.populateTransaction(pendingTxParams);
|
||||
delete populated.from;
|
||||
payload.rawSignedTx = await connected.signTransaction(populated);
|
||||
} catch (e) {
|
||||
payload.error =
|
||||
e.shortMessage || e.message || "Transaction signing failed.";
|
||||
@@ -670,37 +587,29 @@ function init(_ctx) {
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
// A send that never reaches the background is reported to the user
|
||||
// the same way a background that refused it is: describeSigningFailure
|
||||
// turns a null response into the generic message below.
|
||||
let response = null;
|
||||
try {
|
||||
response = await sendMessage(payload);
|
||||
} catch {
|
||||
response = null;
|
||||
}
|
||||
|
||||
if (response && response.txHash) {
|
||||
txStatus.showWait(pendingTxDetails, response.txHash);
|
||||
return;
|
||||
}
|
||||
// A retryable failure leaves the approval pending in the
|
||||
// background, so stay on this screen with a live button rather
|
||||
// than sending the user to a dead end.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The transaction could not be sent.",
|
||||
);
|
||||
if (outcome.retryable) {
|
||||
showError("approve-tx-error", outcome.message);
|
||||
setTxButtonBusy(false);
|
||||
} else {
|
||||
txStatus.showError(pendingTxDetails, null, outcome.message);
|
||||
}
|
||||
runtime.sendMessage(payload, (response) => {
|
||||
if (response && response.txHash) {
|
||||
txStatus.showWait(pendingTxDetails, response.txHash);
|
||||
return;
|
||||
}
|
||||
// A retryable failure leaves the approval pending in the
|
||||
// background, so stay on this screen with a live button rather
|
||||
// than sending the user to a dead end.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The transaction could not be sent.",
|
||||
);
|
||||
if (outcome.retryable) {
|
||||
showError("approve-tx-error", outcome.message);
|
||||
setTxButtonBusy(false);
|
||||
} else {
|
||||
txStatus.showError(pendingTxDetails, null, outcome.message);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
$("btn-reject-tx").addEventListener("click", () => {
|
||||
notify({
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
@@ -717,12 +626,12 @@ function init(_ctx) {
|
||||
hideError("approve-sign-error");
|
||||
setSignButtonBusy(true);
|
||||
|
||||
const active = findWalletFor(pendingSignFrom);
|
||||
const active = findActiveWallet();
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-sign-error",
|
||||
"No wallet was found for the address this request was approved for.",
|
||||
"No wallet was found for the active address.",
|
||||
);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
@@ -794,31 +703,26 @@ function init(_ctx) {
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
let response = null;
|
||||
try {
|
||||
response = await sendMessage(payload);
|
||||
} catch {
|
||||
response = null;
|
||||
}
|
||||
|
||||
if (response && response.signature) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
// The button comes back only when the approval is still pending in
|
||||
// the background; otherwise it stays disabled and the message says
|
||||
// why, because a control that cannot succeed must not look like it
|
||||
// can.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The message could not be signed.",
|
||||
);
|
||||
showError("approve-sign-error", outcome.message);
|
||||
if (outcome.retryable) setSignButtonBusy(false);
|
||||
runtime.sendMessage(payload, (response) => {
|
||||
if (response && response.signature) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
// The button comes back only when the approval is still pending in
|
||||
// the background; otherwise it stays disabled and the message says
|
||||
// why, because a control that cannot succeed must not look like it
|
||||
// can.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The message could not be signed.",
|
||||
);
|
||||
showError("approve-sign-error", outcome.message);
|
||||
if (outcome.retryable) setSignButtonBusy(false);
|
||||
});
|
||||
});
|
||||
|
||||
$("btn-reject-sign").addEventListener("click", () => {
|
||||
notify({
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
|
||||
@@ -2,12 +2,20 @@
|
||||
// Shows transaction details, warnings, errors. On Sign & Send,
|
||||
// reads inline password, decrypts secret, signs and broadcasts.
|
||||
|
||||
const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
|
||||
const {
|
||||
parseEther,
|
||||
parseUnits,
|
||||
formatEther,
|
||||
formatUnits,
|
||||
Contract,
|
||||
} = require("ethers");
|
||||
const {
|
||||
$,
|
||||
showError,
|
||||
hideError,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
renderAddressHtml,
|
||||
@@ -15,7 +23,7 @@ const {
|
||||
goBack,
|
||||
onViewLeave,
|
||||
} = require("./helpers");
|
||||
const { state } = require("../../shared/state");
|
||||
const { state, currentNetwork } = require("../../shared/state");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
@@ -25,10 +33,6 @@ const {
|
||||
getFullWarnings,
|
||||
} = require("../../shared/addressWarnings");
|
||||
const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
|
||||
const {
|
||||
displayedDecimals,
|
||||
transferAmountUnits,
|
||||
} = require("../../shared/transferAmount");
|
||||
const {
|
||||
CODES,
|
||||
FEE_PENDING,
|
||||
@@ -306,17 +310,8 @@ async function estimateGas(txInfo) {
|
||||
});
|
||||
} else {
|
||||
const contract = new Contract(txInfo.token, ERC20_ABI, provider);
|
||||
// The scale the screen is rendering with, not the contract's own
|
||||
// answer: the estimate has to be for the transfer that would be
|
||||
// signed, and that one is encoded from what was displayed. See
|
||||
// transferAmount.js. A pending transaction that carries no usable
|
||||
// scale throws here, which reports the fee as unknown and leaves
|
||||
// Send blocked — an amount that cannot be checked against the
|
||||
// screen is never estimated for, let alone sent.
|
||||
const amount = parseUnits(
|
||||
txInfo.amount,
|
||||
displayedDecimals(txInfo.tokenDecimals),
|
||||
);
|
||||
const decimals = await contract.decimals();
|
||||
const amount = parseUnits(txInfo.amount, decimals);
|
||||
gasLimit = await contract.transfer.estimateGas(txInfo.to, amount, {
|
||||
from: txInfo.from,
|
||||
});
|
||||
@@ -404,7 +399,7 @@ function clearPassword() {
|
||||
hideError("confirm-tx-password-error");
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
function init(ctx) {
|
||||
onViewLeave("confirm-tx", clearPassword);
|
||||
|
||||
$("btn-confirm-send").addEventListener("click", async () => {
|
||||
@@ -426,11 +421,8 @@ function init(_ctx) {
|
||||
wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
showError(
|
||||
"confirm-tx-password-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
);
|
||||
} catch (e) {
|
||||
showError("confirm-tx-password-error", "Wrong password.");
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -458,16 +450,8 @@ function init(_ctx) {
|
||||
ERC20_ABI,
|
||||
connectedSigner,
|
||||
);
|
||||
// The contract's decimals() is read to be COMPARED with the
|
||||
// scale the screen rendered this amount at, not to encode with:
|
||||
// encoding from it signs whatever the contract answers now,
|
||||
// which is not what the user read. A disagreement throws and is
|
||||
// reported on the error screen. See transferAmount.js.
|
||||
const amount = transferAmountUnits(
|
||||
pendingTx.amount,
|
||||
pendingTx.tokenDecimals,
|
||||
await contract.decimals(),
|
||||
);
|
||||
const decimals = await contract.decimals();
|
||||
const amount = parseUnits(pendingTx.amount, decimals);
|
||||
tx = await contract.transfer(pendingTx.to, amount);
|
||||
}
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ const {
|
||||
addressHoldsFunds,
|
||||
balanceLinesForAddress,
|
||||
} = require("./helpers");
|
||||
const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
|
||||
const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
|
||||
const { walletHasRecoveryPhrase } = require("../../shared/wallet");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const {
|
||||
@@ -84,16 +84,16 @@ function recoveryPathText(wallet) {
|
||||
// own: the rendered lines round to four decimals, so a sentence built from a
|
||||
// rounded number would report "0.0000 ETH" for an address holding real money.
|
||||
// The lines below it carry the amounts, in the same format as Home and
|
||||
// AddressDetail, followed by the USD total when there is one to give — no
|
||||
// total line at all on testnet or before the first price fetch, and no figure
|
||||
// when every holding here is one with no price, since "$0.00" directly under
|
||||
// "This address holds a balance." is a contradiction.
|
||||
// AddressDetail, followed by the USD total when prices are known (null on
|
||||
// testnet and before the first price fetch, where the line is left off rather
|
||||
// than printed as $0.00).
|
||||
function balanceWarningHtml(addr) {
|
||||
if (!addressHoldsFunds(addr)) return " ";
|
||||
const line = formatAddressTotal(getAddressValue(addr));
|
||||
const total = line
|
||||
? `<div class="text-xs text-muted mt-1">${line}</div>`
|
||||
: "";
|
||||
const usd = getAddressValueUsd(addr);
|
||||
const total =
|
||||
usd === null
|
||||
? ""
|
||||
: `<div class="text-xs text-muted mt-1">Total: ${formatUsd(usd)}</div>`;
|
||||
return (
|
||||
`<p class="mb-1">This address holds a balance. Removing it does not ` +
|
||||
`move or spend anything; the balance stays at the address.</p>` +
|
||||
|
||||
@@ -73,9 +73,8 @@ function init(_ctx) {
|
||||
// Verify password against the wallet's encrypted data
|
||||
try {
|
||||
await decryptWithPassword(wallet.encryptedSecret, pw);
|
||||
} catch {
|
||||
$("delete-wallet-flash").textContent =
|
||||
"That password is incorrect. Please try again.";
|
||||
} catch (_e) {
|
||||
$("delete-wallet-flash").textContent = "Wrong password.";
|
||||
$("delete-wallet-flash").style.visibility = "visible";
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
|
||||
@@ -112,7 +112,7 @@ function show(walletIdx, addrIdx) {
|
||||
async function reveal() {
|
||||
const password = $("export-privkey-password").value;
|
||||
if (!password) {
|
||||
fail("Please enter your password.");
|
||||
fail("Password is required.");
|
||||
return;
|
||||
}
|
||||
if (walletIndex === null) {
|
||||
@@ -144,7 +144,7 @@ async function reveal() {
|
||||
$("export-privkey-flash").style.visibility = "hidden";
|
||||
} catch {
|
||||
if (!isCurrentReveal(generation)) return;
|
||||
fail("That password is incorrect. Please try again.");
|
||||
fail("That password is not correct. Please try again.");
|
||||
} finally {
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
|
||||
@@ -1,9 +1,12 @@
|
||||
// Shared DOM helpers used by all views.
|
||||
|
||||
const { isDebug } = require("../../shared/log");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { markViewRendered } = require("../viewRouter");
|
||||
|
||||
// When views are added, removed, or transitions between them change,
|
||||
// update the view-navigation documentation in README.md to match.
|
||||
@@ -73,10 +76,6 @@ function showView(name) {
|
||||
}
|
||||
clearFlash();
|
||||
state.currentView = name;
|
||||
// A view's show() ends here, so this is where the Back path learns the
|
||||
// view is no longer the blank template from index.html and must not be
|
||||
// rendered a second time. See viewRouter.js.
|
||||
markViewRendered(name);
|
||||
saveState();
|
||||
updateDebugBanner(name);
|
||||
}
|
||||
@@ -112,19 +111,12 @@ function updateDebugBanner(viewName) {
|
||||
}
|
||||
}
|
||||
|
||||
// Callback that renders a view being navigated BACK onto. Set once by
|
||||
// index.js via setBackRenderer(), which routes the view through the same
|
||||
// per-view render and data guards restoreView() uses.
|
||||
//
|
||||
// It answers true when it took the navigation — the view is rendered and
|
||||
// shown, or its backing data was gone and it fell back — and false for a
|
||||
// view the popup does not render from persisted state. Those can only be
|
||||
// on the stack from this page load, because the stack is filtered on load,
|
||||
// so they have already been rendered and only need unhiding.
|
||||
let _renderBack = null;
|
||||
// Callback to re-render the main/home view when navigating back to it.
|
||||
// Set once by index.js via setRenderMain().
|
||||
let _renderMain = null;
|
||||
|
||||
function setBackRenderer(fn) {
|
||||
_renderBack = fn;
|
||||
function setRenderMain(fn) {
|
||||
_renderMain = fn;
|
||||
}
|
||||
|
||||
// Push the current view onto the navigation stack so goBack() can
|
||||
@@ -144,11 +136,9 @@ function goBack() {
|
||||
} else {
|
||||
target = "main";
|
||||
}
|
||||
// A popped view is landed on, not navigated to. If the popup has been
|
||||
// closed and reopened since the view was pushed, nothing has ever
|
||||
// rendered it in this page load and its template is still blank, so it
|
||||
// has to be rendered here rather than merely unhidden.
|
||||
if (_renderBack && _renderBack(target)) return;
|
||||
if (target === "main" && _renderMain) {
|
||||
_renderMain();
|
||||
}
|
||||
showView(target);
|
||||
}
|
||||
|
||||
@@ -480,7 +470,7 @@ module.exports = {
|
||||
showView,
|
||||
onViewLeave,
|
||||
updateDebugBanner,
|
||||
setBackRenderer,
|
||||
setRenderMain,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
|
||||
@@ -2,6 +2,7 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
balanceLinesForAddress,
|
||||
isoDate,
|
||||
timeAgo,
|
||||
@@ -14,7 +15,6 @@ const {
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState, currentAddress } = require("../../shared/state");
|
||||
const { notify } = require("../../shared/browserApi");
|
||||
const {
|
||||
updateSendBalance,
|
||||
renderSendTokenSelect,
|
||||
@@ -28,9 +28,8 @@ const {
|
||||
} = require("../../shared/walletDefects");
|
||||
const {
|
||||
formatUsd,
|
||||
formatAddressTotal,
|
||||
getPrice,
|
||||
getAddressValue,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
@@ -72,7 +71,9 @@ function renderTotalValue() {
|
||||
el.textContent = ethStr + ethUsd;
|
||||
|
||||
if (subEl) {
|
||||
subEl.innerHTML = formatAddressTotal(getAddressValue(addr)) || " ";
|
||||
const totalUsd = getAddressValueUsd(addr);
|
||||
subEl.innerHTML =
|
||||
totalUsd !== null ? "Total: " + formatUsd(totalUsd) : " ";
|
||||
}
|
||||
}
|
||||
|
||||
@@ -256,8 +257,8 @@ function walletListHtml() {
|
||||
html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
|
||||
html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
|
||||
html += `</div>`;
|
||||
const addrTotal = formatAddressTotal(getAddressValue(addr));
|
||||
html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrTotal || " "}</div>`;
|
||||
const addrUsd = formatUsd(getAddressValueUsd(addr));
|
||||
html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrUsd || " "}</div>`;
|
||||
html += balanceLinesForAddress(
|
||||
addr,
|
||||
state.trackedTokens,
|
||||
@@ -292,7 +293,11 @@ function render(ctx) {
|
||||
state.activeAddress = addr;
|
||||
await saveState();
|
||||
render(ctx);
|
||||
notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
const runtime =
|
||||
typeof browser !== "undefined"
|
||||
? browser.runtime
|
||||
: chrome.runtime;
|
||||
runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -57,7 +57,7 @@ function show() {
|
||||
attachCopyHandlers("view-receive");
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
function init(ctx) {
|
||||
$("btn-receive-copy").addEventListener("click", () => {
|
||||
const addr = $("receive-address-block").dataset.full;
|
||||
if (addr) {
|
||||
|
||||
@@ -4,6 +4,7 @@ const {
|
||||
$,
|
||||
showFlash,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
@@ -209,7 +210,7 @@ function init(_ctx) {
|
||||
}
|
||||
resolvedTo = resolved;
|
||||
ensName = to;
|
||||
} catch {
|
||||
} catch (e) {
|
||||
showFlash("Failed to resolve ENS name.");
|
||||
return;
|
||||
}
|
||||
@@ -220,11 +221,6 @@ function init(_ctx) {
|
||||
|
||||
let tokenSymbol = null;
|
||||
let tokenBalance = null;
|
||||
// The scale the amount and the balance below are rendered at, carried
|
||||
// forward so the transfer is encoded with the number the user read
|
||||
// rather than with whatever the contract answers at signing time. See
|
||||
// src/shared/transferAmount.js.
|
||||
let tokenDecimals = null;
|
||||
if (token !== "ETH") {
|
||||
const tb = (addr.tokenBalances || []).find(
|
||||
(t) => t.address.toLowerCase() === token.toLowerCase(),
|
||||
@@ -235,7 +231,6 @@ function init(_ctx) {
|
||||
state.trackedTokens,
|
||||
);
|
||||
tokenBalance = tb ? tb.balance || "0" : "0";
|
||||
tokenDecimals = tb ? tb.decimals : null;
|
||||
}
|
||||
|
||||
ctx.showConfirmTx({
|
||||
@@ -247,7 +242,6 @@ function init(_ctx) {
|
||||
balance: addr.balance,
|
||||
tokenSymbol: tokenSymbol,
|
||||
tokenBalance: tokenBalance,
|
||||
tokenDecimals: tokenDecimals,
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
@@ -9,11 +9,8 @@ const {
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { applyTheme } = require("../theme");
|
||||
const {
|
||||
DUST_THRESHOLD_MESSAGE,
|
||||
parseDustThresholdGwei,
|
||||
} = require("../dustThreshold");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
|
||||
const { onChainSwitch } = require("../../shared/chainSwitch");
|
||||
const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
|
||||
const deleteWallet = require("./deleteWallet");
|
||||
@@ -28,7 +25,8 @@ const {
|
||||
GITEA_COMMIT_URL,
|
||||
} = require("../../shared/buildInfo");
|
||||
|
||||
const { notify } = require("../../shared/browserApi");
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
let versionClickCount = 0;
|
||||
let versionClickTimer = null;
|
||||
@@ -59,7 +57,7 @@ function renderSiteList(containerId, siteMap, stateKey) {
|
||||
}
|
||||
}
|
||||
await saveState();
|
||||
notify({ type: "AUTISTMASK_REMOVE_SITE" });
|
||||
runtime.sendMessage({ type: "AUTISTMASK_REMOVE_SITE" });
|
||||
renderSiteList(containerId, state[key], key);
|
||||
});
|
||||
});
|
||||
@@ -167,7 +165,10 @@ function renderWalletListSettings() {
|
||||
function show() {
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
$("settings-network").value = state.networkId;
|
||||
const networkSelect = $("settings-network");
|
||||
if (networkSelect) {
|
||||
networkSelect.value = state.networkId;
|
||||
}
|
||||
renderTrackedTokens();
|
||||
renderSiteLists();
|
||||
renderWalletListSettings();
|
||||
@@ -279,13 +280,15 @@ function init(ctx) {
|
||||
});
|
||||
|
||||
const networkSelect = $("settings-network");
|
||||
networkSelect.addEventListener("change", async () => {
|
||||
const newId = networkSelect.value;
|
||||
const net = await onChainSwitch(newId);
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
showFlash("Switched to " + net.name + ".");
|
||||
});
|
||||
if (networkSelect) {
|
||||
networkSelect.addEventListener("change", async () => {
|
||||
const newId = networkSelect.value;
|
||||
const net = await onChainSwitch(newId);
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
showFlash("Switched to " + net.name + ".");
|
||||
});
|
||||
}
|
||||
|
||||
$("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
|
||||
$("settings-show-zero-balances").addEventListener("change", async () => {
|
||||
@@ -326,14 +329,13 @@ function init(ctx) {
|
||||
|
||||
$("settings-dust-threshold").value = state.dustThresholdGwei;
|
||||
$("settings-dust-threshold").addEventListener("change", async () => {
|
||||
const val = parseDustThresholdGwei($("settings-dust-threshold").value);
|
||||
// Rejected input is never coerced. The field is put back to the
|
||||
// stored threshold so it never shows a value the wallet is not
|
||||
// using, and the message says what the field wants so the snap-back
|
||||
// is explained rather than silent.
|
||||
if (val === null) {
|
||||
showFlash(DUST_THRESHOLD_MESSAGE);
|
||||
} else {
|
||||
const raw = $("settings-dust-threshold").value.trim();
|
||||
const val = Number(raw);
|
||||
// 0 is accepted and means "hide nothing". Empty, negative,
|
||||
// fractional and non-numeric input is rejected outright rather than
|
||||
// coerced, and the field is put back to the stored threshold so it
|
||||
// never shows a value the wallet is not using.
|
||||
if (raw !== "" && Number.isInteger(val) && val >= 0) {
|
||||
state.dustThresholdGwei = val;
|
||||
await saveState();
|
||||
}
|
||||
|
||||
@@ -126,7 +126,7 @@ async function reveal() {
|
||||
if (!isCurrentReveal(generation)) return;
|
||||
// Deliberately not the caught error: the message is fixed so that
|
||||
// nothing derived from the ciphertext or the attempt can surface.
|
||||
fail("That password is incorrect. Please try again.");
|
||||
fail("That password is not correct. Please try again.");
|
||||
} finally {
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
|
||||
@@ -23,6 +23,8 @@ const makeBlockie = require("ethereum-blockies-base64");
|
||||
const { log, debugFetch } = require("../../shared/log");
|
||||
const { decodeCalldata } = require("./approval");
|
||||
|
||||
let ctx;
|
||||
|
||||
/**
|
||||
* Determine a human-readable transaction type string from tx fields.
|
||||
*/
|
||||
@@ -164,7 +166,7 @@ function render() {
|
||||
if (el) el.classList.add("hidden");
|
||||
}
|
||||
|
||||
loadFullTxDetails(tx.hash, tx.to);
|
||||
loadFullTxDetails(tx.hash, tx.to, tx.isContractCall);
|
||||
|
||||
const isoStr = isoDate(tx.timestamp);
|
||||
$("tx-detail-time").innerHTML =
|
||||
@@ -272,7 +274,7 @@ function populateOnChainDetails(txData) {
|
||||
}
|
||||
}
|
||||
|
||||
async function loadFullTxDetails(txHash, toAddress) {
|
||||
async function loadFullTxDetails(txHash, toAddress, isContractCall) {
|
||||
const section = $("tx-detail-calldata-section");
|
||||
const actionEl = $("tx-detail-calldata-action");
|
||||
const detailsEl = $("tx-detail-calldata-details");
|
||||
@@ -347,9 +349,8 @@ async function loadFullTxDetails(txHash, toAddress) {
|
||||
}
|
||||
}
|
||||
|
||||
// The ctx this view is initialized with is unused: this module is the leaf of
|
||||
// the navigation, and the other views reach it through their own ctx.
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("btn-tx-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
|
||||
@@ -12,7 +12,7 @@ const {
|
||||
clearViewStack,
|
||||
} = require("./helpers");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const { state, currentNetwork } = require("../../shared/state");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { log } = require("../../shared/log");
|
||||
|
||||
@@ -229,6 +229,10 @@ function tokenLabel(address) {
|
||||
return t ? t.symbol : null;
|
||||
}
|
||||
|
||||
function etherscanTokenLink(address) {
|
||||
return `${currentNetwork().explorerUrl}/token/${address}`;
|
||||
}
|
||||
|
||||
function decodedDetailsHtml(decoded) {
|
||||
if (!decoded || !decoded.details) return "";
|
||||
let html = `<div class="border border-border border-dashed p-2 mb-3">`;
|
||||
|
||||
@@ -17,31 +17,23 @@
|
||||
// run finished and the alarm fires one run-duration earlier than that. Every
|
||||
// guard must therefore either be strictly shorter than the period it gates or
|
||||
// be bypassed on the scheduled tick — see backgroundRefresh() in
|
||||
// src/background/index.js.
|
||||
|
||||
const { alarmsApi } = require("./browserApi");
|
||||
// src/background/index.js and updatePhishingList() in shared/phishingDomains.js.
|
||||
|
||||
const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
|
||||
|
||||
// Alarms this extension used to create and no longer has a handler for. A
|
||||
// browser keeps an alarm until something clears it, so a job that is deleted
|
||||
// from the code goes on waking the service worker on its old schedule forever,
|
||||
// on every install that ever ran the version which created it. Removing the job
|
||||
// means removing the alarm, so retired names are listed here and cleared on
|
||||
// every start until the installs that carry them are long gone.
|
||||
const OBSOLETE_ALARMS = [
|
||||
// The 24-hour phishing blocklist refresh, retired when the runtime fetch
|
||||
// was removed and the list became purely build-time vendored.
|
||||
"autistmask-phishing-refresh",
|
||||
];
|
||||
const PHISHING_REFRESH_ALARM = "autistmask-phishing-refresh";
|
||||
|
||||
const MIN_ALARM_PERIOD_MINUTES = 1;
|
||||
const BALANCE_REFRESH_PERIOD_MINUTES = 1;
|
||||
const PHISHING_REFRESH_PERIOD_MINUTES = 24 * 60;
|
||||
|
||||
// alarmsApi() resolves on use rather than at module load: the worker is torn
|
||||
// Resolved on use rather than captured at module load: the worker is torn
|
||||
// down and re-evaluated repeatedly, and tests install a stub after requiring
|
||||
// this module. It returns null where the API is absent, which is why every
|
||||
// entry point below degrades instead of throwing.
|
||||
// the module.
|
||||
function alarmsApi() {
|
||||
if (typeof browser !== "undefined" && browser.alarms) return browser.alarms;
|
||||
if (typeof chrome !== "undefined" && chrome.alarms) return chrome.alarms;
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create an alarm unless one with the requested period already exists.
|
||||
@@ -75,34 +67,22 @@ async function ensureAlarm(name, periodInMinutes) {
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear every alarm this extension no longer handles.
|
||||
* Ensure both recurring background jobs are scheduled. Safe to call on every
|
||||
* worker start, on onInstalled and on onStartup.
|
||||
*
|
||||
* @returns {Promise<string[]>} the retired alarms this call actually cleared.
|
||||
*/
|
||||
async function clearObsoleteAlarms() {
|
||||
const api = alarmsApi();
|
||||
if (!api || !api.clear) return [];
|
||||
const cleared = [];
|
||||
for (const name of OBSOLETE_ALARMS) {
|
||||
if (await api.clear(name)) cleared.push(name);
|
||||
}
|
||||
return cleared;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure the recurring background jobs are scheduled, and that retired ones are
|
||||
* not. Safe to call on every worker start, on onInstalled and on onStartup.
|
||||
*
|
||||
* @returns {Promise<{balance: boolean, cleared: string[]}>} which alarms this
|
||||
* call had to create, and which retired ones it removed.
|
||||
* @returns {Promise<{balance: boolean, phishing: boolean}>} which alarms this
|
||||
* call had to create.
|
||||
*/
|
||||
async function ensureRecurringAlarms() {
|
||||
const balance = await ensureAlarm(
|
||||
BALANCE_REFRESH_ALARM,
|
||||
BALANCE_REFRESH_PERIOD_MINUTES,
|
||||
);
|
||||
const cleared = await clearObsoleteAlarms();
|
||||
return { balance, cleared };
|
||||
const phishing = await ensureAlarm(
|
||||
PHISHING_REFRESH_ALARM,
|
||||
PHISHING_REFRESH_PERIOD_MINUTES,
|
||||
);
|
||||
return { balance, phishing };
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -124,10 +104,10 @@ function registerAlarmHandlers(handlers) {
|
||||
|
||||
module.exports = {
|
||||
BALANCE_REFRESH_ALARM,
|
||||
OBSOLETE_ALARMS,
|
||||
PHISHING_REFRESH_ALARM,
|
||||
MIN_ALARM_PERIOD_MINUTES,
|
||||
BALANCE_REFRESH_PERIOD_MINUTES,
|
||||
clearObsoleteAlarms,
|
||||
PHISHING_REFRESH_PERIOD_MINUTES,
|
||||
ensureAlarm,
|
||||
ensureRecurringAlarms,
|
||||
registerAlarmHandlers,
|
||||
|
||||
@@ -1,213 +0,0 @@
|
||||
// Preparation of the transaction an approval screen displays.
|
||||
//
|
||||
// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
|
||||
// The nonce, the gas limit and the fees have to be filled in from the network
|
||||
// before anything can be signed, and whoever fills them in decides what the
|
||||
// user is shown. That work used to happen in the popup, after the user had
|
||||
// already approved: the numbers on the approval screen came from the popup and
|
||||
// were compared against nothing, so a compromised popup could display one fee
|
||||
// and sign another, and the ceilings in approvalVerify.js were all that stood
|
||||
// between the user and a fee that hands the validator the balance.
|
||||
//
|
||||
// So it happens here instead, in the background, before the approval window is
|
||||
// opened. The background populates the transaction, shows that object, and
|
||||
// verifies the signed artifact against that same object — the popup is handed
|
||||
// a finished transaction and signs it as given. Every field the user reads is
|
||||
// then a field that is compared.
|
||||
//
|
||||
// The cost is an RPC round trip before the approval window exists. Nothing is
|
||||
// displayed while it is in flight, and a failure — an unreachable node, a
|
||||
// reverting gas estimate, a transaction type this wallet does not sign, a fee
|
||||
// past the ceilings — means no approval and no window at all: the error goes
|
||||
// back to the requesting page, which is where the user's click came from. That
|
||||
// is deliberate. The alternative, opening the window first and populating
|
||||
// behind a spinner, needs a pending approval that exists before it can be
|
||||
// displayed or signed, and a half-initialised approval is exactly the state
|
||||
// the settle interlock in the background exists to keep out of that record.
|
||||
// The failure also lands earlier than it used to rather than later: the same
|
||||
// estimate previously failed after the user had typed their password.
|
||||
|
||||
const {
|
||||
VoidSigner,
|
||||
accessListify,
|
||||
getAddress,
|
||||
getBytes,
|
||||
hexlify,
|
||||
toQuantity,
|
||||
} = require("ethers");
|
||||
const {
|
||||
ALLOWED_TX_TYPES,
|
||||
SERIALIZED_FIELDS,
|
||||
assertWithinCeilings,
|
||||
} = require("./approvalVerify");
|
||||
|
||||
// How long the population may take before the request is failed back to the
|
||||
// page. Without a bound a hung RPC endpoint leaves the dApp's promise pending
|
||||
// forever with nothing on screen to explain it; ethers' own request timeout is
|
||||
// minutes long, which is not a wait anyone will sit through.
|
||||
const POPULATE_TIMEOUT_MS = 20000;
|
||||
|
||||
// The request fields taken from the page. Anything else is dropped rather than
|
||||
// passed to ethers: the object is page-controlled, and a future ethers that
|
||||
// learns to carry a new transaction field must not start picking one up out of
|
||||
// it without this module knowing.
|
||||
const REQUEST_FIELDS = [
|
||||
"to",
|
||||
"value",
|
||||
"data",
|
||||
"nonce",
|
||||
"gasLimit",
|
||||
"gasPrice",
|
||||
"maxFeePerGas",
|
||||
"maxPriorityFeePerGas",
|
||||
"chainId",
|
||||
"accessList",
|
||||
"type",
|
||||
];
|
||||
|
||||
class ApprovalPrepareError extends Error {
|
||||
constructor(message) {
|
||||
super(message);
|
||||
this.name = "ApprovalPrepareError";
|
||||
}
|
||||
}
|
||||
|
||||
function fail(message) {
|
||||
return new ApprovalPrepareError(message);
|
||||
}
|
||||
|
||||
function present(v) {
|
||||
return v !== null && v !== undefined && v !== "";
|
||||
}
|
||||
|
||||
// These strings reach the user through the requesting page, so they are full
|
||||
// sentences even when the tail of one came from ethers or from the node.
|
||||
function sentence(text) {
|
||||
return /[.!?]$/.test(text) ? text : text + ".";
|
||||
}
|
||||
|
||||
// Reject a promise that has taken too long, and never leave the timer behind.
|
||||
async function withTimeout(promise, ms, message) {
|
||||
let timer = null;
|
||||
try {
|
||||
return await Promise.race([
|
||||
promise,
|
||||
new Promise((_resolve, reject) => {
|
||||
timer = setTimeout(() => reject(fail(message)), ms);
|
||||
}),
|
||||
]);
|
||||
} finally {
|
||||
if (timer !== null) clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
// The page's request, reduced to the fields this wallet acts on.
|
||||
function requestFrom(txParams, from) {
|
||||
const request = { from: getAddress(from) };
|
||||
for (const key of REQUEST_FIELDS) {
|
||||
if (present(txParams[key])) request[key] = txParams[key];
|
||||
}
|
||||
if (
|
||||
present(request.type) &&
|
||||
!ALLOWED_TX_TYPES.includes(Number(request.type))
|
||||
) {
|
||||
throw fail(
|
||||
"The site asked for a transaction of a type this wallet does not sign.",
|
||||
);
|
||||
}
|
||||
return request;
|
||||
}
|
||||
|
||||
// Turn a populated transaction into the object that crosses to the popup, is
|
||||
// displayed, and is compared with the signed artifact. It carries exactly the
|
||||
// fields its type serializes, plus the address it is to be signed by, and
|
||||
// every quantity as a hex string: extension messaging is JSON, which has no
|
||||
// bigint, and a field that did not survive the trip would be a field the user
|
||||
// was shown and nothing compared.
|
||||
function serializeApprovedTx(populated, from) {
|
||||
const type = Number(populated.type);
|
||||
if (!ALLOWED_TX_TYPES.includes(type)) {
|
||||
throw fail(
|
||||
"This transaction would have to be sent as a type this wallet does not sign.",
|
||||
);
|
||||
}
|
||||
const approved = { type, from: getAddress(from) };
|
||||
for (const key of SERIALIZED_FIELDS[type]) {
|
||||
if (key === "to") {
|
||||
approved.to = present(populated.to)
|
||||
? getAddress(populated.to)
|
||||
: null;
|
||||
} else if (key === "data") {
|
||||
approved.data = present(populated.data)
|
||||
? hexlify(getBytes(populated.data))
|
||||
: "0x";
|
||||
} else if (key === "accessList") {
|
||||
approved.accessList = accessListify(populated.accessList || []);
|
||||
} else if (key === "value") {
|
||||
approved.value = toQuantity(populated.value || 0);
|
||||
} else if (!present(populated[key])) {
|
||||
// Unreachable while populateTransaction() fills every quantity of
|
||||
// the type it produced. If it ever does not, the approval must not
|
||||
// be raised: an unfixed quantity is one the artifact cannot be
|
||||
// checked against.
|
||||
throw fail(
|
||||
"The transaction could not be prepared: the network did not supply a " +
|
||||
key +
|
||||
".",
|
||||
);
|
||||
} else {
|
||||
approved[key] = toQuantity(populated[key]);
|
||||
}
|
||||
}
|
||||
return approved;
|
||||
}
|
||||
|
||||
// Populate the transaction a site asked for, as the address it will be signed
|
||||
// by, and return the object to display, sign and verify against. Throws with a
|
||||
// full sentence when no approval can be raised.
|
||||
async function prepareApprovalTx(provider, from, txParams) {
|
||||
if (!present(from)) {
|
||||
throw fail("There is no active address to send this transaction from.");
|
||||
}
|
||||
const request = requestFrom(txParams || {}, from);
|
||||
|
||||
let populated;
|
||||
try {
|
||||
// The sequence ethers' own sendTransaction() runs internally, so the
|
||||
// nonce, gas, fee and chain id are populated exactly as they were when
|
||||
// the popup did this. VoidSigner cannot sign, which is the point: the
|
||||
// background prepares, the popup signs.
|
||||
populated = await withTimeout(
|
||||
new VoidSigner(getAddress(from), provider).populateTransaction(
|
||||
request,
|
||||
),
|
||||
POPULATE_TIMEOUT_MS,
|
||||
"The transaction could not be prepared: the network did not answer in time.",
|
||||
);
|
||||
} catch (e) {
|
||||
if (e instanceof ApprovalPrepareError) throw e;
|
||||
throw fail(
|
||||
sentence(
|
||||
"The transaction could not be prepared: " +
|
||||
(e.shortMessage ||
|
||||
e.message ||
|
||||
"the network did not answer"),
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
const approved = serializeApprovedTx(populated, from);
|
||||
// The backstop, applied before the user is shown anything rather than
|
||||
// after they have approved it: what is displayed here is what gets signed,
|
||||
// so an RPC node reporting an absurd fee has to be refused here.
|
||||
assertWithinCeilings(approved);
|
||||
return approved;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
prepareApprovalTx,
|
||||
serializeApprovedTx,
|
||||
ApprovalPrepareError,
|
||||
POPULATE_TIMEOUT_MS,
|
||||
REQUEST_FIELDS,
|
||||
};
|
||||
@@ -7,13 +7,6 @@
|
||||
// the signer from the artifact and checks it against the approval it is
|
||||
// holding before acting on it. All recovery is delegated to ethers.
|
||||
//
|
||||
// What the artifact is checked against is the transaction the background
|
||||
// populated and the popup displayed (see approvalTx.js), not the request the
|
||||
// dApp made. The two differ in every field a dApp normally leaves out — nonce,
|
||||
// gas limit, fees — and those are the fields the user reads off the approval
|
||||
// screen, so comparing against the request would leave the numbers on screen
|
||||
// vouched for by nothing.
|
||||
//
|
||||
// The check is an allowlist, in both directions, because a denylist cannot be
|
||||
// correct against a transaction format that keeps gaining fields:
|
||||
//
|
||||
@@ -38,12 +31,14 @@
|
||||
// never a warning: what the user approved is what gets broadcast, or nothing
|
||||
// does.
|
||||
//
|
||||
// The approved transaction is required to fix every field its type serializes,
|
||||
// so there is no "the approval did not say" branch to fall through: a quantity
|
||||
// the approval does not carry is a refusal, because an artifact that cannot be
|
||||
// compared with what was displayed has not been checked. The chain id is
|
||||
// checked against the selected network as well as against the approval, which
|
||||
// is what makes a cross-chain replay impossible.
|
||||
// Fields the approval does not carry are not treated as zero. The popup
|
||||
// populates nonce, gas limit, fee and chain id through populateTransaction()
|
||||
// when the requesting page did not fix them, so there is no approved value to
|
||||
// compare against; treating absent as zero would refuse every legitimate
|
||||
// transaction. Those fields are instead held to the absolute ceilings below,
|
||||
// and the chain id is always checked against the selected network rather than
|
||||
// against the approval alone, which is what makes a cross-chain replay
|
||||
// impossible.
|
||||
//
|
||||
// Every failure message is a full sentence, because these strings are shown to
|
||||
// the user and returned to the dApp.
|
||||
@@ -118,17 +113,6 @@ const FORBIDDEN_FIELDS = [
|
||||
},
|
||||
];
|
||||
|
||||
// Absolute ceilings — a BACKSTOP, not the primary control.
|
||||
//
|
||||
// The primary control is equality: every field of the artifact is compared
|
||||
// with the populated transaction the user was shown, so nothing the popup
|
||||
// signs can differ from the screen. What equality cannot bound is the
|
||||
// populated transaction itself, which is built from what the configured RPC
|
||||
// node answered — a node that reports an absurd fee gets that fee displayed,
|
||||
// and a user who does not read the fee line would approve it. These ceilings
|
||||
// bound that, and they are therefore applied where the transaction is
|
||||
// populated (approvalTx.js) as well as here.
|
||||
//
|
||||
// Above the block gas limit of every supported network (see networks.js), so
|
||||
// no transaction that could ever be included is refused by it.
|
||||
const MAX_GAS_LIMIT = 100000000n;
|
||||
@@ -240,151 +224,40 @@ function normalizeData(v) {
|
||||
return String(v).toLowerCase();
|
||||
}
|
||||
|
||||
// How each field of an approved transaction is compared with the artifact.
|
||||
// There is an entry here for every field any allowed type serializes — a test
|
||||
// pins that against SERIALIZED_FIELDS — so the comparison loop covers the
|
||||
// whole of what gets signed and cannot silently skip a field for want of a
|
||||
// comparator.
|
||||
//
|
||||
// `kind` decides how the two sides are made comparable. A `quantity` must be
|
||||
// fixed by the approval: it is one of the numbers on the approval screen, and
|
||||
// an absent one means the artifact cannot be checked against what was
|
||||
// displayed. `to`, `value`, `data` and `accessList` have canonical absent
|
||||
// forms — contract creation, zero, "0x" and the empty list — so they are
|
||||
// normalized on both sides instead.
|
||||
const APPROVED_FIELDS = {
|
||||
chainId: {
|
||||
kind: "quantity",
|
||||
label: "network",
|
||||
message:
|
||||
"The signed transaction is for a different network than the one that was approved.",
|
||||
},
|
||||
nonce: {
|
||||
kind: "quantity",
|
||||
// Quantity fields the requesting page may fix in the approval. Each is
|
||||
// compared exactly when the approval carries it, and left to the ceilings
|
||||
// above when it does not.
|
||||
const APPROVED_QUANTITIES = [
|
||||
{
|
||||
key: "nonce",
|
||||
label: "nonce",
|
||||
message: "The signed transaction does not carry the approved nonce.",
|
||||
},
|
||||
gasLimit: {
|
||||
kind: "quantity",
|
||||
{
|
||||
key: "gasLimit",
|
||||
label: "gas limit",
|
||||
message:
|
||||
"The signed transaction does not carry the approved gas limit.",
|
||||
},
|
||||
gasPrice: {
|
||||
kind: "quantity",
|
||||
{
|
||||
key: "gasPrice",
|
||||
label: "gas price",
|
||||
message:
|
||||
"The signed transaction does not carry the approved gas price.",
|
||||
},
|
||||
maxFeePerGas: {
|
||||
kind: "quantity",
|
||||
{
|
||||
key: "maxFeePerGas",
|
||||
label: "maximum fee per gas",
|
||||
message:
|
||||
"The signed transaction does not carry the approved maximum fee per gas.",
|
||||
},
|
||||
maxPriorityFeePerGas: {
|
||||
kind: "quantity",
|
||||
{
|
||||
key: "maxPriorityFeePerGas",
|
||||
label: "maximum priority fee per gas",
|
||||
message:
|
||||
"The signed transaction does not carry the approved maximum priority fee per gas.",
|
||||
},
|
||||
to: {
|
||||
kind: "address",
|
||||
label: "recipient",
|
||||
message:
|
||||
"The signed transaction does not go to the approved recipient.",
|
||||
},
|
||||
value: {
|
||||
kind: "value",
|
||||
label: "value",
|
||||
message: "The signed transaction does not carry the approved value.",
|
||||
},
|
||||
data: {
|
||||
kind: "data",
|
||||
label: "call data",
|
||||
message:
|
||||
"The signed transaction does not carry the approved call data.",
|
||||
},
|
||||
accessList: {
|
||||
kind: "accessList",
|
||||
label: "access list",
|
||||
message:
|
||||
"The signed transaction does not carry the approved access list.",
|
||||
},
|
||||
};
|
||||
|
||||
// Compare one field of the artifact with the approved transaction. A field
|
||||
// with no entry in the table above is refused rather than skipped: the loop
|
||||
// below runs over the fields the type serializes, so an unmatched key means
|
||||
// something that gets signed has no comparator at all.
|
||||
function assertFieldMatches(key, parsed, approvedTx) {
|
||||
const field = APPROVED_FIELDS[key];
|
||||
if (!field) {
|
||||
throw refuse(
|
||||
"The signed transaction carries a field this wallet cannot compare with the approval.",
|
||||
);
|
||||
}
|
||||
switch (field.kind) {
|
||||
case "quantity": {
|
||||
if (!present(approvedTx[key])) {
|
||||
throw refuse(
|
||||
"The approved transaction fixes no " +
|
||||
field.label +
|
||||
", so the signed transaction cannot be checked" +
|
||||
" against what was shown.",
|
||||
);
|
||||
}
|
||||
const approved = normalizeQuantity(approvedTx[key], field.label);
|
||||
if (normalizeQuantity(parsed[key], field.label) !== approved) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
return;
|
||||
}
|
||||
case "address":
|
||||
if (!sameAddress(parsed[key], approvedTx[key])) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
return;
|
||||
case "value":
|
||||
if (normalizeValue(parsed[key]) !== normalizeValue(approvedTx[key]))
|
||||
throw refuse(field.message);
|
||||
return;
|
||||
case "data":
|
||||
if (normalizeData(parsed[key]) !== normalizeData(approvedTx[key]))
|
||||
throw refuse(field.message);
|
||||
return;
|
||||
default:
|
||||
if (
|
||||
normalizeAccessList(parsed[key]) !==
|
||||
normalizeAccessList(approvedTx[key])
|
||||
) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The ceilings, applied to a transaction that is either about to be displayed
|
||||
// or about to be broadcast. See MAX_GAS_LIMIT above for what they are for:
|
||||
// they bound what the RPC node can talk this wallet into showing the user,
|
||||
// which is the one thing comparing the artifact with the screen cannot do.
|
||||
function assertWithinCeilings(tx) {
|
||||
if (
|
||||
present(tx.gasLimit) &&
|
||||
normalizeQuantity(tx.gasLimit, "gas limit") > MAX_GAS_LIMIT
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a gas limit no network this wallet supports can accept.",
|
||||
);
|
||||
}
|
||||
for (const key of ["gasPrice", "maxFeePerGas", "maxPriorityFeePerGas"]) {
|
||||
if (!present(tx[key])) continue;
|
||||
if (normalizeQuantity(tx[key], "fee per gas") > MAX_FEE_PER_GAS) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a fee per gas far above any plausible value.",
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
];
|
||||
|
||||
// Refuse a field only a transaction type this wallet does not sign can carry.
|
||||
// The type allowlist keeps these unreachable in production, which is exactly
|
||||
@@ -444,28 +317,10 @@ function assertCanonicalBytes(parsed, rawSignedTx) {
|
||||
// signed by the address the approval was raised for, on the network that is
|
||||
// selected. Returns the parsed ethers Transaction on success, throws
|
||||
// otherwise.
|
||||
//
|
||||
// `approvedTx` is the populated transaction the approval screen displayed, and
|
||||
// `expectedFrom` is the address that was active when the approval was raised —
|
||||
// not whichever address is active now. An address switch between approval and
|
||||
// signing therefore refuses here rather than producing a transaction from an
|
||||
// account the approval did not name.
|
||||
function verifySignedTx(
|
||||
rawSignedTx,
|
||||
approvedTx,
|
||||
expectedFrom,
|
||||
selectedChainId,
|
||||
) {
|
||||
function verifySignedTx(rawSignedTx, txParams, expectedFrom, selectedChainId) {
|
||||
if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
|
||||
throw refuse("The signed transaction is missing or malformed.");
|
||||
}
|
||||
// Nothing to compare against is a refusal like any other: an approval that
|
||||
// does not carry the transaction it displayed cannot vouch for one.
|
||||
if (!approvedTx || typeof approvedTx !== "object") {
|
||||
throw refuse(
|
||||
"There is no approved transaction to check the signed transaction against.",
|
||||
);
|
||||
}
|
||||
|
||||
let parsed;
|
||||
try {
|
||||
@@ -505,15 +360,46 @@ function verifySignedTx(
|
||||
"The signed transaction is for a different network than the one that is selected.",
|
||||
);
|
||||
}
|
||||
if (
|
||||
present(txParams.chainId) &&
|
||||
parsed.chainId !== normalizeQuantity(txParams.chainId, "network")
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction is for a different network than the one that was approved.",
|
||||
);
|
||||
}
|
||||
|
||||
// The approved fee mechanism, named before the type comparison below
|
||||
// subsumes it: the fee the user agreed to is only meaningful under the
|
||||
// mechanism it was quoted in, and saying so is more use than "a different
|
||||
// transaction type".
|
||||
if (!sameAddress(parsed.to, txParams.to)) {
|
||||
throw refuse(
|
||||
"The signed transaction does not go to the approved recipient.",
|
||||
);
|
||||
}
|
||||
if (normalizeValue(parsed.value) !== normalizeValue(txParams.value)) {
|
||||
throw refuse(
|
||||
"The signed transaction does not carry the approved value.",
|
||||
);
|
||||
}
|
||||
if (normalizeData(parsed.data) !== normalizeData(txParams.data)) {
|
||||
throw refuse(
|
||||
"The signed transaction does not carry the approved call data.",
|
||||
);
|
||||
}
|
||||
if (
|
||||
normalizeAccessList(parsed.accessList) !==
|
||||
normalizeAccessList(txParams.accessList)
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction does not carry the approved access list.",
|
||||
);
|
||||
}
|
||||
|
||||
// An approval that fixed EIP-1559 fees must not be signed as a legacy
|
||||
// transaction, and vice versa: the fee the user agreed to is only
|
||||
// meaningful under the mechanism it was quoted in.
|
||||
const approvedEip1559 =
|
||||
present(approvedTx.maxFeePerGas) ||
|
||||
present(approvedTx.maxPriorityFeePerGas);
|
||||
const approvedLegacy = present(approvedTx.gasPrice);
|
||||
present(txParams.maxFeePerGas) ||
|
||||
present(txParams.maxPriorityFeePerGas);
|
||||
const approvedLegacy = present(txParams.gasPrice);
|
||||
const signedEip1559 = parsed.type === 2;
|
||||
if (
|
||||
(approvedEip1559 && !signedEip1559) ||
|
||||
@@ -524,32 +410,27 @@ function verifySignedTx(
|
||||
);
|
||||
}
|
||||
|
||||
// The type decides which fields are compared, so it is compared first and
|
||||
// against the approval, not merely checked for membership of the
|
||||
// allowlist above.
|
||||
if (!present(approvedTx.type)) {
|
||||
throw refuse(
|
||||
"The approved transaction fixes no transaction type, so the signed transaction cannot be checked against what was shown.",
|
||||
);
|
||||
}
|
||||
if (
|
||||
BigInt(parsed.type) !==
|
||||
normalizeQuantity(approvedTx.type, "transaction type")
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction does not use the approved transaction type.",
|
||||
);
|
||||
for (const field of APPROVED_QUANTITIES) {
|
||||
if (!present(txParams[field.key])) continue;
|
||||
const approved = normalizeQuantity(txParams[field.key], field.label);
|
||||
if (normalizeQuantity(parsed[field.key], field.label) !== approved) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
}
|
||||
|
||||
// Every field this type serializes, compared with the transaction the user
|
||||
// was shown. Driving the loop off SERIALIZED_FIELDS is what keeps this
|
||||
// exhaustive: the same table decides what assertNothingUnchecked() rebuilds
|
||||
// from, so a field that gets signed and is not compared here cannot exist.
|
||||
for (const key of SERIALIZED_FIELDS[parsed.type]) {
|
||||
assertFieldMatches(key, parsed, approvedTx);
|
||||
if (parsed.gasLimit > MAX_GAS_LIMIT) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a gas limit no network this wallet supports can accept.",
|
||||
);
|
||||
}
|
||||
for (const key of ["gasPrice", "maxFeePerGas", "maxPriorityFeePerGas"]) {
|
||||
const fee = parsed[key];
|
||||
if (fee !== null && fee !== undefined && fee > MAX_FEE_PER_GAS) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a fee per gas far above any plausible value.",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
assertWithinCeilings(parsed);
|
||||
|
||||
assertNothingUnchecked(parsed);
|
||||
assertCanonicalBytes(parsed, rawSignedTx);
|
||||
@@ -602,12 +483,6 @@ const TX_STAGE_BROADCAST = "broadcast";
|
||||
// may yet succeed, so the one thing the popup must not say is "start again
|
||||
// from the site".
|
||||
const TX_STAGE_INFLIGHT = "inflight";
|
||||
// A transaction refused for a nonce that is already spoken for, either by the
|
||||
// node's own answer or by this wallet's record of what it has broadcast. It is
|
||||
// the one broadcast-stage failure that is not ambiguous: the transaction was
|
||||
// not taken, so the user is told it did not reach the network and to send it
|
||||
// again, rather than being warned that it might already be out there.
|
||||
const TX_STAGE_NONCE = "nonce";
|
||||
|
||||
function errorText(err) {
|
||||
if (typeof err === "string" && err !== "") return err;
|
||||
@@ -617,59 +492,6 @@ function errorText(err) {
|
||||
return "The transaction could not be sent.";
|
||||
}
|
||||
|
||||
// Every string a failure might carry its reason in. ethers reports the node's
|
||||
// own words in `shortMessage`, but a JSON-RPC error it could not classify is
|
||||
// nested under `error` or `info.error` with the node's message intact, and the
|
||||
// classification below has to see that too.
|
||||
function failureTexts(err) {
|
||||
if (typeof err === "string") return [err];
|
||||
if (!err || typeof err !== "object") return [];
|
||||
const texts = [];
|
||||
for (const text of [err.shortMessage, err.message, err.reason]) {
|
||||
if (text) texts.push(String(text));
|
||||
}
|
||||
const nested = err.error || (err.info && err.info.error);
|
||||
if (nested && nested.message) texts.push(String(nested.message));
|
||||
return texts;
|
||||
}
|
||||
|
||||
// What the Ethereum clients say when a transaction's nonce is already spoken
|
||||
// for: either it is below the account's next nonce, or another transaction is
|
||||
// sitting in the pool at that nonce and this one did not outbid it. Either way
|
||||
// the node answered, and its answer was that it did not take this transaction.
|
||||
//
|
||||
// "already known" is deliberately absent. A node that says it knows the
|
||||
// transaction has it, so that transaction did reach the network and the
|
||||
// ambiguous broadcast wording is the correct one for it.
|
||||
const NONCE_COLLISION_PATTERNS = [
|
||||
/nonce too low/i,
|
||||
/nonce has already been used/i,
|
||||
/invalid nonce/i,
|
||||
/oldnonce/i,
|
||||
/replacement transaction underpriced/i,
|
||||
/replacement fee too low/i,
|
||||
];
|
||||
|
||||
// ethers' own classification of the same two conditions.
|
||||
const NONCE_COLLISION_CODES = ["NONCE_EXPIRED", "REPLACEMENT_UNDERPRICED"];
|
||||
|
||||
// Whether a failed send is a nonce collision.
|
||||
function isNonceCollision(err) {
|
||||
if (!err) return false;
|
||||
if (err.code && NONCE_COLLISION_CODES.includes(err.code)) return true;
|
||||
return failureTexts(err).some((text) =>
|
||||
NONCE_COLLISION_PATTERNS.some((pattern) => pattern.test(text)),
|
||||
);
|
||||
}
|
||||
|
||||
// What both the requesting page and the popup are told about a nonce
|
||||
// collision. The node's own words ("nonce too low") are a fragment and are
|
||||
// replaced rather than passed through: they are not a sentence, and they say
|
||||
// less than the wallet knows.
|
||||
const NONCE_COLLISION_MESSAGE =
|
||||
"The transaction was not sent, because its nonce had already been used" +
|
||||
" by another transaction.";
|
||||
|
||||
// What the background does with a pending transaction approval after a failed
|
||||
// attempt: what it tells the popup, and whether the approval is spent
|
||||
// (resolved to the requesting page as an error and deleted) or left standing
|
||||
@@ -682,35 +504,16 @@ const NONCE_COLLISION_MESSAGE =
|
||||
// approval. Anything else failed before the check ran and is retryable.
|
||||
// - broadcast: always terminal. A broadcast that throws after the node
|
||||
// accepted the transaction is routine (a timeout, a dropped response, a
|
||||
// node answering "already known"), so the wallet cannot tell a transaction
|
||||
// that never left from one that is already in the mempool. The approval is
|
||||
// spent and the requesting page has been given its outcome; a second
|
||||
// attempt against it would report a second outcome for one request.
|
||||
// - nonce: terminal too, and the one case where the wallet does know the
|
||||
// transaction never left. The approval carries a nonce that is spent, so
|
||||
// the artifact signed against it can never be accepted and the user is told
|
||||
// to send it again from the site.
|
||||
//
|
||||
// The stage comes back out because a broadcast failure the node blamed on the
|
||||
// nonce is reclassified here; the caller reports the stage this returns rather
|
||||
// than the one it passed in.
|
||||
// node answering "already known"), and the popup's retry does not
|
||||
// re-broadcast these bytes — it re-runs populateTransaction() and signs
|
||||
// again at a freshly fetched pending-tag nonce. Retrying would therefore
|
||||
// put a second transaction on the chain for one approval.
|
||||
function describeTxFailure(stage, err) {
|
||||
if (
|
||||
stage === TX_STAGE_NONCE ||
|
||||
(stage === TX_STAGE_BROADCAST && isNonceCollision(err))
|
||||
) {
|
||||
return {
|
||||
error: NONCE_COLLISION_MESSAGE,
|
||||
retryable: false,
|
||||
spendApproval: true,
|
||||
stage: TX_STAGE_NONCE,
|
||||
};
|
||||
}
|
||||
const error = errorText(err);
|
||||
const retryable =
|
||||
stage === TX_STAGE_SIGN ||
|
||||
(stage === TX_STAGE_VERIFY && failureIsRetryable(err));
|
||||
return { error, retryable, spendApproval: !retryable, stage };
|
||||
return { error, retryable, spendApproval: !retryable };
|
||||
}
|
||||
|
||||
// What the popup shows and does after the background reports a failed signing
|
||||
@@ -720,20 +523,14 @@ function describeTxFailure(stage, err) {
|
||||
//
|
||||
// A failed broadcast gets its own wording: the transaction may already be on
|
||||
// the network, so telling the user to start again from the site is exactly the
|
||||
// wrong instruction. A nonce collision is the exception to that exception —
|
||||
// the transaction demonstrably did not go out, and saying it might have would
|
||||
// send the user hunting for a transaction that does not exist.
|
||||
// wrong instruction.
|
||||
function describeSigningFailure(response, fallbackMessage) {
|
||||
let message = (response && response.error) || fallbackMessage;
|
||||
if (!/[.!?]$/.test(message)) message += ".";
|
||||
const retryable = !!(response && response.retryable);
|
||||
const stage = response && response.stage;
|
||||
if (!retryable) {
|
||||
if (stage === TX_STAGE_NONCE) {
|
||||
message +=
|
||||
" The transaction did not reach the network." +
|
||||
" Please send it again from the site.";
|
||||
} else if (stage === TX_STAGE_BROADCAST) {
|
||||
if (stage === TX_STAGE_BROADCAST) {
|
||||
message +=
|
||||
" The transaction may still have reached the network." +
|
||||
" Check the account before sending it again.";
|
||||
@@ -756,23 +553,18 @@ module.exports = {
|
||||
assertNoForbiddenFields,
|
||||
assertNothingUnchecked,
|
||||
assertCanonicalBytes,
|
||||
assertWithinCeilings,
|
||||
sameAddress,
|
||||
failureIsRetryable,
|
||||
isNonceCollision,
|
||||
describeTxFailure,
|
||||
describeSigningFailure,
|
||||
ApprovalMismatchError,
|
||||
NONCE_COLLISION_MESSAGE,
|
||||
ALLOWED_TX_TYPES,
|
||||
SERIALIZED_FIELDS,
|
||||
FORBIDDEN_FIELDS,
|
||||
APPROVED_FIELDS,
|
||||
TX_STAGE_SIGN,
|
||||
TX_STAGE_VERIFY,
|
||||
TX_STAGE_BROADCAST,
|
||||
TX_STAGE_INFLIGHT,
|
||||
TX_STAGE_NONCE,
|
||||
MAX_GAS_LIMIT,
|
||||
MAX_FEE_PER_GAS,
|
||||
};
|
||||
|
||||
@@ -66,12 +66,7 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
|
||||
const balances = [];
|
||||
for (const item of items) {
|
||||
// Case-insensitive: the token type is an explorer's label, not a
|
||||
// protocol value, and an exact comparison silently drops a real
|
||||
// holding if one ever writes "erc-20". Which types are admitted
|
||||
// is unchanged.
|
||||
const type = String(item.token?.type || "").toUpperCase();
|
||||
if (type !== "ERC-20") continue;
|
||||
if (item.token?.type !== "ERC-20") continue;
|
||||
const decimals = parseInt(item.token.decimals || "18", 10);
|
||||
const bal = formatTokenBalance(item.value || "0", decimals);
|
||||
if (bal === "0.0") continue;
|
||||
|
||||
@@ -1,262 +0,0 @@
|
||||
// The one place in this tree that names `browser` or `chrome`.
|
||||
//
|
||||
// The two targets do not agree on the namespace, and they disagree about the
|
||||
// call shape only in which one is native. Chrome MV3 exposes `chrome.*`,
|
||||
// where tabs, windows and messaging take a trailing callback and report
|
||||
// failure through the global `chrome.runtime.lastError`. Firefox MV2 exposes
|
||||
// `browser.*`, where those same methods return promises — but, measured on
|
||||
// Firefox 153.0.3, it ALSO honours a trailing Chrome-style callback, returns
|
||||
// no promise when one is given, and populates `browser.runtime.lastError`.
|
||||
// The callback code that predated this module therefore ran on both, and
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/153 was filed on the belief
|
||||
// that it did not. This module exists for uniformity, not for repair: the
|
||||
// tree used to resolve the namespace with a ternary at six call sites and
|
||||
// then mix promise-form storage with callback-form messaging.
|
||||
//
|
||||
// The strategy is promises out, everywhere: one namespace, one call shape,
|
||||
// composing with the `async` handlers in the background. Callers `await`;
|
||||
// nothing outside this file has to know which browser it is running on.
|
||||
//
|
||||
// Two deliberate asymmetries, because they are what the browsers actually do
|
||||
// rather than what a uniform-looking shim would pretend:
|
||||
//
|
||||
// - Storage is called in its PROMISE form on both namespaces.
|
||||
// `chrome.storage.local.get()` returns a promise on MV3 and the popup
|
||||
// already depends on that — src/shared/state.js has always awaited it.
|
||||
// Wrapping it in a callback here would be a change, not a fix.
|
||||
// - notify() sends without a callback. It is for a message whose answer
|
||||
// nobody reads; appending a callback would only manufacture a
|
||||
// lastError/rejection for a receiver that was never expected to reply.
|
||||
//
|
||||
// Everything is resolved on use rather than captured at module load. The MV3
|
||||
// service worker is torn down and re-evaluated repeatedly, and the unit
|
||||
// suite installs its stubs on `global.chrome` around a require().
|
||||
|
||||
// The extension API namespace, preferring `browser.*` where it exists.
|
||||
//
|
||||
// Whole-namespace, never per-method: mixing `browser.tabs` with
|
||||
// `chrome.windows` would also mix promise and callback semantics inside a
|
||||
// single call path, which is the bug this module exists to remove.
|
||||
function extensionApi() {
|
||||
if (typeof browser !== "undefined" && browser) return browser;
|
||||
if (typeof chrome !== "undefined" && chrome) return chrome;
|
||||
return null;
|
||||
}
|
||||
|
||||
// True when the resolved namespace is the promise-flavoured one.
|
||||
//
|
||||
// It doubles as "this is the Gecko/MV2 build", which is a second question
|
||||
// with the same answer and one real caller: src/content/index.js has to
|
||||
// inject the inpage provider itself there, because MV2 has no
|
||||
// `"world": "MAIN"` for a manifest-declared content script.
|
||||
function hasBrowserNamespace() {
|
||||
return typeof browser !== "undefined" && !!browser;
|
||||
}
|
||||
|
||||
function namespaceMember(name) {
|
||||
const api = extensionApi();
|
||||
return (api && api[name]) || null;
|
||||
}
|
||||
|
||||
function runtimeApi() {
|
||||
return namespaceMember("runtime");
|
||||
}
|
||||
|
||||
function tabsApi() {
|
||||
return namespaceMember("tabs");
|
||||
}
|
||||
|
||||
function windowsApi() {
|
||||
return namespaceMember("windows");
|
||||
}
|
||||
|
||||
function alarmsApi() {
|
||||
return namespaceMember("alarms");
|
||||
}
|
||||
|
||||
// The toolbar button. MV3 calls it `action`, MV2 calls it `browserAction`.
|
||||
function actionApi() {
|
||||
const api = extensionApi();
|
||||
if (!api) return null;
|
||||
return api.action || api.browserAction || null;
|
||||
}
|
||||
|
||||
// `storage.local`, or null in a context that has no storage permission.
|
||||
//
|
||||
// Null rather than a throw for the one caller that genuinely degrades:
|
||||
// src/shared/phishingDomains.js falls back to its vendored blocklist and does
|
||||
// its own null check. Everything that reads or writes the wallet goes through
|
||||
// storageGet()/storageSet(), which reject instead — see there.
|
||||
function storageLocal() {
|
||||
const storage = namespaceMember("storage");
|
||||
return (storage && storage.local) || null;
|
||||
}
|
||||
|
||||
// The callback-path error channel. Read only from inside an appended
|
||||
// callback, i.e. only on the `chrome.*` path, where it is the sole way a
|
||||
// failure is reported. The background's three explicit lastError checks are
|
||||
// gone because invoke() turns it into a rejection before any caller sees it.
|
||||
function lastError() {
|
||||
const runtime = runtimeApi();
|
||||
return (runtime && runtime.lastError) || null;
|
||||
}
|
||||
|
||||
// Call `owner[method](...args)` and return a promise for its result.
|
||||
//
|
||||
// On the promise namespace the method already returns one. On the callback
|
||||
// namespace the callback is appended here and lastError becomes a rejection,
|
||||
// because a caller holding a promise has nowhere to check a global flag.
|
||||
function invoke(owner, method, ...args) {
|
||||
if (!owner || typeof owner[method] !== "function") {
|
||||
return Promise.reject(
|
||||
new Error(
|
||||
"extension API " +
|
||||
method +
|
||||
"() is not available in this context",
|
||||
),
|
||||
);
|
||||
}
|
||||
if (hasBrowserNamespace()) {
|
||||
try {
|
||||
return Promise.resolve(owner[method](...args));
|
||||
} catch (e) {
|
||||
return Promise.reject(e);
|
||||
}
|
||||
}
|
||||
return new Promise((resolve, reject) => {
|
||||
owner[method](...args, (result) => {
|
||||
const err = lastError();
|
||||
if (err) reject(new Error(err.message || String(err)));
|
||||
else resolve(result);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message to the extension's own contexts and resolve with the reply.
|
||||
*
|
||||
* Rejects when nothing is listening, on both browsers. A caller that does not
|
||||
* care must say so — see notify().
|
||||
*
|
||||
* @param {Object} message
|
||||
* @returns {Promise<*>} the receiver's response.
|
||||
*/
|
||||
function sendMessage(message) {
|
||||
return invoke(runtimeApi(), "sendMessage", message);
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message nobody is expected to answer, and swallow the fact that
|
||||
* nobody did.
|
||||
*
|
||||
* @param {Object} message
|
||||
* @returns {void}
|
||||
*/
|
||||
function notify(message) {
|
||||
const runtime = runtimeApi();
|
||||
if (!runtime || typeof runtime.sendMessage !== "function") return;
|
||||
const result = runtime.sendMessage(message);
|
||||
// MV3 hands back a promise for a one-argument send, and it rejects when
|
||||
// the background is not listening. Unhandled, that surfaces as an error
|
||||
// the e2e suites fail the run on.
|
||||
if (result && typeof result.catch === "function") result.catch(() => {});
|
||||
}
|
||||
|
||||
// These two carry the wallet. A missing `storage.local` has to reject and not
|
||||
// default: resolving {} would make an existing wallet read back as no wallet,
|
||||
// and resolving a no-op write would discard the user's state with nothing
|
||||
// logged. A caller that wants to degrade takes storageLocal() directly.
|
||||
function storageUnavailable(method) {
|
||||
return Promise.reject(
|
||||
new Error("extension storage.local is not available: " + method),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string|string[]|Object} keys
|
||||
* @returns {Promise<Object>} the stored items.
|
||||
* @throws rejects where `storage.local` is absent.
|
||||
*/
|
||||
function storageGet(keys) {
|
||||
const storage = storageLocal();
|
||||
if (!storage) return storageUnavailable("get");
|
||||
return Promise.resolve(storage.get(keys));
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} items
|
||||
* @returns {Promise<void>}
|
||||
* @throws rejects where `storage.local` is absent.
|
||||
*/
|
||||
function storageSet(items) {
|
||||
const storage = storageLocal();
|
||||
if (!storage) return storageUnavailable("set");
|
||||
return Promise.resolve(storage.set(items));
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} queryInfo
|
||||
* @returns {Promise<Array>} the matching tabs.
|
||||
*/
|
||||
function tabsQuery(queryInfo) {
|
||||
return invoke(tabsApi(), "query", queryInfo);
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message to one tab's content script.
|
||||
*
|
||||
* Rejects for a tab that has no receiver, which is most of them. That
|
||||
* rejection is the promise-shaped replacement for the runtime.lastError
|
||||
* checks the broadcast helpers used to make, and callers ignore it the same
|
||||
* way.
|
||||
*
|
||||
* @param {number} tabId
|
||||
* @param {Object} message
|
||||
* @returns {Promise<*>}
|
||||
*/
|
||||
function tabsSendMessage(tabId, message) {
|
||||
return invoke(tabsApi(), "sendMessage", tabId, message);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} createData
|
||||
* @returns {Promise<Object>} the created window.
|
||||
*/
|
||||
function windowsCreate(createData) {
|
||||
return invoke(windowsApi(), "create", createData);
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {Promise<Object>} the last focused window.
|
||||
*/
|
||||
function windowsGetLastFocused() {
|
||||
return invoke(windowsApi(), "getLastFocused");
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {number} windowId
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
function windowsRemove(windowId) {
|
||||
return invoke(windowsApi(), "remove", windowId);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
actionApi,
|
||||
alarmsApi,
|
||||
extensionApi,
|
||||
hasBrowserNamespace,
|
||||
notify,
|
||||
runtimeApi,
|
||||
sendMessage,
|
||||
storageGet,
|
||||
storageLocal,
|
||||
storageSet,
|
||||
tabsApi,
|
||||
tabsQuery,
|
||||
tabsSendMessage,
|
||||
windowsApi,
|
||||
windowsCreate,
|
||||
windowsGetLastFocused,
|
||||
windowsRemove,
|
||||
};
|
||||
@@ -19,26 +19,9 @@ async function onChainSwitch(newNetworkId) {
|
||||
const net = networkById(newNetworkId);
|
||||
|
||||
// --- core identity ---
|
||||
// Endpoints are remembered per network rather than reset to the
|
||||
// defaults, because a user who points the wallet at their own node has
|
||||
// no way to get that URL back once it is gone: overwriting it moved
|
||||
// every address and every transaction onto a third-party endpoint
|
||||
// silently and permanently.
|
||||
//
|
||||
// state.rpcUrl / state.blockscoutUrl stay the live endpoints of the
|
||||
// active network, so nothing that reads them changes. The invariant is
|
||||
// that for the ACTIVE network those two fields are authoritative and
|
||||
// the map entry may be stale (Settings writes the fields directly);
|
||||
// for every other network the map is authoritative. Snapshotting the
|
||||
// outgoing network here, before the switch, is what reconciles them.
|
||||
state.networkEndpoints[state.networkId] = {
|
||||
rpcUrl: state.rpcUrl,
|
||||
blockscoutUrl: state.blockscoutUrl,
|
||||
};
|
||||
const remembered = state.networkEndpoints[net.id] || {};
|
||||
state.networkId = net.id;
|
||||
state.rpcUrl = remembered.rpcUrl || net.defaultRpcUrl;
|
||||
state.blockscoutUrl = remembered.blockscoutUrl || net.defaultBlockscoutUrl;
|
||||
state.rpcUrl = net.defaultRpcUrl;
|
||||
state.blockscoutUrl = net.defaultBlockscoutUrl;
|
||||
|
||||
// --- price cache ---
|
||||
// Prices are chain-specific (testnet tokens are worthless,
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
// The one definition of how a domain becomes a blocklist entry.
|
||||
//
|
||||
// The vendored phishing blocklist ships digests, not domain names: see
|
||||
// phishingDomains.js for why, and script/vendor-blocklist for how the artifact
|
||||
// is produced. Both sides have to agree exactly — a mismatch would silently
|
||||
// match nothing, which is a blocklist that quietly protects no one — so the
|
||||
// rule lives here and is required by both rather than written down twice.
|
||||
//
|
||||
// sha256 truncated to 64 bits. Truncation is what keeps the artifact small
|
||||
// enough to bundle (16 hex characters per entry rather than 64), and 64 bits is
|
||||
// far past what this has to withstand: over ~10^5 entries the chance that any
|
||||
// hostname a user visits collides with an entry it is not is about 10^-14 per
|
||||
// lookup, and a deliberate collision buys an attacker a false phishing warning
|
||||
// on a site they do not control, not a missed one. For scale, Safe Browsing
|
||||
// distributes 32-bit prefixes and resolves the rest against a server; this is
|
||||
// 32 bits more, with no server involved.
|
||||
|
||||
const { sha256, toUtf8Bytes } = require("ethers");
|
||||
|
||||
const HASH_ALGORITHM = "sha256";
|
||||
const HASH_HEX_CHARS = 16;
|
||||
|
||||
/**
|
||||
* The blocklist entry for a domain: lowercased, hashed, truncated.
|
||||
*
|
||||
* @param {string} domain
|
||||
* @returns {string} HASH_HEX_CHARS lowercase hex characters, no 0x prefix.
|
||||
*/
|
||||
function hashDomain(domain) {
|
||||
// ethers returns "0x" + 64 hex characters.
|
||||
return sha256(toUtf8Bytes(domain.toLowerCase())).slice(
|
||||
2,
|
||||
2 + HASH_HEX_CHARS,
|
||||
);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
HASH_ALGORITHM,
|
||||
HASH_HEX_CHARS,
|
||||
hashDomain,
|
||||
};
|
||||
@@ -4,7 +4,8 @@
|
||||
//
|
||||
// POPUP ONLY. localStorage does not exist in the Chrome MV3 service worker,
|
||||
// so this module must not be pulled into src/background/. Anything the
|
||||
// background context needs to cache goes in extension storage instead.
|
||||
// background context needs to cache goes in extension storage instead (see
|
||||
// shared/phishingDomains.js).
|
||||
|
||||
const { getProvider } = require("./balances");
|
||||
const { log } = require("./log");
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -1,109 +1,165 @@
|
||||
// Domain-based phishing detection against a blocklist vendored at build time.
|
||||
// Domain-based phishing detection using a vendored blocklist with delta updates.
|
||||
//
|
||||
// The list is produced by script/vendor-blocklist from a hash-pinned upstream
|
||||
// commit, committed as phishingBlocklist.json, and bundled. There is no runtime
|
||||
// fetch: the extension asks nobody anything to answer this question, so no third
|
||||
// party learns which sites a user connects to, and no third party decides what
|
||||
// this wallet warns about. The cost is staleness — the shipped list is exactly
|
||||
// as fresh as the last vendoring run that was released — and the refresh path is
|
||||
// re-running that script and shipping the diff.
|
||||
// A community-maintained phishing domain blocklist is vendored in
|
||||
// phishingBlocklist.json and bundled at build time. At runtime, we fetch
|
||||
// the live list periodically and keep only the delta (new entries not in
|
||||
// the vendored list) in memory. This keeps runtime memory usage small.
|
||||
//
|
||||
// The artifact holds digests, not domains: sha256 truncated to 64 bits, one
|
||||
// entry per 16 hex characters, concatenated in sorted order into a single
|
||||
// string (see domainHash.js). Three things follow from that shape, and all
|
||||
// three are the reason for it:
|
||||
// The domain-checker checks the in-memory delta first (fresh/recent scam
|
||||
// sites), then falls back to the vendored list.
|
||||
//
|
||||
// - the extension ships no plaintext list of anyone's domain names, which is
|
||||
// what makes a blocklist assembled elsewhere shippable here at all.
|
||||
// - a lookup is a binary search over that string. Nothing is built at module
|
||||
// load, which matters because the MV3 service worker is torn down when idle
|
||||
// and re-evaluates this file on every wake.
|
||||
// - the file is 1.7 MB rather than 8.7 MB.
|
||||
//
|
||||
// Nothing here is async: callers answer an approval prompt with the result.
|
||||
// If the delta and its fetch timestamp fit in 256 KiB they are persisted to
|
||||
// extension storage, so they survive termination of the MV3 service worker.
|
||||
// Extension storage, not localStorage: localStorage does not exist in a
|
||||
// service worker, so the previous persistence never ran on Chrome at all.
|
||||
// The stored timestamps are what keep a restarted worker from re-fetching on
|
||||
// every wake while still noticing an overdue update. Those guards apply to the
|
||||
// startup path only; the 24-hour alarm tick bypasses them, or it would veto
|
||||
// its own refresh — see updatePhishingList().
|
||||
|
||||
const vendored = require("./phishingBlocklist.json");
|
||||
const { HASH_ALGORITHM, HASH_HEX_CHARS, hashDomain } = require("./domainHash");
|
||||
const vendoredConfig = require("./phishingBlocklist.json");
|
||||
|
||||
// The artifact is generated, so a shape it does not have is a build fault, not
|
||||
// a runtime condition. It is checked anyway, and loudly, because every way of
|
||||
// getting it wrong — a stale format, a truncated file, a different digest —
|
||||
// produces a blocklist that matches nothing at all while looking perfectly
|
||||
// healthy. A phishing check that silently answers "no" to everything is the one
|
||||
// failure this module must not have.
|
||||
function checkArtifact(a) {
|
||||
const bad = (why) =>
|
||||
new Error(
|
||||
"phishingBlocklist.json " +
|
||||
why +
|
||||
". It is generated by script/vendor-blocklist; re-run that " +
|
||||
"rather than editing it.",
|
||||
);
|
||||
const BLOCKLIST_URL =
|
||||
"https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
|
||||
|
||||
if (!a || typeof a !== "object") throw bad("is not an object");
|
||||
if (a.algorithm !== HASH_ALGORITHM) {
|
||||
throw bad(
|
||||
"declares algorithm " +
|
||||
JSON.stringify(a.algorithm) +
|
||||
", but this build hashes with " +
|
||||
HASH_ALGORITHM,
|
||||
);
|
||||
const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
|
||||
|
||||
// Floor on how often an unscheduled path may hit the network. The worker is
|
||||
// revived every ~30 seconds while the browser is busy, and every revival runs
|
||||
// the startup path; without a persisted record of the last attempt, any state
|
||||
// that leaves lastFetchTime unset — a fetch that failed, or a delta too large
|
||||
// to store — would download the full list on every single wake.
|
||||
const MIN_FETCH_ATTEMPT_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
|
||||
|
||||
const DELTA_STORAGE_KEY = "phishing-delta";
|
||||
const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
|
||||
|
||||
// Vendored set — built once from the bundled JSON.
|
||||
const vendoredBlacklist = new Set(
|
||||
(vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
|
||||
);
|
||||
|
||||
// Delta set — only entries from live list that are NOT in vendored.
|
||||
let deltaBlacklist = new Set();
|
||||
let lastFetchTime = 0;
|
||||
let lastAttemptTime = 0;
|
||||
let fetchPromise = null;
|
||||
let loadPromise = null;
|
||||
|
||||
// Resolved on use rather than captured at module load, so a test can install
|
||||
// a stub after requiring the module and so the popup — which has no reason to
|
||||
// touch the delta — does not fail to load where the API is absent.
|
||||
function storageApi() {
|
||||
if (typeof browser !== "undefined" && browser.storage) {
|
||||
return browser.storage.local;
|
||||
}
|
||||
if (a.hashHexChars !== HASH_HEX_CHARS) {
|
||||
throw bad(
|
||||
"declares " +
|
||||
JSON.stringify(a.hashHexChars) +
|
||||
" hex characters per entry, but this build produces " +
|
||||
HASH_HEX_CHARS,
|
||||
);
|
||||
if (typeof chrome !== "undefined" && chrome.storage) {
|
||||
return chrome.storage.local;
|
||||
}
|
||||
if (typeof a.hashes !== "string") throw bad("has no hashes string");
|
||||
if (!Number.isInteger(a.count) || a.count < 1) {
|
||||
throw bad("declares no usable entry count");
|
||||
}
|
||||
if (a.hashes.length !== a.count * HASH_HEX_CHARS) {
|
||||
throw bad(
|
||||
"holds " +
|
||||
a.hashes.length +
|
||||
" hex characters, which is not the " +
|
||||
a.count * HASH_HEX_CHARS +
|
||||
" its count of " +
|
||||
a.count +
|
||||
" entries requires",
|
||||
);
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sanitise a timestamp read back from storage.
|
||||
*
|
||||
* A value in the future is permanent poison: every guard here measures elapsed
|
||||
* time as `Date.now() - stamp` and tests only the lower bound, so a stamp a
|
||||
* year ahead suppresses updates for a year with no path that ever clears it.
|
||||
* Clock skew and a restored profile backup both produce one. Since these
|
||||
* timestamps only ever gate work, discarding an impossible one is safe: it
|
||||
* costs at most a single extra fetch and restores a sane value immediately.
|
||||
*
|
||||
* @param {unknown} value
|
||||
* @returns {number} the timestamp, or 0 if it is unusable.
|
||||
*/
|
||||
function sanitizeTimestamp(value) {
|
||||
if (typeof value !== "number" || !Number.isFinite(value)) return 0;
|
||||
if (value <= 0 || value > Date.now()) return 0;
|
||||
return value;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load the persisted delta and its timestamps from extension storage.
|
||||
* Runs once per worker lifetime; every entry point funnels through
|
||||
* ensureDeltaLoaded() so a wake from termination restores state exactly once.
|
||||
*
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function loadDeltaFromStorage() {
|
||||
const storage = storageApi();
|
||||
if (!storage) return;
|
||||
try {
|
||||
const result = await storage.get(DELTA_STORAGE_KEY);
|
||||
const data = result && result[DELTA_STORAGE_KEY];
|
||||
if (!data) return;
|
||||
if (Array.isArray(data.blacklist)) {
|
||||
deltaBlacklist = new Set(
|
||||
data.blacklist.map((d) => d.toLowerCase()),
|
||||
);
|
||||
}
|
||||
lastFetchTime = sanitizeTimestamp(data.lastFetchTime);
|
||||
lastAttemptTime = sanitizeTimestamp(data.lastAttemptTime);
|
||||
} catch {
|
||||
// Storage unavailable or corrupt — start empty and re-fetch.
|
||||
}
|
||||
}
|
||||
|
||||
checkArtifact(vendored);
|
||||
|
||||
const HASHES = vendored.hashes;
|
||||
const COUNT = vendored.count;
|
||||
function ensureDeltaLoaded() {
|
||||
if (!loadPromise) loadPromise = loadDeltaFromStorage();
|
||||
return loadPromise;
|
||||
}
|
||||
|
||||
/**
|
||||
* Is this digest one of the vendored entries?
|
||||
* Persist the delta and its timestamps if they fit within MAX_DELTA_BYTES.
|
||||
*
|
||||
* Binary search over fixed-width records. The digests are lowercase hex of one
|
||||
* width, so lexicographic order is numeric order and the artifact is written
|
||||
* sorted; tests assert that ordering against the committed file, because an
|
||||
* unsorted artifact would fail lookups silently rather than loudly.
|
||||
* The 256 KiB cap covers the delta and its freshness claim: when the delta is
|
||||
* too large to keep, lastFetchTime goes with it, so the next start re-fetches
|
||||
* rather than trusting a freshness claim for a delta it no longer holds.
|
||||
* lastAttemptTime is written either way — it records that the network was
|
||||
* contacted, which stays true whatever became of the response, and it is what
|
||||
* stops a permanently oversized list from downloading on every worker wake.
|
||||
*
|
||||
* @param {string} hash
|
||||
* @returns {boolean}
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
function hashListed(hash) {
|
||||
let lo = 0;
|
||||
let hi = COUNT - 1;
|
||||
while (lo <= hi) {
|
||||
const mid = (lo + hi) >> 1;
|
||||
const at = HASHES.slice(
|
||||
mid * HASH_HEX_CHARS,
|
||||
(mid + 1) * HASH_HEX_CHARS,
|
||||
);
|
||||
if (at === hash) return true;
|
||||
if (at < hash) lo = mid + 1;
|
||||
else hi = mid - 1;
|
||||
async function saveDeltaToStorage() {
|
||||
const storage = storageApi();
|
||||
if (!storage) return;
|
||||
try {
|
||||
const data = {
|
||||
blacklist: Array.from(deltaBlacklist),
|
||||
lastFetchTime,
|
||||
lastAttemptTime,
|
||||
};
|
||||
const json = JSON.stringify(data);
|
||||
if (json.length < MAX_DELTA_BYTES) {
|
||||
await storage.set({ [DELTA_STORAGE_KEY]: data });
|
||||
} else if (lastAttemptTime > 0) {
|
||||
await storage.set({ [DELTA_STORAGE_KEY]: { lastAttemptTime } });
|
||||
} else {
|
||||
await storage.remove(DELTA_STORAGE_KEY);
|
||||
}
|
||||
} catch {
|
||||
// Storage unavailable — skip silently
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load a pre-parsed config and compute the delta against the vendored list.
|
||||
* Used for both live fetches and testing.
|
||||
*
|
||||
* @param {{ blacklist?: string[] }} config
|
||||
* @returns {Promise<void>} resolves once the delta has been persisted.
|
||||
*/
|
||||
function loadConfig(config) {
|
||||
const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
|
||||
|
||||
// Delta = entries in the live list that are NOT in the vendored list
|
||||
deltaBlacklist = new Set(
|
||||
liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
|
||||
);
|
||||
|
||||
lastFetchTime = Date.now();
|
||||
return saveDeltaToStorage();
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -126,33 +182,161 @@ function hostnameVariants(hostname) {
|
||||
|
||||
/**
|
||||
* Check if a hostname is on the phishing blocklist.
|
||||
* Checks delta first (fresh/recent scam sites), then vendored list.
|
||||
*
|
||||
* Synchronous by design — callers answer an approval prompt with it. On a
|
||||
* worker that has just woken, the persisted delta may still be loading; the
|
||||
* vendored list, which is bundled and always present, carries the check until
|
||||
* it lands.
|
||||
*
|
||||
* @param {string} hostname - The hostname to check.
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function isPhishingDomain(hostname) {
|
||||
if (!hostname) return false;
|
||||
for (const variant of hostnameVariants(hostname)) {
|
||||
if (hashListed(hashDomain(variant))) return true;
|
||||
const variants = hostnameVariants(hostname);
|
||||
|
||||
// Check delta blacklist first (fresh/recent scam sites), then vendored
|
||||
for (const v of variants) {
|
||||
if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the blocklist size for diagnostics.
|
||||
* Fetch the latest blocklist and compute delta against vendored data.
|
||||
* De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS,
|
||||
* counted from the persisted timestamp so the cache outlives the worker.
|
||||
*
|
||||
* `force` is what makes the 24-hour alarm actually refresh every 24 hours.
|
||||
* The alarm fires one period after the previous alarm, but lastFetchTime is
|
||||
* stamped when that fetch *completed*, so an unforced tick lands one fetch
|
||||
* latency inside its own TTL, skips, and turns the real cadence into 48 hours.
|
||||
* Shortening the TTL instead would not fix it: the worker wakes every ~30
|
||||
* seconds and the startup path re-checks the TTL each time, so a shortened TTL
|
||||
* simply becomes the real cadence. The TTL is there to stop redundant fetches
|
||||
* on wake, and the scheduled tick is not redundant, so it bypasses it.
|
||||
*
|
||||
* @param {{force?: boolean}} [opts] force: fetch unless one is already in
|
||||
* flight, ignoring both the freshness and the retry guard. For the scheduled
|
||||
* alarm tick only.
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function updatePhishingList({ force = false } = {}) {
|
||||
// A worker that has just been revived knows nothing until the persisted
|
||||
// record is back in memory; without this the freshness check below would
|
||||
// always see 0 and re-fetch on every wake.
|
||||
await ensureDeltaLoaded();
|
||||
|
||||
if (!force) {
|
||||
const now = Date.now();
|
||||
// Skip if recently fetched.
|
||||
if (lastFetchTime > 0 && now - lastFetchTime < CACHE_TTL_MS) return;
|
||||
// Skip if the network was contacted recently and the result was not
|
||||
// usable — a failed fetch or an oversized delta leaves lastFetchTime
|
||||
// unset, and without this every wake would retry.
|
||||
if (
|
||||
lastAttemptTime > 0 &&
|
||||
now - lastAttemptTime < MIN_FETCH_ATTEMPT_INTERVAL_MS
|
||||
) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// De-duplicate concurrent calls
|
||||
if (fetchPromise) return fetchPromise;
|
||||
|
||||
fetchPromise = (async () => {
|
||||
lastAttemptTime = Date.now();
|
||||
try {
|
||||
const resp = await fetch(BLOCKLIST_URL);
|
||||
if (!resp.ok) throw new Error("HTTP " + resp.status);
|
||||
const config = await resp.json();
|
||||
await loadConfig(config);
|
||||
} catch {
|
||||
// Silently fail — vendored list still provides coverage. Persist
|
||||
// the attempt so a persistently failing fetch is retried on the
|
||||
// schedule rather than on every wake.
|
||||
await saveDeltaToStorage();
|
||||
} finally {
|
||||
fetchPromise = null;
|
||||
}
|
||||
})();
|
||||
|
||||
return fetchPromise;
|
||||
}
|
||||
|
||||
/**
|
||||
* Restore persisted state and fetch if the list is overdue.
|
||||
*
|
||||
* Called from the background script every time it starts — a fresh install,
|
||||
* a browser start, and every revival of a terminated service worker all land
|
||||
* here. The recurring 24-hour schedule itself is an alarm (see
|
||||
* shared/alarms.js), not a timer, because timers die with the worker.
|
||||
*
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function initPhishingList() {
|
||||
await ensureDeltaLoaded();
|
||||
return updatePhishingList();
|
||||
}
|
||||
|
||||
/**
|
||||
* The 24-hour alarm tick. Separate from initPhishingList() because this is the
|
||||
* scheduled refresh and must not be vetoed by the guards that exist to keep
|
||||
* the unscheduled startup path off the network.
|
||||
*
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function refreshPhishingListOnSchedule() {
|
||||
return updatePhishingList({ force: true });
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the total blocklist size (vendored + delta) for diagnostics.
|
||||
*
|
||||
* @returns {number}
|
||||
*/
|
||||
function getBlocklistSize() {
|
||||
return COUNT;
|
||||
return vendoredBlacklist.size + deltaBlacklist.size;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the delta blocklist size for diagnostics.
|
||||
*
|
||||
* @returns {number}
|
||||
*/
|
||||
function getDeltaSize() {
|
||||
return deltaBlacklist.size;
|
||||
}
|
||||
|
||||
/**
|
||||
* Reset internal state (for testing).
|
||||
*/
|
||||
function _reset() {
|
||||
deltaBlacklist = new Set();
|
||||
lastFetchTime = 0;
|
||||
lastAttemptTime = 0;
|
||||
fetchPromise = null;
|
||||
loadPromise = null;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
isPhishingDomain,
|
||||
updatePhishingList,
|
||||
refreshPhishingListOnSchedule,
|
||||
initPhishingList,
|
||||
loadDeltaFromStorage,
|
||||
loadConfig,
|
||||
CACHE_TTL_MS,
|
||||
MIN_FETCH_ATTEMPT_INTERVAL_MS,
|
||||
DELTA_STORAGE_KEY,
|
||||
MAX_DELTA_BYTES,
|
||||
getBlocklistSize,
|
||||
getDeltaSize,
|
||||
hostnameVariants,
|
||||
// Exposed for testing only: the ends of the search range are where an
|
||||
// off-by-one hides, and reaching them through isPhishingDomain() would mean
|
||||
// knowing which domain hashes to the first or last entry.
|
||||
_hashListed: hashListed,
|
||||
_reset,
|
||||
// Exposed for testing only
|
||||
_getVendoredBlacklistSize: () => vendoredBlacklist.size,
|
||||
_getDeltaBlacklist: () => deltaBlacklist,
|
||||
};
|
||||
|
||||
@@ -21,7 +21,7 @@ async function refreshPrices() {
|
||||
const fetched = await getTopTokenPrices(25);
|
||||
Object.assign(prices, fetched);
|
||||
lastFetchedAt = now;
|
||||
} catch {
|
||||
} catch (e) {
|
||||
// prices stay stale on error
|
||||
}
|
||||
}
|
||||
@@ -55,77 +55,42 @@ function formatUsd(amount) {
|
||||
);
|
||||
}
|
||||
|
||||
// What an address is worth, as { usd, partial }.
|
||||
//
|
||||
// Prices are fetched for the top 25 tokens only, so an address can hold real
|
||||
// assets this code has no price for. Adding up the priced ones and calling the
|
||||
// result the total states a number the holdings do not support: an address
|
||||
// holding nothing but unpriced tokens comes out at $0.00, which tells the user
|
||||
// their address is worth nothing when it may hold a great deal. Worth zero and
|
||||
// worth an unknown amount are separate facts and get separate fields, the same
|
||||
// way an absent holders_count is not a count of zero.
|
||||
//
|
||||
// usd: the value of the holdings a price is known for, or null when
|
||||
// nothing is knowable at all — testnet, or before the first fetch.
|
||||
// partial: the address also holds a token with no price, so usd is a floor
|
||||
// and not the total.
|
||||
//
|
||||
// Render it through formatAddressTotal() rather than reading usd alone.
|
||||
function getAddressValue(addr) {
|
||||
function getAddressValueUsd(addr) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return { usd: null, partial: false };
|
||||
if (!prices.ETH) return { usd: null, partial: false };
|
||||
let usd = parseFloat(addr.balance || "0") * prices.ETH;
|
||||
let partial = false;
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
const ethBal = parseFloat(addr.balance || "0");
|
||||
total += ethBal * prices.ETH;
|
||||
for (const token of addr.tokenBalances || []) {
|
||||
const tokenBal = parseFloat(token.balance || "0");
|
||||
// A balance of zero is not a holding: it can neither add to the total
|
||||
// nor make it incomplete.
|
||||
if (!(tokenBal > 0)) continue;
|
||||
if (prices[token.symbol]) {
|
||||
usd += tokenBal * prices[token.symbol];
|
||||
} else {
|
||||
partial = true;
|
||||
if (tokenBal > 0 && prices[token.symbol]) {
|
||||
total += tokenBal * prices[token.symbol];
|
||||
}
|
||||
}
|
||||
return { usd, partial };
|
||||
return total;
|
||||
}
|
||||
|
||||
// The same pair for a whole wallet, and for every wallet at once. One
|
||||
// unpriced holding anywhere makes the sum a floor, so partial carries up.
|
||||
function getWalletValue(wallet) {
|
||||
return sumValues(wallet.addresses.map(getAddressValue));
|
||||
}
|
||||
|
||||
function getTotalValue(wallets) {
|
||||
return sumValues(wallets.map(getWalletValue));
|
||||
}
|
||||
|
||||
function sumValues(values) {
|
||||
let usd = null;
|
||||
let partial = false;
|
||||
for (const value of values) {
|
||||
if (value.usd === null) continue;
|
||||
usd = (usd === null ? 0 : usd) + value.usd;
|
||||
partial = partial || value.partial;
|
||||
function getWalletValueUsd(wallet) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
for (const addr of wallet.addresses) {
|
||||
total += getAddressValueUsd(addr);
|
||||
}
|
||||
return { usd, partial };
|
||||
return total;
|
||||
}
|
||||
|
||||
// The one rendering of an address total, so no screen says it differently.
|
||||
//
|
||||
// A partial total is shown and named as partial: the figure is the ETH and
|
||||
// priced tokens the user does hold, which is worth having, and suppressing it
|
||||
// would throw away a number that is correct as far as it goes. What is never
|
||||
// shown is a figure covering no holdings at all — the $0.00 sum of an empty
|
||||
// set beside a list of tokens is the bug this replaces.
|
||||
function formatAddressTotal(value) {
|
||||
if (!value || value.usd === null) return "";
|
||||
if (!value.partial) return "Total: " + formatUsd(value.usd);
|
||||
if (value.usd > 0) {
|
||||
return "Total: " + formatUsd(value.usd) + " plus unpriced tokens";
|
||||
function getTotalValueUsd(wallets) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
for (const wallet of wallets) {
|
||||
total += getWalletValueUsd(wallet);
|
||||
}
|
||||
return "Total: unpriced tokens only";
|
||||
return total;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
@@ -134,8 +99,7 @@ module.exports = {
|
||||
clearPrices,
|
||||
getPrice,
|
||||
formatUsd,
|
||||
formatAddressTotal,
|
||||
getAddressValue,
|
||||
getWalletValue,
|
||||
getTotalValue,
|
||||
getAddressValueUsd,
|
||||
getWalletValueUsd,
|
||||
getTotalValueUsd,
|
||||
};
|
||||
|
||||
@@ -2,10 +2,11 @@
|
||||
|
||||
const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
|
||||
const { networkById } = require("./networks");
|
||||
// Dependency-free constant module; safe to pull into a background bundle.
|
||||
const { RESTORABLE_VIEWS } = require("../popup/restorableViews");
|
||||
|
||||
const { storageGet, storageSet } = require("./browserApi");
|
||||
const storageApi =
|
||||
typeof browser !== "undefined"
|
||||
? browser.storage.local
|
||||
: chrome.storage.local;
|
||||
|
||||
const DEFAULT_STATE = {
|
||||
hasWallet: false,
|
||||
@@ -14,11 +15,6 @@ const DEFAULT_STATE = {
|
||||
networkId: "mainnet",
|
||||
rpcUrl: DEFAULT_RPC_URL,
|
||||
blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
|
||||
// Endpoints remembered per network: { [networkId]: { rpcUrl,
|
||||
// blockscoutUrl } }. rpcUrl/blockscoutUrl above are the live endpoints
|
||||
// of the active network; this is what the others are restored from
|
||||
// when the active network changes. See onChainSwitch().
|
||||
networkEndpoints: {},
|
||||
lastBalanceRefresh: 0,
|
||||
activeAddress: null,
|
||||
allowedSites: {},
|
||||
@@ -39,9 +35,6 @@ const DEFAULT_STATE = {
|
||||
|
||||
const state = {
|
||||
...DEFAULT_STATE,
|
||||
// Its own object, not the one DEFAULT_STATE holds: onChainSwitch()
|
||||
// mutates this map in place, and a spread copies the reference.
|
||||
networkEndpoints: {},
|
||||
currentView: null,
|
||||
selectedWallet: null,
|
||||
selectedAddress: null,
|
||||
@@ -50,39 +43,6 @@ const state = {
|
||||
viewStack: [],
|
||||
};
|
||||
|
||||
// Keep only the leading run of stored views the popup is willing to render.
|
||||
//
|
||||
// restoreView() refuses to reopen ONTO a non-restorable view, but the stack
|
||||
// behind it used to be restored verbatim, so Back could walk onto a screen
|
||||
// whose content is deliberately never re-rendered — and "show-phrase" has no
|
||||
// Back control to leave by. Truncating at the first such entry instead of
|
||||
// splicing it out keeps the result a prefix of the stored stack, so every
|
||||
// surviving entry's Back target is exactly the one it had; splicing would
|
||||
// silently re-point the entry above the hole at a different screen.
|
||||
//
|
||||
// Filtering happens here on load rather than in saveState(): the live
|
||||
// in-session stack is legitimate (the screen really is rendered while the
|
||||
// popup is open), and only a load-side filter also repairs the stacks
|
||||
// already in storage, including ones written before a view left the set.
|
||||
function restorableStack(stored, currentView) {
|
||||
// A stored stack that is missing or not an array keeps nothing, but it
|
||||
// still goes through the never-empty rule below rather than returning
|
||||
// early: otherwise a corrupt stack would depend on exactly the goBack()
|
||||
// fallback that the explicit ["main"] exists in order not to depend on.
|
||||
const source = Array.isArray(stored) ? stored : [];
|
||||
const cut = source.findIndex((view) => !RESTORABLE_VIEWS.has(view));
|
||||
const kept = cut === -1 ? source.slice() : source.slice(0, cut);
|
||||
// A view restored below the root still needs somewhere for Back to go.
|
||||
if (
|
||||
kept.length === 0 &&
|
||||
currentView !== "main" &&
|
||||
RESTORABLE_VIEWS.has(currentView)
|
||||
) {
|
||||
return ["main"];
|
||||
}
|
||||
return kept;
|
||||
}
|
||||
|
||||
// Return the network configuration for the currently selected network.
|
||||
function currentNetwork() {
|
||||
return networkById(state.networkId);
|
||||
@@ -96,7 +56,6 @@ async function saveState() {
|
||||
networkId: state.networkId,
|
||||
rpcUrl: state.rpcUrl,
|
||||
blockscoutUrl: state.blockscoutUrl,
|
||||
networkEndpoints: state.networkEndpoints,
|
||||
lastBalanceRefresh: state.lastBalanceRefresh,
|
||||
activeAddress: state.activeAddress,
|
||||
allowedSites: state.allowedSites,
|
||||
@@ -120,11 +79,11 @@ async function saveState() {
|
||||
viewData: state.viewData,
|
||||
viewStack: state.viewStack,
|
||||
};
|
||||
await storageSet({ autistmask: persisted });
|
||||
await storageApi.set({ autistmask: persisted });
|
||||
}
|
||||
|
||||
async function loadState() {
|
||||
const result = await storageGet("autistmask");
|
||||
const result = await storageApi.get("autistmask");
|
||||
if (result.autistmask) {
|
||||
const saved = result.autistmask;
|
||||
state.wallets = saved.wallets || [];
|
||||
@@ -137,30 +96,6 @@ async function loadState() {
|
||||
state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
|
||||
state.blockscoutUrl =
|
||||
saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
|
||||
// An actual object is required, not merely a truthy non-array: the
|
||||
// code below and onChainSwitch() index and ASSIGN INTO this value,
|
||||
// and assigning a property to a string or a number is a silent no-op
|
||||
// in sloppy mode. A stored primitive would therefore be re-persisted
|
||||
// unchanged forever, and every switch would fall back to the network
|
||||
// default — the endpoint loss this map exists to prevent, with no
|
||||
// self-healing. The allowedSites/deniedSites guards below are only
|
||||
// read from, which is why they can be looser.
|
||||
state.networkEndpoints =
|
||||
typeof saved.networkEndpoints === "object" &&
|
||||
saved.networkEndpoints !== null &&
|
||||
!Array.isArray(saved.networkEndpoints)
|
||||
? saved.networkEndpoints
|
||||
: {};
|
||||
// A profile written before this map existed carries exactly one pair
|
||||
// of endpoints, belonging to whatever network it was last on. Adopt
|
||||
// it as that network's remembered pair, so a custom endpoint set on
|
||||
// the old build is not lost by the first switch away and back.
|
||||
if (!state.networkEndpoints[state.networkId]) {
|
||||
state.networkEndpoints[state.networkId] = {
|
||||
rpcUrl: state.rpcUrl,
|
||||
blockscoutUrl: state.blockscoutUrl,
|
||||
};
|
||||
}
|
||||
state.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
|
||||
state.activeAddress = saved.activeAddress || null;
|
||||
state.allowedSites =
|
||||
@@ -215,7 +150,7 @@ async function loadState() {
|
||||
saved.selectedAddress !== undefined ? saved.selectedAddress : null;
|
||||
state.selectedToken = saved.selectedToken || null;
|
||||
state.viewData = saved.viewData || {};
|
||||
state.viewStack = restorableStack(saved.viewStack, state.currentView);
|
||||
state.viewStack = Array.isArray(saved.viewStack) ? saved.viewStack : [];
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -8,23 +8,11 @@
|
||||
// either verdict alone, because the balance list is where the user forms
|
||||
// their belief about what they own (issue #235).
|
||||
//
|
||||
// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
|
||||
// that may bear it, or to null. Null means the symbol belongs to the native
|
||||
// asset, which has no contract at all, so no contract may bear it and every
|
||||
// one that does is a spoof. "ETH" is the only such entry today; the rule is
|
||||
// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
|
||||
// bear it, or to null. Null means the symbol belongs to the native asset,
|
||||
// which has no contract at all, so no contract may bear it and every one
|
||||
// that does is a spoof. "ETH" is the only such entry today; the rule is
|
||||
// written so that a second one needs no change here or at any call site.
|
||||
//
|
||||
// The value is a set because a ticker is not unique: seven symbols in the
|
||||
// bundled list belong to two real contracts each, and answering with one of
|
||||
// them hid the other one's holders' money (issue #276). Membership, not
|
||||
// equality, is therefore the question — but it is the same question, asked of
|
||||
// a table that can now state the truth. Every address in a set is one the
|
||||
// wallet ships as a real token; a contract outside the set is still a spoof.
|
||||
//
|
||||
// The symbol is attacker-controlled — it is whatever the ERC-20 contract
|
||||
// returns — so the lookup is done on a normalized form (issue #260): the
|
||||
// question is whether the symbol reaches the user's eye as a known one,
|
||||
// since that is what the user acts on.
|
||||
|
||||
const { KNOWN_SYMBOLS } = require("./tokenList");
|
||||
|
||||
@@ -34,59 +22,6 @@ function normalizeAddress(addr) {
|
||||
return (addr || "").toLowerCase();
|
||||
}
|
||||
|
||||
// Fold a symbol onto what a user actually sees, and no further:
|
||||
//
|
||||
// NFKC collapses compatibility variants that render as the ASCII
|
||||
// letters they imitate — fullwidth ETH, styled mathematical
|
||||
// letters — and maps the non-ASCII spaces onto U+0020.
|
||||
// strip drops what paints nothing: \p{Cf} plus
|
||||
// \p{Default_Ignorable_Code_Point} plus U+007F. That covers
|
||||
// the format characters (zero-width space, joiner and
|
||||
// non-joiner, word joiner, soft hyphen, byte-order mark, bidi
|
||||
// marks and overrides), the variation selectors, the Hangul
|
||||
// fillers, and DELETE. Removed everywhere, not merely at the
|
||||
// ends.
|
||||
// trim removes surrounding whitespace, which HTML collapses:
|
||||
// `" ETH "` is painted next to the user's real ETH as `ETH`.
|
||||
// toUpperCase makes the comparison case-insensitive, as before.
|
||||
//
|
||||
// The rule is "strip what paints nothing". The Unicode classes are how
|
||||
// that is spelled, not what it means, which is why U+007F is named on its
|
||||
// own: it is a control rather than a default-ignorable character, so no
|
||||
// class here reaches it, yet it paints nothing all the same. Measured in
|
||||
// the repo's pinned e2e Chromium (16px sans-serif, plain `ETH` = 32.00px,
|
||||
// so an invisible prefix leaves 32.00px):
|
||||
//
|
||||
// U+007F, U+3164, U+115F, U+FE0F, U+FE00 32.00px — invisible
|
||||
// U+FFA0 40.00px — a box
|
||||
// U+1160 48.00px — a box
|
||||
// U+0001, U+0085, U+0090 48.00px — a box
|
||||
//
|
||||
// U+1160 and U+FFA0 are `Default_Ignorable_Code_Point` members that font
|
||||
// fallback nonetheless draws, and they are stripped anyway: erring toward
|
||||
// hiding a token that does not look like `ETH` is the harmless direction of
|
||||
// the two. The other controls are left alone for the same reason read the
|
||||
// other way — a symbol carrying a visible box does not reach the eye as
|
||||
// `ETH`, so filtering it would hide a token the user could not have
|
||||
// confused with the native asset.
|
||||
//
|
||||
// Deliberately not folded, and asserted as open in tests/symbolSpoof.test.js:
|
||||
// interior whitespace (`E T H` renders as `E T H`, so folding it would filter
|
||||
// a token nobody could confuse with the native asset), confusables that are
|
||||
// distinct letters rather than compatibility variants (Cyrillic capital Ie,
|
||||
// U+0415; Greek capital Epsilon, U+0395), bidi reordering, which needs the
|
||||
// bidi algorithm rather than a character filter, and the visible controls.
|
||||
//
|
||||
// This decides only how the question is asked. Nothing here changes what a
|
||||
// surface displays; a token still shows the symbol it reports.
|
||||
function normalizeSymbol(symbol) {
|
||||
return String(symbol || "")
|
||||
.normalize("NFKC")
|
||||
.replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}\x7F]/gu, "")
|
||||
.trim()
|
||||
.toUpperCase();
|
||||
}
|
||||
|
||||
// True when a token bearing `symbol` from contract `contractAddress` is
|
||||
// impersonating a known symbol.
|
||||
//
|
||||
@@ -96,11 +31,11 @@ function normalizeSymbol(symbol) {
|
||||
function isSpoofedSymbol(symbol, contractAddress) {
|
||||
const contract = normalizeAddress(contractAddress);
|
||||
if (!contract) return false;
|
||||
const sym = normalizeSymbol(symbol);
|
||||
const sym = (symbol || "").toUpperCase();
|
||||
if (!KNOWN_SYMBOLS.has(sym)) return false;
|
||||
const legit = KNOWN_SYMBOLS.get(sym);
|
||||
if (legit === null) return true;
|
||||
return !legit.has(contract);
|
||||
return contract !== normalizeAddress(legit);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
|
||||
@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
|
||||
TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
|
||||
}
|
||||
|
||||
// Build a map of symbol (uppercased) -> the set of contract addresses
|
||||
// (lowercased) that legitimately bear it. Used for spoofed-symbol detection.
|
||||
// "ETH" maps to null: the native asset has no contract, so no contract may
|
||||
// bear its symbol.
|
||||
//
|
||||
// The value is a set and not a single address because tickers are not unique
|
||||
// and the list above proves it: seven of these 512 tokens share a symbol with
|
||||
// another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
|
||||
// different real contracts each, all of them from the same source fetch. A
|
||||
// one-address-per-symbol table can only answer that by picking a winner, and
|
||||
// the loser is then a token in our own bundled list that the spoof filter
|
||||
// hides from the balance list, the history and the send selector at its own
|
||||
// address, so the user cannot spend it (issue #276). Naming every address
|
||||
// that bears the symbol is the only shape that says what is true; it does not
|
||||
// loosen the rule, because a contract outside the set is still a spoof.
|
||||
// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
|
||||
// Used for spoofed-symbol detection. "ETH" maps to null (native token).
|
||||
const KNOWN_SYMBOLS = new Map();
|
||||
KNOWN_SYMBOLS.set("ETH", null);
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!KNOWN_SYMBOLS.has(upper)) {
|
||||
KNOWN_SYMBOLS.set(upper, new Set());
|
||||
}
|
||||
const addresses = KNOWN_SYMBOLS.get(upper);
|
||||
// A null entry is the native asset and stays null: an ERC-20 that reports
|
||||
// the native symbol does not thereby become entitled to it.
|
||||
if (addresses !== null) {
|
||||
addresses.add(t.address.toLowerCase());
|
||||
KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,116 +0,0 @@
|
||||
// The base-unit amount an ERC-20 transfer from the wallet's own Send screen is
|
||||
// encoded with.
|
||||
//
|
||||
// A token amount is a decimal string plus a scale, and the two come from
|
||||
// different places. The confirmation screen renders the amount, the balance and
|
||||
// the symbol from the block explorer's cached metadata (see
|
||||
// fetchTokenBalances() in balances.js); the transfer used to be encoded from
|
||||
// decimals() read off the contract at signing time, and nothing compared the
|
||||
// two. A token whose on-chain scale differs from the cached one — an
|
||||
// upgradeable or proxy token, a caller-dependent one, a stale or wrong explorer
|
||||
// entry — therefore signed an amount that was never displayed, off by a power
|
||||
// of ten for every decimal place of disagreement.
|
||||
//
|
||||
// So the scale used to encode is the scale the screen rendered with, carried
|
||||
// forward on the pending transaction, and the contract's own answer is read
|
||||
// only to be compared with it. A disagreement is a refusal, never a preference
|
||||
// for either number: the wallet cannot tell which of the two the user meant,
|
||||
// and both candidate transfers move an amount nobody approved.
|
||||
//
|
||||
// This is the confirmTx counterpart to approvalVerify.js, which does the same
|
||||
// job for the dApp approval path, and it takes the same stance: a quantity that
|
||||
// cannot be compared with what was displayed has not been checked, so an absent
|
||||
// or unusable value is refused rather than filled in.
|
||||
//
|
||||
// Every message here is shown to the user on the transaction error screen, so
|
||||
// each is a full sentence and names the numbers it is refusing over.
|
||||
|
||||
const { parseUnits } = require("ethers");
|
||||
|
||||
// Solidity's decimals() returns a uint8, so anything outside that range is not
|
||||
// an answer this wallet can use.
|
||||
const MAX_DECIMALS = 255;
|
||||
|
||||
const UNKNOWN_DISPLAYED_DECIMALS_MESSAGE =
|
||||
"The transfer was not sent, because the number of decimal places this" +
|
||||
" amount was shown with is unknown, so the amount that would be signed" +
|
||||
" cannot be shown to be the amount that was displayed.";
|
||||
|
||||
const UNREADABLE_CONTRACT_DECIMALS_MESSAGE =
|
||||
"The transfer was not sent, because the token contract did not report a" +
|
||||
" usable number of decimal places, so the amount that would be signed" +
|
||||
" cannot be checked against the amount that was displayed.";
|
||||
|
||||
function mismatchMessage(displayed, onChain) {
|
||||
return (
|
||||
"The transfer was not sent. The token contract reports " +
|
||||
onChain +
|
||||
" decimal places, but the amount was displayed using " +
|
||||
displayed +
|
||||
", so signing it would move a different amount than the one shown." +
|
||||
" Reopen the wallet to reload this token's details and try again."
|
||||
);
|
||||
}
|
||||
|
||||
// A decimals value from either source as a number, or null if it is not one.
|
||||
// decimals() comes back from ethers as a bigint and the explorer's copy arrives
|
||||
// as a string, so both of those are accepted alongside a plain number; anything
|
||||
// fractional, negative, out of uint8 range, or of any other type at all is not.
|
||||
//
|
||||
// The types are enumerated rather than coerced because Number() is far too
|
||||
// willing: Number([]) is 0 and Number(true) is 1, so a coercing check would
|
||||
// admit an empty array as a scale of zero and encode a whole-token transfer
|
||||
// against it.
|
||||
function toDecimals(value) {
|
||||
let n;
|
||||
if (typeof value === "number") {
|
||||
n = value;
|
||||
} else if (typeof value === "bigint") {
|
||||
if (value < 0n || value > BigInt(MAX_DECIMALS)) return null;
|
||||
n = Number(value);
|
||||
} else if (typeof value === "string") {
|
||||
if (!/^[0-9]+$/.test(value)) return null;
|
||||
n = Number(value);
|
||||
} else {
|
||||
return null;
|
||||
}
|
||||
if (!Number.isInteger(n) || n < 0 || n > MAX_DECIMALS) return null;
|
||||
return n;
|
||||
}
|
||||
|
||||
// The decimals the confirmation screen rendered an amount with, as a number.
|
||||
// Throws when the pending transaction does not carry a usable one — which is
|
||||
// also what keeps the gas estimate from quietly estimating a different transfer
|
||||
// than the one that would be signed.
|
||||
function displayedDecimals(value) {
|
||||
const displayed = toDecimals(value);
|
||||
if (displayed === null) {
|
||||
throw new Error(UNKNOWN_DISPLAYED_DECIMALS_MESSAGE);
|
||||
}
|
||||
return displayed;
|
||||
}
|
||||
|
||||
// The transfer amount in the token's base units, or a throw. `amount` is the
|
||||
// decimal string the user typed and the screen displayed, `displayed` is the
|
||||
// scale it was displayed at, and `onChain` is what the contract's decimals()
|
||||
// answered at signing time. The two scales must agree.
|
||||
function transferAmountUnits(amount, displayed, onChain) {
|
||||
const shown = displayedDecimals(displayed);
|
||||
const reported = toDecimals(onChain);
|
||||
if (reported === null) {
|
||||
throw new Error(UNREADABLE_CONTRACT_DECIMALS_MESSAGE);
|
||||
}
|
||||
if (reported !== shown) {
|
||||
throw new Error(mismatchMessage(shown, reported));
|
||||
}
|
||||
return parseUnits(String(amount), shown);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
displayedDecimals,
|
||||
transferAmountUnits,
|
||||
mismatchMessage,
|
||||
MAX_DECIMALS,
|
||||
UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
|
||||
UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
|
||||
};
|
||||
@@ -82,7 +82,7 @@ function toFixedPoint(value) {
|
||||
if (text === "") return null;
|
||||
try {
|
||||
return parseUnits(text, SCALE_DECIMALS);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -102,11 +102,6 @@ function decodeV2SwapExactIn(input) {
|
||||
// Decode V2_SWAP_EXACT_OUT (command 0x09) input bytes.
|
||||
// ABI: (address recipient, uint256 amountOut, uint256 amountInMax,
|
||||
// address[] path, bool payerIsUser)
|
||||
//
|
||||
// Nothing calls this: decode() has no 0x09 arm, so a V2 exact-out swap gets
|
||||
// its command name and no token or amount detail. Kept for the fix, which is
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/283.
|
||||
// eslint-disable-next-line no-unused-vars
|
||||
function decodeV2SwapExactOut(input) {
|
||||
try {
|
||||
const d = coder.decode(
|
||||
|
||||
@@ -57,7 +57,7 @@ async function cryptoBackend() {
|
||||
try {
|
||||
await WebAssembly.compile(EMPTY_WASM_MODULE);
|
||||
return "wasm";
|
||||
} catch {
|
||||
} catch (_) {
|
||||
return "asmjs";
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
// Wallet and address deletion state transitions, kept out of the views so the
|
||||
// selection and broadcast rules are testable without a DOM.
|
||||
|
||||
const { notify } = require("./browserApi");
|
||||
|
||||
// Two records of the same address can be stored in different cases, so
|
||||
// address equality is never a literal string comparison.
|
||||
function sameAddress(a, b) {
|
||||
@@ -146,7 +144,9 @@ function removeAddressFromState(state, walletIdx, addrIdx) {
|
||||
// accountsChanged to connected sites. Same call shape as the address
|
||||
// switch in the home view.
|
||||
function broadcastActiveChanged() {
|
||||
notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
|
||||
@@ -1,238 +0,0 @@
|
||||
// The USD total of an address that holds something this build cannot price
|
||||
// (issue #261).
|
||||
//
|
||||
// Prices exist for the top 25 tokens only, so an address can hold real assets
|
||||
// with no price attached. Summing what is priced and printing the result as
|
||||
// the total says "$0.00" for an address holding nothing but unpriced tokens —
|
||||
// worth-nothing and worth-an-unknown-amount collapsed into one number, in the
|
||||
// direction that matters. The two are separate facts here, the same way an
|
||||
// absent holders_count is not a count of zero.
|
||||
//
|
||||
// The value and its rendering are asserted directly, and then through the two
|
||||
// call sites that return their markup as a string: the wallet list on Home and
|
||||
// the balance warning on the address-removal confirmation. AddressDetail and
|
||||
// the Home summary line render into the DOM and are covered by tests/e2e.
|
||||
|
||||
// helpers.js pulls in state.js, which reads chrome.storage.local at load.
|
||||
globalThis.chrome = {
|
||||
storage: { local: { get: async () => ({}), set: async () => {} } },
|
||||
};
|
||||
|
||||
const {
|
||||
prices,
|
||||
clearPrices,
|
||||
getAddressValue,
|
||||
getWalletValue,
|
||||
getTotalValue,
|
||||
formatAddressTotal,
|
||||
} = require("../src/shared/prices");
|
||||
const { state } = require("../src/shared/state");
|
||||
const { walletListHtml } = require("../src/popup/views/home");
|
||||
const { balanceWarningHtml } = require("../src/popup/views/deleteAddress");
|
||||
|
||||
const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
|
||||
const NOVEL = "0x1111111111111111111111111111111111111111";
|
||||
|
||||
// No ETH, and a token no price is known for. The case the user is told is
|
||||
// worth $0.00 today.
|
||||
const UNPRICED_ONLY = {
|
||||
address: "0x" + "a".repeat(40),
|
||||
balance: "0",
|
||||
tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
|
||||
};
|
||||
|
||||
// Nothing at all: the address really is worth zero.
|
||||
const EMPTY = {
|
||||
address: "0x" + "b".repeat(40),
|
||||
balance: "0",
|
||||
tokenBalances: [],
|
||||
};
|
||||
|
||||
// Every holding priced.
|
||||
const FULLY_PRICED = {
|
||||
address: "0x" + "c".repeat(40),
|
||||
balance: "1.5",
|
||||
tokenBalances: [{ address: USDC, symbol: "USDC", balance: "2500.0" }],
|
||||
};
|
||||
|
||||
// Part priced, part not: 1.5 ETH plus a token with no price.
|
||||
const PARTLY_PRICED = {
|
||||
address: "0x" + "d".repeat(40),
|
||||
balance: "1.5",
|
||||
tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
|
||||
};
|
||||
|
||||
beforeEach(() => {
|
||||
clearPrices();
|
||||
prices.ETH = 2000;
|
||||
prices.USDC = 1;
|
||||
state.wallets = [];
|
||||
state.trackedTokens = [];
|
||||
state.showZeroBalanceTokens = false;
|
||||
state.activeAddress = null;
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
clearPrices();
|
||||
});
|
||||
|
||||
// The total line only, in each of the two markup-returning call sites. The
|
||||
// ETH balance line above it legitimately reads $0.00 for an address with no
|
||||
// ETH, so the assertions have to name the line under test.
|
||||
function walletListTotal(addr) {
|
||||
state.wallets = [{ name: "Wallet 1", type: "hd", addresses: [addr] }];
|
||||
const match = walletListHtml().match(/min-h-\[1rem\]">([^<]*)</);
|
||||
return match && match[1];
|
||||
}
|
||||
|
||||
function removalWarningTotal(addr) {
|
||||
const match = balanceWarningHtml(addr).match(/mt-1">([^<]*)</);
|
||||
return match && match[1];
|
||||
}
|
||||
|
||||
describe("the value of an address, and whether it is the whole value", () => {
|
||||
test("an address holding only unpriced tokens has an incomplete value", () => {
|
||||
expect(getAddressValue(UNPRICED_ONLY)).toEqual({
|
||||
usd: 0,
|
||||
partial: true,
|
||||
});
|
||||
});
|
||||
|
||||
test("an address holding nothing is complete, and zero", () => {
|
||||
expect(getAddressValue(EMPTY)).toEqual({ usd: 0, partial: false });
|
||||
});
|
||||
|
||||
test("a fully priced address is complete, and unchanged", () => {
|
||||
expect(getAddressValue(FULLY_PRICED)).toEqual({
|
||||
usd: 5500,
|
||||
partial: false,
|
||||
});
|
||||
});
|
||||
|
||||
test("a partly priced address keeps the part it can price", () => {
|
||||
expect(getAddressValue(PARTLY_PRICED)).toEqual({
|
||||
usd: 3000,
|
||||
partial: true,
|
||||
});
|
||||
});
|
||||
|
||||
// A token balance of zero is not a holding, so it cannot make the total
|
||||
// incomplete: an address with a spent-out unpriced token is worth zero.
|
||||
test("a zero balance in an unpriced token leaves the value complete", () => {
|
||||
const addr = {
|
||||
address: "0x1",
|
||||
balance: "0",
|
||||
tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "0" }],
|
||||
};
|
||||
expect(getAddressValue(addr)).toEqual({ usd: 0, partial: false });
|
||||
});
|
||||
|
||||
// Before the first price fetch, and on testnet, nothing is knowable: that
|
||||
// is a third state, and it stays distinct from both of the others.
|
||||
test("no prices at all means no value, not an incomplete one", () => {
|
||||
clearPrices();
|
||||
expect(getAddressValue(FULLY_PRICED)).toEqual({
|
||||
usd: null,
|
||||
partial: false,
|
||||
});
|
||||
});
|
||||
|
||||
test("one unpriced holding makes a wallet and the grand total partial", () => {
|
||||
const wallet = { addresses: [FULLY_PRICED, UNPRICED_ONLY] };
|
||||
expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: true });
|
||||
expect(getTotalValue([wallet])).toEqual({ usd: 5500, partial: true });
|
||||
});
|
||||
|
||||
test("a wallet of fully priced addresses stays complete", () => {
|
||||
const wallet = { addresses: [FULLY_PRICED, EMPTY] };
|
||||
expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: false });
|
||||
});
|
||||
});
|
||||
|
||||
describe("how that value is written on screen", () => {
|
||||
test("a complete total is the figure", () => {
|
||||
expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe(
|
||||
"Total: $5,500.00",
|
||||
);
|
||||
});
|
||||
|
||||
test("an address worth zero says so", () => {
|
||||
expect(formatAddressTotal(getAddressValue(EMPTY))).toBe("Total: $0.00");
|
||||
});
|
||||
|
||||
// The figure is still worth having — it is the ETH the user does hold —
|
||||
// but on its own it understates the address, so it is named as partial.
|
||||
test("a partly priced total is given, and marked as partial", () => {
|
||||
expect(formatAddressTotal(getAddressValue(PARTLY_PRICED))).toBe(
|
||||
"Total: $3,000.00 plus unpriced tokens",
|
||||
);
|
||||
});
|
||||
|
||||
// Nothing priced is held, so there is no figure to give: printing the
|
||||
// $0.00 sum of an empty set is the bug.
|
||||
test("a total with nothing priced in it gives no figure", () => {
|
||||
const line = formatAddressTotal(getAddressValue(UNPRICED_ONLY));
|
||||
expect(line).toBe("Total: unpriced tokens only");
|
||||
expect(line).not.toContain("$");
|
||||
});
|
||||
|
||||
test("an unknown value is written as nothing at all", () => {
|
||||
clearPrices();
|
||||
expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe("");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the wallet list on Home", () => {
|
||||
test("an address holding only unpriced tokens is not totalled at $0.00", () => {
|
||||
expect(walletListTotal(UNPRICED_ONLY)).toBe(
|
||||
"Total: unpriced tokens only",
|
||||
);
|
||||
});
|
||||
|
||||
test("an address holding nothing is still totalled at $0.00", () => {
|
||||
expect(walletListTotal(EMPTY)).toBe("Total: $0.00");
|
||||
});
|
||||
|
||||
test("a fully priced address shows its total", () => {
|
||||
expect(walletListTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
|
||||
});
|
||||
|
||||
test("a partly priced address shows the priced part, marked partial", () => {
|
||||
expect(walletListTotal(PARTLY_PRICED)).toBe(
|
||||
"Total: $3,000.00 plus unpriced tokens",
|
||||
);
|
||||
});
|
||||
|
||||
test("an address whose value is unknown keeps its blank line", () => {
|
||||
clearPrices();
|
||||
expect(walletListTotal(FULLY_PRICED)).toBe(" ");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the balance warning on the address-removal confirmation", () => {
|
||||
// "This address holds a balance." followed by "Total: $0.00" is a flat
|
||||
// contradiction, on the one screen whose job is to warn.
|
||||
test("an address holding only unpriced tokens is not totalled at $0.00", () => {
|
||||
expect(balanceWarningHtml(UNPRICED_ONLY)).toContain(
|
||||
"This address holds a balance.",
|
||||
);
|
||||
expect(removalWarningTotal(UNPRICED_ONLY)).toBe(
|
||||
"Total: unpriced tokens only",
|
||||
);
|
||||
});
|
||||
|
||||
test("a fully priced address still shows its total", () => {
|
||||
expect(removalWarningTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
|
||||
});
|
||||
|
||||
test("a partly priced address shows the priced part, marked partial", () => {
|
||||
expect(removalWarningTotal(PARTLY_PRICED)).toBe(
|
||||
"Total: $3,000.00 plus unpriced tokens",
|
||||
);
|
||||
});
|
||||
|
||||
test("no total line is written when the value is unknown", () => {
|
||||
clearPrices();
|
||||
expect(removalWarningTotal(FULLY_PRICED)).toBe(null);
|
||||
});
|
||||
});
|
||||
@@ -80,12 +80,17 @@ describe("alarms module", () => {
|
||||
delete global.chrome;
|
||||
});
|
||||
|
||||
test("ensureRecurringAlarms schedules the recurring job", async () => {
|
||||
test("ensureRecurringAlarms schedules both recurring jobs", async () => {
|
||||
const created = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(created).toEqual({ balance: true, cleared: [] });
|
||||
expect(created).toEqual({ balance: true, phishing: true });
|
||||
|
||||
const names = alarmsStub.created.map((c) => c.name);
|
||||
expect(names).toEqual([alarmsMod.BALANCE_REFRESH_ALARM]);
|
||||
const names = alarmsStub.created.map((c) => c.name).sort();
|
||||
expect(names).toEqual(
|
||||
[
|
||||
alarmsMod.BALANCE_REFRESH_ALARM,
|
||||
alarmsMod.PHISHING_REFRESH_ALARM,
|
||||
].sort(),
|
||||
);
|
||||
});
|
||||
|
||||
test("the balance refresh keeps its 60-second cadence", async () => {
|
||||
@@ -94,35 +99,12 @@ describe("alarms module", () => {
|
||||
expect(balance.periodInMinutes).toBe(1);
|
||||
});
|
||||
|
||||
test("a retired job's alarm is cleared, not left running", async () => {
|
||||
// The browser holds an alarm until something clears it. Deleting the
|
||||
// job from the code is not enough: on every install that ever ran the
|
||||
// version which created it, the alarm goes on waking the service
|
||||
// worker on its old schedule with nothing to deliver it to.
|
||||
for (const name of alarmsMod.OBSOLETE_ALARMS) {
|
||||
alarmsStub.create(name, { periodInMinutes: 24 * 60 });
|
||||
}
|
||||
expect(alarmsMod.OBSOLETE_ALARMS.length).toBeGreaterThan(0);
|
||||
|
||||
const result = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(result.cleared).toEqual(alarmsMod.OBSOLETE_ALARMS);
|
||||
for (const name of alarmsMod.OBSOLETE_ALARMS) {
|
||||
expect(alarmsStub.alarms.get(name)).toBeUndefined();
|
||||
}
|
||||
});
|
||||
|
||||
test("clearing a retired alarm is not re-reported once it is gone", async () => {
|
||||
test("the phishing refresh keeps its 24-hour cadence", async () => {
|
||||
await alarmsMod.ensureRecurringAlarms();
|
||||
const again = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(again.cleared).toEqual([]);
|
||||
});
|
||||
|
||||
test("no retired name is also a live one", async () => {
|
||||
// A name in both lists would be created and then cleared on every
|
||||
// start, so the job it schedules would never fire.
|
||||
expect(alarmsMod.OBSOLETE_ALARMS).not.toContain(
|
||||
alarmsMod.BALANCE_REFRESH_ALARM,
|
||||
const phishing = alarmsStub.alarms.get(
|
||||
alarmsMod.PHISHING_REFRESH_ALARM,
|
||||
);
|
||||
expect(phishing.periodInMinutes).toBe(24 * 60);
|
||||
});
|
||||
|
||||
test("no period is below the browser-enforced minimum", async () => {
|
||||
@@ -140,14 +122,14 @@ describe("alarms module", () => {
|
||||
|
||||
test("a revived worker does not reset an existing alarm's schedule", async () => {
|
||||
await alarmsMod.ensureRecurringAlarms();
|
||||
expect(alarmsStub.create).toHaveBeenCalledTimes(1);
|
||||
expect(alarmsStub.create).toHaveBeenCalledTimes(2);
|
||||
|
||||
// Every wake re-runs the startup path. Re-creating an alarm restarts
|
||||
// its period, so a busy extension would push the next fire out
|
||||
// forever and the job would never run.
|
||||
const again = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(again).toEqual({ balance: false, cleared: [] });
|
||||
expect(alarmsStub.create).toHaveBeenCalledTimes(1);
|
||||
expect(again).toEqual({ balance: false, phishing: false });
|
||||
expect(alarmsStub.create).toHaveBeenCalledTimes(2);
|
||||
});
|
||||
|
||||
test("a missing alarm is re-created on the next start", async () => {
|
||||
@@ -155,7 +137,7 @@ describe("alarms module", () => {
|
||||
await alarmsStub.clear(alarmsMod.BALANCE_REFRESH_ALARM);
|
||||
|
||||
const again = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(again).toEqual({ balance: true, cleared: [] });
|
||||
expect(again).toEqual({ balance: true, phishing: false });
|
||||
expect(
|
||||
alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM),
|
||||
).toBeDefined();
|
||||
@@ -165,17 +147,17 @@ describe("alarms module", () => {
|
||||
// An install carries its alarms across an extension update, so a
|
||||
// period changed in a new release only ever reaches users if the
|
||||
// stale one is reconciled.
|
||||
alarmsStub.create(alarmsMod.BALANCE_REFRESH_ALARM, {
|
||||
alarmsStub.create(alarmsMod.PHISHING_REFRESH_ALARM, {
|
||||
periodInMinutes: 7 * 24 * 60,
|
||||
});
|
||||
alarmsStub.create.mockClear();
|
||||
|
||||
const created = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(created.balance).toBe(true);
|
||||
expect(created.phishing).toBe(true);
|
||||
expect(
|
||||
alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM)
|
||||
alarmsStub.alarms.get(alarmsMod.PHISHING_REFRESH_ALARM)
|
||||
.periodInMinutes,
|
||||
).toBe(alarmsMod.BALANCE_REFRESH_PERIOD_MINUTES);
|
||||
).toBe(alarmsMod.PHISHING_REFRESH_PERIOD_MINUTES);
|
||||
});
|
||||
|
||||
test("reconciling a period settles instead of re-creating forever", async () => {
|
||||
@@ -186,31 +168,31 @@ describe("alarms module", () => {
|
||||
alarmsStub.create.mockClear();
|
||||
|
||||
const again = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(again).toEqual({ balance: false, cleared: [] });
|
||||
expect(again).toEqual({ balance: false, phishing: false });
|
||||
expect(alarmsStub.create).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test("handlers are dispatched by alarm name from one listener", () => {
|
||||
const balance = jest.fn();
|
||||
const other = jest.fn();
|
||||
const phishing = jest.fn();
|
||||
expect(
|
||||
alarmsMod.registerAlarmHandlers({
|
||||
[alarmsMod.BALANCE_REFRESH_ALARM]: balance,
|
||||
"autistmask-some-other-job": other,
|
||||
[alarmsMod.PHISHING_REFRESH_ALARM]: phishing,
|
||||
}),
|
||||
).toBe(true);
|
||||
expect(alarmsStub.listenerCount()).toBe(1);
|
||||
|
||||
alarmsStub.fire(alarmsMod.BALANCE_REFRESH_ALARM);
|
||||
expect(balance).toHaveBeenCalledTimes(1);
|
||||
expect(other).not.toHaveBeenCalled();
|
||||
expect(phishing).not.toHaveBeenCalled();
|
||||
|
||||
alarmsStub.fire("autistmask-some-other-job");
|
||||
expect(other).toHaveBeenCalledTimes(1);
|
||||
alarmsStub.fire(alarmsMod.PHISHING_REFRESH_ALARM);
|
||||
expect(phishing).toHaveBeenCalledTimes(1);
|
||||
|
||||
alarmsStub.fire("an-alarm-with-no-handler");
|
||||
alarmsStub.fire("some-other-extension-alarm");
|
||||
expect(balance).toHaveBeenCalledTimes(1);
|
||||
expect(other).toHaveBeenCalledTimes(1);
|
||||
expect(phishing).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
test("Firefox MV2 gets the same treatment via browser.alarms", async () => {
|
||||
@@ -223,8 +205,8 @@ describe("alarms module", () => {
|
||||
try {
|
||||
const mod = require("../src/shared/alarms");
|
||||
const created = await mod.ensureRecurringAlarms();
|
||||
expect(created).toEqual({ balance: true, cleared: [] });
|
||||
expect(firefoxAlarms.created).toHaveLength(1);
|
||||
expect(created).toEqual({ balance: true, phishing: true });
|
||||
expect(firefoxAlarms.created).toHaveLength(2);
|
||||
// The Chrome stub must not have been touched.
|
||||
expect(alarmsStub.create).not.toHaveBeenCalled();
|
||||
} finally {
|
||||
@@ -238,7 +220,7 @@ describe("alarms module", () => {
|
||||
const mod = require("../src/shared/alarms");
|
||||
await expect(mod.ensureRecurringAlarms()).resolves.toEqual({
|
||||
balance: false,
|
||||
cleared: [],
|
||||
phishing: false,
|
||||
});
|
||||
expect(mod.registerAlarmHandlers({})).toBe(false);
|
||||
});
|
||||
@@ -292,12 +274,9 @@ function loadBackground(initialStore = {}) {
|
||||
tabs: { query: jest.fn(), sendMessage: jest.fn() },
|
||||
action: { setPopup: jest.fn() },
|
||||
};
|
||||
// Present so that a startup path which went to the network would be
|
||||
// recorded rather than throwing, which is what makes "no request was made"
|
||||
// an observation instead of an assumption.
|
||||
global.fetch = jest.fn(async () => ({
|
||||
ok: true,
|
||||
json: async () => ({}),
|
||||
json: async () => ({ blacklist: [] }),
|
||||
}));
|
||||
jest.resetModules();
|
||||
require("../src/background/index");
|
||||
@@ -339,21 +318,17 @@ describe("background worker scheduling", () => {
|
||||
// Let the startup path's promises settle.
|
||||
await settle();
|
||||
|
||||
const names = alarmsStub.created.map((c) => c.name);
|
||||
const { BALANCE_REFRESH_ALARM } = require("../src/shared/alarms");
|
||||
expect(names).toEqual([BALANCE_REFRESH_ALARM]);
|
||||
const names = alarmsStub.created.map((c) => c.name).sort();
|
||||
const {
|
||||
BALANCE_REFRESH_ALARM,
|
||||
PHISHING_REFRESH_ALARM,
|
||||
} = require("../src/shared/alarms");
|
||||
expect(names).toEqual(
|
||||
[BALANCE_REFRESH_ALARM, PHISHING_REFRESH_ALARM].sort(),
|
||||
);
|
||||
expect(mockSetIntervalCalls).toBe(0);
|
||||
});
|
||||
|
||||
test("startup contacts nothing", async () => {
|
||||
// The phishing blocklist is vendored at build time and there is no
|
||||
// other startup fetch, so a worker coming up asks nobody anything.
|
||||
// Every wake used to be a candidate for a blocklist download.
|
||||
loadBackground();
|
||||
await settle();
|
||||
expect(global.fetch).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test("an onAlarm listener is installed on startup", async () => {
|
||||
alarmsStub = loadBackground().alarmsStub;
|
||||
await settle();
|
||||
@@ -373,7 +348,7 @@ describe("background worker scheduling", () => {
|
||||
alarmsStub.created.length = 0;
|
||||
loaded.listeners.onStartup[0]();
|
||||
await settle();
|
||||
expect(alarmsStub.created).toHaveLength(1);
|
||||
expect(alarmsStub.created).toHaveLength(2);
|
||||
});
|
||||
|
||||
test("the install-time listener and the top-level call share one run", async () => {
|
||||
@@ -385,10 +360,13 @@ describe("background worker scheduling", () => {
|
||||
loaded.listeners.onInstalled[0]();
|
||||
await settle();
|
||||
|
||||
expect(alarmsStub.created).toHaveLength(1);
|
||||
expect(alarmsStub.created.map((c) => c.name)).toEqual([
|
||||
"autistmask-balance-refresh",
|
||||
]);
|
||||
expect(alarmsStub.created).toHaveLength(2);
|
||||
expect(alarmsStub.created.map((c) => c.name).sort()).toEqual(
|
||||
[
|
||||
"autistmask-balance-refresh",
|
||||
"autistmask-phishing-refresh",
|
||||
].sort(),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
@@ -1,309 +0,0 @@
|
||||
// Preparation of the transaction the approval screen displays.
|
||||
//
|
||||
// This is the half of the fix that makes the verification in
|
||||
// approvalVerify.test.js mean anything: the numbers the user reads have to be
|
||||
// produced before the screen is drawn and be the numbers that get signed. What
|
||||
// is asserted here is that the object leaving this module is complete (nothing
|
||||
// is left for the popup to fill in), that it survives the messaging boundary
|
||||
// (extension messaging is JSON, which has no bigint), and that nothing the
|
||||
// requesting page or the RPC node can say turns it into an approval that
|
||||
// should never have been raised.
|
||||
|
||||
const { Network, Wallet } = require("ethers");
|
||||
const {
|
||||
prepareApprovalTx,
|
||||
serializeApprovedTx,
|
||||
POPULATE_TIMEOUT_MS,
|
||||
} = require("../src/shared/approvalTx");
|
||||
const {
|
||||
SERIALIZED_FIELDS,
|
||||
MAX_FEE_PER_GAS,
|
||||
MAX_GAS_LIMIT,
|
||||
} = require("../src/shared/approvalVerify");
|
||||
|
||||
const SIGNER_KEY =
|
||||
"0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
|
||||
const signer = new Wallet(SIGNER_KEY);
|
||||
const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
|
||||
// The ordinary dApp request: recipient, value, call data, and nothing else.
|
||||
const TX_PARAMS = {
|
||||
from: signer.address,
|
||||
to: RECIPIENT,
|
||||
value: "0x2386f26fc10000",
|
||||
data: "0xdeadbeef",
|
||||
};
|
||||
|
||||
function providerWith(overrides) {
|
||||
return {
|
||||
getNetwork: async () => Network.from(1),
|
||||
getTransactionCount: async () => 7,
|
||||
estimateGas: async () => 21000n,
|
||||
getFeeData: async () => ({
|
||||
gasPrice: 2000000000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
}),
|
||||
...(overrides || {}),
|
||||
};
|
||||
}
|
||||
|
||||
// A node that only quotes a flat gas price, so populateTransaction produces a
|
||||
// legacy transaction rather than an EIP-1559 one.
|
||||
const legacyProvider = providerWith({
|
||||
getFeeData: async () => ({
|
||||
gasPrice: 2000000000n,
|
||||
maxFeePerGas: null,
|
||||
maxPriorityFeePerGas: null,
|
||||
}),
|
||||
});
|
||||
|
||||
describe("prepareApprovalTx", () => {
|
||||
test("fills in everything the request left out", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
expect(approved).toEqual({
|
||||
type: 2,
|
||||
from: signer.address,
|
||||
chainId: "0x1",
|
||||
nonce: "0x7",
|
||||
gasLimit: "0x5208",
|
||||
maxPriorityFeePerGas: "0x3b9aca00",
|
||||
maxFeePerGas: "0x77359400",
|
||||
to: RECIPIENT,
|
||||
value: TX_PARAMS.value,
|
||||
data: TX_PARAMS.data,
|
||||
accessList: [],
|
||||
});
|
||||
});
|
||||
|
||||
// The object is displayed, signed and verified against on the far side of
|
||||
// chrome.runtime.sendMessage, which is JSON: a bigint would throw on the
|
||||
// way out and a field that did not survive the trip would be a field the
|
||||
// user was shown and nothing compared.
|
||||
test("survives the messaging boundary unchanged", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
expect(JSON.parse(JSON.stringify(approved))).toEqual(approved);
|
||||
for (const value of Object.values(approved)) {
|
||||
expect(typeof value).not.toBe("bigint");
|
||||
}
|
||||
});
|
||||
|
||||
test("carries exactly the fields its type serializes, and the signer", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
expect(Object.keys(approved).sort()).toEqual(
|
||||
["type", "from", ...SERIALIZED_FIELDS[2]].sort(),
|
||||
);
|
||||
});
|
||||
|
||||
test("produces a legacy transaction when that is all the node quotes", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
legacyProvider,
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
expect(approved.type).toBe(0);
|
||||
expect(approved.gasPrice).toBe("0x77359400");
|
||||
expect(approved.maxFeePerGas).toBeUndefined();
|
||||
expect(Object.keys(approved).sort()).toEqual(
|
||||
["type", "from", ...SERIALIZED_FIELDS[0]].sort(),
|
||||
);
|
||||
});
|
||||
|
||||
test("keeps a nonce, gas limit and fee the request did fix", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{
|
||||
...TX_PARAMS,
|
||||
nonce: "0x2",
|
||||
gasLimit: "0x30d40",
|
||||
maxFeePerGas: "0x12a05f200",
|
||||
maxPriorityFeePerGas: "0x3b9aca00",
|
||||
},
|
||||
);
|
||||
expect(approved.nonce).toBe("0x2");
|
||||
expect(approved.gasLimit).toBe("0x30d40");
|
||||
expect(approved.maxFeePerGas).toBe("0x12a05f200");
|
||||
});
|
||||
|
||||
test("carries an access list the request asked for", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{
|
||||
...TX_PARAMS,
|
||||
accessList: [{ address: RECIPIENT, storageKeys: [] }],
|
||||
},
|
||||
);
|
||||
expect(approved.accessList).toEqual([
|
||||
{ address: RECIPIENT, storageKeys: [] },
|
||||
]);
|
||||
});
|
||||
|
||||
// The request is page-controlled. Anything this wallet does not act on is
|
||||
// dropped before ethers sees it, so a field a future ethers learns to
|
||||
// carry cannot be picked up out of it without this module knowing.
|
||||
test("drops request fields this wallet does not act on", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{
|
||||
...TX_PARAMS,
|
||||
authorizationList: [{ address: RECIPIENT }],
|
||||
blobVersionedHashes: ["0x01" + "ab".repeat(31)],
|
||||
customData: { anything: true },
|
||||
},
|
||||
);
|
||||
expect(approved.authorizationList).toBeUndefined();
|
||||
expect(approved.blobVersionedHashes).toBeUndefined();
|
||||
expect(approved.customData).toBeUndefined();
|
||||
expect(approved.type).toBe(2);
|
||||
});
|
||||
|
||||
test("refuses a transaction type this wallet does not sign", async () => {
|
||||
await expect(
|
||||
prepareApprovalTx(providerWith(), signer.address, {
|
||||
...TX_PARAMS,
|
||||
type: 4,
|
||||
}),
|
||||
).rejects.toThrow(/type this wallet does not sign/);
|
||||
});
|
||||
|
||||
test("refuses to raise an approval with no active address", async () => {
|
||||
await expect(
|
||||
prepareApprovalTx(providerWith(), null, TX_PARAMS),
|
||||
).rejects.toThrow(/no active address/);
|
||||
});
|
||||
|
||||
// The ceilings as a backstop: equality with the screen cannot bound what
|
||||
// the node talks the wallet into putting on the screen, so it is refused
|
||||
// before the user is shown anything.
|
||||
test("refuses a fee the node quoted above the ceiling", async () => {
|
||||
const gouging = providerWith({
|
||||
getFeeData: async () => ({
|
||||
gasPrice: MAX_FEE_PER_GAS + 1n,
|
||||
maxFeePerGas: MAX_FEE_PER_GAS + 1n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
}),
|
||||
});
|
||||
await expect(
|
||||
prepareApprovalTx(gouging, signer.address, TX_PARAMS),
|
||||
).rejects.toThrow(/fee per gas far above any plausible value/);
|
||||
});
|
||||
|
||||
test("refuses a gas limit the node estimated above the ceiling", async () => {
|
||||
const absurd = providerWith({
|
||||
estimateGas: async () => MAX_GAS_LIMIT + 1n,
|
||||
});
|
||||
await expect(
|
||||
prepareApprovalTx(absurd, signer.address, TX_PARAMS),
|
||||
).rejects.toThrow(/gas limit no network this wallet supports/);
|
||||
});
|
||||
|
||||
// No approval and no window: the failure goes back to the page the click
|
||||
// came from, in a sentence.
|
||||
test("reports a failed estimate as a full sentence", async () => {
|
||||
const reverting = providerWith({
|
||||
estimateGas: async () => {
|
||||
throw new Error("execution reverted: ERC20: transfer amount");
|
||||
},
|
||||
});
|
||||
let thrown;
|
||||
try {
|
||||
await prepareApprovalTx(reverting, signer.address, TX_PARAMS);
|
||||
} catch (e) {
|
||||
thrown = e;
|
||||
}
|
||||
expect(thrown.message).toMatch(
|
||||
/^The transaction could not be prepared/,
|
||||
);
|
||||
expect(thrown.message).toMatch(/execution reverted/);
|
||||
expect(thrown.message).toMatch(/^[A-Z].*\.$/);
|
||||
});
|
||||
|
||||
// Without a bound, an unreachable node leaves the page's promise pending
|
||||
// with nothing on screen to explain it.
|
||||
test("gives up on a node that never answers", async () => {
|
||||
jest.useFakeTimers();
|
||||
try {
|
||||
const hanging = providerWith({
|
||||
estimateGas: () => new Promise(() => {}),
|
||||
});
|
||||
const pending = prepareApprovalTx(
|
||||
hanging,
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
const settled = expect(pending).rejects.toThrow(
|
||||
/did not answer in time/,
|
||||
);
|
||||
await jest.advanceTimersByTimeAsync(POPULATE_TIMEOUT_MS + 1);
|
||||
await settled;
|
||||
} finally {
|
||||
jest.useRealTimers();
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("serializeApprovedTx", () => {
|
||||
// Unreachable through prepareApprovalTx while the request type is checked
|
||||
// first, which is what it is for: a node or an ethers upgrade that
|
||||
// populates a type this wallet does not sign must not produce an approval.
|
||||
test("refuses a populated transaction of a type this wallet does not sign", () => {
|
||||
expect(() =>
|
||||
serializeApprovedTx(
|
||||
{ type: 3, to: RECIPIENT, nonce: 7 },
|
||||
signer.address,
|
||||
),
|
||||
).toThrow(/type this wallet does not sign/);
|
||||
});
|
||||
|
||||
test("refuses a populated transaction missing a quantity", () => {
|
||||
expect(() =>
|
||||
serializeApprovedTx(
|
||||
{
|
||||
type: 2,
|
||||
chainId: 1n,
|
||||
nonce: 7,
|
||||
gasLimit: 21000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
to: RECIPIENT,
|
||||
value: 0n,
|
||||
data: "0x",
|
||||
},
|
||||
signer.address,
|
||||
),
|
||||
).toThrow(/did not supply a maxPriorityFeePerGas/);
|
||||
});
|
||||
|
||||
test("keeps a contract creation's absent recipient absent", () => {
|
||||
const approved = serializeApprovedTx(
|
||||
{
|
||||
type: 0,
|
||||
chainId: 1n,
|
||||
nonce: 7,
|
||||
gasPrice: 2000000000n,
|
||||
gasLimit: 21000n,
|
||||
to: null,
|
||||
value: 0n,
|
||||
data: "0x600160005500",
|
||||
},
|
||||
signer.address,
|
||||
);
|
||||
expect(approved.to).toBeNull();
|
||||
expect(approved.value).toBe("0x0");
|
||||
expect(approved.data).toBe("0x600160005500");
|
||||
});
|
||||
});
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,329 +0,0 @@
|
||||
// Back after reopening the popup (#268).
|
||||
//
|
||||
// A reopened popup renders the wallet list and the one view it restores
|
||||
// onto; every other view is still the blank static template from
|
||||
// index.html. goBack() used to only unhide its target, so Back landed on
|
||||
// that blank template for any view the popup had not rendered in this page
|
||||
// load. These tests drive the real goBack() with the real router wired to
|
||||
// recording view modules, so what is asserted is which view render ran —
|
||||
// the thing that was missing.
|
||||
//
|
||||
// The rendering itself is asserted against the real popup in a real
|
||||
// browser by tests/e2e/run.js; here the DOM is a stub, because goBack()
|
||||
// only needs showView() to work.
|
||||
|
||||
const els = new Map();
|
||||
|
||||
function fakeEl() {
|
||||
return {
|
||||
textContent: "",
|
||||
innerHTML: "",
|
||||
classList: {
|
||||
toggle() {},
|
||||
add() {},
|
||||
remove() {},
|
||||
contains: () => false,
|
||||
},
|
||||
remove() {},
|
||||
};
|
||||
}
|
||||
|
||||
globalThis.document = {
|
||||
getElementById(id) {
|
||||
if (!els.has(id)) els.set(id, fakeEl());
|
||||
return els.get(id);
|
||||
},
|
||||
};
|
||||
|
||||
// helpers.js pulls in state.js, which reads chrome.storage.local at load.
|
||||
globalThis.chrome = {
|
||||
storage: { local: { get: async () => ({}), set: async () => {} } },
|
||||
};
|
||||
|
||||
const {
|
||||
showView,
|
||||
goBack,
|
||||
setBackRenderer,
|
||||
pushCurrentView,
|
||||
} = require("../src/popup/views/helpers");
|
||||
const {
|
||||
makeBackRenderer,
|
||||
markViewRendered,
|
||||
resetRenderedViews,
|
||||
} = require("../src/popup/viewRouter");
|
||||
const { state } = require("../src/shared/state");
|
||||
|
||||
const ADDRESS = "0x1111111111111111111111111111111111111111";
|
||||
const TOKEN = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
|
||||
|
||||
let calls;
|
||||
|
||||
// Stand-ins for the view modules. Each records itself and then shows its
|
||||
// view, which is what every real view render ends with — so the assertions
|
||||
// can tell "rendered and shown" apart from "merely unhidden".
|
||||
function recorder(name, view) {
|
||||
return () => {
|
||||
calls.push(name);
|
||||
showView(view);
|
||||
};
|
||||
}
|
||||
|
||||
function makeViews() {
|
||||
return {
|
||||
main: { show: recorder("main", "main") },
|
||||
addressDetail: { show: recorder("addressDetail", "address") },
|
||||
addressToken: { show: recorder("addressToken", "address-token") },
|
||||
receive: { show: recorder("receive", "receive") },
|
||||
settings: { show: recorder("settings", "settings") },
|
||||
settingsAddToken: {
|
||||
show: recorder("settingsAddToken", "settings-addtoken"),
|
||||
},
|
||||
confirmTx: { restore: recorder("confirmTx", "confirm-tx") },
|
||||
transactionDetail: {
|
||||
render: recorder("transactionDetail", "transaction"),
|
||||
},
|
||||
txStatus: {
|
||||
restoreWait: () => {
|
||||
calls.push("waitTx");
|
||||
showView("wait-tx");
|
||||
return true;
|
||||
},
|
||||
renderSuccess: recorder("successTx", "success-tx"),
|
||||
renderError: recorder("errorTx", "error-tx"),
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
// The popup as it stands just after a reopen: one wallet with one address,
|
||||
// the view the popup restored onto, and the stack behind it.
|
||||
//
|
||||
// A reopen is a fresh page load, so the record of what has been rendered
|
||||
// starts empty — that emptiness is what makes the Back path render at all.
|
||||
// Returns the view modules so a test can drive forward navigation through
|
||||
// the same recorders the router renders through.
|
||||
function reopenedOn(view, stack, extra) {
|
||||
calls = [];
|
||||
resetRenderedViews();
|
||||
state.wallets = [
|
||||
{
|
||||
name: "Wallet 1",
|
||||
addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
|
||||
},
|
||||
];
|
||||
state.selectedWallet = 0;
|
||||
state.selectedAddress = 0;
|
||||
state.selectedToken = null;
|
||||
state.viewData = null;
|
||||
state.currentView = view;
|
||||
state.viewStack = stack.slice();
|
||||
Object.assign(state, extra || {});
|
||||
// Restoring onto a view renders it, so the reopened popup has that one
|
||||
// view on the page and nothing else.
|
||||
markViewRendered(view);
|
||||
const views = makeViews();
|
||||
setBackRenderer(makeBackRenderer(state, views));
|
||||
return views;
|
||||
}
|
||||
|
||||
// The reproduction from the issue, step for step.
|
||||
describe("Back onto a view the reopened popup never rendered", () => {
|
||||
test("Back from settings renders the address detail underneath", () => {
|
||||
reopenedOn("settings", ["main", "address"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["addressDetail"]);
|
||||
expect(state.currentView).toBe("address");
|
||||
expect(state.viewStack).toEqual(["main"]);
|
||||
});
|
||||
|
||||
test("Back onto the token detail renders it", () => {
|
||||
reopenedOn("settings", ["main", "address", "address-token"], {
|
||||
selectedToken: TOKEN,
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["addressToken"]);
|
||||
expect(state.currentView).toBe("address-token");
|
||||
});
|
||||
|
||||
test("Back onto Receive renders it", () => {
|
||||
reopenedOn("settings", ["main", "address", "receive"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["receive"]);
|
||||
expect(state.currentView).toBe("receive");
|
||||
});
|
||||
|
||||
test("Back onto the transaction detail renders it", () => {
|
||||
reopenedOn("settings", ["main", "transaction"], {
|
||||
viewData: { tx: { hash: "0xdead" } },
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["transactionDetail"]);
|
||||
expect(state.currentView).toBe("transaction");
|
||||
});
|
||||
|
||||
test("Back onto the transaction confirmation restores it", () => {
|
||||
reopenedOn("settings", ["main", "confirm-tx"], {
|
||||
viewData: { pendingTx: { to: ADDRESS, amount: "1" } },
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["confirmTx"]);
|
||||
expect(state.currentView).toBe("confirm-tx");
|
||||
});
|
||||
|
||||
test("Back onto the success screen renders it", () => {
|
||||
reopenedOn("settings", ["main", "success-tx"], {
|
||||
viewData: { hash: "0xdead" },
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["successTx"]);
|
||||
expect(state.currentView).toBe("success-tx");
|
||||
});
|
||||
|
||||
test("Back onto the failure screen renders it", () => {
|
||||
reopenedOn("settings", ["main", "error-tx"], {
|
||||
viewData: { message: "execution reverted" },
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["errorTx"]);
|
||||
expect(state.currentView).toBe("error-tx");
|
||||
});
|
||||
|
||||
test("Back onto Home renders the wallet list", () => {
|
||||
reopenedOn("settings", ["main"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("Back with an empty stack renders Home", () => {
|
||||
reopenedOn("settings", []);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
});
|
||||
|
||||
// The guards are restoreView()'s, so a popped view whose backing data is
|
||||
// gone lands on Home rather than on an empty template.
|
||||
describe("Back onto a view whose backing data is gone", () => {
|
||||
test("the token detail with no token selected falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "address-token"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("the transaction detail with no transaction falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "transaction"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("the confirmation with no pending transaction falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "confirm-tx"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("an address view with no address selected falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "receive"], {
|
||||
selectedAddress: null,
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("the success screen with no transaction hash falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "success-tx"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("the failure screen with no message falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "error-tx"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("a wait that can no longer be resumed falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "wait-tx"]);
|
||||
const views = makeViews();
|
||||
views.txStatus.restoreWait = () => false;
|
||||
setBackRenderer(makeBackRenderer(state, views));
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
});
|
||||
|
||||
// Forward navigation renders as it goes, and a second render would re-fetch
|
||||
// and clobber whatever the view holds — an unsaved edit, a request in
|
||||
// flight. So the Back path renders only a view this page load has never
|
||||
// rendered, and merely unhides every other one: the views it does not
|
||||
// render from persisted state, and the views already on the page.
|
||||
describe("what the Back path leaves alone", () => {
|
||||
test("forward navigation renders nothing by itself", () => {
|
||||
reopenedOn("address", ["main"]);
|
||||
pushCurrentView();
|
||||
showView("send");
|
||||
expect(calls).toEqual([]);
|
||||
expect(state.viewStack).toEqual(["main", "address"]);
|
||||
});
|
||||
|
||||
test("Back onto a live-session view only unhides it", () => {
|
||||
reopenedOn("confirm-tx", ["main", "address", "send"]);
|
||||
goBack();
|
||||
expect(calls).toEqual([]);
|
||||
expect(state.currentView).toBe("send");
|
||||
});
|
||||
|
||||
test("Back renders its target exactly once", () => {
|
||||
reopenedOn("settings", ["main", "address"]);
|
||||
goBack();
|
||||
expect(calls.filter((c) => c === "addressDetail")).toHaveLength(1);
|
||||
});
|
||||
|
||||
test("Back onto a view this page load already rendered only unhides it", () => {
|
||||
const views = reopenedOn("main", []);
|
||||
pushCurrentView();
|
||||
views.addressDetail.show();
|
||||
pushCurrentView();
|
||||
views.settings.show();
|
||||
calls = [];
|
||||
goBack();
|
||||
expect(calls).toEqual([]);
|
||||
expect(state.currentView).toBe("address");
|
||||
});
|
||||
|
||||
// The unit mirror of the regression the browser suite pins: Settings
|
||||
// reassigns its fields from persisted state on every render, so a
|
||||
// re-render on the way back discards an edit the user has not saved.
|
||||
test("Back onto Settings visited earlier in this page load does not re-render it", () => {
|
||||
const views = reopenedOn("main", []);
|
||||
pushCurrentView();
|
||||
views.settings.show();
|
||||
pushCurrentView();
|
||||
views.settingsAddToken.show();
|
||||
calls = [];
|
||||
goBack();
|
||||
expect(calls).toEqual([]);
|
||||
expect(state.currentView).toBe("settings");
|
||||
});
|
||||
|
||||
// Home is the deliberate exception, unchanged from the popup's
|
||||
// behaviour before the router existed: it re-renders on every Back so
|
||||
// the wallet list reflects what changed while the user was away.
|
||||
test("Back onto Home renders it again even when it is already on the page", () => {
|
||||
const views = reopenedOn("main", []);
|
||||
pushCurrentView();
|
||||
views.addressDetail.show();
|
||||
calls = [];
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
});
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,232 +0,0 @@
|
||||
// Who may move the active chain.
|
||||
//
|
||||
// wallet_switchEthereumChain used to be answered for any origin at all, with
|
||||
// no connection check and no prompt, so a page the user had never connected
|
||||
// to could clear the [TESTNET] banner under someone who believed they were
|
||||
// on Sepolia (https://git.eeqj.de/sneak/AutistMask/issues/308). The refusal
|
||||
// is asserted as a refusal to ACT — the state unmoved and no chainChanged
|
||||
// broadcast — because an error code alone would not distinguish a gate from
|
||||
// a switch that happened and then reported a failure.
|
||||
//
|
||||
// The endpoint half of that issue lives in tests/networkEndpoints.test.js;
|
||||
// this file mocks the state module, which that one exercises for real.
|
||||
|
||||
const { networkById } = require("../src/shared/networks");
|
||||
|
||||
const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
|
||||
// The site the persisted state has connected, and one it has never heard of.
|
||||
const CONNECTED_ORIGIN = "https://dapp.example";
|
||||
const CONNECTED_HOSTNAME = "dapp.example";
|
||||
const STRANGER_ORIGIN = "https://stranger.example";
|
||||
|
||||
const MAINNET = networkById("mainnet");
|
||||
const SEPOLIA = networkById("sepolia");
|
||||
|
||||
// The user's own node, so a switch that happens is visible as the loss of it.
|
||||
const CUSTOM_RPC = "http://127.0.0.1:8545";
|
||||
|
||||
function walletFixture() {
|
||||
return [
|
||||
{
|
||||
name: "Wallet 1",
|
||||
type: "hd",
|
||||
addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
|
||||
},
|
||||
];
|
||||
}
|
||||
|
||||
// Let the handler's promise chain run to the next suspension point. The gate
|
||||
// reads storage before it answers, so the response is several awaits deep.
|
||||
async function settle() {
|
||||
for (let i = 0; i < 50; i++) await Promise.resolve();
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
delete global.chrome;
|
||||
});
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// The gate: which origins the background will switch the chain for.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
// Load the background worker against stubbed browser APIs, with the real
|
||||
// chain-switch module behind it, and return the handles to drive it. The
|
||||
// wallet state is a plain object so that a switch that DID happen is visible
|
||||
// as a mutation of it, and one that did not is visible as its absence.
|
||||
function loadBackground() {
|
||||
jest.resetModules();
|
||||
|
||||
const walletState = {
|
||||
networkId: "mainnet",
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: MAINNET.defaultBlockscoutUrl,
|
||||
networkEndpoints: {},
|
||||
wallets: walletFixture(),
|
||||
lastBalanceRefresh: 1,
|
||||
tokenHolderCache: {},
|
||||
fraudContracts: [],
|
||||
};
|
||||
|
||||
jest.doMock("../src/shared/state", () => ({
|
||||
state: walletState,
|
||||
loadState: jest.fn(async () => {}),
|
||||
saveState: jest.fn(async () => {}),
|
||||
currentNetwork: () => networkById(walletState.networkId),
|
||||
}));
|
||||
jest.doMock("../src/shared/balances", () => ({
|
||||
getProvider: () => ({}),
|
||||
refreshBalances: jest.fn(async () => {}),
|
||||
}));
|
||||
jest.doMock("../src/shared/phishingDomains", () => ({
|
||||
isPhishingDomain: () => false,
|
||||
}));
|
||||
jest.doMock("../src/shared/alarms", () => ({
|
||||
BALANCE_REFRESH_ALARM: "balance",
|
||||
BALANCE_REFRESH_PERIOD_MINUTES: 1,
|
||||
ensureRecurringAlarms: jest.fn(async () => {}),
|
||||
registerAlarmHandlers: jest.fn(),
|
||||
}));
|
||||
|
||||
const persisted = {
|
||||
wallets: walletFixture(),
|
||||
activeAddress: ADDRESS,
|
||||
allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
|
||||
deniedSites: {},
|
||||
};
|
||||
|
||||
let messageListener = null;
|
||||
// Every message the background pushed at a content script. chainChanged
|
||||
// is what tells a page the wallet moved, so an ungated switch is visible
|
||||
// here as well as in the state.
|
||||
const toTabs = [];
|
||||
|
||||
global.chrome = {
|
||||
storage: {
|
||||
local: {
|
||||
get: jest.fn(async () => ({ autistmask: persisted })),
|
||||
set: jest.fn(async () => {}),
|
||||
},
|
||||
},
|
||||
runtime: {
|
||||
getURL: (path) => "chrome-extension://autistmask/" + path,
|
||||
onMessage: {
|
||||
addListener: (fn) => {
|
||||
messageListener = fn;
|
||||
},
|
||||
},
|
||||
onConnect: { addListener: () => {} },
|
||||
lastError: null,
|
||||
},
|
||||
windows: {
|
||||
getLastFocused: (cb) => cb(null),
|
||||
create: (options, cb) => cb({ id: 1 }),
|
||||
remove: (id, cb) => {
|
||||
if (cb) cb();
|
||||
},
|
||||
onRemoved: { addListener: () => {} },
|
||||
},
|
||||
tabs: {
|
||||
query: (queryInfo, cb) => cb([{ id: 1 }]),
|
||||
sendMessage: (tabId, message, cb) => {
|
||||
toTabs.push(message);
|
||||
if (cb) cb();
|
||||
},
|
||||
},
|
||||
action: { setPopup: () => {} },
|
||||
};
|
||||
|
||||
require("../src/background/index");
|
||||
|
||||
async function switchChain(chainId, origin) {
|
||||
let result = null;
|
||||
messageListener(
|
||||
{
|
||||
type: "AUTISTMASK_RPC",
|
||||
method: "wallet_switchEthereumChain",
|
||||
params: [{ chainId }],
|
||||
},
|
||||
{ origin },
|
||||
(r) => {
|
||||
result = r;
|
||||
},
|
||||
);
|
||||
await settle();
|
||||
return result;
|
||||
}
|
||||
|
||||
return {
|
||||
switchChain,
|
||||
walletState,
|
||||
chainChangedEvents: () =>
|
||||
toTabs.filter((m) => m.eventName === "chainChanged"),
|
||||
};
|
||||
}
|
||||
|
||||
describe("wallet_switchEthereumChain is gated on the connection", () => {
|
||||
test("an origin the wallet was never connected to is refused with 4100", async () => {
|
||||
const bg = loadBackground();
|
||||
|
||||
const result = await bg.switchChain(SEPOLIA.chainId, STRANGER_ORIGIN);
|
||||
|
||||
expect(result.error).toEqual({ code: 4100, message: "Unauthorized" });
|
||||
expect(result.result).toBeUndefined();
|
||||
// The refusal has to be a refusal to ACT, not just an error string:
|
||||
// the wallet is still on mainnet, still on the user's own node, and
|
||||
// no page was told the chain moved.
|
||||
expect(bg.walletState.networkId).toBe("mainnet");
|
||||
expect(bg.walletState.rpcUrl).toBe(CUSTOM_RPC);
|
||||
expect(bg.chainChangedEvents()).toEqual([]);
|
||||
});
|
||||
|
||||
test("an unconnected origin is refused even for the chain already active", async () => {
|
||||
const bg = loadBackground();
|
||||
|
||||
const result = await bg.switchChain(MAINNET.chainId, STRANGER_ORIGIN);
|
||||
|
||||
expect(result.error).toEqual({ code: 4100, message: "Unauthorized" });
|
||||
});
|
||||
|
||||
test("an unconnected origin is refused before the unsupported-chain answer", async () => {
|
||||
const bg = loadBackground();
|
||||
|
||||
const result = await bg.switchChain("0x89", STRANGER_ORIGIN);
|
||||
|
||||
expect(result.error.code).toBe(4100);
|
||||
});
|
||||
|
||||
test("a connected origin switches the chain", async () => {
|
||||
const bg = loadBackground();
|
||||
|
||||
const result = await bg.switchChain(SEPOLIA.chainId, CONNECTED_ORIGIN);
|
||||
|
||||
expect(result).toEqual({ result: null });
|
||||
expect(bg.walletState.networkId).toBe("sepolia");
|
||||
expect(bg.chainChangedEvents()).toEqual([
|
||||
{
|
||||
type: "AUTISTMASK_EVENT",
|
||||
eventName: "chainChanged",
|
||||
data: SEPOLIA.chainId,
|
||||
},
|
||||
]);
|
||||
});
|
||||
|
||||
test("a connected origin asking for an unsupported chain still gets 4902", async () => {
|
||||
const bg = loadBackground();
|
||||
|
||||
const result = await bg.switchChain("0x89", CONNECTED_ORIGIN);
|
||||
|
||||
expect(result.error.code).toBe(4902);
|
||||
expect(bg.walletState.networkId).toBe("mainnet");
|
||||
});
|
||||
|
||||
test("a switch by a connected origin keeps the user's endpoint", async () => {
|
||||
const bg = loadBackground();
|
||||
|
||||
await bg.switchChain(SEPOLIA.chainId, CONNECTED_ORIGIN);
|
||||
expect(bg.walletState.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
|
||||
|
||||
await bg.switchChain(MAINNET.chainId, CONNECTED_ORIGIN);
|
||||
expect(bg.walletState.rpcUrl).toBe(CUSTOM_RPC);
|
||||
});
|
||||
});
|
||||
@@ -1,212 +0,0 @@
|
||||
// What a chain switch does to a worker that has not loaded state yet.
|
||||
//
|
||||
// The MV3 service worker is terminated when idle and revived by the next
|
||||
// message, and nothing loads state at module scope. The chain-switch handler
|
||||
// reaches onChainSwitch(), which mutates the module-level `state` singleton
|
||||
// and then persists EVERY field of it, so a handler that runs before a load
|
||||
// writes DEFAULT_STATE over the user's stored profile — every wallet, every
|
||||
// site approval, every tracked token and the custom endpoint
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/316). The same singleton is
|
||||
// what currentNetwork() answers from, so the same-chain early return also
|
||||
// compares against the wrong network.
|
||||
//
|
||||
// This file therefore uses the REAL state module and never calls loadState()
|
||||
// itself: the handler has to do it. tests/chainSwitchGate.test.js mocks the
|
||||
// state module wholesale and tests/networkEndpoints.test.js always loads
|
||||
// first, so neither can see this.
|
||||
|
||||
const { networkById } = require("../src/shared/networks");
|
||||
|
||||
const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
|
||||
const CONNECTED_ORIGIN = "https://dapp.example";
|
||||
const CONNECTED_HOSTNAME = "dapp.example";
|
||||
|
||||
const MAINNET = networkById("mainnet");
|
||||
const SEPOLIA = networkById("sepolia");
|
||||
|
||||
// The user's own node, and a wallet whose loss is the whole point.
|
||||
const CUSTOM_RPC = "http://127.0.0.1:8545";
|
||||
const CUSTOM_BLOCKSCOUT = "http://127.0.0.1:4000/api/v2";
|
||||
const TOKEN = "0x6B175474E89094C44Da98b954EedeAC495271d0F";
|
||||
|
||||
function walletFixture() {
|
||||
return [
|
||||
{
|
||||
name: "Wallet 1",
|
||||
type: "hd",
|
||||
addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
|
||||
},
|
||||
];
|
||||
}
|
||||
|
||||
// A profile as an installed extension holds it, on `networkId`.
|
||||
function storedProfile(networkId) {
|
||||
return {
|
||||
hasWallet: true,
|
||||
wallets: walletFixture(),
|
||||
activeAddress: ADDRESS,
|
||||
networkId,
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: CUSTOM_BLOCKSCOUT,
|
||||
allowedSites: { [ADDRESS]: [CONNECTED_HOSTNAME] },
|
||||
deniedSites: {},
|
||||
trackedTokens: [{ address: TOKEN, symbol: "DAI", decimals: 18 }],
|
||||
theme: "dark",
|
||||
};
|
||||
}
|
||||
|
||||
async function settle() {
|
||||
for (let i = 0; i < 50; i++) await Promise.resolve();
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
delete global.chrome;
|
||||
});
|
||||
|
||||
// Load the background worker with the real state and chain-switch modules
|
||||
// behind it, over a storage stub that actually keeps what is written — a
|
||||
// wipe is only observable against storage that remembers.
|
||||
function loadColdWorker(networkId) {
|
||||
jest.resetModules();
|
||||
|
||||
jest.doMock("../src/shared/balances", () => ({
|
||||
getProvider: () => ({}),
|
||||
refreshBalances: jest.fn(async () => {}),
|
||||
}));
|
||||
jest.doMock("../src/shared/phishingDomains", () => ({
|
||||
isPhishingDomain: () => false,
|
||||
}));
|
||||
jest.doMock("../src/shared/alarms", () => ({
|
||||
BALANCE_REFRESH_ALARM: "balance",
|
||||
BALANCE_REFRESH_PERIOD_MINUTES: 1,
|
||||
ensureRecurringAlarms: jest.fn(async () => {}),
|
||||
registerAlarmHandlers: jest.fn(),
|
||||
}));
|
||||
|
||||
const store = { autistmask: storedProfile(networkId) };
|
||||
|
||||
let messageListener = null;
|
||||
const toTabs = [];
|
||||
|
||||
global.chrome = {
|
||||
storage: {
|
||||
local: {
|
||||
get: jest.fn(async () => ({ autistmask: store.autistmask })),
|
||||
set: jest.fn(async (items) => {
|
||||
store.autistmask = items.autistmask;
|
||||
}),
|
||||
},
|
||||
},
|
||||
runtime: {
|
||||
getURL: (path) => "chrome-extension://autistmask/" + path,
|
||||
onMessage: {
|
||||
addListener: (fn) => {
|
||||
messageListener = fn;
|
||||
},
|
||||
},
|
||||
onConnect: { addListener: () => {} },
|
||||
lastError: null,
|
||||
},
|
||||
windows: {
|
||||
getLastFocused: (cb) => cb(null),
|
||||
create: (options, cb) => cb({ id: 1 }),
|
||||
remove: (id, cb) => {
|
||||
if (cb) cb();
|
||||
},
|
||||
onRemoved: { addListener: () => {} },
|
||||
},
|
||||
tabs: {
|
||||
query: (queryInfo, cb) => cb([{ id: 1 }]),
|
||||
sendMessage: (tabId, message, cb) => {
|
||||
toTabs.push(message);
|
||||
if (cb) cb();
|
||||
},
|
||||
},
|
||||
action: { setPopup: () => {} },
|
||||
};
|
||||
|
||||
require("../src/background/index");
|
||||
|
||||
async function switchChain(chainId) {
|
||||
let result = null;
|
||||
messageListener(
|
||||
{
|
||||
type: "AUTISTMASK_RPC",
|
||||
method: "wallet_switchEthereumChain",
|
||||
params: [{ chainId }],
|
||||
},
|
||||
{ origin: CONNECTED_ORIGIN },
|
||||
(r) => {
|
||||
result = r;
|
||||
},
|
||||
);
|
||||
await settle();
|
||||
return result;
|
||||
}
|
||||
|
||||
return {
|
||||
switchChain,
|
||||
persisted: () => store.autistmask,
|
||||
chainChangedEvents: () =>
|
||||
toTabs.filter((m) => m.eventName === "chainChanged"),
|
||||
};
|
||||
}
|
||||
|
||||
describe("a chain switch on a worker that never loaded state", () => {
|
||||
test("keeps the wallets, approvals, tokens and custom endpoint", async () => {
|
||||
const bg = loadColdWorker("mainnet");
|
||||
|
||||
const result = await bg.switchChain(SEPOLIA.chainId);
|
||||
expect(result).toEqual({ result: null });
|
||||
|
||||
const after = bg.persisted();
|
||||
// The switch itself happened.
|
||||
expect(after.networkId).toBe("sepolia");
|
||||
expect(after.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
|
||||
|
||||
// And it took nothing else with it. Without the load these come back
|
||||
// as [], {}, [] and "system" from DEFAULT_STATE — every wallet in the
|
||||
// extension gone, encrypted secrets included.
|
||||
expect(after.wallets).toEqual(walletFixture());
|
||||
expect(after.hasWallet).toBe(true);
|
||||
expect(after.activeAddress).toBe(ADDRESS);
|
||||
expect(after.allowedSites).toEqual({ [ADDRESS]: [CONNECTED_HOSTNAME] });
|
||||
expect(after.trackedTokens).toEqual([
|
||||
{ address: TOKEN, symbol: "DAI", decimals: 18 },
|
||||
]);
|
||||
expect(after.theme).toBe("dark");
|
||||
|
||||
// The user's mainnet endpoint is remembered rather than replaced by
|
||||
// the public default, so switching back returns it.
|
||||
expect(after.networkEndpoints.mainnet).toEqual({
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: CUSTOM_BLOCKSCOUT,
|
||||
});
|
||||
|
||||
await bg.switchChain(MAINNET.chainId);
|
||||
expect(bg.persisted().rpcUrl).toBe(CUSTOM_RPC);
|
||||
expect(bg.persisted().blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
|
||||
expect(bg.persisted().wallets).toEqual(walletFixture());
|
||||
});
|
||||
|
||||
test("compares the requested chain against the stored one, not the default", async () => {
|
||||
// Stored on Sepolia, asked for mainnet. Reading the unloaded
|
||||
// singleton makes this look like the chain already active, so the
|
||||
// page is told the switch succeeded while the wallet stays on the
|
||||
// testnet it was on.
|
||||
const bg = loadColdWorker("sepolia");
|
||||
|
||||
const result = await bg.switchChain(MAINNET.chainId);
|
||||
expect(result).toEqual({ result: null });
|
||||
|
||||
expect(bg.persisted().networkId).toBe("mainnet");
|
||||
expect(bg.chainChangedEvents()).toEqual([
|
||||
{
|
||||
type: "AUTISTMASK_EVENT",
|
||||
eventName: "chainChanged",
|
||||
data: MAINNET.chainId,
|
||||
},
|
||||
]);
|
||||
});
|
||||
});
|
||||
@@ -150,7 +150,7 @@ describe("the balance warning on the removal confirmation", () => {
|
||||
expect(balanceWarningHtml(ETH_ONLY)).toContain("Total: $3,000.00");
|
||||
});
|
||||
|
||||
// getAddressValue() reports no value on testnet and before the first
|
||||
// getAddressValueUsd() returns null on testnet and before the first
|
||||
// price fetch. A "Total: $0.00" there would be a lie about the holdings.
|
||||
test("no USD total is shown when prices are not known", () => {
|
||||
expect(balanceWarningHtml(TOKEN_ONLY)).not.toContain("Total:");
|
||||
|
||||
@@ -1,243 +0,0 @@
|
||||
// Tests for the dust threshold field in Settings (issue #233).
|
||||
//
|
||||
// Two halves: what the parse accepts, and what the settings view does with a
|
||||
// rejection. The view half runs against the real change handler with the DOM
|
||||
// helpers stubbed out, because the bug was not in the parse — it was that a
|
||||
// rejection said nothing.
|
||||
|
||||
const {
|
||||
DUST_THRESHOLD_MESSAGE,
|
||||
parseDustThresholdGwei,
|
||||
} = require("../src/popup/dustThreshold");
|
||||
|
||||
describe("parsing the dust threshold", () => {
|
||||
test("accepts a whole number of gwei", () => {
|
||||
expect(parseDustThresholdGwei("100000")).toBe(100000);
|
||||
expect(parseDustThresholdGwei("1")).toBe(1);
|
||||
});
|
||||
|
||||
// Zero is a real setting, not an empty field: it hides nothing.
|
||||
test("accepts zero", () => {
|
||||
expect(parseDustThresholdGwei("0")).toBe(0);
|
||||
});
|
||||
|
||||
test("accepts surrounding whitespace", () => {
|
||||
expect(parseDustThresholdGwei(" 250 ")).toBe(250);
|
||||
});
|
||||
|
||||
test("rejects an empty field", () => {
|
||||
expect(parseDustThresholdGwei("")).toBe(null);
|
||||
expect(parseDustThresholdGwei(" ")).toBe(null);
|
||||
});
|
||||
|
||||
test("rejects a negative threshold", () => {
|
||||
expect(parseDustThresholdGwei("-1")).toBe(null);
|
||||
});
|
||||
|
||||
// parseInt used to read this as 1, which is not what was typed.
|
||||
test("rejects a fractional value", () => {
|
||||
expect(parseDustThresholdGwei("1.5")).toBe(null);
|
||||
expect(parseDustThresholdGwei("1.0")).toBe(null);
|
||||
});
|
||||
|
||||
// parseInt used to read this as 100. The unit is printed beside the
|
||||
// field already.
|
||||
test("rejects a value carrying its unit", () => {
|
||||
expect(parseDustThresholdGwei("100 gwei")).toBe(null);
|
||||
});
|
||||
|
||||
// Number() reads this as 16. Storing 16 for a field that was told to
|
||||
// want a whole number of gwei would be the same silent substitution the
|
||||
// message exists to end.
|
||||
test("rejects hex notation", () => {
|
||||
expect(parseDustThresholdGwei("0x10")).toBe(null);
|
||||
});
|
||||
|
||||
// Number() reads this as 1000.
|
||||
test("rejects exponent notation", () => {
|
||||
expect(parseDustThresholdGwei("1e3")).toBe(null);
|
||||
});
|
||||
|
||||
test("rejects other non-numeric input", () => {
|
||||
expect(parseDustThresholdGwei("lots")).toBe(null);
|
||||
expect(parseDustThresholdGwei("+5")).toBe(null);
|
||||
expect(parseDustThresholdGwei("Infinity")).toBe(null);
|
||||
expect(parseDustThresholdGwei(undefined)).toBe(null);
|
||||
expect(parseDustThresholdGwei(5)).toBe(null);
|
||||
});
|
||||
|
||||
// Beyond 2^53 the digits would round on the way in, so the stored
|
||||
// threshold would not be the one typed.
|
||||
test("rejects a value too large to hold exactly", () => {
|
||||
expect(parseDustThresholdGwei("9007199254740993")).toBe(null);
|
||||
});
|
||||
});
|
||||
|
||||
describe("the rejection message", () => {
|
||||
// README, Language & Labeling: error messages are full sentences.
|
||||
test("is a full sentence naming the constraint", () => {
|
||||
expect(DUST_THRESHOLD_MESSAGE).toMatch(/^[A-Z].*\.$/);
|
||||
expect(DUST_THRESHOLD_MESSAGE).toContain("whole number of gwei");
|
||||
expect(DUST_THRESHOLD_MESSAGE).toContain("zero or greater");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the flash line the message is shown in", () => {
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const POPUP_HTML = fs.readFileSync(
|
||||
path.join(__dirname, "..", "src", "popup", "index.html"),
|
||||
"utf8",
|
||||
);
|
||||
|
||||
// This asserts only that the reservation exists in the markup. It does
|
||||
// NOT and CANNOT assert that the message fits inside it: jest runs on
|
||||
// the node environment here, with no layout engine, so every rendered
|
||||
// height is zero. An earlier version of this block claimed to pin the
|
||||
// No Layout Shift policy with this regex, and it passed at any message
|
||||
// length, including one that wrapped to two lines and pushed the
|
||||
// settings view down 12px.
|
||||
//
|
||||
// The assertion that actually measures — empty line vs. the message,
|
||||
// real Chromium, documented 360x600 popup — is
|
||||
// "a rejected dust threshold shifts no layout (#233)" in
|
||||
// tests/e2e/run.js, run by make test-e2e. It is not in make check
|
||||
// because REPO_POLICIES.md caps make test at 20 seconds and a browser
|
||||
// suite does not fit; run it before changing the wording.
|
||||
test("reserves its height in the markup", () => {
|
||||
const flashLine = POPUP_HTML.match(
|
||||
/<div\s+id="flash-msg"\s+class="([^"]*)"/,
|
||||
);
|
||||
expect(flashLine).not.toBeNull();
|
||||
expect(flashLine[1]).toMatch(/min-h-\[/);
|
||||
});
|
||||
});
|
||||
|
||||
describe("the settings view on a change to the field", () => {
|
||||
let elements;
|
||||
let flashes;
|
||||
let saves;
|
||||
let state;
|
||||
|
||||
// A stand-in for one DOM node: enough of an element for init() to set
|
||||
// properties on it and hang listeners off it.
|
||||
function fakeElement() {
|
||||
return {
|
||||
value: "",
|
||||
checked: false,
|
||||
textContent: "",
|
||||
href: "",
|
||||
style: {},
|
||||
dataset: {},
|
||||
classList: { add() {}, remove() {} },
|
||||
listeners: {},
|
||||
addEventListener(event, handler) {
|
||||
this.listeners[event] = handler;
|
||||
},
|
||||
querySelectorAll: () => [],
|
||||
};
|
||||
}
|
||||
|
||||
function loadSettingsView() {
|
||||
elements = {};
|
||||
flashes = [];
|
||||
saves = 0;
|
||||
|
||||
jest.resetModules();
|
||||
|
||||
jest.doMock("../src/popup/views/helpers", () => ({
|
||||
$: (id) => (elements[id] ||= fakeElement()),
|
||||
showView: () => {},
|
||||
updateDebugBanner: () => {},
|
||||
showFlash: (msg) => flashes.push(msg),
|
||||
escapeHtml: (s) => s,
|
||||
flashCopyFeedback: () => {},
|
||||
goBack: () => {},
|
||||
pushCurrentView: () => {},
|
||||
onViewLeave: () => {},
|
||||
VIEWS: [],
|
||||
}));
|
||||
|
||||
state = require("../src/shared/state").state;
|
||||
state.dustThresholdGwei = 100000;
|
||||
|
||||
const settings = require("../src/popup/views/settings");
|
||||
settings.init({});
|
||||
return elements["settings-dust-threshold"];
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
globalThis.chrome = {
|
||||
runtime: { sendMessage: () => {} },
|
||||
storage: {
|
||||
local: {
|
||||
get: async () => ({}),
|
||||
set: async () => {
|
||||
saves++;
|
||||
},
|
||||
},
|
||||
},
|
||||
};
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
jest.dontMock("../src/popup/views/helpers");
|
||||
delete globalThis.chrome;
|
||||
});
|
||||
|
||||
async function change(field, typed) {
|
||||
field.value = typed;
|
||||
await field.listeners.change();
|
||||
}
|
||||
|
||||
test("a valid value is stored and says nothing", async () => {
|
||||
const field = loadSettingsView();
|
||||
|
||||
await change(field, "250");
|
||||
|
||||
expect(state.dustThresholdGwei).toBe(250);
|
||||
expect(field.value).toBe(250);
|
||||
expect(flashes).toEqual([]);
|
||||
expect(saves).toBe(1);
|
||||
});
|
||||
|
||||
test("a rejected value shows the message and is not stored", async () => {
|
||||
const field = loadSettingsView();
|
||||
|
||||
await change(field, "1.5");
|
||||
|
||||
expect(state.dustThresholdGwei).toBe(100000);
|
||||
expect(flashes).toEqual([DUST_THRESHOLD_MESSAGE]);
|
||||
expect(saves).toBe(0);
|
||||
});
|
||||
|
||||
// The snap-back is the behaviour the message explains, so it stays.
|
||||
test("a rejected value still resyncs the field to what is stored", async () => {
|
||||
const field = loadSettingsView();
|
||||
|
||||
await change(field, "100 gwei");
|
||||
|
||||
expect(field.value).toBe(100000);
|
||||
});
|
||||
|
||||
test("every rejected notation gets the same one message", async () => {
|
||||
for (const typed of ["", "-1", "1.5", "100 gwei", "0x10", "1e3"]) {
|
||||
const field = loadSettingsView();
|
||||
|
||||
await change(field, typed);
|
||||
|
||||
expect(flashes).toEqual([DUST_THRESHOLD_MESSAGE]);
|
||||
expect(state.dustThresholdGwei).toBe(100000);
|
||||
}
|
||||
});
|
||||
|
||||
test("zero is accepted, not treated as an empty field", async () => {
|
||||
const field = loadSettingsView();
|
||||
|
||||
await change(field, "0");
|
||||
|
||||
expect(state.dustThresholdGwei).toBe(0);
|
||||
expect(flashes).toEqual([]);
|
||||
});
|
||||
});
|
||||
@@ -1,34 +0,0 @@
|
||||
# Chrome end-to-end image: the pinned Playwright image with this repo and a
|
||||
# freshly built extension inside it, built by script/test-e2e. The suite is
|
||||
# still started with `docker run`, so every runtime flag the harness needs
|
||||
# (--ipc=host in particular) applies as before.
|
||||
#
|
||||
# The repo is baked in rather than bind-mounted because a bind mount does
|
||||
# not resolve under Gitea Actions: the runner runs the job in a container
|
||||
# against the HOST's docker socket, so the source side of a -v is resolved
|
||||
# by the host daemon while the job's checkout lives on a docker volume that
|
||||
# is not a host path -- the mount silently succeeds and /work is empty. A
|
||||
# build context is streamed to the daemon and so works from anywhere.
|
||||
# Building the extension here too means the machine starting a run needs
|
||||
# docker and nothing else.
|
||||
|
||||
# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
|
||||
#
|
||||
# The playwright-core devDependency is pinned to the matching Playwright
|
||||
# version (1.56.0) and the two must be bumped together: the browsers ship
|
||||
# inside this image, and playwright-core looks for the exact browser
|
||||
# revision its own version expects. A mismatch fails at launch.
|
||||
FROM mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2
|
||||
|
||||
WORKDIR /work
|
||||
|
||||
# Same layering as the root Dockerfile: script/bootstrap installs the
|
||||
# prerequisites and the dependencies, and the manifests are copied first so
|
||||
# that layer is cached until they change.
|
||||
COPY script/ script/
|
||||
COPY package.json yarn.lock ./
|
||||
RUN script/bootstrap
|
||||
|
||||
COPY . .
|
||||
|
||||
RUN make build
|
||||
@@ -1,77 +0,0 @@
|
||||
# Firefox end-to-end image: stock Firefox plus geckodriver on a node base,
|
||||
# with this repo and a freshly built extension inside it, built by
|
||||
# script/test-e2e-firefox. The harness itself has no dependencies, so
|
||||
# nothing is installed for it.
|
||||
#
|
||||
# The build context is the repo root. The repo is baked in rather than
|
||||
# bind-mounted because a bind mount does not resolve under Gitea Actions:
|
||||
# the runner runs the job in a container against the HOST's docker socket,
|
||||
# so the source side of a -v is resolved by the host daemon while the job's
|
||||
# checkout lives on a docker volume that is not a host path -- the mount
|
||||
# silently succeeds and /work is empty. Baking the build in is also the
|
||||
# only way this suite can have both a built extension and the
|
||||
# `--network none` it runs under, since a container with no network cannot
|
||||
# install anything.
|
||||
#
|
||||
# All three external artifacts are pinned by digest, and are fetched in
|
||||
# layers above the repo copy, so editing the harness or any source file
|
||||
# re-runs only the two cheap layers at the bottom. The Firefox version in
|
||||
# particular must not float: -remote-allow-system-access is mandatory on
|
||||
# 153 and was not on 142, so the flag the harness passes is
|
||||
# version-coupled.
|
||||
|
||||
# node:22-bookworm-slim, 2026-08-12
|
||||
FROM node@sha256:d649c27dae7ba0137b3cef5dd75baa422c08dc3d9e3fc0c23dfb172dc3cc6436
|
||||
|
||||
ENV DEBIAN_FRONTEND=noninteractive
|
||||
|
||||
# Firefox's shared-library dependencies on a slim base, plus the two tools
|
||||
# needed to fetch and unpack the pinned tarballs.
|
||||
RUN apt-get update \
|
||||
&& apt-get install -y --no-install-recommends \
|
||||
ca-certificates \
|
||||
curl \
|
||||
libasound2 \
|
||||
libdbus-glib-1-2 \
|
||||
libgtk-3-0 \
|
||||
libx11-xcb1 \
|
||||
libxt6 \
|
||||
libxtst6 \
|
||||
xz-utils \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Firefox 153.0.3, linux-x86_64, en-US
|
||||
ARG FIREFOX_URL=https://ftp.mozilla.org/pub/firefox/releases/153.0.3/linux-x86_64/en-US/firefox-153.0.3.tar.xz
|
||||
ARG FIREFOX_SHA256=22b312280900bfb174b685ece32c7b3c6d72e7f8e53d6d30f21ac41a8dc500a2
|
||||
RUN curl -fsSL -o /tmp/firefox.tar.xz "$FIREFOX_URL" \
|
||||
&& echo "$FIREFOX_SHA256 /tmp/firefox.tar.xz" | sha256sum -c - \
|
||||
&& tar -xJf /tmp/firefox.tar.xz -C /opt \
|
||||
&& rm /tmp/firefox.tar.xz \
|
||||
&& /opt/firefox/firefox --version
|
||||
|
||||
# geckodriver v0.36.0, linux64
|
||||
ARG GECKODRIVER_URL=https://github.com/mozilla/geckodriver/releases/download/v0.36.0/geckodriver-v0.36.0-linux64.tar.gz
|
||||
ARG GECKODRIVER_SHA256=0bde38707eb0a686a20c6bd50f4adcc7d60d4f73c60eb83ee9e0db8f65823e04
|
||||
RUN curl -fsSL -o /tmp/geckodriver.tar.gz "$GECKODRIVER_URL" \
|
||||
&& echo "$GECKODRIVER_SHA256 /tmp/geckodriver.tar.gz" | sha256sum -c - \
|
||||
&& tar -xzf /tmp/geckodriver.tar.gz -C /usr/local/bin \
|
||||
&& rm /tmp/geckodriver.tar.gz \
|
||||
&& geckodriver --version
|
||||
|
||||
ENV FIREFOX_BIN=/opt/firefox/firefox
|
||||
ENV GECKODRIVER=/usr/local/bin/geckodriver
|
||||
|
||||
WORKDIR /work
|
||||
|
||||
# Same layering as the root Dockerfile: script/bootstrap installs the
|
||||
# prerequisites and the dependencies, and the manifests are copied first so
|
||||
# that layer is cached until they change.
|
||||
COPY script/ script/
|
||||
COPY package.json yarn.lock ./
|
||||
RUN script/bootstrap
|
||||
|
||||
COPY . .
|
||||
|
||||
RUN make build
|
||||
|
||||
CMD ["node", "tests/e2e/firefox/run.js", "dist/firefox"]
|
||||
@@ -1,238 +0,0 @@
|
||||
// A loopback dApp origin and stub Ethereum node for the Firefox suite.
|
||||
//
|
||||
// The Firefox container runs with --network none, and the harness note in
|
||||
// driver.js records the consequence: with no http:// origin in reach, no
|
||||
// content script was ever injected, so content-script behaviour was
|
||||
// UNVERIFIED and the dApp flows could not be driven at all.
|
||||
//
|
||||
// --network none removes every interface except loopback, and loopback is
|
||||
// enough. This serves the page and the JSON-RPC endpoint from 127.0.0.1
|
||||
// inside the same container Firefox runs in, so the dApp round trips execute
|
||||
// against a real http:// origin and the run stays as offline as it was: the
|
||||
// only reachable peer is this process.
|
||||
//
|
||||
// The page itself is not written twice. DAPP_HTML comes from the Chrome
|
||||
// suite's fixture, so both harnesses drive the same __dapp API and the same
|
||||
// message log.
|
||||
//
|
||||
// Unlike driver.js this file does use ethers, and it has to: the node has to
|
||||
// answer eth_sendRawTransaction with the hash ethers computes for the
|
||||
// artifact it was handed, or provider.broadcastTransaction() refuses the
|
||||
// answer, and the suite recovers signatures itself rather than believing the
|
||||
// extension's own verdict.
|
||||
|
||||
"use strict";
|
||||
|
||||
const http = require("http");
|
||||
|
||||
const { Transaction } = require("ethers");
|
||||
|
||||
const { DAPP_HTML } = require("../network");
|
||||
|
||||
// The same fee shape the Chrome suite uses, for the same reason: it has to
|
||||
// pass the ceilings in src/shared/approvalVerify.js and it has to leave the
|
||||
// reserve and the estimate distinguishable.
|
||||
const GAS_LIMIT = 21000n;
|
||||
const BASE_FEE_WEI = 100000000000n; // 100 gwei
|
||||
const PRIORITY_FEE_WEI = 1000000000n; // 1 gwei
|
||||
const GAS_PRICE_WEI = BASE_FEE_WEI + PRIORITY_FEE_WEI;
|
||||
|
||||
const STUB_BLOCK_NUMBER = 21000000;
|
||||
|
||||
// A 32-byte zero word, returned for every eth_call. It is what makes ethers'
|
||||
// ENS reverse lookup resolve to "no resolver set" instead of throwing, and a
|
||||
// throw there reaches the console through src/shared/log.js, which fails the
|
||||
// run on its own.
|
||||
const ZERO_WORD = "0x" + "0".repeat(64);
|
||||
|
||||
// One ETH, so the popup's balance lines render something and the wallet does
|
||||
// not look empty on the approval screen.
|
||||
const STUB_BALANCE_WEI = 10n ** 18n;
|
||||
|
||||
function hex(value) {
|
||||
return "0x" + BigInt(value).toString(16);
|
||||
}
|
||||
|
||||
function latestBlock() {
|
||||
return {
|
||||
hash: "0x" + "11".repeat(32),
|
||||
parentHash: "0x" + "22".repeat(32),
|
||||
number: hex(STUB_BLOCK_NUMBER),
|
||||
timestamp: hex(1767326645),
|
||||
nonce: "0x0000000000000000",
|
||||
difficulty: "0x0",
|
||||
gasLimit: "0x1c9c380",
|
||||
gasUsed: "0xf4240",
|
||||
miner: "0xc0ffee0000000000000000000000000000c0ffee",
|
||||
extraData: "0x",
|
||||
baseFeePerGas: hex(BASE_FEE_WEI),
|
||||
transactions: [],
|
||||
};
|
||||
}
|
||||
|
||||
const RPC_RESULTS = {
|
||||
eth_chainId: "0x1",
|
||||
net_version: "1",
|
||||
eth_blockNumber: hex(STUB_BLOCK_NUMBER),
|
||||
eth_getBalance: hex(STUB_BALANCE_WEI),
|
||||
eth_call: ZERO_WORD,
|
||||
eth_getCode: "0x",
|
||||
eth_gasPrice: hex(GAS_PRICE_WEI),
|
||||
eth_estimateGas: hex(GAS_LIMIT),
|
||||
eth_getTransactionCount: "0x0",
|
||||
eth_maxPriorityFeePerGas: hex(PRIORITY_FEE_WEI),
|
||||
// "accepted but not mined", which is what a node says about a transaction
|
||||
// it has only just taken. The wait screen the approval hands off to polls
|
||||
// this for the rest of the run.
|
||||
eth_getTransactionReceipt: null,
|
||||
web3_clientVersion: "autistmask-e2e-firefox/0",
|
||||
};
|
||||
|
||||
// Answer one JSON-RPC call. `broadcast` collects every raw transaction that
|
||||
// reached this node, which is what the transaction assertions are made
|
||||
// against — the artifact as the node saw it, never as the extension described
|
||||
// it.
|
||||
function rpcResult(req, state) {
|
||||
const method = req.method;
|
||||
|
||||
if (method === "eth_sendRawTransaction") {
|
||||
const raw = req.params && req.params[0];
|
||||
state.broadcast.push(raw);
|
||||
// ethers checks the hash it is given against the hash it computes for
|
||||
// the artifact it sent, so this cannot be a fixed string.
|
||||
return Transaction.from(raw).hash;
|
||||
}
|
||||
|
||||
if (method === "eth_getBlockByNumber" || method === "eth_getBlockByHash") {
|
||||
return latestBlock();
|
||||
}
|
||||
|
||||
if (Object.prototype.hasOwnProperty.call(RPC_RESULTS, method)) {
|
||||
return RPC_RESULTS[method];
|
||||
}
|
||||
|
||||
// Never a silent default. An unstubbed method answered with null looks
|
||||
// like a working node returning nothing, and the assertion downstream
|
||||
// fails somewhere unrelated.
|
||||
state.unstubbed.push(method);
|
||||
throw new Error("no fixture for JSON-RPC method " + method);
|
||||
}
|
||||
|
||||
function readBody(req) {
|
||||
return new Promise((resolve, reject) => {
|
||||
let body = "";
|
||||
req.on("data", (chunk) => {
|
||||
body += chunk;
|
||||
});
|
||||
req.on("end", () => resolve(body));
|
||||
req.on("error", reject);
|
||||
});
|
||||
}
|
||||
|
||||
function handleRpcBody(body, state) {
|
||||
const parsed = JSON.parse(body);
|
||||
const answer = (req) => {
|
||||
try {
|
||||
return {
|
||||
jsonrpc: "2.0",
|
||||
id: req.id,
|
||||
result: rpcResult(req, state),
|
||||
};
|
||||
} catch (e) {
|
||||
return {
|
||||
jsonrpc: "2.0",
|
||||
id: req.id,
|
||||
error: { code: -32601, message: e.message },
|
||||
};
|
||||
}
|
||||
};
|
||||
return Array.isArray(parsed) ? parsed.map(answer) : answer(parsed);
|
||||
}
|
||||
|
||||
/**
|
||||
* Serve the dApp page and the stub node on loopback.
|
||||
*
|
||||
* @returns {Promise<Object>} the running fixture: `url` and `origin` of the
|
||||
* page, `rpcUrl` for the extension's rpcUrl setting, `broadcast` (the raw
|
||||
* transactions the node received, in order), `unstubbed` (JSON-RPC methods
|
||||
* nothing answered) and `close()`.
|
||||
*/
|
||||
async function startDappServer() {
|
||||
const state = { broadcast: [], unstubbed: [], requests: [] };
|
||||
|
||||
const server = http.createServer((req, res) => {
|
||||
const url = new URL(req.url, "http://127.0.0.1");
|
||||
state.requests.push(req.method + " " + url.pathname);
|
||||
|
||||
if (url.pathname === "/rpc" && req.method === "POST") {
|
||||
readBody(req)
|
||||
.then((body) => {
|
||||
const payload = JSON.stringify(handleRpcBody(body, state));
|
||||
res.writeHead(200, {
|
||||
"Content-Type": "application/json",
|
||||
// The extension fetches this from its background
|
||||
// page, whose origin is moz-extension://. Without CORS
|
||||
// the fetch fails and every transaction assertion
|
||||
// fails for a reason that has nothing to do with the
|
||||
// wallet.
|
||||
"Access-Control-Allow-Origin": "*",
|
||||
});
|
||||
res.end(payload);
|
||||
})
|
||||
.catch((e) => {
|
||||
res.writeHead(500, { "Content-Type": "text/plain" });
|
||||
res.end(String(e && e.message));
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
if (url.pathname === "/") {
|
||||
res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
|
||||
res.end(DAPP_HTML);
|
||||
return;
|
||||
}
|
||||
|
||||
// An empty favicon rather than a 404: a 404 is a page error in
|
||||
// Firefox's console under some settings, and the suite fails the run
|
||||
// on those.
|
||||
if (url.pathname === "/favicon.ico") {
|
||||
res.writeHead(200, { "Content-Type": "image/x-icon" });
|
||||
res.end("");
|
||||
return;
|
||||
}
|
||||
|
||||
res.writeHead(404, { "Content-Type": "text/plain" });
|
||||
res.end("not found");
|
||||
});
|
||||
|
||||
await new Promise((resolve, reject) => {
|
||||
server.on("error", reject);
|
||||
// Port 0: this host runs many sessions at once, and a fixed port is a
|
||||
// guaranteed collision rather than a possible one.
|
||||
server.listen(0, "127.0.0.1", resolve);
|
||||
});
|
||||
|
||||
const { port } = server.address();
|
||||
const origin = "http://127.0.0.1:" + port;
|
||||
|
||||
return {
|
||||
origin,
|
||||
url: origin + "/",
|
||||
rpcUrl: origin + "/rpc",
|
||||
broadcast: state.broadcast,
|
||||
unstubbed: state.unstubbed,
|
||||
requests: state.requests,
|
||||
close: () =>
|
||||
new Promise((resolve) => {
|
||||
server.closeAllConnections();
|
||||
server.close(() => resolve());
|
||||
}),
|
||||
};
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
GAS_LIMIT,
|
||||
GAS_PRICE_WEI,
|
||||
STUB_BALANCE_WEI,
|
||||
startDappServer,
|
||||
};
|
||||
@@ -1,558 +0,0 @@
|
||||
// A minimal WebDriver client for geckodriver, plus the privileged console
|
||||
// reader the error assertions are built on. No npm dependencies: global
|
||||
// fetch and child_process against geckodriver's HTTP API is less code than
|
||||
// a driver library and keeps the harness at zero packages.
|
||||
//
|
||||
// Run through script/test-e2e-firefox, which builds dist/firefox/ and the
|
||||
// pinned container around this. FIREFOX_BIN and GECKODRIVER locate the two
|
||||
// binaries; the image sets both.
|
||||
|
||||
"use strict";
|
||||
|
||||
const { spawn } = require("child_process");
|
||||
const net = require("net");
|
||||
|
||||
const FIREFOX_BIN = process.env.FIREFOX_BIN || "firefox";
|
||||
const GECKODRIVER = process.env.GECKODRIVER || "geckodriver";
|
||||
|
||||
// The extension id declared in manifest/firefox.json, and the uuid the
|
||||
// popup is served from. Firefox normally assigns that uuid randomly per
|
||||
// profile, which would make the popup URL undiscoverable without querying
|
||||
// privileged state; setting extensions.webextensions.uuids before launch
|
||||
// pins it instead. This only works because the manifest declares a fixed
|
||||
// browser_specific_settings.gecko.id — without one the mapping has no key.
|
||||
const EXTENSION_ID = "autistmask@sneak.berlin";
|
||||
const EXTENSION_UUID = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
|
||||
const EXTENSION_ORIGIN = "moz-extension://" + EXTENSION_UUID;
|
||||
|
||||
// The W3C web element identifier. Getting the last character wrong yields
|
||||
// an element reference of "undefined" and a bewildering "element with the
|
||||
// reference undefined is not known" from geckodriver, so findElement()
|
||||
// below checks for the key rather than indexing blindly.
|
||||
const WEB_ELEMENT_KEY = "element-6066-11e4-a52e-4f735466cecf";
|
||||
|
||||
const SCRIPT_TIMEOUT_MS = 120000;
|
||||
const DEFAULT_WAIT_MS = 20000;
|
||||
const POLL_INTERVAL_MS = 100;
|
||||
|
||||
function sleep(ms) {
|
||||
return new Promise((resolve) => setTimeout(resolve, ms));
|
||||
}
|
||||
|
||||
// An ephemeral port picked by the kernel, then handed to geckodriver.
|
||||
// There is a race between closing this listener and geckodriver binding,
|
||||
// but this host runs many sessions at once and a fixed 4444 is a
|
||||
// guaranteed collision rather than a possible one.
|
||||
function freePort() {
|
||||
return new Promise((resolve, reject) => {
|
||||
const srv = net.createServer();
|
||||
srv.on("error", reject);
|
||||
srv.listen(0, "127.0.0.1", () => {
|
||||
const { port } = srv.address();
|
||||
srv.close(() => resolve(port));
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
class WebDriverError extends Error {
|
||||
constructor(command, body) {
|
||||
const v = (body && body.value) || {};
|
||||
super(
|
||||
command +
|
||||
" failed: " +
|
||||
(v.error || "unknown error") +
|
||||
": " +
|
||||
(v.message || JSON.stringify(body)),
|
||||
);
|
||||
this.name = "WebDriverError";
|
||||
this.error = v.error;
|
||||
}
|
||||
}
|
||||
|
||||
class Driver {
|
||||
constructor(proc, base) {
|
||||
this.proc = proc;
|
||||
this.base = base;
|
||||
this.sessionId = null;
|
||||
this.context = "content";
|
||||
}
|
||||
|
||||
async send(method, path, body) {
|
||||
const url = this.base + path;
|
||||
const res = await fetch(url, {
|
||||
method,
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: body === undefined ? undefined : JSON.stringify(body),
|
||||
});
|
||||
const text = await res.text();
|
||||
let parsed;
|
||||
try {
|
||||
parsed = JSON.parse(text);
|
||||
} catch {
|
||||
throw new Error(
|
||||
method + " " + path + ": non-JSON response: " + text,
|
||||
);
|
||||
}
|
||||
if (!res.ok) throw new WebDriverError(method + " " + path, parsed);
|
||||
return parsed.value;
|
||||
}
|
||||
|
||||
session(method, path, body) {
|
||||
return this.send(method, "/session/" + this.sessionId + path, body);
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------ setup
|
||||
|
||||
async newSession() {
|
||||
const prefs = {
|
||||
// See EXTENSION_UUID above. The pref is a string pref whose
|
||||
// value is itself JSON.
|
||||
"extensions.webextensions.uuids": JSON.stringify({
|
||||
[EXTENSION_ID]: EXTENSION_UUID,
|
||||
}),
|
||||
// The container has loopback and nothing else. Firefox's own
|
||||
// link-status detection can read that as "offline" and then
|
||||
// refuse every request, including the ones to the loopback dApp
|
||||
// origin the suite serves; this takes the decision away from it.
|
||||
"network.manage-offline-status": false,
|
||||
// Force the site-connection prompt down its windows.create()
|
||||
// fallback.
|
||||
//
|
||||
// src/background/index.js prefers the toolbar-anchored popup for
|
||||
// that one approval and opens a real window only when
|
||||
// openPopup() refuses. A panel is not a top-level browsing
|
||||
// context, so WebDriver cannot see it, list it or click in it —
|
||||
// the same blind spot the Chrome harness documents. Leaving this
|
||||
// at its default would make which path runs depend on whether a
|
||||
// headless Firefox counts as having had a user gesture, which is
|
||||
// not a thing to leave to chance in a suite that has to be able
|
||||
// to fail. The window path is shipped code and the same approval
|
||||
// id, so what is driven is real; what is NOT covered either way
|
||||
// is the panel presentation itself.
|
||||
"extensions.openPopupWithoutUserGesture.enabled": false,
|
||||
};
|
||||
|
||||
const value = await this.send("POST", "/session", {
|
||||
capabilities: {
|
||||
alwaysMatch: {
|
||||
browserName: "firefox",
|
||||
"moz:firefoxOptions": {
|
||||
binary: FIREFOX_BIN,
|
||||
args: [
|
||||
"-headless",
|
||||
// Mandatory on Firefox 153: without it,
|
||||
// navigating to moz-extension:// and running
|
||||
// chrome-context script both fail with
|
||||
// "unsupported operation".
|
||||
//
|
||||
// It grants the driver FULL CHROME PRIVILEGES
|
||||
// over this browser. Acceptable only because
|
||||
// the browser is a throwaway in a CI
|
||||
// container; never point a session with this
|
||||
// flag at anything you care about.
|
||||
"-remote-allow-system-access",
|
||||
],
|
||||
prefs,
|
||||
},
|
||||
},
|
||||
},
|
||||
});
|
||||
this.sessionId = value.sessionId;
|
||||
await this.session("POST", "/timeouts", { script: SCRIPT_TIMEOUT_MS });
|
||||
return value;
|
||||
}
|
||||
|
||||
// Installs the unpacked MV2 build straight from a directory.
|
||||
// temporary:true bypasses signature checks, so no XPI and no signing
|
||||
// are involved, and the add-on dies with the profile.
|
||||
async installAddon(dir) {
|
||||
return this.session("POST", "/moz/addon/install", {
|
||||
path: dir,
|
||||
temporary: true,
|
||||
});
|
||||
}
|
||||
|
||||
// Classic navigation on purpose. BiDi's browsingContext.navigate
|
||||
// refuses moz-extension:// URLs outright.
|
||||
async navigate(url) {
|
||||
await this.session("POST", "/url", { url });
|
||||
}
|
||||
|
||||
async quit() {
|
||||
if (this.sessionId) {
|
||||
await this.session("DELETE", "").catch(() => {});
|
||||
this.sessionId = null;
|
||||
}
|
||||
this.proc.kill("SIGTERM");
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------- scripts
|
||||
|
||||
async setContext(context) {
|
||||
if (this.context === context) return;
|
||||
await this.session("POST", "/moz/context", { context });
|
||||
this.context = context;
|
||||
}
|
||||
|
||||
async execute(script, args = []) {
|
||||
await this.setContext("content");
|
||||
return this.session("POST", "/execute/sync", { script, args });
|
||||
}
|
||||
|
||||
// The asynchronous form: the script is handed a resolve callback as its
|
||||
// last argument and the call settles when that is invoked. Everything
|
||||
// interesting about an extension page is promise-shaped — storage reads,
|
||||
// the provider's own request() — and /execute/sync cannot wait for any
|
||||
// of it.
|
||||
async executeAsync(script, args = []) {
|
||||
await this.setContext("content");
|
||||
return this.session("POST", "/execute/async", { script, args });
|
||||
}
|
||||
|
||||
// Runs in the privileged chrome scope, where Services and Ci exist.
|
||||
async executeChrome(script, args = []) {
|
||||
await this.setContext("chrome");
|
||||
try {
|
||||
return await this.session("POST", "/execute/sync", {
|
||||
script,
|
||||
args,
|
||||
});
|
||||
} finally {
|
||||
await this.setContext("content");
|
||||
}
|
||||
}
|
||||
|
||||
// ------------------------------------------------------- page waits
|
||||
|
||||
// Polls a content-context expression until it returns truthy. Every
|
||||
// wait in the suite goes through here so a timeout always says which
|
||||
// condition it was waiting on rather than "timed out".
|
||||
async waitFor(what, script, args = [], timeout = DEFAULT_WAIT_MS) {
|
||||
const deadline = Date.now() + timeout;
|
||||
// Assigned on every path through the loop body before it is read, so
|
||||
// there is no initializer to give it.
|
||||
let last;
|
||||
for (;;) {
|
||||
try {
|
||||
const v = await this.execute(script, args);
|
||||
if (v) return v;
|
||||
last = null;
|
||||
} catch (e) {
|
||||
// A navigation or view swap in flight makes execute
|
||||
// throw; that is a not-yet, not a failure, until the
|
||||
// deadline says otherwise.
|
||||
last = e.message;
|
||||
}
|
||||
if (Date.now() >= deadline) {
|
||||
throw new Error(
|
||||
"timed out after " +
|
||||
timeout +
|
||||
"ms waiting for " +
|
||||
what +
|
||||
(last ? " (last error: " + last + ")" : ""),
|
||||
);
|
||||
}
|
||||
await sleep(POLL_INTERVAL_MS);
|
||||
}
|
||||
}
|
||||
|
||||
// Shown means shown: in the popup a view is switched by toggling a
|
||||
// "hidden" class, and an element that is present but collapsed is not
|
||||
// the thing a test means by visible.
|
||||
async waitVisible(selector, timeout = DEFAULT_WAIT_MS) {
|
||||
return this.waitFor(
|
||||
"selector " + selector + " to be visible",
|
||||
`const el = document.querySelector(arguments[0]);
|
||||
if (!el) return false;
|
||||
const r = el.getBoundingClientRect();
|
||||
return r.width > 0 && r.height > 0;`,
|
||||
[selector],
|
||||
timeout,
|
||||
);
|
||||
}
|
||||
|
||||
async isVisible(selector) {
|
||||
return this.execute(
|
||||
`const el = document.querySelector(arguments[0]);
|
||||
if (!el) return false;
|
||||
const r = el.getBoundingClientRect();
|
||||
return r.width > 0 && r.height > 0;`,
|
||||
[selector],
|
||||
);
|
||||
}
|
||||
|
||||
async count(selector) {
|
||||
return this.execute(
|
||||
"return document.querySelectorAll(arguments[0]).length;",
|
||||
[selector],
|
||||
);
|
||||
}
|
||||
|
||||
async text(selector) {
|
||||
return this.execute(
|
||||
`const el = document.querySelector(arguments[0]);
|
||||
return el ? el.textContent : null;`,
|
||||
[selector],
|
||||
);
|
||||
}
|
||||
|
||||
async title() {
|
||||
return this.session("GET", "/title");
|
||||
}
|
||||
|
||||
// The id of the view element currently on top, which is what a
|
||||
// failing step needs to report: "the screen did not change" is only
|
||||
// useful if it says which screen it stayed on.
|
||||
async currentView() {
|
||||
return this.execute(
|
||||
`const views = document.querySelectorAll('[id^="view-"]');
|
||||
for (const v of views) {
|
||||
const r = v.getBoundingClientRect();
|
||||
if (r.width > 0 && r.height > 0) return v.id;
|
||||
}
|
||||
return null;`,
|
||||
);
|
||||
}
|
||||
|
||||
// ----------------------------------------------------- interactions
|
||||
|
||||
async findElement(selector) {
|
||||
const value = await this.session("POST", "/element", {
|
||||
using: "css selector",
|
||||
value: selector,
|
||||
});
|
||||
const ref = value && value[WEB_ELEMENT_KEY];
|
||||
if (typeof ref !== "string") {
|
||||
throw new Error(
|
||||
"no " +
|
||||
WEB_ELEMENT_KEY +
|
||||
" in the element response for " +
|
||||
selector +
|
||||
": " +
|
||||
JSON.stringify(value),
|
||||
);
|
||||
}
|
||||
return ref;
|
||||
}
|
||||
|
||||
// Real WebDriver clicks and real key events rather than in-page
|
||||
// .click() and value assignment: the popup's handlers are wired to
|
||||
// events, and synthesising them from inside the page would test the
|
||||
// harness's idea of the UI instead of the UI.
|
||||
async click(selector) {
|
||||
await this.waitVisible(selector);
|
||||
const id = await this.findElement(selector);
|
||||
await this.session("POST", "/element/" + id + "/click", {});
|
||||
}
|
||||
|
||||
async fill(selector, value) {
|
||||
await this.waitVisible(selector);
|
||||
const id = await this.findElement(selector);
|
||||
await this.session("POST", "/element/" + id + "/clear", {});
|
||||
await this.session("POST", "/element/" + id + "/value", {
|
||||
text: String(value),
|
||||
});
|
||||
}
|
||||
|
||||
async value(selector) {
|
||||
return this.execute(
|
||||
`const el = document.querySelector(arguments[0]);
|
||||
return el ? el.value : null;`,
|
||||
[selector],
|
||||
);
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------ windows
|
||||
//
|
||||
// The approval prompts this suite drives are separate top-level windows
|
||||
// the extension opens itself, so every one of them is a window handle
|
||||
// here and the suite has to move between them explicitly.
|
||||
|
||||
async windowHandles() {
|
||||
return this.session("GET", "/window/handles");
|
||||
}
|
||||
|
||||
async currentWindow() {
|
||||
return this.session("GET", "/window");
|
||||
}
|
||||
|
||||
async switchToWindow(handle) {
|
||||
await this.setContext("content");
|
||||
await this.session("POST", "/window", { handle });
|
||||
}
|
||||
|
||||
async newWindow(type = "window") {
|
||||
await this.setContext("content");
|
||||
const value = await this.session("POST", "/window/new", { type });
|
||||
return value.handle;
|
||||
}
|
||||
|
||||
// Closes the current window and leaves the session on `fallback`, because
|
||||
// a session whose current window is gone fails every subsequent command
|
||||
// with "no such window" rather than with anything diagnosable.
|
||||
async closeWindow(fallback) {
|
||||
await this.setContext("content");
|
||||
await this.session("DELETE", "/window");
|
||||
if (fallback) await this.switchToWindow(fallback);
|
||||
}
|
||||
|
||||
async url() {
|
||||
return this.session("GET", "/url");
|
||||
}
|
||||
|
||||
// The handle of the first window whose URL matches, or null. Restores the
|
||||
// window that was current before the search either way: a probe that
|
||||
// silently relocates the session is a trap for the step after it.
|
||||
async findWindow(predicate) {
|
||||
const origin = await this.currentWindow();
|
||||
try {
|
||||
for (const handle of await this.windowHandles()) {
|
||||
await this.switchToWindow(handle);
|
||||
if (predicate(await this.url())) return handle;
|
||||
}
|
||||
return null;
|
||||
} finally {
|
||||
// Tolerated: the window the search started from may have been the
|
||||
// one that just closed, and a throw in here would replace the
|
||||
// real result with "no such window".
|
||||
await this.switchToWindow(origin).catch(() => {});
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ------------------------------------------------------- error capture
|
||||
|
||||
// Uncaught errors from extension code, read out of the privileged console
|
||||
// service.
|
||||
//
|
||||
// This is not the obvious mechanism, and the obvious one does not work:
|
||||
// WebDriver BiDi's log.entryAdded delivers NOTHING for extension pages.
|
||||
// Verified on Firefox 142 and 153 against a same-session control — a plain
|
||||
// http:// page yields uncaught errors with stack traces, the
|
||||
// moz-extension:// popup yields zero events, because the remote agent
|
||||
// excludes extension browsing contexts from BiDi observation. A harness
|
||||
// built on Playwright-BiDi or Puppeteer-BiDi therefore sees nothing and
|
||||
// reports success. Do not "simplify" this back to BiDi.
|
||||
//
|
||||
// nsIConsoleService is not per-page: it also carries errors from the
|
||||
// background page, which BiDi would not have covered even if it worked.
|
||||
// Background-page capture is verified by probe — a throw at the top of
|
||||
// src/background/index.js, which kills the background page outright, fails
|
||||
// the run.
|
||||
//
|
||||
// Content scripts ARE now exercised: tests/e2e/firefox/dapp.js serves a page
|
||||
// from loopback, which survives --network none, and the suite drives the
|
||||
// EIP-1193 round trips through the content script injected into it. What is
|
||||
// still unproven is the CAPTURE, not the execution — no probe has forced a
|
||||
// throw from inside a content script and watched it fail the run, so an
|
||||
// uncaught content-script error arriving by this route remains an
|
||||
// expectation rather than a demonstrated fact. Do not claim otherwise.
|
||||
//
|
||||
// Warnings are excluded so the semantics match Playwright's pageerror:
|
||||
// uncaught errors only.
|
||||
//
|
||||
// The read and the clear are ONE chrome script on purpose. Splitting them
|
||||
// into two round trips leaves a blind window between them in which an
|
||||
// error is logged into a buffer that is about to be discarded, and is
|
||||
// destroyed unread rather than deferred to the next drain. That was not
|
||||
// theoretical: with a separate reset() call, a probe of 100 sequenced
|
||||
// throws at 20ms spacing lost one of them outright.
|
||||
const DRAIN_ERRORS_SCRIPT = `
|
||||
const origin = arguments[0];
|
||||
const out = [];
|
||||
for (const raw of Services.console.getMessageArray() || []) {
|
||||
let e;
|
||||
try {
|
||||
e = raw.QueryInterface(Ci.nsIScriptError);
|
||||
} catch (_) {
|
||||
continue;
|
||||
}
|
||||
if (e.flags & Ci.nsIScriptError.warningFlag) continue;
|
||||
const src = e.sourceName || "";
|
||||
if (!src.startsWith(origin)) continue;
|
||||
out.push({
|
||||
msg: e.errorMessage,
|
||||
src: src,
|
||||
line: e.lineNumber,
|
||||
cat: e.category,
|
||||
});
|
||||
}
|
||||
Services.console.reset();
|
||||
return out;
|
||||
`;
|
||||
|
||||
class ConsoleErrors {
|
||||
constructor(driver, originPrefix) {
|
||||
this.driver = driver;
|
||||
this.originPrefix = originPrefix;
|
||||
}
|
||||
|
||||
// Everything logged since the last take, read and cleared atomically
|
||||
// in a single chrome round trip. Poll-based, so an error is attributed
|
||||
// to the step that was running when it was drained, not to the moment
|
||||
// inside that step at which it happened — see the limitation note in
|
||||
// run.js. An error that arrives mid-drain is not lost — it makes this
|
||||
// batch or the next one — but the console service ring buffer holds
|
||||
// only 250 messages, so more than that between two takes evicts the
|
||||
// oldest unread. A clean run peaks at 4.
|
||||
async take() {
|
||||
const found = await this.driver.executeChrome(DRAIN_ERRORS_SCRIPT, [
|
||||
this.originPrefix,
|
||||
]);
|
||||
return found || [];
|
||||
}
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------- startup
|
||||
|
||||
async function waitForDriverReady(base, timeoutMs) {
|
||||
const deadline = Date.now() + timeoutMs;
|
||||
for (;;) {
|
||||
try {
|
||||
const res = await fetch(base + "/status");
|
||||
if (res.ok) {
|
||||
const body = await res.json();
|
||||
if (body && body.value && body.value.ready !== false) return;
|
||||
}
|
||||
} catch {
|
||||
// not listening yet
|
||||
}
|
||||
if (Date.now() >= deadline) {
|
||||
throw new Error(
|
||||
"geckodriver did not become ready within " + timeoutMs + "ms",
|
||||
);
|
||||
}
|
||||
await sleep(POLL_INTERVAL_MS);
|
||||
}
|
||||
}
|
||||
|
||||
async function start() {
|
||||
const port = await freePort();
|
||||
const proc = spawn(
|
||||
GECKODRIVER,
|
||||
["--port", String(port), "--host", "127.0.0.1"],
|
||||
{ stdio: ["ignore", "inherit", "inherit"] },
|
||||
);
|
||||
proc.on("error", (e) => {
|
||||
console.error("geckodriver failed to spawn: " + e.message);
|
||||
});
|
||||
|
||||
const base = "http://127.0.0.1:" + port;
|
||||
try {
|
||||
await waitForDriverReady(base, 30000);
|
||||
} catch (e) {
|
||||
proc.kill("SIGKILL");
|
||||
throw e;
|
||||
}
|
||||
return new Driver(proc, base);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
ConsoleErrors,
|
||||
Driver,
|
||||
EXTENSION_ID,
|
||||
EXTENSION_ORIGIN,
|
||||
EXTENSION_UUID,
|
||||
start,
|
||||
sleep,
|
||||
};
|
||||
@@ -1,955 +0,0 @@
|
||||
// Firefox end-to-end suite: drives the real popup in a real Firefox with
|
||||
// the unpacked MV2 build installed as a temporary add-on, and fails the run
|
||||
// on any uncaught error coming from an extension source.
|
||||
//
|
||||
// Run via script/test-e2e-firefox, which builds dist/firefox/ and the pinned
|
||||
// container. The extension directory is the one argument.
|
||||
//
|
||||
// node tests/e2e/firefox/run.js [dist/firefox]
|
||||
//
|
||||
// Deliberately not part of script/check, and deliberately not named
|
||||
// *.test.js: REPO_POLICIES.md caps make test at 20 seconds and a browser
|
||||
// suite does not fit.
|
||||
//
|
||||
// This shares no driver layer with the Chrome suite in tests/e2e/, and the
|
||||
// UI steps below are written twice on purpose. Chrome runs on Playwright,
|
||||
// which cannot see extension-page errors in Firefox at all (see the BiDi
|
||||
// note in driver.js), so the two backends have no common substrate to
|
||||
// abstract over. Duplicated steps do not pay for a shim; revisit if this
|
||||
// suite grows to where they do. What IS shared is the dApp page fixture
|
||||
// itself — DAPP_HTML, served here from loopback by dapp.js — so an assertion
|
||||
// about the __dapp API means the same thing on both browsers.
|
||||
//
|
||||
// The dApp steps need an http:// origin, which --network none was thought to
|
||||
// rule out. It does not: loopback survives it, so the page and the stub node
|
||||
// are served from 127.0.0.1 inside the container and the run reaches nothing
|
||||
// but this process. See tests/e2e/firefox/dapp.js.
|
||||
//
|
||||
// LIMITATION, and the difference from the Chrome suite worth knowing: error
|
||||
// capture here is POLL-BASED, not event-streamed. The console service is
|
||||
// drained at each step boundary, so an error is attributed to the step it
|
||||
// was drained after, never to a moment within that step. What is drained
|
||||
// covers the whole run from add-on install to the last drain below, which
|
||||
// lands ~1.5s after the last step returns (500ms settle + 1000ms sleep +
|
||||
// two drain round trips). That cut-off jitters run to run: three runs of
|
||||
// throws at fixed offsets reported everything to +1.5s and one of them
|
||||
// also +1.6s, and past it the browser is torn down first. Inside the
|
||||
// window there is no race — the drain reads and clears in one chrome
|
||||
// round trip — but there is a capacity limit: nsIConsoleService keeps
|
||||
// only the newest 250 messages, so 400 throws in one step report as
|
||||
// exactly 250. A clean run peaks at 4 of 250, so that is headroom today
|
||||
// and not a guarantee for a step that logs heavily. The Chrome harness
|
||||
// receives pageerror events as they happen and can say more. Do not read
|
||||
// a green Firefox run as the same claim.
|
||||
|
||||
"use strict";
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const {
|
||||
Transaction,
|
||||
formatEther,
|
||||
getAddress,
|
||||
getBytes,
|
||||
hexlify,
|
||||
parseEther,
|
||||
toQuantity,
|
||||
toUtf8Bytes,
|
||||
verifyMessage,
|
||||
} = require("ethers");
|
||||
|
||||
const { ConsoleErrors, EXTENSION_ORIGIN, start, sleep } = require("./driver");
|
||||
const { startDappServer } = require("./dapp");
|
||||
const { STUB_COUNTERPARTY } = require("../network");
|
||||
|
||||
const REPO_ROOT = path.resolve(__dirname, "..", "..", "..");
|
||||
const POPUP_URL = EXTENSION_ORIGIN + "/src/popup/index.html";
|
||||
const PASSWORD = "e2e-harness-password";
|
||||
|
||||
// Firefox installs the add-on and starts its background page asynchronously
|
||||
// after the install call returns. Nothing observable marks the end of that,
|
||||
// so the popup's own first render is the signal we wait on instead.
|
||||
const STEP_TIMEOUT_MS = 120000;
|
||||
|
||||
const steps = [];
|
||||
|
||||
function step(name, fn) {
|
||||
steps.push({ name, fn });
|
||||
}
|
||||
|
||||
function assert(cond, message) {
|
||||
if (!cond) throw new Error(message);
|
||||
}
|
||||
|
||||
function withTimeout(promise, name) {
|
||||
let timer;
|
||||
const timeout = new Promise((_, reject) => {
|
||||
timer = setTimeout(
|
||||
() =>
|
||||
reject(
|
||||
new Error(
|
||||
name + " timed out after " + STEP_TIMEOUT_MS + "ms",
|
||||
),
|
||||
),
|
||||
STEP_TIMEOUT_MS,
|
||||
);
|
||||
});
|
||||
return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------- steps
|
||||
|
||||
step("popup loads and reaches the welcome view", async (env) => {
|
||||
const d = env.driver;
|
||||
await d.navigate(POPUP_URL);
|
||||
await d.waitVisible("#view-welcome", STEP_TIMEOUT_MS);
|
||||
const title = await d.title();
|
||||
assert(title === "AutistMask", "unexpected popup title: " + title);
|
||||
});
|
||||
|
||||
step("wallet creation through the UI reaches the main view", async (env) => {
|
||||
const d = env.driver;
|
||||
await d.click("#btn-welcome-add");
|
||||
await d.waitVisible("#view-add-wallet");
|
||||
await d.click("#btn-generate-phrase");
|
||||
await d.waitFor(
|
||||
"a generated recovery phrase of at least 12 words",
|
||||
`const el = document.getElementById("wallet-mnemonic");
|
||||
return !!el && el.value.trim().split(/\\s+/).length >= 12;`,
|
||||
);
|
||||
env.phrase = (await d.value("#wallet-mnemonic")).trim();
|
||||
|
||||
await d.fill("#add-wallet-password", PASSWORD);
|
||||
await d.fill("#add-wallet-password-confirm", PASSWORD);
|
||||
await d.click("#btn-add-wallet-confirm");
|
||||
// Argon2id under libsodium, for real, so this is the slow one.
|
||||
await d.waitVisible("#view-main", STEP_TIMEOUT_MS);
|
||||
|
||||
assert(
|
||||
env.phrase.split(/\s+/).length >= 12,
|
||||
"wallet creation did not yield a recovery phrase",
|
||||
);
|
||||
const addrs = await d.count("#wallet-list .btn-addr-info");
|
||||
assert(addrs > 0, "no addresses rendered in the wallet list");
|
||||
});
|
||||
|
||||
step("add token screen opens from address detail", async (env) => {
|
||||
const d = env.driver;
|
||||
if (!(await d.isVisible("#view-address"))) {
|
||||
await d.waitVisible("#view-main");
|
||||
await d.click("#wallet-list .btn-addr-info");
|
||||
}
|
||||
await d.waitVisible("#view-address");
|
||||
|
||||
await d.click("#btn-add-token");
|
||||
// Reported with the view it actually stayed on: a screen that does
|
||||
// not change is the symptom a missing import produces, and naming
|
||||
// the screen is what makes that diagnosable.
|
||||
try {
|
||||
await d.waitVisible("#view-add-token");
|
||||
} catch (e) {
|
||||
throw new Error(
|
||||
e.message + "; current view is " + (await d.currentView()),
|
||||
);
|
||||
}
|
||||
|
||||
const picks = await d.count("#common-token-list .common-token");
|
||||
assert(picks > 0, "no common-token quick-pick buttons rendered");
|
||||
});
|
||||
|
||||
// ------------------------------------------------- the dApp round trips
|
||||
//
|
||||
// Everything above drives the popup on its own. From here the page, the
|
||||
// content script, the inpage provider, the background page and the approval
|
||||
// window all have to work together — the paths
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/153 rewrote, and the ones no
|
||||
// Firefox test reached before. They are asserted here because nothing else
|
||||
// covers them on this browser, not because they were broken: these steps
|
||||
// pass against the pre-refactor callback code too, which is how the issue's
|
||||
// premise was refuted.
|
||||
//
|
||||
// The shape is the Chrome suite's (tests/e2e/run.js, the #183 section) and
|
||||
// the assertions mean the same things:
|
||||
//
|
||||
// - the signature is recovered here, in the runner, from the artifact the
|
||||
// extension produced, and compared against the address read out of
|
||||
// extension storage. The background verifies too; these assertions do not
|
||||
// lean on that, because a test that trusted the wallet's own verdict would
|
||||
// pass against a wallet that verified nothing.
|
||||
// - the transaction is asserted against the raw signed transaction that
|
||||
// reached the stub node, not against anything the extension reported.
|
||||
//
|
||||
// What this does NOT cover: a real dApp with real funds against a real
|
||||
// network. The node is a fixture on loopback.
|
||||
|
||||
const SIGN_TEXT = "AutistMask e2e round trip: personal_sign";
|
||||
const SIGN_HEX = hexlify(toUtf8Bytes(SIGN_TEXT));
|
||||
|
||||
const TX_VALUE_ETH = "0.0123";
|
||||
const TX_VALUE_WEI = parseEther(TX_VALUE_ETH);
|
||||
// Call data that decodes as nothing, so the screen assertion compares the
|
||||
// calldata itself rather than a decoder's summary of it.
|
||||
const TX_DATA = "0xdeadbeef" + "01".repeat(28);
|
||||
|
||||
const USER_REJECTION_MESSAGE = "User rejected the request.";
|
||||
|
||||
// Read the extension's persisted state, point its rpcUrl at the loopback stub
|
||||
// node, and hand back the active address. Runs on the popup page, which is
|
||||
// the one moz-extension:// document the suite has open and therefore the only
|
||||
// place the storage API is reachable from.
|
||||
async function pointAtStubNode(d, rpcUrl) {
|
||||
const outcome = await d.executeAsync(
|
||||
`const done = arguments[arguments.length - 1];
|
||||
const rpcUrl = arguments[0];
|
||||
const api = typeof browser !== "undefined" ? browser : chrome;
|
||||
Promise.resolve(api.storage.local.get("autistmask"))
|
||||
.then((r) => {
|
||||
const s = r.autistmask;
|
||||
if (!s) throw new Error("the extension has no persisted state");
|
||||
s.rpcUrl = rpcUrl;
|
||||
const w = s.wallets && s.wallets[0];
|
||||
const first = w && w.addresses && w.addresses[0];
|
||||
const address = s.activeAddress || (first && first.address);
|
||||
if (!address) throw new Error("the extension holds no address");
|
||||
return Promise.resolve(api.storage.local.set({ autistmask: s }))
|
||||
.then(() => done({ address: address }));
|
||||
})
|
||||
.catch((e) => done({ error: String((e && e.message) || e) }));`,
|
||||
[rpcUrl],
|
||||
);
|
||||
assert(
|
||||
outcome && !outcome.error,
|
||||
"could not point the extension at the stub node: " +
|
||||
(outcome && outcome.error),
|
||||
);
|
||||
return getAddress(outcome.address);
|
||||
}
|
||||
|
||||
// The approval window the background opened. Approvals are raised from an RPC
|
||||
// call rather than from a user gesture, so the extension opens a real window
|
||||
// for them, which is an ordinary window handle here.
|
||||
async function waitForApprovalWindow(d, timeout = 30000) {
|
||||
const deadline = Date.now() + timeout;
|
||||
for (;;) {
|
||||
const handle = await d.findWindow((u) => u.includes("?approval="));
|
||||
if (handle) return handle;
|
||||
if (Date.now() > deadline) {
|
||||
throw new Error(
|
||||
"the extension opened no approval window within " +
|
||||
timeout +
|
||||
"ms",
|
||||
);
|
||||
}
|
||||
await sleep(100);
|
||||
}
|
||||
}
|
||||
|
||||
function startRequest(d, key, method, params) {
|
||||
return d.execute(
|
||||
"window.__dapp.start(arguments[0], arguments[1], arguments[2]);" +
|
||||
" return true;",
|
||||
[key, method, params],
|
||||
);
|
||||
}
|
||||
|
||||
// The settled outcome of a parked request, or {settled:"pending"} if it is
|
||||
// still outstanding. A bounded wait rather than a bare await: "returns a
|
||||
// rejection rather than hanging" is one of the things under test, and an
|
||||
// await would report a hang as a step timeout with no indication of which
|
||||
// call never settled.
|
||||
function settleRequest(d, key, timeout = 45000) {
|
||||
return d.executeAsync(
|
||||
`const done = arguments[arguments.length - 1];
|
||||
const key = arguments[0];
|
||||
const timeout = arguments[1];
|
||||
Promise.race([
|
||||
window.__dapp.settle(key),
|
||||
new Promise((r) => setTimeout(() => r({ settled: "pending" }), timeout)),
|
||||
]).then(done, (e) => done({ settled: "error", message: String(e) }));`,
|
||||
[key, timeout],
|
||||
);
|
||||
}
|
||||
|
||||
// Every AUTISTMASK_* message that has crossed between the page and the
|
||||
// content script. This is the boundary half of the rejection assertion: the
|
||||
// code has to be on the wire as well as on the Error the page catches, so a
|
||||
// pass cannot come from the provider inventing one.
|
||||
function dappMessages(d, type) {
|
||||
return d.execute(
|
||||
// `want` is bound outside the callback deliberately: inside it,
|
||||
// arguments[0] is the message being tested, not the script argument,
|
||||
// and the filter silently matches nothing.
|
||||
"var want = arguments[0];" +
|
||||
" return window.__dapp.messages.filter(function (m) {" +
|
||||
" return !want || m.type === want; });",
|
||||
[type || null],
|
||||
);
|
||||
}
|
||||
|
||||
async function lastResponseError(d) {
|
||||
const responses = await dappMessages(d, "AUTISTMASK_RESPONSE");
|
||||
const last = responses[responses.length - 1];
|
||||
assert(last, "the page received no AUTISTMASK_RESPONSE at all");
|
||||
return last.error || null;
|
||||
}
|
||||
|
||||
// A rejected prompt, asserted at both ends: the page's promise rejected
|
||||
// rather than hanging or resolving, and the response that crossed the
|
||||
// boundary carried EIP-1193 code 4001.
|
||||
async function assertUserRejection(d, key, label) {
|
||||
const outcome = await settleRequest(d, key);
|
||||
assert(
|
||||
outcome.settled !== "pending",
|
||||
label + " never settled: the rejected prompt left the page hanging",
|
||||
);
|
||||
assert(
|
||||
outcome.settled === "rejected",
|
||||
label + " resolved instead of rejecting: " + JSON.stringify(outcome),
|
||||
);
|
||||
assert(
|
||||
outcome.message === USER_REJECTION_MESSAGE,
|
||||
label + " rejected with the wrong message: " + outcome.message,
|
||||
);
|
||||
const error = await lastResponseError(d);
|
||||
assert(
|
||||
error && error.code === 4001,
|
||||
label +
|
||||
" did not carry EIP-1193 code 4001 across the boundary: " +
|
||||
JSON.stringify(error),
|
||||
);
|
||||
assert(
|
||||
outcome.hasCode,
|
||||
label +
|
||||
" reached the page as an error with no code property at all, so a " +
|
||||
"dApp cannot tell the user's refusal from a failure: " +
|
||||
JSON.stringify(outcome),
|
||||
);
|
||||
assert(
|
||||
outcome.code === 4001,
|
||||
label +
|
||||
" reached the page with code " +
|
||||
JSON.stringify(outcome.code) +
|
||||
" rather than EIP-1193 4001",
|
||||
);
|
||||
assert(
|
||||
outcome.name === "ProviderRpcError",
|
||||
label +
|
||||
" reached the page as " +
|
||||
JSON.stringify(outcome.name) +
|
||||
" rather than an EIP-1193 ProviderRpcError",
|
||||
);
|
||||
console.log(
|
||||
"# " +
|
||||
label +
|
||||
": code 4001 on the wire and on the page's " +
|
||||
outcome.name,
|
||||
);
|
||||
}
|
||||
|
||||
step("the loopback dApp page gets the real inpage provider", async (env) => {
|
||||
const d = env.driver;
|
||||
|
||||
// The popup is still the current window; point the extension at the stub
|
||||
// node from there, then reload it so its in-memory copy of the state
|
||||
// carries the new rpcUrl and cannot save the old one back over it.
|
||||
env.address = await pointAtStubNode(d, env.server.rpcUrl);
|
||||
await d.navigate(POPUP_URL);
|
||||
await d.waitVisible("#view-main", STEP_TIMEOUT_MS);
|
||||
env.popupWindow = await d.currentWindow();
|
||||
|
||||
env.dappWindow = await d.newWindow("tab");
|
||||
await d.switchToWindow(env.dappWindow);
|
||||
await d.navigate(env.server.url);
|
||||
|
||||
// window.ethereum is not the fixture's doing — it is the shipped content
|
||||
// script, injected into a real http:// origin. Waiting for it is waiting
|
||||
// for the real provider to have installed itself.
|
||||
await d.waitFor(
|
||||
"the injected EIP-1193 provider and the test page API",
|
||||
"return !!window.ethereum && !!window.__dapp;",
|
||||
[],
|
||||
STEP_TIMEOUT_MS,
|
||||
);
|
||||
|
||||
// EIP-6963, asked of the provider itself. The announcement carries the
|
||||
// uuid src/content/index.js reads out of extension storage — call site 1
|
||||
// in the issue — and it has to name this extension and hand back the very
|
||||
// object on window.ethereum.
|
||||
const announced = await d.executeAsync(
|
||||
`const done = arguments[arguments.length - 1];
|
||||
const onAnnounce = (e) => {
|
||||
window.removeEventListener("eip6963:announceProvider", onAnnounce);
|
||||
done({
|
||||
rdns: e.detail.info.rdns,
|
||||
uuid: e.detail.info.uuid,
|
||||
isWindowEthereum: e.detail.provider === window.ethereum,
|
||||
});
|
||||
};
|
||||
window.addEventListener("eip6963:announceProvider", onAnnounce);
|
||||
window.dispatchEvent(new Event("eip6963:requestProvider"));
|
||||
setTimeout(() => done(null), 15000);`,
|
||||
);
|
||||
assert(announced, "the provider announced itself to no EIP-6963 request");
|
||||
assert(
|
||||
announced.rdns === "berlin.sneak.autistmask",
|
||||
"the announced provider is not this extension: " +
|
||||
JSON.stringify(announced),
|
||||
);
|
||||
assert(
|
||||
announced.isWindowEthereum,
|
||||
"the announced provider is not the object on window.ethereum",
|
||||
);
|
||||
assert(
|
||||
typeof announced.uuid === "string" && announced.uuid.length === 36,
|
||||
"the announcement carries no stored provider uuid: " +
|
||||
JSON.stringify(announced.uuid),
|
||||
);
|
||||
|
||||
// A full page -> content script -> background round trip that needs no
|
||||
// approval, so the relay is proven before any prompt is driven. This is
|
||||
// call site 2, the one that used to fail for every window.ethereum
|
||||
// request a dApp made.
|
||||
const chainId = await d.executeAsync(
|
||||
`const done = arguments[arguments.length - 1];
|
||||
window.ethereum.request({ method: "eth_chainId" }).then(
|
||||
(r) => done({ ok: r }),
|
||||
(e) => done({ err: String((e && e.message) || e) }),
|
||||
);`,
|
||||
);
|
||||
assert(
|
||||
chainId && chainId.ok === "0x1",
|
||||
"eth_chainId did not round trip through the extension: " +
|
||||
JSON.stringify(chainId),
|
||||
);
|
||||
console.log(
|
||||
"# dapp origin " + env.server.origin + " active address " + env.address,
|
||||
);
|
||||
});
|
||||
|
||||
step(
|
||||
"eth_requestAccounts approved returns the selected address",
|
||||
async (env) => {
|
||||
const d = env.driver;
|
||||
await d.switchToWindow(env.dappWindow);
|
||||
await startRequest(d, "accounts", "eth_requestAccounts", []);
|
||||
|
||||
const popup = await waitForApprovalWindow(d);
|
||||
await d.switchToWindow(popup);
|
||||
await d.waitVisible("#view-approve-site");
|
||||
|
||||
const hostname = await d.text("#approve-hostname");
|
||||
assert(
|
||||
hostname === "127.0.0.1",
|
||||
"the site prompt names the wrong origin: " +
|
||||
JSON.stringify(hostname),
|
||||
);
|
||||
const shown = await d.text("#approve-address");
|
||||
assert(
|
||||
shown.toLowerCase().includes(env.address.toLowerCase()),
|
||||
"the site prompt shows the wrong address: " + JSON.stringify(shown),
|
||||
);
|
||||
|
||||
// Remembered, so the origin stays authorized for the sign and transaction
|
||||
// steps below.
|
||||
const checked = await d.execute(
|
||||
'return document.getElementById("approve-remember").checked;',
|
||||
);
|
||||
if (!checked) await d.click("#approve-remember");
|
||||
await d.click("#btn-approve");
|
||||
|
||||
// The approve button closes its own window, so get off it before asking
|
||||
// the page anything.
|
||||
await d.switchToWindow(env.dappWindow);
|
||||
const outcome = await settleRequest(d, "accounts");
|
||||
assert(
|
||||
outcome.settled === "resolved",
|
||||
"eth_requestAccounts did not resolve: " + JSON.stringify(outcome),
|
||||
);
|
||||
assert(
|
||||
Array.isArray(outcome.result) && outcome.result.length === 1,
|
||||
"eth_requestAccounts returned no single account: " +
|
||||
JSON.stringify(outcome.result),
|
||||
);
|
||||
assert(
|
||||
getAddress(outcome.result[0]) === env.address,
|
||||
"eth_requestAccounts returned " +
|
||||
outcome.result[0] +
|
||||
", not the selected address " +
|
||||
env.address,
|
||||
);
|
||||
},
|
||||
);
|
||||
|
||||
step(
|
||||
"personal_sign returns a signature that recovers to the address",
|
||||
async (env) => {
|
||||
const d = env.driver;
|
||||
await d.switchToWindow(env.dappWindow);
|
||||
await startRequest(d, "sign", "personal_sign", [SIGN_HEX, env.address]);
|
||||
|
||||
const popup = await waitForApprovalWindow(d);
|
||||
await d.switchToWindow(popup);
|
||||
await d.waitVisible("#view-approve-sign");
|
||||
|
||||
const screen = await d.execute(
|
||||
`return {
|
||||
hostname: document.getElementById("approve-sign-hostname").textContent,
|
||||
type: document.getElementById("approve-sign-type").textContent,
|
||||
message: document.getElementById("approve-sign-message").textContent,
|
||||
from: document.getElementById("approve-sign-from").textContent,
|
||||
};`,
|
||||
);
|
||||
assert(
|
||||
screen.hostname === "127.0.0.1",
|
||||
"the sign prompt names the wrong origin: " +
|
||||
JSON.stringify(screen.hostname),
|
||||
);
|
||||
assert(
|
||||
screen.type === "Personal message",
|
||||
"the sign prompt reports the wrong type: " +
|
||||
JSON.stringify(screen.type),
|
||||
);
|
||||
assert(
|
||||
screen.message === SIGN_TEXT,
|
||||
"the sign prompt shows the wrong message: " +
|
||||
JSON.stringify(screen.message),
|
||||
);
|
||||
assert(
|
||||
screen.from.toLowerCase().includes(env.address.toLowerCase()),
|
||||
"the sign prompt shows the wrong signing address: " +
|
||||
JSON.stringify(screen.from),
|
||||
);
|
||||
|
||||
await d.fill("#approve-sign-password", PASSWORD);
|
||||
await d.click("#btn-approve-sign");
|
||||
|
||||
await d.switchToWindow(env.dappWindow);
|
||||
const outcome = await settleRequest(d, "sign");
|
||||
assert(
|
||||
outcome.settled === "resolved",
|
||||
"personal_sign did not resolve: " + JSON.stringify(outcome),
|
||||
);
|
||||
const recovered = getAddress(
|
||||
verifyMessage(getBytes(SIGN_HEX), outcome.result),
|
||||
);
|
||||
console.log(
|
||||
"# personal_sign: recovered=" +
|
||||
recovered +
|
||||
" expected=" +
|
||||
env.address,
|
||||
);
|
||||
assert(
|
||||
recovered === env.address,
|
||||
"the personal_sign signature recovers to " +
|
||||
recovered +
|
||||
", not to the approved address " +
|
||||
env.address,
|
||||
);
|
||||
},
|
||||
);
|
||||
|
||||
step(
|
||||
"eth_sendTransaction shows the transaction and returns its hash",
|
||||
async (env) => {
|
||||
const d = env.driver;
|
||||
const before = env.server.broadcast.length;
|
||||
|
||||
await d.switchToWindow(env.dappWindow);
|
||||
await startRequest(d, "tx", "eth_sendTransaction", [
|
||||
{
|
||||
from: env.address,
|
||||
to: STUB_COUNTERPARTY,
|
||||
value: toQuantity(TX_VALUE_WEI),
|
||||
data: TX_DATA,
|
||||
},
|
||||
]);
|
||||
|
||||
const popup = await waitForApprovalWindow(d);
|
||||
await d.switchToWindow(popup);
|
||||
await d.waitVisible("#view-approve-tx");
|
||||
|
||||
const screen = await d.execute(
|
||||
`return {
|
||||
hostname: document.getElementById("approve-tx-hostname").textContent,
|
||||
from: document.getElementById("approve-tx-from").textContent,
|
||||
to: document.getElementById("approve-tx-to").textContent,
|
||||
value: document.getElementById("approve-tx-value").textContent,
|
||||
data: document.getElementById("approve-tx-data").textContent,
|
||||
dataShown: !document
|
||||
.getElementById("approve-tx-data-section")
|
||||
.classList.contains("hidden"),
|
||||
};`,
|
||||
);
|
||||
assert(
|
||||
screen.hostname === "127.0.0.1",
|
||||
"the transaction prompt names the wrong origin: " +
|
||||
JSON.stringify(screen.hostname),
|
||||
);
|
||||
assert(
|
||||
screen.from.toLowerCase().includes(env.address.toLowerCase()),
|
||||
"the transaction prompt shows the wrong sender: " +
|
||||
JSON.stringify(screen.from),
|
||||
);
|
||||
assert(
|
||||
screen.to.toLowerCase().includes(STUB_COUNTERPARTY.toLowerCase()),
|
||||
"the transaction prompt shows the wrong recipient: " +
|
||||
JSON.stringify(screen.to),
|
||||
);
|
||||
assert(
|
||||
screen.value.startsWith(TX_VALUE_ETH + " ETH"),
|
||||
"the transaction prompt shows the wrong value: " +
|
||||
JSON.stringify(screen.value),
|
||||
);
|
||||
assert(
|
||||
screen.dataShown && screen.data === TX_DATA,
|
||||
"the transaction prompt does not show the approved call data: " +
|
||||
JSON.stringify(screen.data),
|
||||
);
|
||||
|
||||
await d.fill("#approve-tx-password", PASSWORD);
|
||||
await d.click("#btn-approve-tx");
|
||||
|
||||
// The approval window hands off to the wait screen rather than closing,
|
||||
// and the hash it shows is asserted before it is retired: left open it
|
||||
// polls the stub node for a receipt for the rest of the run.
|
||||
await d.waitVisible("#view-wait-tx", STEP_TIMEOUT_MS);
|
||||
const waitHash = await d.text("#wait-tx-hash");
|
||||
|
||||
await d.switchToWindow(env.dappWindow);
|
||||
const outcome = await settleRequest(d, "tx");
|
||||
assert(
|
||||
outcome.settled === "resolved",
|
||||
"eth_sendTransaction did not resolve: " + JSON.stringify(outcome),
|
||||
);
|
||||
|
||||
// The artifact as the node saw it, not as the extension described it.
|
||||
assert(
|
||||
env.server.broadcast.length === before + 1,
|
||||
"expected exactly one raw transaction to reach the node, got " +
|
||||
(env.server.broadcast.length - before),
|
||||
);
|
||||
const signed = Transaction.from(
|
||||
env.server.broadcast[env.server.broadcast.length - 1],
|
||||
);
|
||||
console.log(
|
||||
"# eth_sendTransaction: signer=" +
|
||||
getAddress(signed.from) +
|
||||
" to=" +
|
||||
getAddress(signed.to) +
|
||||
" value=" +
|
||||
formatEther(signed.value) +
|
||||
" chainId=" +
|
||||
signed.chainId,
|
||||
);
|
||||
assert(
|
||||
getAddress(signed.from) === env.address,
|
||||
"the broadcast transaction was signed by " +
|
||||
getAddress(signed.from) +
|
||||
", not by the approved address " +
|
||||
env.address,
|
||||
);
|
||||
assert(
|
||||
getAddress(signed.to) === getAddress(STUB_COUNTERPARTY),
|
||||
"the broadcast transaction goes to " + signed.to,
|
||||
);
|
||||
assert(
|
||||
signed.value === TX_VALUE_WEI,
|
||||
"the broadcast transaction carries " +
|
||||
formatEther(signed.value) +
|
||||
" ETH, not the approved " +
|
||||
TX_VALUE_ETH,
|
||||
);
|
||||
assert(
|
||||
signed.data === TX_DATA,
|
||||
"the broadcast transaction carries different call data: " +
|
||||
signed.data,
|
||||
);
|
||||
assert(
|
||||
signed.chainId === 1n,
|
||||
"the broadcast transaction is for chain " + signed.chainId,
|
||||
);
|
||||
assert(
|
||||
outcome.result === signed.hash,
|
||||
"the page received " +
|
||||
outcome.result +
|
||||
", not the hash of the broadcast transaction " +
|
||||
signed.hash,
|
||||
);
|
||||
assert(
|
||||
waitHash.includes(signed.hash),
|
||||
"the wait screen shows a different hash: " +
|
||||
JSON.stringify(waitHash),
|
||||
);
|
||||
|
||||
await d.switchToWindow(popup);
|
||||
await d.closeWindow(env.dappWindow);
|
||||
},
|
||||
);
|
||||
|
||||
step(
|
||||
"closing an approval window rejects the request with 4001",
|
||||
async (env) => {
|
||||
const d = env.driver;
|
||||
const before = env.server.broadcast.length;
|
||||
|
||||
await d.switchToWindow(env.dappWindow);
|
||||
await startRequest(d, "sign-closed", "personal_sign", [
|
||||
SIGN_HEX,
|
||||
env.address,
|
||||
]);
|
||||
|
||||
const popup = await waitForApprovalWindow(d);
|
||||
await d.switchToWindow(popup);
|
||||
await d.waitVisible("#view-approve-sign");
|
||||
|
||||
// Closed, not rejected: this is the windows.onRemoved path, which can
|
||||
// only fire if windows.create() handed back a window id for the
|
||||
// approval to be matched against — call site 4 in the issue, and the
|
||||
// reason suppressing that write-back turns this step red.
|
||||
await d.closeWindow(env.dappWindow);
|
||||
|
||||
await assertUserRejection(d, "sign-closed", "a closed approval window");
|
||||
assert(
|
||||
env.server.broadcast.length === before,
|
||||
"a closed approval window still put a transaction on the node",
|
||||
);
|
||||
},
|
||||
);
|
||||
|
||||
// ------------------------------------------------------------- runner
|
||||
|
||||
// Uncaught extension errors that are known, tracked and deliberately
|
||||
// tolerated, in the same spirit as ALLOWED_ERRORS in tests/e2e/harness.js:
|
||||
// every entry names the issue that will delete it, and every occurrence is
|
||||
// still printed, so tolerating one is visible in the log rather than silent.
|
||||
// This is the only concession in an otherwise zero-tolerance policy.
|
||||
const ALLOWED_ERRORS = [
|
||||
{
|
||||
// The site-connection buttons in src/popup/views/approval.js send
|
||||
// their decision and call window.close() on the next line. Firefox's
|
||||
// BaseContext.wrapPromise reports, through Cu.reportError, any
|
||||
// extension-API promise that settles after its context unloaded —
|
||||
// whether or not the caller attached a handler, so notify()'s catch
|
||||
// cannot suppress it.
|
||||
//
|
||||
// Pre-existing, and not introduced by the promise shim: the send was
|
||||
// already unawaited, and this suite is merely the first thing to
|
||||
// drive that window on Firefox. It is the same teardown ordering as
|
||||
// the issue below, whose fix — making the outcome independent of when
|
||||
// the popup closes — removes this entry with it.
|
||||
pattern: /Promise (?:resolved|rejected) after context unloaded/,
|
||||
source: /\/src\/popup\/index\.js$/,
|
||||
issue: "https://git.eeqj.de/sneak/AutistMask/issues/275",
|
||||
},
|
||||
];
|
||||
|
||||
function allowedFor(e) {
|
||||
return ALLOWED_ERRORS.find(
|
||||
(a) => a.pattern.test(e.msg) && a.source.test(e.src),
|
||||
);
|
||||
}
|
||||
|
||||
function formatError(e) {
|
||||
return (
|
||||
e.msg + " (" + e.src + ":" + e.line + (e.cat ? ", " + e.cat : "") + ")"
|
||||
);
|
||||
}
|
||||
|
||||
async function main() {
|
||||
// A suite that runs nothing must never report success.
|
||||
if (steps.length === 0) {
|
||||
console.log("1..0");
|
||||
console.log("# FAILED: the Firefox e2e suite registered no steps");
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
const extDir = path.resolve(REPO_ROOT, process.argv[2] || "dist/firefox");
|
||||
if (!fs.existsSync(path.join(extDir, "manifest.json"))) {
|
||||
console.error(
|
||||
"e2e-firefox: no unpacked build at " +
|
||||
extDir +
|
||||
" — run make build first",
|
||||
);
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
// Loopback survives --network none, so this is the http:// origin the
|
||||
// dApp steps need and the node they talk to. Started before the browser
|
||||
// so its url is available to the first step that asks for it.
|
||||
let server;
|
||||
try {
|
||||
server = await startDappServer();
|
||||
} catch (e) {
|
||||
console.error(
|
||||
"e2e-firefox: cannot serve the dApp fixture: " + e.message,
|
||||
);
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
console.log("# dapp fixture: " + server.url + " rpc " + server.rpcUrl);
|
||||
|
||||
let driver;
|
||||
try {
|
||||
driver = await start();
|
||||
await driver.newSession();
|
||||
await driver.installAddon(extDir);
|
||||
} catch (e) {
|
||||
// A browser we cannot start is a failure of the suite, not an
|
||||
// absent suite. Never skip and report success.
|
||||
console.error("e2e-firefox: cannot run the suite: " + e.message);
|
||||
if (driver) await driver.quit().catch(() => {});
|
||||
await server.close();
|
||||
process.exitCode = 1;
|
||||
return;
|
||||
}
|
||||
|
||||
const errors = new ConsoleErrors(driver, EXTENSION_ORIGIN);
|
||||
const env = {
|
||||
driver,
|
||||
server,
|
||||
phrase: null,
|
||||
address: null,
|
||||
dappWindow: null,
|
||||
popupWindow: null,
|
||||
};
|
||||
|
||||
console.log("# extension origin: " + EXTENSION_ORIGIN);
|
||||
console.log("1.." + steps.length);
|
||||
|
||||
let failed = 0;
|
||||
let n = 0;
|
||||
try {
|
||||
// Drain, never reset: anything the add-on logged while installing
|
||||
// and starting its background page has no earlier step to belong
|
||||
// to, so it is folded into step 1 below. Services.console.reset()
|
||||
// here would DELETE it instead, and a background page that throws
|
||||
// at the top of the file — a dead background page — would then
|
||||
// produce a fully green run.
|
||||
let installErrors = [];
|
||||
let installFailure = null;
|
||||
try {
|
||||
installErrors = await errors.take();
|
||||
} catch (e) {
|
||||
installFailure =
|
||||
"could not read the console after install: " + e.message;
|
||||
}
|
||||
|
||||
for (const s of steps) {
|
||||
n += 1;
|
||||
let failure = null;
|
||||
try {
|
||||
await withTimeout(s.fn(env), s.name);
|
||||
} catch (e) {
|
||||
failure = e.message;
|
||||
}
|
||||
|
||||
// Let anything the step provoked reach the console service
|
||||
// before draining it. Without this a failure logged on the
|
||||
// way out of the step lands in the next step's drain, which
|
||||
// still fails the run but blames the wrong step.
|
||||
await sleep(500);
|
||||
|
||||
let found = [];
|
||||
try {
|
||||
found = await errors.take();
|
||||
} catch (e) {
|
||||
failure = failure || "could not read the console: " + e.message;
|
||||
}
|
||||
|
||||
if (n === 1) {
|
||||
found = installErrors.concat(found);
|
||||
installErrors = [];
|
||||
failure = failure || installFailure;
|
||||
installFailure = null;
|
||||
}
|
||||
|
||||
// Tolerated errors are set aside, never dropped: each one is
|
||||
// printed with the issue that keeps it on the list, so the
|
||||
// concession stays in the run output.
|
||||
const tolerated = found.filter((e) => allowedFor(e));
|
||||
found = found.filter((e) => !allowedFor(e));
|
||||
for (const e of tolerated) {
|
||||
console.log(
|
||||
"# tolerated (" +
|
||||
allowedFor(e).issue +
|
||||
"): " +
|
||||
formatError(e),
|
||||
);
|
||||
}
|
||||
|
||||
// Any uncaught error from an extension source fails the step
|
||||
// that provoked it, whether or not its assertions passed.
|
||||
if (!failure && found.length > 0) {
|
||||
failure =
|
||||
n === 1
|
||||
? "uncaught extension errors during add-on install, " +
|
||||
"background startup or this step"
|
||||
: "uncaught extension errors during this step";
|
||||
}
|
||||
|
||||
if (failure) {
|
||||
failed += 1;
|
||||
console.log("not ok " + n + " - " + s.name);
|
||||
console.log(" " + failure);
|
||||
for (const e of found) console.log(" " + formatError(e));
|
||||
} else {
|
||||
console.log("ok " + n + " - " + s.name);
|
||||
}
|
||||
}
|
||||
|
||||
// The tail: errors logged after the last step returned cannot be
|
||||
// blamed on any one step, but they are still reported and they
|
||||
// still fail the run.
|
||||
await sleep(1000);
|
||||
const trailingAll = await errors.take();
|
||||
for (const e of trailingAll.filter((x) => allowedFor(x))) {
|
||||
console.log(
|
||||
"# tolerated (" + allowedFor(e).issue + "): " + formatError(e),
|
||||
);
|
||||
}
|
||||
const trailing = trailingAll.filter((e) => !allowedFor(e));
|
||||
console.log(
|
||||
"# " +
|
||||
(steps.length - failed) +
|
||||
"/" +
|
||||
steps.length +
|
||||
" steps passed",
|
||||
);
|
||||
if (trailing.length > 0) {
|
||||
console.log(
|
||||
"# " +
|
||||
trailing.length +
|
||||
" extension error(s) recorded after the last step, not " +
|
||||
"attributable to any single step:",
|
||||
);
|
||||
for (const e of trailing) console.log("# " + formatError(e));
|
||||
}
|
||||
// A JSON-RPC method nothing answered means the extension asked the
|
||||
// node something this fixture does not model, and whatever depended
|
||||
// on the answer took the error branch instead. That is a hole in the
|
||||
// fixture, not a pass.
|
||||
if (server.unstubbed.length > 0) {
|
||||
console.log(
|
||||
"# FAILED: no fixture for JSON-RPC method(s) " +
|
||||
[...new Set(server.unstubbed)].join(", "),
|
||||
);
|
||||
process.exitCode = 1;
|
||||
}
|
||||
|
||||
if (failed > 0 || trailing.length > 0) {
|
||||
console.log("# FAILED");
|
||||
process.exitCode = 1;
|
||||
}
|
||||
} finally {
|
||||
await driver.quit().catch(() => {});
|
||||
await server.close();
|
||||
}
|
||||
}
|
||||
|
||||
main().catch((e) => {
|
||||
console.error("e2e-firefox: " + (e && e.stack ? e.stack : e));
|
||||
process.exitCode = 1;
|
||||
});
|
||||
@@ -13,7 +13,7 @@ const os = require("os");
|
||||
const path = require("path");
|
||||
|
||||
const { chromium } = require("playwright-core");
|
||||
const { installNetworkStubs, WORKER_PROBE_URL } = require("./network");
|
||||
const { installNetworkStubs } = require("./network");
|
||||
|
||||
const REPO_ROOT = path.resolve(__dirname, "..", "..");
|
||||
const EXT_PATH = path.join(REPO_ROOT, "dist", "chrome");
|
||||
@@ -53,47 +53,15 @@ function isAllowed(text) {
|
||||
// after that — the route handler and the console listeners are gone with
|
||||
// the context — so there is no post-teardown phase to collect, and this
|
||||
// class deliberately offers no mechanism pretending to cover one.
|
||||
//
|
||||
// One narrow exception exists, and it is not a mute: expect(). A test that
|
||||
// drives a failure path on purpose — a refused gas estimate, say — provokes
|
||||
// the console.error the code is supposed to emit, and that error is the
|
||||
// behaviour under test rather than an escape. Declaring it consumes exactly
|
||||
// one matching record and no more, and an expectation nothing matched fails
|
||||
// its test just as an unexpected error does. So it cannot be used to
|
||||
// silence anything: it can only assert that a specific error happened.
|
||||
class ErrorCollector {
|
||||
constructor() {
|
||||
this.entries = [];
|
||||
this.taken = 0;
|
||||
this.expectations = [];
|
||||
}
|
||||
|
||||
// Declare a console.error this test is about to cause deliberately.
|
||||
// `label` names it in the failure message if it never arrives.
|
||||
expect(label, pattern) {
|
||||
this.expectations.push({ label, pattern, matched: false });
|
||||
}
|
||||
|
||||
// Declared expectations that nothing matched, clearing the list so each
|
||||
// test starts with none outstanding.
|
||||
unmatchedExpectations() {
|
||||
const out = this.expectations
|
||||
.filter((e) => !e.matched)
|
||||
.map((e) => e.label);
|
||||
this.expectations = [];
|
||||
return out;
|
||||
}
|
||||
|
||||
record(kind, text) {
|
||||
const line = kind + ": " + String(text).split("\n")[0];
|
||||
if (isAllowed(line)) return;
|
||||
const expected = this.expectations.find(
|
||||
(e) => !e.matched && e.pattern.test(line),
|
||||
);
|
||||
if (expected) {
|
||||
expected.matched = true;
|
||||
return;
|
||||
}
|
||||
this.entries.push(line);
|
||||
}
|
||||
|
||||
@@ -129,109 +97,42 @@ function attachErrorListeners(ctx, errors) {
|
||||
// if it ever stops being.
|
||||
}
|
||||
|
||||
function sleep(ms) {
|
||||
return new Promise((resolve) => setTimeout(resolve, ms));
|
||||
}
|
||||
|
||||
// The most recently seen background worker, waiting for one if none has
|
||||
// appeared yet. Most recent rather than first: Chrome stops an idle MV3
|
||||
// worker and starts a fresh one on the next event, and a handle to a
|
||||
// stopped worker cannot be evaluated in.
|
||||
async function serviceWorker(ctx) {
|
||||
const workers = ctx.serviceWorkers();
|
||||
const latest = workers[workers.length - 1];
|
||||
if (latest) return latest;
|
||||
const [existing] = ctx.serviceWorkers();
|
||||
if (existing) return existing;
|
||||
return ctx.waitForEvent("serviceworker", { timeout: 30000 });
|
||||
}
|
||||
|
||||
// How long to wait for the probe request the worker is asked to make.
|
||||
// How long to wait for the background worker's first outbound request.
|
||||
//
|
||||
// The margin that actually decides whether this check is sound is not
|
||||
// this timeout — it is whether the route handler is installed before the
|
||||
// worker fetches. Measured over several runs: route installation
|
||||
// completes 11-23ms after the context comes up, and the worker's
|
||||
// blocklist fetch arrives 525-883ms after that, so the route wins by
|
||||
// roughly 25-50x. This 30s figure is only slack for a loaded machine on
|
||||
// top of that; losing the race fails the run rather than passing it
|
||||
// quietly, which was verified by forcing a 3s delay before route
|
||||
// installation.
|
||||
const WORKER_TRAFFIC_TIMEOUT_MS = 30000;
|
||||
|
||||
// ctx.route() only sees service-worker requests when Playwright runs with
|
||||
// PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, which script/test-e2e
|
||||
// sets. Without it every fetch the background worker makes goes to the
|
||||
// real internet and nothing says so. A harness whose isolation can lapse
|
||||
// in silence is worthless, so this does not take the flag on trust: a
|
||||
// request the worker itself issues has to show up in the route handler,
|
||||
// or the suite refuses to run.
|
||||
// sets. Without it the worker's traffic — notably the phishing blocklist
|
||||
// fetch src/background/index.js issues at startup — goes to the real
|
||||
// internet, and nothing says so, because src/shared/phishingDomains.js
|
||||
// swallows fetch failures. A harness whose isolation can lapse in silence
|
||||
// is worthless, so this does not take the flag on trust: the background
|
||||
// worker's own startup fetch has to show up in the route handler, or the
|
||||
// suite refuses to run.
|
||||
//
|
||||
// The anchor is a probe the harness asks the worker for, not traffic the
|
||||
// extension generates on its own. It used to be the phishing blocklist
|
||||
// fetch src/background/index.js issued at startup; that fetch is gone —
|
||||
// the blocklist is vendored at build time and the extension contacts
|
||||
// nobody when it starts — so there is no longer any startup traffic to
|
||||
// observe and the check generates its own.
|
||||
//
|
||||
// Evaluating in the worker straight after launch does not work, and that
|
||||
// is not a stale observation: it was tried again here and failed with
|
||||
// "Target page, context or browser has been closed" on the first run.
|
||||
// Chrome stops the freshly registered worker as soon as it has nothing to
|
||||
// do, and the extension no longer gives it anything to do — which is the
|
||||
// same change that removed the old anchor. So the probe wakes the worker
|
||||
// before it evaluates in it, by sending it a message from an extension
|
||||
// page and waiting for the reply: delivering a message is what starts a
|
||||
// stopped worker, and a worker that has just answered one is alive.
|
||||
// The evaluated fetch is not awaited, so nothing in the worker is held
|
||||
// open by the probe either.
|
||||
async function wakeWorker(ctx) {
|
||||
const sw = await serviceWorker(ctx);
|
||||
const extensionId = new URL(sw.url()).host;
|
||||
const page = await ctx.newPage();
|
||||
try {
|
||||
await page.goto(
|
||||
"chrome-extension://" + extensionId + "/src/popup/index.html",
|
||||
);
|
||||
// eth_chainId is answered from local state: it wakes the worker
|
||||
// and changes nothing.
|
||||
await page.evaluate(
|
||||
() =>
|
||||
new Promise((resolve) => {
|
||||
chrome.runtime.sendMessage(
|
||||
{
|
||||
type: "AUTISTMASK_RPC",
|
||||
method: "eth_chainId",
|
||||
params: [],
|
||||
},
|
||||
() => resolve(null),
|
||||
);
|
||||
}),
|
||||
);
|
||||
} finally {
|
||||
await page.close();
|
||||
}
|
||||
}
|
||||
|
||||
async function probeFromWorker(ctx, url) {
|
||||
let lastError = null;
|
||||
for (let attempt = 0; attempt < 5; attempt++) {
|
||||
try {
|
||||
await wakeWorker(ctx);
|
||||
const sw = await serviceWorker(ctx);
|
||||
await sw.evaluate((u) => {
|
||||
// Deliberately not awaited and never rejected: what is
|
||||
// being observed is that the request reaches the route
|
||||
// handler, and an unhandled rejection in the worker would
|
||||
// be collected as a suite error if it did not.
|
||||
fetch(u).catch(() => {});
|
||||
}, url);
|
||||
return;
|
||||
} catch (e) {
|
||||
lastError = e;
|
||||
await sleep(500);
|
||||
}
|
||||
}
|
||||
throw new Error(
|
||||
"could not ask the background worker to fetch " +
|
||||
url +
|
||||
", so service-worker interception was never tested. Last " +
|
||||
"error: " +
|
||||
(lastError && lastError.message),
|
||||
);
|
||||
}
|
||||
|
||||
async function assertWorkerTrafficIntercepted(ctx, stubs) {
|
||||
await probeFromWorker(ctx, WORKER_PROBE_URL);
|
||||
|
||||
// Deliberately NOT a synthetic probe fetched through worker.evaluate():
|
||||
// evaluating in an extension worker this early kills it (the call fails
|
||||
// with "Target page, context or browser has been closed" and the worker
|
||||
// disappears), which would break the very thing being measured. Observing
|
||||
// traffic the extension already generates costs nothing and cannot
|
||||
// perturb it.
|
||||
async function assertWorkerTrafficIntercepted(stubs) {
|
||||
const seen = await stubs.waitForServiceWorkerTraffic(
|
||||
WORKER_TRAFFIC_TIMEOUT_MS,
|
||||
);
|
||||
@@ -244,16 +145,19 @@ async function assertWorkerTrafficIntercepted(ctx, stubs) {
|
||||
throw new Error(
|
||||
"observed no service-worker request in the route handler within " +
|
||||
WORKER_TRAFFIC_TIMEOUT_MS +
|
||||
"ms, although the background worker was asked to fetch " +
|
||||
WORKER_PROBE_URL +
|
||||
". Two causes are plausible and this check cannot distinguish " +
|
||||
"ms. Under working interception the background worker's " +
|
||||
"startup blocklist fetch (src/background/index.js) reaches the " +
|
||||
"handler about half a second after the route is installed. " +
|
||||
"Two causes are plausible and this check cannot distinguish " +
|
||||
"them: (1) service-worker interception is not in effect, so " +
|
||||
"that request went to the real internet unobserved — the suite " +
|
||||
"that traffic went to the real internet unobserved — the suite " +
|
||||
"must be run through script/test-e2e, which sets " +
|
||||
"PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1, and a " +
|
||||
"Playwright upgrade may have dropped or renamed that flag; " +
|
||||
"(2) the probe never ran, because the worker was torn down " +
|
||||
"between being handed over and being evaluated in. Either way " +
|
||||
"(2) no worker request was made in the first place — the route " +
|
||||
"lost the startup race, or the worker no longer fetches at " +
|
||||
"startup, in which case this check needs a new anchor because " +
|
||||
"there is no longer any worker traffic to observe. Either way " +
|
||||
"the fix is a replacement mechanism or an honest downgrade of " +
|
||||
"the isolation claims in tests/e2e/network.js and README.md — " +
|
||||
"not deleting this check",
|
||||
@@ -305,7 +209,7 @@ async function launch(routeOpts) {
|
||||
routeOpts.report = (text) => errors.record("network", text);
|
||||
const stubs = await installNetworkStubs(ctx, routeOpts);
|
||||
|
||||
await assertWorkerTrafficIntercepted(ctx, stubs);
|
||||
await assertWorkerTrafficIntercepted(stubs);
|
||||
|
||||
// The extension id is derived from the unpacked path, so it
|
||||
// changes and must never be hardcoded. It is the host part of the
|
||||
@@ -351,7 +255,7 @@ async function pageCompilesWasm(page) {
|
||||
try {
|
||||
await WebAssembly.compile(new Uint8Array(bytes));
|
||||
return true;
|
||||
} catch {
|
||||
} catch (_) {
|
||||
return false;
|
||||
}
|
||||
}, EMPTY_WASM_MODULE);
|
||||
@@ -386,18 +290,13 @@ async function createWallet(page) {
|
||||
return phrase;
|
||||
}
|
||||
|
||||
// Reach the address detail screen of the FIRST address of the first wallet,
|
||||
// from wherever the popup restored to. Clicking .address-row does not open
|
||||
// it; the [info] button does.
|
||||
//
|
||||
// .first() rather than a bare selector because the suite adds a second
|
||||
// wallet partway through, and every later test would otherwise die in
|
||||
// Playwright's strict mode rather than on an assertion.
|
||||
// Reach the address detail screen from wherever the popup restored to.
|
||||
// Clicking .address-row does not open it; the [info] button does.
|
||||
async function openAddressDetail(page) {
|
||||
const onAddress = await page.isVisible("#view-address");
|
||||
if (!onAddress) {
|
||||
await visible(page, "#view-main");
|
||||
await page.locator("#wallet-list .btn-addr-info").first().click();
|
||||
await page.click("#wallet-list .btn-addr-info");
|
||||
}
|
||||
await visible(page, "#view-address");
|
||||
}
|
||||
|
||||
@@ -9,12 +9,13 @@
|
||||
//
|
||||
// Service-worker coverage is not free: ctx.route() only sees worker
|
||||
// traffic when PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 is set in
|
||||
// the environment, which script/test-e2e does. Without it every fetch the
|
||||
// MV3 background worker makes — the JSON-RPC calls behind every approval
|
||||
// in this suite among them — goes to the real internet unobserved. That is
|
||||
// not left to trust: waitForServiceWorkerTraffic() below backs the
|
||||
// launch-time canary in harness.js, which fails the entire suite if worker
|
||||
// requests stop being visible here.
|
||||
// the environment, which script/test-e2e does. Without it the phishing
|
||||
// blocklist fetch that src/background/index.js issues at worker startup
|
||||
// silently reaches raw.githubusercontent.com on the open internet, and
|
||||
// src/shared/phishingDomains.js swallows the failure so nothing surfaces
|
||||
// it. That is not left to trust: waitForServiceWorkerTraffic() below
|
||||
// backs the launch-time canary in harness.js, which fails the entire
|
||||
// suite if worker requests stop being visible here.
|
||||
//
|
||||
// Anything not explicitly stubbed here is aborted AND reported to the
|
||||
// error collector, so a newly added outbound call shows up as a test
|
||||
@@ -22,8 +23,6 @@
|
||||
|
||||
"use strict";
|
||||
|
||||
const { Transaction } = require("ethers");
|
||||
|
||||
// Fictional ERC-20 used to seed the transaction-detail test. The symbol
|
||||
// must not collide with any entry in src/shared/tokenList.js, or
|
||||
// isSpoofedSymbol() in src/shared/transactions.js drops the transfer as a
|
||||
@@ -45,229 +44,27 @@ const STUB_TX_HASH =
|
||||
|
||||
const STUB_BLOCK_NUMBER = 21000000;
|
||||
|
||||
// The native ETH transfer, seeded by opts.seedNativeTransfer. Its own hash
|
||||
// and an older block, so it is a second row rather than a leg of the token
|
||||
// transfer: mergeTransactions() consolidates a native entry and a token
|
||||
// transfer that share a hash into one row, which would leave nothing native
|
||||
// to open. 0.25 ETH clears the 100000 gwei dust threshold the default
|
||||
// filters apply, so the row is not silently dropped.
|
||||
const STUB_NATIVE_TX_HASH =
|
||||
"0xe7e0000000000000000000000000000000000000000000000000000000000e7e";
|
||||
|
||||
const STUB_NATIVE_BLOCK_NUMBER = STUB_BLOCK_NUMBER - 1;
|
||||
|
||||
const STUB_NATIVE_VALUE_WEI = "250000000000000000";
|
||||
|
||||
// Fixed instant so timeAgo() output is stable across runs.
|
||||
const STUB_TX_TIMESTAMP = "2026-01-02T03:04:05.000000Z";
|
||||
|
||||
const STUB_NATIVE_TX_TIMESTAMP = "2026-01-02T02:03:04.000000Z";
|
||||
|
||||
// A 32-byte zero word. Returned for every eth_call, which is what makes
|
||||
// ethers' ENS reverse lookup resolve to "no resolver set" and return null
|
||||
// instead of throwing. A throw would be logged by src/shared/ens.js via
|
||||
// log.errorf(), i.e. console.error, which fails the run on its own.
|
||||
const ZERO_WORD = "0x" + "0".repeat(64);
|
||||
|
||||
function hex(value) {
|
||||
return "0x" + BigInt(value).toString(16);
|
||||
}
|
||||
|
||||
// A bigint as a 32-byte ABI word.
|
||||
function word(value) {
|
||||
return "0x" + BigInt(value).toString(16).padStart(64, "0");
|
||||
}
|
||||
|
||||
// -------------------------------------------------------- dApp fixture
|
||||
//
|
||||
// The origin the EIP-1193 test page is served from, and the page itself.
|
||||
//
|
||||
// It is a fixture like every other one in this file: the route handler
|
||||
// fulfils the navigation from the string below, so the page never comes
|
||||
// from a remote origin and nothing about the dApp round trips leaves the
|
||||
// container. `.test` is reserved by RFC 6761 and has no owner to reach in
|
||||
// the first place; the launch arguments map every host to NOTFOUND anyway.
|
||||
//
|
||||
// What the page deliberately does NOT do is load a provider. window.ethereum
|
||||
// is put there by the shipped manifest's MAIN-world content script, exactly
|
||||
// as it is on any http(s) page a user visits, so what these tests speak to
|
||||
// is the real inpage provider and not a copy the harness wired up.
|
||||
//
|
||||
// DAPP_HTML below is exported and served verbatim by the Firefox suite too
|
||||
// (tests/e2e/firefox/dapp.js), from a loopback origin rather than through a
|
||||
// route handler. The two suites drive different browsers over different
|
||||
// protocols, but the page they drive — the __dapp API, the message log — is
|
||||
// one fixture, so an assertion written against it means the same thing on
|
||||
// both.
|
||||
const DAPP_ORIGIN = "https://dapp.e2e.test";
|
||||
const DAPP_URL = DAPP_ORIGIN + "/";
|
||||
|
||||
// The same page, served from a hostname that is on the vendored phishing
|
||||
// blocklist, so the phishing warning can be driven end to end against the real
|
||||
// list rather than a stub of it. It is a live entry at the pinned upstream
|
||||
// commit; upstream prunes, so a re-vendoring run that retires it turns the
|
||||
// phishing test red, and the fix is a current entry, not a weaker assertion.
|
||||
const PHISHING_DAPP_ORIGIN = "https://myetheywallet.com";
|
||||
const PHISHING_DAPP_URL = PHISHING_DAPP_ORIGIN + "/";
|
||||
|
||||
// A request the harness asks the background service worker to make, purely so
|
||||
// that worker interception can be proved before any test runs. Nothing in the
|
||||
// extension fetches at startup any more — the blocklist is vendored at build
|
||||
// time — so the canary in harness.js has no product traffic to anchor on and
|
||||
// generates its own. See assertWorkerTrafficIntercepted().
|
||||
const WORKER_PROBE_ORIGIN = "https://worker-probe.e2e.test";
|
||||
const WORKER_PROBE_URL = WORKER_PROBE_ORIGIN + "/canary";
|
||||
|
||||
// Requests are parked rather than awaited. An approval prompt only exists
|
||||
// while its call is in flight, so a test that awaited the promise could
|
||||
// never drive the popup that has to settle it; start() files the promise
|
||||
// under a key and settle() collects it once the prompt has been dealt with.
|
||||
//
|
||||
// The rejection branch records the whole observable shape of the error as it
|
||||
// arrives — name, message, and whether a `code` is present at all as distinct
|
||||
// from its value. EIP-1193 says a user rejection is a ProviderRpcError
|
||||
// carrying code 4001; what the page can actually see is recorded here rather
|
||||
// than assumed, and asserted in run.js.
|
||||
//
|
||||
// The message log is the page's half of the boundary observation: every
|
||||
// AUTISTMASK_* message that crosses between this page and the content
|
||||
// script, in both directions, verbatim.
|
||||
const DAPP_HTML = [
|
||||
"<!doctype html>",
|
||||
'<html lang="en">',
|
||||
"<head>",
|
||||
'<meta charset="utf-8">',
|
||||
"<title>AutistMask e2e dApp</title>",
|
||||
// Inline and empty: without it Chromium asks for /favicon.ico, which
|
||||
// the unstubbed-request guard would report as escaping traffic.
|
||||
'<link rel="icon" href="data:,">',
|
||||
"</head>",
|
||||
"<body>",
|
||||
"<h1>AutistMask e2e dApp</h1>",
|
||||
"<script>",
|
||||
"window.__dapp = {",
|
||||
" messages: [],",
|
||||
" calls: {},",
|
||||
" start: function (key, method, params) {",
|
||||
" window.__dapp.calls[key] = window.ethereum",
|
||||
" .request({ method: method, params: params })",
|
||||
" .then(",
|
||||
" function (result) {",
|
||||
" return { settled: 'resolved', result: result };",
|
||||
" },",
|
||||
" function (error) {",
|
||||
" return {",
|
||||
" settled: 'rejected',",
|
||||
" message: String((error && error.message) || error),",
|
||||
" name: error ? error.name : undefined,",
|
||||
" hasCode: !!error && 'code' in Object(error),",
|
||||
" code: error ? error.code : undefined,",
|
||||
" };",
|
||||
" },",
|
||||
" );",
|
||||
" },",
|
||||
" settle: function (key) {",
|
||||
" return window.__dapp.calls[key];",
|
||||
" },",
|
||||
"};",
|
||||
"window.addEventListener('message', function (event) {",
|
||||
" if (event.source !== window) return;",
|
||||
" var d = event.data;",
|
||||
" if (!d || typeof d.type !== 'string') return;",
|
||||
" if (d.type.indexOf('AUTISTMASK') !== 0) return;",
|
||||
" window.__dapp.messages.push(d);",
|
||||
"});",
|
||||
"</script>",
|
||||
"</body>",
|
||||
"</html>",
|
||||
].join("\n");
|
||||
|
||||
// ------------------------------------------------------------ fee fixture
|
||||
//
|
||||
// The confirmation screen carries two different numbers for the same
|
||||
// transaction and may gate on only one of them:
|
||||
//
|
||||
// reserve = gasLimit * maxFeePerGas — what a node requires to be
|
||||
// available for a type-2 transaction, and what the spend gate
|
||||
// must use.
|
||||
// estimate = gasLimit * gasPrice — what the transfer is expected to
|
||||
// actually cost. Display only.
|
||||
//
|
||||
// Issue #154 was the gate reading the smaller of the two. ethers derives
|
||||
// maxFeePerGas as baseFeePerGas * 2 + maxPriorityFeePerGas, so the numbers
|
||||
// below put the reserve at very nearly twice the estimate. That gap is the
|
||||
// entire point of these values: it leaves room for a send that an
|
||||
// estimate-based gate accepts and a reserve-based gate refuses, which is
|
||||
// what lets the ConfirmTx tests tell the two apart at all. Collapse the gap
|
||||
// — by dropping baseFeePerGas from the block below, say — and those tests
|
||||
// go on passing while asserting nothing.
|
||||
const GAS_LIMIT = 21000n;
|
||||
const BASE_FEE_WEI = 100000000000n; // 100 gwei
|
||||
const PRIORITY_FEE_WEI = 1000000000n; // 1 gwei
|
||||
const GAS_PRICE_WEI = BASE_FEE_WEI + PRIORITY_FEE_WEI; // 101 gwei
|
||||
const MAX_FEE_WEI = BASE_FEE_WEI * 2n + PRIORITY_FEE_WEI; // 201 gwei
|
||||
|
||||
const FEE_ESTIMATE_WEI = GAS_LIMIT * GAS_PRICE_WEI; // 0.002121 ETH
|
||||
const FEE_RESERVE_WEI = GAS_LIMIT * MAX_FEE_WEI; // 0.004221 ETH
|
||||
|
||||
const RPC_RESULTS = {
|
||||
eth_chainId: "0x1",
|
||||
net_version: "1",
|
||||
eth_blockNumber: "0x1406f40",
|
||||
eth_getBalance: "0x0",
|
||||
eth_call: ZERO_WORD,
|
||||
eth_getCode: "0x",
|
||||
eth_gasPrice: hex(GAS_PRICE_WEI),
|
||||
eth_estimateGas: hex(GAS_LIMIT),
|
||||
eth_gasPrice: "0x3b9aca00",
|
||||
eth_estimateGas: "0x5208",
|
||||
eth_getTransactionCount: "0x0",
|
||||
eth_maxPriorityFeePerGas: hex(PRIORITY_FEE_WEI),
|
||||
eth_maxPriorityFeePerGas: "0x3b9aca00",
|
||||
};
|
||||
|
||||
// The "latest" block, which ethers' getFeeData() reads baseFeePerGas from
|
||||
// to derive maxFeePerGas. Without it every fee is a legacy gasPrice, the
|
||||
// reserve and the estimate collapse to the same number, and the gate tests
|
||||
// stop being able to distinguish them.
|
||||
function latestBlock() {
|
||||
return {
|
||||
hash: "0x" + "11".repeat(32),
|
||||
parentHash: "0x" + "22".repeat(32),
|
||||
number: hex(STUB_BLOCK_NUMBER),
|
||||
timestamp: hex(1767326645),
|
||||
nonce: "0x0000000000000000",
|
||||
difficulty: "0x0",
|
||||
gasLimit: "0x1c9c380",
|
||||
gasUsed: "0xf4240",
|
||||
miner: STUB_COUNTERPARTY,
|
||||
extraData: "0x",
|
||||
baseFeePerGas: hex(BASE_FEE_WEI),
|
||||
transactions: [],
|
||||
};
|
||||
}
|
||||
|
||||
// keccak("decimals()")[0:4].
|
||||
const SELECTOR_DECIMALS = "0x313ce567";
|
||||
|
||||
// Every eth_call still answers with a zero word except decimals() on the
|
||||
// stub token, which the wallet reads back at signing time to compare with
|
||||
// the scale the confirmation screen rendered (issue #305).
|
||||
//
|
||||
// opts.tokenDecimalsOverride is the lying contract: set it and decimals()
|
||||
// answers something other than the value this same fixture reports through
|
||||
// Blockscout, which is exactly the disagreement the wallet must refuse to
|
||||
// sign over. It is read at request time, so a test flips it on the options
|
||||
// object the route was registered with — after the confirmation screen has
|
||||
// been built — without re-registering anything.
|
||||
function ethCallResult(req, opts) {
|
||||
const call = Array.isArray(req.params) ? req.params[0] : null;
|
||||
if (!call || typeof call !== "object") return ZERO_WORD;
|
||||
const data = String(call.data || call.input || "").toLowerCase();
|
||||
const to = String(call.to || "").toLowerCase();
|
||||
if (data.startsWith(SELECTOR_DECIMALS) && to === STUB_TOKEN.address) {
|
||||
return word(opts.tokenDecimalsOverride || STUB_TOKEN.decimals);
|
||||
}
|
||||
return ZERO_WORD;
|
||||
}
|
||||
|
||||
function tokenObject() {
|
||||
return {
|
||||
address_hash: STUB_TOKEN.address,
|
||||
@@ -295,48 +92,12 @@ function tokenTransferItems(address) {
|
||||
];
|
||||
}
|
||||
|
||||
// One received native ETH transfer, in the shape src/shared/transactions.js
|
||||
// parses. to.is_contract is false and there is no method, so parseTx() keeps
|
||||
// it a plain transfer rather than a contract call — which is what makes the
|
||||
// detail screen classify it "Native ETH Transfer" and leave the token
|
||||
// contract row hidden.
|
||||
function nativeTransactionItems(address) {
|
||||
return [
|
||||
{
|
||||
hash: STUB_NATIVE_TX_HASH,
|
||||
block_number: STUB_NATIVE_BLOCK_NUMBER,
|
||||
timestamp: STUB_NATIVE_TX_TIMESTAMP,
|
||||
from: { hash: STUB_COUNTERPARTY },
|
||||
to: { hash: address, is_contract: false },
|
||||
value: STUB_NATIVE_VALUE_WEI,
|
||||
status: "ok",
|
||||
},
|
||||
];
|
||||
}
|
||||
|
||||
// A holding of 1.5 E2E, in the shape src/shared/balances.js parses. Serving
|
||||
// this is what puts an ERC-20 in the send screen's token dropdown, which is
|
||||
// the only way the confirmation screen's ERC-20 path can be reached.
|
||||
function tokenBalanceItems() {
|
||||
return [
|
||||
{
|
||||
value: "1500000",
|
||||
token: tokenObject(),
|
||||
},
|
||||
];
|
||||
}
|
||||
|
||||
// Full details for either seeded transaction — the detail screen fetches
|
||||
// them for whichever row was opened, and an unstubbed hash would be
|
||||
// reported as escaping traffic. raw_input is "0x" so the calldata decoder
|
||||
// short-circuits; the on-chain detail fields still populate.
|
||||
function transactionDetails(hash) {
|
||||
// Full details for STUB_TX_HASH. raw_input is "0x" so the calldata
|
||||
// decoder short-circuits; the on-chain detail fields still populate.
|
||||
function transactionDetails() {
|
||||
return {
|
||||
hash: hash,
|
||||
block_number:
|
||||
hash === STUB_NATIVE_TX_HASH
|
||||
? STUB_NATIVE_BLOCK_NUMBER
|
||||
: STUB_BLOCK_NUMBER,
|
||||
hash: STUB_TX_HASH,
|
||||
block_number: STUB_BLOCK_NUMBER,
|
||||
nonce: 7,
|
||||
gas_used: "51000",
|
||||
gas_price: "1000000000",
|
||||
@@ -346,38 +107,6 @@ function transactionDetails(hash) {
|
||||
};
|
||||
}
|
||||
|
||||
// The receipt for a transaction this run broadcast.
|
||||
//
|
||||
// eth_getTransactionReceipt otherwise answers null — "not mined yet", which is
|
||||
// what a node says about a transaction it has only just accepted, and what the
|
||||
// wait screen has to keep polling through. opts.seedReceipt confirms it
|
||||
// instead, which is how a test that drives the popup's own send to a broadcast
|
||||
// gets off the wait screen: the wait resolves to the success view, which has a
|
||||
// Done button, rather than polling for a receipt for the rest of the suite.
|
||||
//
|
||||
// Every field ethers' receipt formatter requires is present. A receipt it
|
||||
// cannot parse throws inside the poll, which the wallet reports through
|
||||
// log.errorf — i.e. console.error — and the harness fails the run on, so a
|
||||
// half-populated fixture here would surface as an unrelated-looking failure.
|
||||
function transactionReceipt(hash) {
|
||||
return {
|
||||
transactionHash: hash,
|
||||
transactionIndex: "0x0",
|
||||
blockHash: "0x" + "33".repeat(32),
|
||||
blockNumber: hex(STUB_BLOCK_NUMBER),
|
||||
from: STUB_COUNTERPARTY,
|
||||
to: STUB_TOKEN.address,
|
||||
cumulativeGasUsed: hex(GAS_LIMIT),
|
||||
gasUsed: hex(GAS_LIMIT),
|
||||
effectiveGasPrice: hex(GAS_PRICE_WEI),
|
||||
contractAddress: null,
|
||||
logs: [],
|
||||
logsBloom: "0x" + "00".repeat(256),
|
||||
status: "0x1",
|
||||
type: "0x2",
|
||||
};
|
||||
}
|
||||
|
||||
function jsonResponse(route, body) {
|
||||
return route.fulfill({
|
||||
status: 200,
|
||||
@@ -392,113 +121,7 @@ function blockscoutAddress(pathname) {
|
||||
return m ? m[1] : null;
|
||||
}
|
||||
|
||||
function sleep(ms) {
|
||||
return new Promise((resolve) => setTimeout(resolve, ms));
|
||||
}
|
||||
|
||||
// How long a deliberately held reply is allowed to stay held, and how often
|
||||
// the release flag is re-read while it is.
|
||||
const HOLD_POLL_MS = 25;
|
||||
const HOLD_MAX_MS = 30000;
|
||||
|
||||
// Hold a gas estimate open for as long as the test asks.
|
||||
//
|
||||
// opts.holdGasEstimate is read here rather than captured, so a test flips it
|
||||
// on the same options object the route was registered with — the same
|
||||
// pattern as seedTokenTransfer. This is the only way to observe the
|
||||
// confirmation screen while its estimate is genuinely in flight; sampling
|
||||
// the screen and hoping to win a race against the network would assert
|
||||
// nothing on a slow machine.
|
||||
//
|
||||
// It never gives up quietly. A hold that outlives the bound is reported like
|
||||
// any other harness fault, because a "pending" state that stopped being
|
||||
// pending on its own is a green assertion about the wrong screen.
|
||||
async function awaitRelease(opts, report) {
|
||||
const started = Date.now();
|
||||
while (opts.holdGasEstimate) {
|
||||
if (Date.now() - started > HOLD_MAX_MS) {
|
||||
report(
|
||||
"held gas estimate was never released after " +
|
||||
HOLD_MAX_MS +
|
||||
"ms",
|
||||
);
|
||||
return;
|
||||
}
|
||||
await sleep(HOLD_POLL_MS);
|
||||
}
|
||||
}
|
||||
|
||||
// One JSON-RPC reply. Methods whose answer depends on a fixture a test has
|
||||
// set, or on the call itself, are resolved here; every other method is a
|
||||
// constant in RPC_RESULTS.
|
||||
function rpcReply(req, opts, report) {
|
||||
const envelope = { jsonrpc: "2.0", id: req.id };
|
||||
|
||||
if (req.method === "eth_getBalance") {
|
||||
return Object.assign(envelope, {
|
||||
result: opts.ethBalanceWei || RPC_RESULTS.eth_getBalance,
|
||||
});
|
||||
}
|
||||
if (req.method === "eth_call") {
|
||||
return Object.assign(envelope, { result: ethCallResult(req, opts) });
|
||||
}
|
||||
if (req.method === "eth_getTransactionReceipt") {
|
||||
const hash = Array.isArray(req.params) ? req.params[0] : null;
|
||||
return Object.assign(envelope, {
|
||||
result: opts.seedReceipt && hash ? transactionReceipt(hash) : null,
|
||||
});
|
||||
}
|
||||
if (req.method === "eth_getBlockByNumber") {
|
||||
return Object.assign(envelope, { result: latestBlock() });
|
||||
}
|
||||
// The end of the dApp transaction round trip: the raw signed transaction
|
||||
// the background hands to the node. It is recorded verbatim so a test can
|
||||
// recover the signer from the exact bytes that were broadcast, rather than
|
||||
// from anything the extension reported about them.
|
||||
//
|
||||
// The reply must be the transaction's real hash. ethers compares the hash
|
||||
// the node returns against the one it computes itself and throws on a
|
||||
// mismatch, so a constant here would fail the broadcast for a reason that
|
||||
// has nothing to do with what is being tested.
|
||||
if (req.method === "eth_sendRawTransaction") {
|
||||
const raw = Array.isArray(req.params) ? req.params[0] : null;
|
||||
let parsed;
|
||||
try {
|
||||
parsed = Transaction.from(raw);
|
||||
} catch {
|
||||
report("eth_sendRawTransaction with an undecodable transaction");
|
||||
return Object.assign(envelope, {
|
||||
error: { code: -32000, message: "undecodable transaction" },
|
||||
});
|
||||
}
|
||||
if (Array.isArray(opts.broadcastTransactions)) {
|
||||
opts.broadcastTransactions.push(raw);
|
||||
}
|
||||
return Object.assign(envelope, { result: parsed.hash });
|
||||
}
|
||||
if (req.method === "eth_estimateGas" && opts.failGasEstimate) {
|
||||
// A refusal the node itself would produce, not a transport error:
|
||||
// this is the shape the confirmation screen has to turn into
|
||||
// "Unable to estimate" rather than into a fee of zero.
|
||||
return Object.assign(envelope, {
|
||||
error: {
|
||||
code: -32000,
|
||||
message: "e2e fixture: gas required exceeds allowance",
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
const result = RPC_RESULTS[req.method];
|
||||
if (result === undefined) {
|
||||
report("unstubbed RPC method: " + req.method);
|
||||
return Object.assign(envelope, {
|
||||
error: { code: -32601, message: "unstubbed in e2e harness" },
|
||||
});
|
||||
}
|
||||
return Object.assign(envelope, { result });
|
||||
}
|
||||
|
||||
async function handleRpc(route, postData, opts, report) {
|
||||
function handleRpc(route, postData, report) {
|
||||
let payload;
|
||||
try {
|
||||
payload = JSON.parse(postData || "null");
|
||||
@@ -509,36 +132,34 @@ async function handleRpc(route, postData, opts, report) {
|
||||
// ethers batches by default, so the body may be an array.
|
||||
const batch = Array.isArray(payload) ? payload : [payload];
|
||||
|
||||
// Anything that is not a JSON-RPC object, or a NON-EMPTY batch of
|
||||
// them, is not RPC at all and must be reported like any other
|
||||
// unrecognised outbound traffic rather than dereferenced.
|
||||
//
|
||||
// The length check is not decoration: every() is vacuously true on an
|
||||
// empty array, so without it a POST with body [] was answered 200 []
|
||||
// and escaped the guard entirely (issue #187). No real batch is empty,
|
||||
// so nothing legitimate is caught by it.
|
||||
//
|
||||
// Two distinct paths land a non-RPC body here, and neither is an
|
||||
// empty-string special case. playwright-core's postData() is
|
||||
// `buffer.toString("utf-8") || null`, so an absent or empty body
|
||||
// decodes to null, JSON.parse("null") yields null, and the type guard
|
||||
// below reports it. A binary body is instead decoded LOSSILY into
|
||||
// mojibake — not null — which is not valid JSON, so the catch above
|
||||
// reports that one. Both end up reported; only the route differs.
|
||||
// Anything that is not a JSON-RPC object, or a batch of them, is not
|
||||
// RPC at all and must be reported like any other unrecognised
|
||||
// outbound traffic rather than dereferenced. request.postData()
|
||||
// returns null both for a bodyless POST and for a body Playwright
|
||||
// cannot decode as UTF-8 (sendBeacon with a Blob, or any binary
|
||||
// payload), so this is not an empty-string special case: it rejects
|
||||
// every non-object payload, exactly as the catch above rejects every
|
||||
// unparseable one.
|
||||
if (
|
||||
payload === null ||
|
||||
typeof payload !== "object" ||
|
||||
batch.length === 0 ||
|
||||
!batch.every((req) => req !== null && typeof req === "object")
|
||||
) {
|
||||
report("unstubbed request: POST " + route.request().url());
|
||||
return route.abort();
|
||||
}
|
||||
if (batch.some((req) => req.method === "eth_estimateGas")) {
|
||||
await awaitRelease(opts, report);
|
||||
}
|
||||
|
||||
const replies = batch.map((req) => rpcReply(req, opts, report));
|
||||
const replies = batch.map((req) => {
|
||||
const result = RPC_RESULTS[req.method];
|
||||
if (result === undefined) {
|
||||
report("unstubbed RPC method: " + req.method);
|
||||
return {
|
||||
jsonrpc: "2.0",
|
||||
id: req.id,
|
||||
error: { code: -32601, message: "unstubbed in e2e harness" },
|
||||
};
|
||||
}
|
||||
return { jsonrpc: "2.0", id: req.id, result };
|
||||
});
|
||||
return jsonResponse(route, Array.isArray(payload) ? replies : replies[0]);
|
||||
}
|
||||
|
||||
@@ -578,26 +199,6 @@ function traceEnabled(raw) {
|
||||
* @param {boolean} [opts.seedTokenTransfer] serve the stubbed ERC-20
|
||||
* transfer. Read at request time, so a test can flip it on the same
|
||||
* options object without re-registering the route.
|
||||
* @param {boolean} [opts.seedNativeTransfer] serve the stubbed native ETH
|
||||
* transfer, read at request time like seedTokenTransfer. Without it the
|
||||
* normal-transactions endpoint answers with an empty list, so there is no
|
||||
* non-ERC-20 row to open.
|
||||
* @param {boolean} [opts.seedTokenBalance] serve the stubbed ERC-20
|
||||
* holding, which is what makes the token reachable from the send screen.
|
||||
* @param {string} [opts.ethBalanceWei] hex wei answered to eth_getBalance;
|
||||
* defaults to zero, which is what every test that predates the funded
|
||||
* fixture expects.
|
||||
* @param {boolean} [opts.failGasEstimate] answer eth_estimateGas with a
|
||||
* node-side refusal.
|
||||
* @param {boolean} [opts.holdGasEstimate] hold every batch containing an
|
||||
* eth_estimateGas until this is cleared again.
|
||||
* @param {string[]} [opts.broadcastTransactions] every raw signed
|
||||
* transaction handed to eth_sendRawTransaction, appended in order.
|
||||
* @param {string} [opts.tokenDecimalsOverride] what decimals() answers for
|
||||
* the stub token, in place of the value Blockscout reports for it. This is
|
||||
* the token that lies about its scale; read at request time.
|
||||
* @param {boolean} [opts.seedReceipt] answer eth_getTransactionReceipt with a
|
||||
* confirmed receipt instead of null, so a wait screen resolves.
|
||||
* @returns {Promise<{waitForServiceWorkerTraffic: (ms: number) =>
|
||||
* Promise<string|null>}>}
|
||||
*/
|
||||
@@ -613,9 +214,10 @@ async function installNetworkStubs(ctx, opts) {
|
||||
// E2E_TRACE_NETWORK=1 prints every request that reaches this handler,
|
||||
// tagged [sw] when it originated in the background service worker.
|
||||
// It exists so the isolation claim above can be re-checked by anyone
|
||||
// in one command, without editing files: the canary probe and then
|
||||
// every JSON-RPC call behind an approval showing up with an [sw] tag
|
||||
// is the proof that the worker really is intercepted.
|
||||
// in one command, without editing files: the phishing blocklist fetch
|
||||
// showing up with an [sw] tag is the proof that the worker really is
|
||||
// intercepted and that the raw.githubusercontent.com stub below is
|
||||
// live code rather than decoration.
|
||||
const trace = traceEnabled(process.env.E2E_TRACE_NETWORK);
|
||||
|
||||
// Regex rather than a glob so chrome-extension:// resource loads are
|
||||
@@ -639,35 +241,13 @@ async function installNetworkStubs(ctx, opts) {
|
||||
|
||||
// JSON-RPC endpoint (any host): a POST with a JSON-RPC body.
|
||||
if (req.method() === "POST") {
|
||||
return handleRpc(route, req.postData(), opts, report);
|
||||
}
|
||||
|
||||
// The local EIP-1193 test page. Served from here so the dApp round
|
||||
// trips run against a real http(s) origin — which is what makes the
|
||||
// shipped content scripts inject at all — without any remote origin
|
||||
// being involved.
|
||||
if (
|
||||
(url.origin === DAPP_ORIGIN ||
|
||||
url.origin === PHISHING_DAPP_ORIGIN) &&
|
||||
p === "/"
|
||||
) {
|
||||
return route.fulfill({
|
||||
status: 200,
|
||||
contentType: "text/html; charset=utf-8",
|
||||
body: DAPP_HTML,
|
||||
});
|
||||
return handleRpc(route, req.postData(), report);
|
||||
}
|
||||
|
||||
// Blockscout v2
|
||||
if (p.includes("/api/v2/")) {
|
||||
if (/\/addresses\/0x[0-9a-fA-F]{40}\/transactions$/.test(p)) {
|
||||
const addr = blockscoutAddress(p);
|
||||
return jsonResponse(route, {
|
||||
items:
|
||||
opts.seedNativeTransfer && addr
|
||||
? nativeTransactionItems(addr)
|
||||
: [],
|
||||
});
|
||||
return jsonResponse(route, { items: [] });
|
||||
}
|
||||
if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-transfers$/.test(p)) {
|
||||
const addr = blockscoutAddress(p);
|
||||
@@ -679,15 +259,10 @@ async function installNetworkStubs(ctx, opts) {
|
||||
});
|
||||
}
|
||||
if (/\/addresses\/0x[0-9a-fA-F]{40}\/token-balances$/.test(p)) {
|
||||
return jsonResponse(
|
||||
route,
|
||||
opts.seedTokenBalance ? tokenBalanceItems() : [],
|
||||
);
|
||||
return jsonResponse(route, []);
|
||||
}
|
||||
for (const hash of [STUB_TX_HASH, STUB_NATIVE_TX_HASH]) {
|
||||
if (p.endsWith("/transactions/" + hash)) {
|
||||
return jsonResponse(route, transactionDetails(hash));
|
||||
}
|
||||
if (p.endsWith("/transactions/" + STUB_TX_HASH)) {
|
||||
return jsonResponse(route, transactionDetails());
|
||||
}
|
||||
}
|
||||
|
||||
@@ -696,10 +271,18 @@ async function installNetworkStubs(ctx, opts) {
|
||||
return jsonResponse(route, { Data: {} });
|
||||
}
|
||||
|
||||
// The interception canary's own request. Answered with nothing: what
|
||||
// is being observed is that it arrived here at all.
|
||||
if (url.href === WORKER_PROBE_URL) {
|
||||
return route.fulfill({ status: 204, body: "" });
|
||||
// MetaMask phishing blocklist
|
||||
if (
|
||||
url.hostname === "raw.githubusercontent.com" ||
|
||||
p.endsWith("/eth-phishing-detect/main/src/config.json")
|
||||
) {
|
||||
return jsonResponse(route, {
|
||||
version: 2,
|
||||
tolerance: 2,
|
||||
fuzzylist: [],
|
||||
whitelist: [],
|
||||
blacklist: [],
|
||||
});
|
||||
}
|
||||
|
||||
// Best-effort Etherscan address labels: served as an empty page.
|
||||
@@ -720,12 +303,12 @@ async function installNetworkStubs(ctx, opts) {
|
||||
* Resolve with the first service-worker-originated request this
|
||||
* handler saw, or null if none arrives within `ms`.
|
||||
*
|
||||
* The caller asks the worker for one request of its own (see
|
||||
* WORKER_PROBE_URL) and then waits here, so under working
|
||||
* interception this resolves almost immediately. Nothing arriving
|
||||
* means worker traffic is bypassing the handler entirely and going
|
||||
* to the real internet, which the caller turns into a hard failure
|
||||
* of the whole suite.
|
||||
* The background worker fetches the phishing blocklist at
|
||||
* startup, unconditionally, within about a second of the context
|
||||
* coming up — so under working interception this resolves almost
|
||||
* immediately. Nothing arriving means worker traffic is bypassing
|
||||
* the handler entirely and going to the real internet, which the
|
||||
* caller turns into a hard failure of the whole suite.
|
||||
*/
|
||||
waitForServiceWorkerTraffic(ms) {
|
||||
if (firstWorkerRequest) return Promise.resolve(firstWorkerRequest);
|
||||
@@ -746,17 +329,6 @@ async function installNetworkStubs(ctx, opts) {
|
||||
|
||||
module.exports = {
|
||||
installNetworkStubs,
|
||||
DAPP_HTML,
|
||||
DAPP_ORIGIN,
|
||||
DAPP_URL,
|
||||
PHISHING_DAPP_ORIGIN,
|
||||
PHISHING_DAPP_URL,
|
||||
WORKER_PROBE_URL,
|
||||
FEE_ESTIMATE_WEI,
|
||||
FEE_RESERVE_WEI,
|
||||
STUB_COUNTERPARTY,
|
||||
STUB_NATIVE_TX_HASH,
|
||||
STUB_NATIVE_VALUE_WEI,
|
||||
STUB_TOKEN,
|
||||
STUB_TX_HASH,
|
||||
};
|
||||
|
||||
2837
tests/e2e/run.js
2837
tests/e2e/run.js
File diff suppressed because it is too large
Load Diff
@@ -247,7 +247,7 @@ describe("a reveal that is not interrupted", () => {
|
||||
|
||||
expect(node("export-privkey-value").textContent).toBe("");
|
||||
expect(node("export-privkey-flash").textContent).toBe(
|
||||
"That password is incorrect. Please try again.",
|
||||
"That password is not correct. Please try again.",
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,310 +0,0 @@
|
||||
// The EIP-1193 error the page actually catches (src/content/inpage.js).
|
||||
//
|
||||
// The bug this pins down (issue #274): the provider rebuilt every failure as
|
||||
// `new Error(error.message)`, so the `code` the background produced and the
|
||||
// content script relayed intact was thrown away in the last hop. A dApp
|
||||
// checking `err.code === 4001` — the standard way to tell "the user said no"
|
||||
// from "the wallet broke" — saw undefined, and well-behaved sites showed an
|
||||
// error or retried instead of accepting the refusal.
|
||||
//
|
||||
// inpage.js is a bare IIFE injected into the page's JS context, not a module:
|
||||
// it takes no import and exports nothing, and reaches for `window` at load.
|
||||
// So it is evaluated here the way the browser evaluates it, against a stub
|
||||
// window, and the provider is collected from `window.ethereum`. The globals it
|
||||
// touches are passed in as function parameters rather than assigned to
|
||||
// globalThis: nothing leaks between tests, and the source is compiled in this
|
||||
// realm, so the errors it constructs are comparable against this file's own
|
||||
// `Error` — which a second realm's intrinsics would silently defeat.
|
||||
//
|
||||
// There is no jsdom in this repo; see tests/txStatus.test.js.
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
const { webcrypto } = require("crypto");
|
||||
|
||||
const SOURCE = fs.readFileSync(
|
||||
path.join(__dirname, "..", "src", "content", "inpage.js"),
|
||||
"utf8",
|
||||
);
|
||||
|
||||
const loadInto = new Function(
|
||||
"window",
|
||||
"self",
|
||||
"crypto",
|
||||
"Event",
|
||||
"CustomEvent",
|
||||
SOURCE,
|
||||
);
|
||||
|
||||
class StubEvent {
|
||||
constructor(type) {
|
||||
this.type = type;
|
||||
}
|
||||
}
|
||||
|
||||
class StubCustomEvent extends StubEvent {
|
||||
constructor(type, init) {
|
||||
super(type);
|
||||
this.detail = init && init.detail;
|
||||
}
|
||||
}
|
||||
|
||||
// Every code the background emits on the RPC path today, read out of
|
||||
// src/background/index.js. The provider must not know this list — it passes
|
||||
// through whatever arrived — but the cases below are the real ones.
|
||||
const REJECTED = 4001; // user rejected the request
|
||||
const UNAUTHORIZED = 4100; // site not connected / wrong address
|
||||
const UNRECOGNIZED_CHAIN = 4902; // switch/add to an unsupported chain
|
||||
|
||||
// A stub window with the four things inpage.js touches: message listeners,
|
||||
// postMessage out to the content script, window.ethereum, and dispatchEvent
|
||||
// for the EIP-6963 announcement.
|
||||
function loadProvider() {
|
||||
const messageListeners = [];
|
||||
const posted = [];
|
||||
|
||||
const win = {
|
||||
addEventListener(type, fn) {
|
||||
if (type === "message") messageListeners.push(fn);
|
||||
},
|
||||
removeEventListener(type, fn) {
|
||||
const i = messageListeners.indexOf(fn);
|
||||
if (type === "message" && i !== -1) messageListeners.splice(i, 1);
|
||||
},
|
||||
postMessage(data) {
|
||||
posted.push(data);
|
||||
},
|
||||
dispatchEvent() {
|
||||
return true;
|
||||
},
|
||||
};
|
||||
win.window = win;
|
||||
|
||||
loadInto(win, win, webcrypto, StubEvent, StubCustomEvent);
|
||||
|
||||
// Deliver the content script's answer to an outstanding request. The id is
|
||||
// read back off the wire rather than assumed: inpage.js issues its own
|
||||
// eth_chainId at load, so the first id a test sees is not 1.
|
||||
function respond(response) {
|
||||
const request = posted
|
||||
.filter((m) => m.type === "AUTISTMASK_REQUEST")
|
||||
.pop();
|
||||
expect(request).toBeDefined();
|
||||
const event = {
|
||||
source: win,
|
||||
data: { type: "AUTISTMASK_RESPONSE", id: request.id, ...response },
|
||||
};
|
||||
for (const fn of messageListeners.slice()) fn(event);
|
||||
}
|
||||
|
||||
return { provider: win.ethereum, posted, respond };
|
||||
}
|
||||
|
||||
// Start a request, answer it with `response`, and hand back the rejection.
|
||||
// Fails the test if the call resolves instead.
|
||||
async function rejectionFrom(start, response) {
|
||||
const { provider, respond } = loadProvider();
|
||||
const settled = start(provider).then(
|
||||
(result) => ({ resolved: result }),
|
||||
(error) => ({ error }),
|
||||
);
|
||||
// The provider posts synchronously, so the request is already on the wire.
|
||||
respond(response);
|
||||
const outcome = await settled;
|
||||
expect(outcome).not.toHaveProperty("resolved");
|
||||
return outcome.error;
|
||||
}
|
||||
|
||||
describe("an EIP-1193 code reaches the page", () => {
|
||||
test("a user rejection arrives as code 4001", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
expect(err.message).toBe("User rejected the request.");
|
||||
});
|
||||
|
||||
test("it is a ProviderRpcError, and an Error", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err).toBeInstanceOf(Error);
|
||||
expect(err.name).toBe("ProviderRpcError");
|
||||
});
|
||||
|
||||
test("4100 unauthorized arrives intact", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "personal_sign", params: ["0x00"] }),
|
||||
{ error: { code: UNAUTHORIZED, message: "Unauthorized" } },
|
||||
);
|
||||
expect(err.code).toBe(UNAUTHORIZED);
|
||||
expect(err.message).toBe("Unauthorized");
|
||||
});
|
||||
|
||||
test("4902 unrecognized chain arrives intact", async () => {
|
||||
const message =
|
||||
"AutistMask supports Ethereum Mainnet and Sepolia Testnet only.";
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "wallet_switchEthereumChain" }),
|
||||
{ error: { code: UNRECOGNIZED_CHAIN, message } },
|
||||
);
|
||||
expect(err.code).toBe(UNRECOGNIZED_CHAIN);
|
||||
expect(err.message).toBe(message);
|
||||
});
|
||||
|
||||
// The provider is not allowed to know the list above: a code added to the
|
||||
// background later must reach the page without this file being edited.
|
||||
test("a code the provider has never heard of is passed through", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_accounts" }),
|
||||
{ error: { code: 4900, message: "Disconnected" } },
|
||||
);
|
||||
expect(err.code).toBe(4900);
|
||||
});
|
||||
|
||||
test("data is carried when the boundary sent it", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_call" }),
|
||||
{
|
||||
error: {
|
||||
code: -32000,
|
||||
message: "execution reverted",
|
||||
data: "0x08c379a0",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect(err.code).toBe(-32000);
|
||||
expect(err.data).toBe("0x08c379a0");
|
||||
});
|
||||
|
||||
test("no data property is invented when the boundary sent none", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
{
|
||||
error: {
|
||||
code: REJECTED,
|
||||
message: "User rejected the request.",
|
||||
},
|
||||
},
|
||||
);
|
||||
expect("data" in err).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("the message is untouched", () => {
|
||||
test("a coded error keeps the message byte for byte", async () => {
|
||||
const message =
|
||||
"This site asked to sign as an address that is not " +
|
||||
"the active one.";
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "personal_sign" }),
|
||||
{ error: { code: UNAUTHORIZED, message } },
|
||||
);
|
||||
expect(err.message).toBe(message);
|
||||
});
|
||||
|
||||
test("an error the background sent with no code keeps its message", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { message: "No accounts available" } },
|
||||
);
|
||||
expect(err.message).toBe("No accounts available");
|
||||
});
|
||||
|
||||
// A ProviderRpcError whose code is undefined would claim a conformance it
|
||||
// does not have, and `'code' in err` is exactly what a careful dApp asks.
|
||||
test("an error with no code gets no code property at all", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { message: "No accounts available" } },
|
||||
);
|
||||
expect(err).toBeInstanceOf(Error);
|
||||
expect("code" in err).toBe(false);
|
||||
});
|
||||
|
||||
test("an error with no message keeps the generic fallback", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_sendTransaction" }),
|
||||
{ error: { code: REJECTED } },
|
||||
);
|
||||
expect(err.message).toBe("Request failed");
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
});
|
||||
|
||||
// Every entry point the provider exposes, not just eth_requestAccounts. They
|
||||
// all funnel through the same response listener, and this is what says so.
|
||||
describe("every request path carries the code", () => {
|
||||
const rejection = {
|
||||
error: { code: REJECTED, message: "User rejected the request." },
|
||||
};
|
||||
|
||||
test("request()", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.request({ method: "eth_requestAccounts" }),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("enable()", async () => {
|
||||
const err = await rejectionFrom((p) => p.enable(), rejection);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("send(method, params)", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.send("eth_requestAccounts", []),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("send({ method, params })", async () => {
|
||||
const err = await rejectionFrom(
|
||||
(p) => p.send({ method: "personal_sign", params: ["0x00"] }),
|
||||
rejection,
|
||||
);
|
||||
expect(err.code).toBe(REJECTED);
|
||||
});
|
||||
|
||||
test("sendAsync() hands the code to its callback", async () => {
|
||||
const { provider, respond } = loadProvider();
|
||||
const called = new Promise((resolve) => {
|
||||
provider.sendAsync({ id: 1, method: "eth_requestAccounts" }, (e) =>
|
||||
resolve(e),
|
||||
);
|
||||
});
|
||||
respond(rejection);
|
||||
const err = await called;
|
||||
expect(err.name).toBe("ProviderRpcError");
|
||||
expect(err.code).toBe(REJECTED);
|
||||
expect(err.message).toBe("User rejected the request.");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the success path is unchanged", () => {
|
||||
test("a result still resolves", async () => {
|
||||
const { provider, respond } = loadProvider();
|
||||
const settled = provider.request({ method: "eth_requestAccounts" });
|
||||
respond({ result: ["0xb61264DEFB0c4B8afb3D73724be15310036743a5"] });
|
||||
await expect(settled).resolves.toEqual([
|
||||
"0xb61264DEFB0c4B8afb3D73724be15310036743a5",
|
||||
]);
|
||||
expect(provider.selectedAddress).toBe(
|
||||
"0xb61264DEFB0c4B8afb3D73724be15310036743a5",
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -1,192 +0,0 @@
|
||||
// What a chain switch is allowed to do to the endpoints the user configured.
|
||||
//
|
||||
// A switch used to overwrite state.rpcUrl and state.blockscoutUrl with the
|
||||
// network defaults, so a user pointing the wallet at their own node lost that
|
||||
// url the first time anything switched chains — with no notification and no
|
||||
// way to recover it, having been moved onto a public endpoint that then sees
|
||||
// every address they hold (https://git.eeqj.de/sneak/AutistMask/issues/308).
|
||||
// Endpoints are now remembered per network, which is why the round trips
|
||||
// below assert the ORIGINAL url comes back rather than only that the switch
|
||||
// happened.
|
||||
|
||||
const { networkById } = require("../src/shared/networks");
|
||||
|
||||
const ADDRESS = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
|
||||
const MAINNET = networkById("mainnet");
|
||||
const SEPOLIA = networkById("sepolia");
|
||||
|
||||
// The user's own node: the pair the switch used to throw away.
|
||||
const CUSTOM_RPC = "http://127.0.0.1:8545";
|
||||
const CUSTOM_BLOCKSCOUT = "http://127.0.0.1:4000/api/v2";
|
||||
|
||||
function walletFixture() {
|
||||
return [
|
||||
{
|
||||
name: "Wallet 1",
|
||||
type: "hd",
|
||||
addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
|
||||
},
|
||||
];
|
||||
}
|
||||
|
||||
// The real state module against stubbed storage, plus whatever the last
|
||||
// saveState() wrote — so a case can reload a fresh module from the bytes an
|
||||
// earlier one persisted, which is what an extension restart does. `state` is
|
||||
// a module-level singleton, so the registry has to be reset per load.
|
||||
function loadModuleWith(persisted) {
|
||||
jest.resetModules();
|
||||
let written = null;
|
||||
global.chrome = {
|
||||
storage: {
|
||||
local: {
|
||||
get: jest.fn(async () =>
|
||||
persisted ? { autistmask: persisted } : {},
|
||||
),
|
||||
set: jest.fn(async (items) => {
|
||||
written = items.autistmask;
|
||||
}),
|
||||
},
|
||||
},
|
||||
};
|
||||
return {
|
||||
mod: require("../src/shared/state"),
|
||||
chainSwitch: require("../src/shared/chainSwitch"),
|
||||
written: () => written,
|
||||
};
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
delete global.chrome;
|
||||
});
|
||||
|
||||
describe("a custom endpoint survives a chain switch", () => {
|
||||
test("switching away and back restores the user's rpc and blockscout urls", async () => {
|
||||
const { mod, chainSwitch } = loadModuleWith({
|
||||
wallets: walletFixture(),
|
||||
networkId: "mainnet",
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: CUSTOM_BLOCKSCOUT,
|
||||
networkEndpoints: {
|
||||
mainnet: {
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: CUSTOM_BLOCKSCOUT,
|
||||
},
|
||||
},
|
||||
});
|
||||
await mod.loadState();
|
||||
|
||||
await chainSwitch.onChainSwitch("sepolia");
|
||||
// The new chain gets its own endpoints, not the ones belonging to the
|
||||
// chain just left: a mainnet node cannot answer for Sepolia.
|
||||
expect(mod.state.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
|
||||
expect(mod.state.blockscoutUrl).toBe(SEPOLIA.defaultBlockscoutUrl);
|
||||
|
||||
await chainSwitch.onChainSwitch("mainnet");
|
||||
expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
|
||||
expect(mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
|
||||
});
|
||||
|
||||
test("an endpoint set on the network being left is remembered, not lost", async () => {
|
||||
const { mod, chainSwitch } = loadModuleWith({
|
||||
wallets: walletFixture(),
|
||||
networkId: "sepolia",
|
||||
rpcUrl: SEPOLIA.defaultRpcUrl,
|
||||
blockscoutUrl: SEPOLIA.defaultBlockscoutUrl,
|
||||
networkEndpoints: {},
|
||||
});
|
||||
await mod.loadState();
|
||||
|
||||
// What the Settings screen does: write the live field, then save. The
|
||||
// map entry for the active network is stale until the switch, which
|
||||
// is what snapshotting the outgoing network exists to reconcile.
|
||||
mod.state.rpcUrl = CUSTOM_RPC;
|
||||
await mod.saveState();
|
||||
|
||||
await chainSwitch.onChainSwitch("mainnet");
|
||||
expect(mod.state.rpcUrl).toBe(MAINNET.defaultRpcUrl);
|
||||
|
||||
await chainSwitch.onChainSwitch("sepolia");
|
||||
expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
|
||||
});
|
||||
|
||||
test("the remembered endpoints survive an extension restart", async () => {
|
||||
const first = loadModuleWith({
|
||||
wallets: walletFixture(),
|
||||
networkId: "mainnet",
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: CUSTOM_BLOCKSCOUT,
|
||||
});
|
||||
await first.mod.loadState();
|
||||
await first.chainSwitch.onChainSwitch("sepolia");
|
||||
|
||||
// Reload from exactly the bytes the switch persisted.
|
||||
const second = loadModuleWith(first.written());
|
||||
await second.mod.loadState();
|
||||
expect(second.mod.state.networkId).toBe("sepolia");
|
||||
expect(second.mod.state.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
|
||||
|
||||
await second.chainSwitch.onChainSwitch("mainnet");
|
||||
expect(second.mod.state.rpcUrl).toBe(CUSTOM_RPC);
|
||||
expect(second.mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
|
||||
});
|
||||
|
||||
test("a profile written before networkEndpoints existed keeps its endpoint", async () => {
|
||||
// Exactly the stored shape the current release writes: one pair of
|
||||
// urls and no map. It is adopted as the remembered pair of the
|
||||
// network it was stored under.
|
||||
const { mod, chainSwitch } = loadModuleWith({
|
||||
wallets: walletFixture(),
|
||||
networkId: "mainnet",
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: CUSTOM_BLOCKSCOUT,
|
||||
});
|
||||
await mod.loadState();
|
||||
|
||||
expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
|
||||
expect(mod.state.networkEndpoints).toEqual({
|
||||
mainnet: { rpcUrl: CUSTOM_RPC, blockscoutUrl: CUSTOM_BLOCKSCOUT },
|
||||
});
|
||||
|
||||
await chainSwitch.onChainSwitch("sepolia");
|
||||
await chainSwitch.onChainSwitch("mainnet");
|
||||
expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
|
||||
expect(mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
|
||||
});
|
||||
|
||||
// A primitive is the dangerous case, not the array: assigning a property
|
||||
// to a string throws nothing and stores nothing, so a stored string would
|
||||
// be carried through loadState() and re-persisted by every save, and each
|
||||
// switch would fall back to the public default in place of the user's
|
||||
// endpoint, permanently.
|
||||
test.each([
|
||||
["an array", ["not", "a", "map"]],
|
||||
["a string", "junk"],
|
||||
["a number", 7],
|
||||
])("a stored networkEndpoints that is %s is discarded", async (_, bad) => {
|
||||
const { mod, chainSwitch } = loadModuleWith({
|
||||
wallets: walletFixture(),
|
||||
networkId: "mainnet",
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: CUSTOM_BLOCKSCOUT,
|
||||
networkEndpoints: bad,
|
||||
});
|
||||
await mod.loadState();
|
||||
|
||||
// Discarded, then seeded from the live endpoints the same way an old
|
||||
// profile is — never left as something onChainSwitch() would index.
|
||||
expect(mod.state.networkEndpoints).toEqual({
|
||||
mainnet: {
|
||||
rpcUrl: CUSTOM_RPC,
|
||||
blockscoutUrl: CUSTOM_BLOCKSCOUT,
|
||||
},
|
||||
});
|
||||
|
||||
// And the endpoint really survives the round trip, which is the point
|
||||
// of discarding it rather than only of the shape being right.
|
||||
await chainSwitch.onChainSwitch("sepolia");
|
||||
await chainSwitch.onChainSwitch("mainnet");
|
||||
expect(mod.state.rpcUrl).toBe(CUSTOM_RPC);
|
||||
expect(mod.state.blockscoutUrl).toBe(CUSTOM_BLOCKSCOUT);
|
||||
});
|
||||
});
|
||||
@@ -1,299 +0,0 @@
|
||||
// One wording for one condition (issues #172 and #265).
|
||||
//
|
||||
// Every screen that asks for the password decrypts the vault itself, and
|
||||
// each one used to write its own sentence for the same failure: the send
|
||||
// confirmation and the delete-wallet confirmation said "Wrong password."
|
||||
// (a fragment, which RULES.md Language & Labeling forbids), the reveal
|
||||
// screens said "That password is not correct.", and the two dApp approval
|
||||
// paths said "That password is incorrect." A user hitting two of those
|
||||
// minutes apart had no way to tell whether the wallet meant the same
|
||||
// thing.
|
||||
//
|
||||
// This scans the source rather than driving six views, because the
|
||||
// invariant is about the set of call sites and not about any one of them:
|
||||
// a seventh screen that decrypts the vault has to join the set, and a
|
||||
// DOM test per view cannot notice one that was never written.
|
||||
//
|
||||
// The assertions are per CALL SITE, not per file. approval.js decrypts in
|
||||
// two places and is where the divergence came from; a per-file check that
|
||||
// only asks whether the canonical sentence appears somewhere in the file
|
||||
// passes while one of those two says something else entirely. So each
|
||||
// call site is read back to its own catch handler and the prose that
|
||||
// handler shows the user must be the canonical sentence and nothing else
|
||||
// — which fails on a novel wording, not only on a known-superseded one.
|
||||
//
|
||||
// The empty-password condition (#265) is pinned the same way and off the
|
||||
// same call sites: the private key export screen said "Password is
|
||||
// required." where the other five said "Please enter your password." Each
|
||||
// decrypt's password variable is walked back to the guard that rejects it
|
||||
// when blank, and the prose that guard shows must be the canonical
|
||||
// sentence. Anchoring on the decrypt keeps the wallet-creation screen out
|
||||
// of the set: an empty field there is a password being CHOSEN, a
|
||||
// different condition with its own wording.
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const SRC = path.join(__dirname, "..", "src");
|
||||
|
||||
const CANONICAL = "That password is incorrect. Please try again.";
|
||||
const CANONICAL_EMPTY = "Please enter your password.";
|
||||
|
||||
// Wordings this repo has actually shipped for the same condition. This is
|
||||
// a secondary, whole-file sweep for stragglers outside a decrypt handler;
|
||||
// divergence at a call site is caught by the exact-match assertion, which
|
||||
// needs no list of phrasings to guess at.
|
||||
const SUPERSEDED = [
|
||||
"Wrong password.",
|
||||
"That password is not correct. Please try again.",
|
||||
"Password is required.",
|
||||
];
|
||||
|
||||
function jsFilesUnder(dir) {
|
||||
return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
|
||||
const full = path.join(dir, entry.name);
|
||||
if (entry.isDirectory()) return jsFilesUnder(full);
|
||||
return entry.name.endsWith(".js") ? [full] : [];
|
||||
});
|
||||
}
|
||||
|
||||
// Blank out the interior of every comment and string literal, keeping the
|
||||
// offsets and line breaks, so braces can be counted without a quote or a
|
||||
// commented-out block throwing the count off. The literals are returned
|
||||
// alongside with the offset of their opening quote, which is how a
|
||||
// message is later attributed to the handler it sits in.
|
||||
function scan(source) {
|
||||
const masked = source.split("");
|
||||
const strings = [];
|
||||
const blank = (from, to) => {
|
||||
for (let k = from; k < to; k++) if (masked[k] !== "\n") masked[k] = " ";
|
||||
};
|
||||
let i = 0;
|
||||
while (i < source.length) {
|
||||
const two = source.slice(i, i + 2);
|
||||
if (two === "//") {
|
||||
const nl = source.indexOf("\n", i);
|
||||
const stop = nl === -1 ? source.length : nl;
|
||||
blank(i, stop);
|
||||
i = stop;
|
||||
} else if (two === "/*") {
|
||||
const close = source.indexOf("*/", i + 2);
|
||||
const stop = close === -1 ? source.length : close + 2;
|
||||
blank(i, stop);
|
||||
i = stop;
|
||||
} else if (
|
||||
source[i] === '"' ||
|
||||
source[i] === "'" ||
|
||||
source[i] === "`"
|
||||
) {
|
||||
const quote = source[i];
|
||||
let j = i + 1;
|
||||
let value = "";
|
||||
while (j < source.length && source[j] !== quote) {
|
||||
if (source[j] === "\\") {
|
||||
value += source[j + 1];
|
||||
j += 2;
|
||||
continue;
|
||||
}
|
||||
value += source[j];
|
||||
j += 1;
|
||||
}
|
||||
blank(i + 1, j);
|
||||
strings.push({ offset: i, value });
|
||||
i = j + 1;
|
||||
} else {
|
||||
i += 1;
|
||||
}
|
||||
}
|
||||
return { masked: masked.join(""), strings };
|
||||
}
|
||||
|
||||
// Offset of the `{` that opens the block containing `at`, or -1.
|
||||
function enclosingBlockStart(masked, at) {
|
||||
let depth = 0;
|
||||
for (let i = at; i >= 0; i--) {
|
||||
if (masked[i] === "}") depth += 1;
|
||||
else if (masked[i] === "{") {
|
||||
if (depth === 0) return i;
|
||||
depth -= 1;
|
||||
}
|
||||
}
|
||||
return -1;
|
||||
}
|
||||
|
||||
// Offset just past the `}` matching the `{` at `open`.
|
||||
function blockEnd(masked, open) {
|
||||
let depth = 0;
|
||||
for (let i = open; i < masked.length; i++) {
|
||||
if (masked[i] === "{") depth += 1;
|
||||
else if (masked[i] === "}") {
|
||||
depth -= 1;
|
||||
if (depth === 0) return i + 1;
|
||||
}
|
||||
}
|
||||
throw new Error("unterminated block");
|
||||
}
|
||||
|
||||
// The catch handler guarding a given decryptWithPassword call: walk out to
|
||||
// the try block the call sits in, then take the catch that follows it.
|
||||
function handlerSpan(masked, callOffset, label) {
|
||||
const tryOpen = enclosingBlockStart(masked, callOffset);
|
||||
if (tryOpen === -1 || !/\btry\s*$/.test(masked.slice(0, tryOpen)))
|
||||
throw new Error(`${label}: the decrypt is not inside a try block`);
|
||||
const rest = masked.slice(blockEnd(masked, tryOpen));
|
||||
const catchMatch = /^\s*catch\s*(\([^)]*\)\s*)?\{/.exec(rest);
|
||||
if (!catchMatch)
|
||||
throw new Error(`${label}: the decrypt's try block has no catch`);
|
||||
const catchOpen = blockEnd(masked, tryOpen) + catchMatch[0].length - 1;
|
||||
return [catchOpen, blockEnd(masked, catchOpen)];
|
||||
}
|
||||
|
||||
// The prose the handler puts in front of the user. Element ids, class
|
||||
// names and visibility keywords are single words; a sentence has a space
|
||||
// in it, and that is the whole distinction needed here.
|
||||
function handlerMessages(file, callOffset, label) {
|
||||
const { masked, strings } = scan(fs.readFileSync(file, "utf8"));
|
||||
const [from, to] = handlerSpan(masked, callOffset, label);
|
||||
return strings
|
||||
.filter((s) => s.offset >= from && s.offset < to)
|
||||
.map((s) => s.value)
|
||||
.filter((v) => v.includes(" "));
|
||||
}
|
||||
|
||||
// The identifier a decrypt call passes as its password, which is what the
|
||||
// empty-field guard for that screen tests.
|
||||
function passwordArg(masked, callOffset, label) {
|
||||
const open = callOffset + "decryptWithPassword".length;
|
||||
const args = [];
|
||||
let depth = 0;
|
||||
let start = open + 1;
|
||||
for (let i = open; i < masked.length; i++) {
|
||||
const c = masked[i];
|
||||
if (c === "(" || c === "[" || c === "{") depth += 1;
|
||||
else if (c === ")" || c === "]" || c === "}") {
|
||||
depth -= 1;
|
||||
if (depth === 0) {
|
||||
args.push(masked.slice(start, i));
|
||||
break;
|
||||
}
|
||||
} else if (c === "," && depth === 1) {
|
||||
args.push(masked.slice(start, i));
|
||||
start = i + 1;
|
||||
}
|
||||
}
|
||||
const arg = (args[1] ?? "").trim();
|
||||
if (!/^[A-Za-z_$][\w$]*$/.test(arg))
|
||||
throw new Error(`${label}: password argument is not a name: ${arg}`);
|
||||
return arg;
|
||||
}
|
||||
|
||||
// Innermost block enclosing the decrypt that also declares its password
|
||||
// variable — the handler the screen's submit button runs, which is where
|
||||
// the empty-field guard lives.
|
||||
function declaringBlock(masked, callOffset, ident, label) {
|
||||
const declared = new RegExp(`\\b(?:const|let|var)\\s+${ident}\\s*=`);
|
||||
let at = callOffset;
|
||||
for (;;) {
|
||||
const open = enclosingBlockStart(masked, at);
|
||||
if (open === -1) throw new Error(`${label}: nothing declares ${ident}`);
|
||||
const end = blockEnd(masked, open);
|
||||
if (declared.test(masked.slice(open, end))) return [open, end];
|
||||
at = open - 1;
|
||||
}
|
||||
}
|
||||
|
||||
// The prose the empty-field guard puts in front of the user. Exactly one
|
||||
// guard per handler is required: two would mean the condition is answered
|
||||
// in more than one place and this would be pinning only one of them.
|
||||
function emptyGuardMessages(file, callOffset, label) {
|
||||
const { masked, strings } = scan(fs.readFileSync(file, "utf8"));
|
||||
const ident = passwordArg(masked, callOffset, label);
|
||||
const [from, to] = declaringBlock(masked, callOffset, ident, label);
|
||||
const guard = new RegExp(`if\\s*\\(\\s*!\\s*${ident}\\s*\\)\\s*\\{`, "g");
|
||||
const opens = [];
|
||||
let m;
|
||||
while ((m = guard.exec(masked.slice(from, to))) !== null)
|
||||
opens.push(from + m.index + m[0].length - 1);
|
||||
if (opens.length !== 1)
|
||||
throw new Error(
|
||||
`${label}: expected one empty-${ident} guard, found ${opens.length}`,
|
||||
);
|
||||
const close = blockEnd(masked, opens[0]);
|
||||
return strings
|
||||
.filter((s) => s.offset >= opens[0] && s.offset < close)
|
||||
.map((s) => s.value)
|
||||
.filter((v) => v.includes(" "));
|
||||
}
|
||||
|
||||
// The call sites are found, not listed: the file layout moves (the private
|
||||
// key export was in addressDetail.js when #172 was filed and is its own
|
||||
// view now), and a hardcoded list would quietly stop covering a screen it
|
||||
// no longer names.
|
||||
function callSites() {
|
||||
const sites = [];
|
||||
for (const file of jsFilesUnder(SRC)) {
|
||||
if (file === path.join(SRC, "shared", "vault.js")) continue;
|
||||
const { masked } = scan(fs.readFileSync(file, "utf8"));
|
||||
const rel = path.relative(SRC, file).split(path.sep).join("/");
|
||||
let n = 0;
|
||||
let at = masked.indexOf("decryptWithPassword(");
|
||||
while (at !== -1) {
|
||||
n += 1;
|
||||
sites.push({ file, rel, offset: at, label: `${rel} #${n}` });
|
||||
at = masked.indexOf("decryptWithPassword(", at + 1);
|
||||
}
|
||||
}
|
||||
return sites.sort((a, b) => a.label.localeCompare(b.label));
|
||||
}
|
||||
|
||||
describe("password failure messages", () => {
|
||||
const sites = callSites();
|
||||
const files = [...new Set(sites.map((s) => s.file))].sort();
|
||||
|
||||
test("the call sites are found where they are expected", () => {
|
||||
const counts = {};
|
||||
for (const site of sites)
|
||||
counts[site.rel] = (counts[site.rel] ?? 0) + 1;
|
||||
expect(counts).toEqual({
|
||||
"popup/views/approval.js": 2,
|
||||
"popup/views/confirmTx.js": 1,
|
||||
"popup/views/deleteWallet.js": 1,
|
||||
"popup/views/exportPrivkey.js": 1,
|
||||
"popup/views/showPhrase.js": 1,
|
||||
});
|
||||
});
|
||||
|
||||
test("the canonical messages are full sentences", () => {
|
||||
expect(CANONICAL).toMatch(/^[A-Z][^]*\.$/);
|
||||
expect(CANONICAL_EMPTY).toMatch(/^[A-Z][^]*\.$/);
|
||||
});
|
||||
|
||||
// Exact equality, per call site: a message that is merely different
|
||||
// rather than known-obsolete fails here too, which a scan for historic
|
||||
// wordings cannot do.
|
||||
test.each(sites.map((s) => [s.label, s]))(
|
||||
"%s answers a rejected password with the canonical sentence",
|
||||
(label, site) => {
|
||||
expect(handlerMessages(site.file, site.offset, label)).toEqual([
|
||||
CANONICAL,
|
||||
]);
|
||||
},
|
||||
);
|
||||
|
||||
test.each(sites.map((s) => [s.label, s]))(
|
||||
"%s answers an empty password field with the canonical sentence",
|
||||
(label, site) => {
|
||||
expect(emptyGuardMessages(site.file, site.offset, label)).toEqual([
|
||||
CANONICAL_EMPTY,
|
||||
]);
|
||||
},
|
||||
);
|
||||
|
||||
test.each(files.map((f) => [path.relative(SRC, f), f]))(
|
||||
"%s carries no superseded wording",
|
||||
(_rel, file) => {
|
||||
const source = fs.readFileSync(file, "utf8");
|
||||
for (const old of SUPERSEDED) expect(source).not.toContain(old);
|
||||
},
|
||||
);
|
||||
});
|
||||
@@ -1,219 +1,573 @@
|
||||
// The phishing blocklist is vendored at build time and shipped as digests:
|
||||
// script/vendor-blocklist writes src/shared/phishingBlocklist.json, and nothing
|
||||
// fetches anything at runtime. Two things therefore have to be proven here, and
|
||||
// the second is the one that would otherwise fail silently:
|
||||
//
|
||||
// - real domains from the vendored list are detected, and clean ones are not.
|
||||
// - a malformed artifact fails loudly. Every way of getting the artifact
|
||||
// wrong produces a blocklist that matches nothing while looking healthy,
|
||||
// which is a phishing check that answers "no" to everything.
|
||||
// Extension storage stub for the Node test environment. The module resolves
|
||||
// the storage API on use, so this only has to exist before the first call.
|
||||
// Values round-trip through JSON the way structured cloning would, so a test
|
||||
// cannot pass by holding a live reference to the module's own array.
|
||||
const storageStore = {};
|
||||
global.chrome = {
|
||||
storage: {
|
||||
local: {
|
||||
get: async (key) =>
|
||||
Object.prototype.hasOwnProperty.call(storageStore, key)
|
||||
? { [key]: JSON.parse(JSON.stringify(storageStore[key])) }
|
||||
: {},
|
||||
set: async (items) => {
|
||||
for (const [key, value] of Object.entries(items)) {
|
||||
storageStore[key] = JSON.parse(JSON.stringify(value));
|
||||
}
|
||||
},
|
||||
remove: async (key) => {
|
||||
delete storageStore[key];
|
||||
},
|
||||
},
|
||||
},
|
||||
};
|
||||
|
||||
const {
|
||||
isPhishingDomain,
|
||||
loadConfig,
|
||||
getBlocklistSize,
|
||||
getDeltaSize,
|
||||
hostnameVariants,
|
||||
DELTA_STORAGE_KEY,
|
||||
_reset,
|
||||
_getVendoredBlacklistSize,
|
||||
_getDeltaBlacklist,
|
||||
} = require("../src/shared/phishingDomains");
|
||||
const { HASH_HEX_CHARS, hashDomain } = require("../src/shared/domainHash");
|
||||
const vendored = require("../src/shared/phishingBlocklist.json");
|
||||
|
||||
// Domains present in the vendored list at the pinned upstream commit. Upstream
|
||||
// prunes as well as adds, so re-vendoring can retire one of these and turn this
|
||||
// red; that is the intended prompt to pick a current entry, not a licence to
|
||||
// weaken the assertion into "some domain somewhere matches".
|
||||
const LISTED = [
|
||||
"0-google.ph",
|
||||
"myetheywallet.com",
|
||||
// An underscore is not legal in a hostname, but DNS carries one and
|
||||
// browsers resolve it, and upstream lists well over a hundred phishing
|
||||
// sites that use one. The vendoring transform keeps them.
|
||||
"phntum-wallett.godaddysites.com",
|
||||
"coinbase_prologin1.godaddysites.com",
|
||||
];
|
||||
|
||||
// Not on the list, and the kind of host a user actually visits.
|
||||
const CLEAN = ["etherscan.io", "example.com", "opensea.io", "sneak.berlin"];
|
||||
|
||||
describe("vendored blocklist", () => {
|
||||
test("the artifact holds the whole list", () => {
|
||||
expect(getBlocklistSize()).toBeGreaterThan(100000);
|
||||
expect(vendored.hashes).toHaveLength(vendored.count * HASH_HEX_CHARS);
|
||||
});
|
||||
|
||||
test("the digests are sorted and unique", () => {
|
||||
// The lookup is a binary search over the concatenated digests. An
|
||||
// unsorted or duplicated artifact would fail lookups quietly rather
|
||||
// than loudly, so the ordering the search depends on is asserted here
|
||||
// against the committed file rather than assumed of the generator.
|
||||
// One assertion at the end rather than one per entry: 100k+ expect()
|
||||
// calls cost seconds, and make test is capped at 30 for the whole
|
||||
// suite. The index of the first offender is reported, so a failure
|
||||
// still says where.
|
||||
let previous = "";
|
||||
let outOfOrderAt = -1;
|
||||
for (let i = 0; i < vendored.count; i++) {
|
||||
const at = vendored.hashes.slice(
|
||||
i * HASH_HEX_CHARS,
|
||||
(i + 1) * HASH_HEX_CHARS,
|
||||
);
|
||||
if (at <= previous) {
|
||||
outOfOrderAt = i;
|
||||
break;
|
||||
}
|
||||
previous = at;
|
||||
}
|
||||
expect(outOfOrderAt).toBe(-1);
|
||||
});
|
||||
|
||||
test("every digest is lowercase hex of the declared width", () => {
|
||||
expect(vendored.hashes).toMatch(/^[0-9a-f]*$/);
|
||||
});
|
||||
|
||||
test("detects domains from the vendored list", () => {
|
||||
for (const domain of LISTED) {
|
||||
expect(isPhishingDomain(domain)).toBe(true);
|
||||
}
|
||||
});
|
||||
|
||||
test("does not flag legitimate domains", () => {
|
||||
for (const domain of CLEAN) {
|
||||
expect(isPhishingDomain(domain)).toBe(false);
|
||||
}
|
||||
});
|
||||
|
||||
test("detects a subdomain of a listed domain", () => {
|
||||
expect(isPhishingDomain("wallet." + LISTED[0])).toBe(true);
|
||||
expect(isPhishingDomain("a.b.c." + LISTED[0])).toBe(true);
|
||||
});
|
||||
|
||||
test("matching is case-insensitive", () => {
|
||||
expect(isPhishingDomain(LISTED[0].toUpperCase())).toBe(true);
|
||||
});
|
||||
|
||||
test("returns false for an empty or missing hostname", () => {
|
||||
expect(isPhishingDomain("")).toBe(false);
|
||||
expect(isPhishingDomain(null)).toBe(false);
|
||||
expect(isPhishingDomain(undefined)).toBe(false);
|
||||
});
|
||||
|
||||
test("the first and last entries are both reachable", () => {
|
||||
// The ends are where an off-by-one in a binary search hides: a search
|
||||
// that never examines index 0 or index count-1 still finds everything
|
||||
// in between, and the real list is not searched exhaustively here.
|
||||
const first = vendored.hashes.slice(0, HASH_HEX_CHARS);
|
||||
const last = vendored.hashes.slice(-HASH_HEX_CHARS);
|
||||
const { _hashListed } = require("../src/shared/phishingDomains");
|
||||
expect(_hashListed(first)).toBe(true);
|
||||
expect(_hashListed(last)).toBe(true);
|
||||
expect(_hashListed("0".repeat(HASH_HEX_CHARS))).toBe(false);
|
||||
expect(_hashListed("f".repeat(HASH_HEX_CHARS))).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("hostnameVariants", () => {
|
||||
test("returns exact hostname plus parent domains", () => {
|
||||
expect(hostnameVariants("sub.evil.com")).toEqual([
|
||||
"sub.evil.com",
|
||||
"evil.com",
|
||||
]);
|
||||
});
|
||||
|
||||
test("returns just the hostname for a bare domain", () => {
|
||||
expect(hostnameVariants("example.com")).toEqual(["example.com"]);
|
||||
});
|
||||
|
||||
test("handles deep subdomain chains", () => {
|
||||
expect(hostnameVariants("a.b.c.d.com")).toEqual([
|
||||
"a.b.c.d.com",
|
||||
"b.c.d.com",
|
||||
"c.d.com",
|
||||
"d.com",
|
||||
]);
|
||||
});
|
||||
|
||||
test("lowercases hostnames", () => {
|
||||
expect(hostnameVariants("Evil.COM")).toEqual(["evil.com"]);
|
||||
});
|
||||
});
|
||||
|
||||
describe("domain hashing", () => {
|
||||
test("a digest is the declared width of lowercase hex", () => {
|
||||
const hash = hashDomain("example.com");
|
||||
expect(hash).toHaveLength(HASH_HEX_CHARS);
|
||||
expect(hash).toMatch(/^[0-9a-f]+$/);
|
||||
});
|
||||
|
||||
test("hashing is case-insensitive, so lookups are too", () => {
|
||||
expect(hashDomain("Evil.COM")).toBe(hashDomain("evil.com"));
|
||||
});
|
||||
|
||||
test("different domains get different digests", () => {
|
||||
expect(hashDomain("evil.com")).not.toBe(hashDomain("evil.org"));
|
||||
});
|
||||
});
|
||||
|
||||
// A blocklist that silently matches nothing is the failure this module must not
|
||||
// have, so each way of breaking the artifact is required to throw at load. The
|
||||
// generator is the only thing that writes this file, but "the generator is
|
||||
// correct" is not something the shipped extension can check at runtime — this
|
||||
// is what makes a format drift a build failure rather than a silent one.
|
||||
describe("a malformed artifact fails loudly", () => {
|
||||
const GOOD = {
|
||||
algorithm: "sha256",
|
||||
hashHexChars: HASH_HEX_CHARS,
|
||||
count: 2,
|
||||
hashes: "0".repeat(HASH_HEX_CHARS) + "1".repeat(HASH_HEX_CHARS),
|
||||
};
|
||||
|
||||
function loadWith(artifact) {
|
||||
let mod;
|
||||
jest.isolateModules(() => {
|
||||
jest.doMock(
|
||||
"../src/shared/phishingBlocklist.json",
|
||||
() => artifact,
|
||||
{
|
||||
virtual: false,
|
||||
},
|
||||
);
|
||||
mod = require("../src/shared/phishingDomains");
|
||||
});
|
||||
return mod;
|
||||
function clearStorage() {
|
||||
for (const key of Object.keys(storageStore)) {
|
||||
delete storageStore[key];
|
||||
}
|
||||
}
|
||||
|
||||
// The MV3 service worker is torn down when idle and re-evaluated on the next
|
||||
// event, which wipes every module-level variable. Re-requiring the module with
|
||||
// the registry reset is exactly that: fresh in-memory state, same extension
|
||||
// storage underneath.
|
||||
function restartWorker() {
|
||||
jest.resetModules();
|
||||
return require("../src/shared/phishingDomains");
|
||||
}
|
||||
|
||||
// Reset delta state before each test to avoid cross-test contamination.
|
||||
// Note: vendored sets are immutable and always present.
|
||||
beforeEach(() => {
|
||||
_reset();
|
||||
clearStorage();
|
||||
});
|
||||
|
||||
describe("phishingDomains", () => {
|
||||
describe("vendored blocklist", () => {
|
||||
test("vendored blacklist is loaded from bundled JSON", () => {
|
||||
// The vendored blocklist should have a large number of entries
|
||||
expect(_getVendoredBlacklistSize()).toBeGreaterThan(100000);
|
||||
});
|
||||
|
||||
test("detects domains from vendored blacklist", () => {
|
||||
// These are well-known phishing domains in the vendored list
|
||||
expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
|
||||
expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
|
||||
});
|
||||
|
||||
test("getBlocklistSize includes vendored entries", () => {
|
||||
expect(getBlocklistSize()).toBeGreaterThan(100000);
|
||||
});
|
||||
});
|
||||
|
||||
describe("hostnameVariants", () => {
|
||||
test("returns exact hostname plus parent domains", () => {
|
||||
const variants = hostnameVariants("sub.evil.com");
|
||||
expect(variants).toEqual(["sub.evil.com", "evil.com"]);
|
||||
});
|
||||
|
||||
test("returns just the hostname for a bare domain", () => {
|
||||
const variants = hostnameVariants("example.com");
|
||||
expect(variants).toEqual(["example.com"]);
|
||||
});
|
||||
|
||||
test("handles deep subdomain chains", () => {
|
||||
const variants = hostnameVariants("a.b.c.d.com");
|
||||
expect(variants).toEqual([
|
||||
"a.b.c.d.com",
|
||||
"b.c.d.com",
|
||||
"c.d.com",
|
||||
"d.com",
|
||||
]);
|
||||
});
|
||||
|
||||
test("lowercases hostnames", () => {
|
||||
const variants = hostnameVariants("Evil.COM");
|
||||
expect(variants).toEqual(["evil.com"]);
|
||||
});
|
||||
});
|
||||
|
||||
describe("delta computation via loadConfig", () => {
|
||||
test("loadConfig computes delta of new entries not in vendored list", () => {
|
||||
loadConfig({
|
||||
blacklist: [
|
||||
"brand-new-scam-site-xyz123.com",
|
||||
"hopprotocol.pro", // already in vendored
|
||||
],
|
||||
});
|
||||
// Only the new domain should be in the delta
|
||||
expect(
|
||||
_getDeltaBlacklist().has("brand-new-scam-site-xyz123.com"),
|
||||
).toBe(true);
|
||||
expect(_getDeltaBlacklist().has("hopprotocol.pro")).toBe(false);
|
||||
expect(getDeltaSize()).toBe(1);
|
||||
});
|
||||
|
||||
test("re-loading config replaces previous delta", () => {
|
||||
loadConfig({
|
||||
blacklist: ["first-scam-xyz.com"],
|
||||
});
|
||||
expect(isPhishingDomain("first-scam-xyz.com")).toBe(true);
|
||||
|
||||
loadConfig({
|
||||
blacklist: ["second-scam-xyz.com"],
|
||||
});
|
||||
expect(isPhishingDomain("first-scam-xyz.com")).toBe(false);
|
||||
expect(isPhishingDomain("second-scam-xyz.com")).toBe(true);
|
||||
});
|
||||
|
||||
test("getBlocklistSize includes both vendored and delta", () => {
|
||||
const baseSize = getBlocklistSize();
|
||||
loadConfig({
|
||||
blacklist: ["delta-only-scam-xyz.com"],
|
||||
});
|
||||
expect(getBlocklistSize()).toBe(baseSize + 1);
|
||||
});
|
||||
});
|
||||
|
||||
describe("isPhishingDomain with delta + vendored", () => {
|
||||
test("detects domain from delta blacklist", () => {
|
||||
loadConfig({
|
||||
blacklist: ["fresh-scam-xyz.com"],
|
||||
});
|
||||
expect(isPhishingDomain("fresh-scam-xyz.com")).toBe(true);
|
||||
});
|
||||
|
||||
test("detects domain from vendored blacklist", () => {
|
||||
// No delta loaded — vendored still works
|
||||
expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
|
||||
});
|
||||
|
||||
test("returns false for clean domains", () => {
|
||||
expect(isPhishingDomain("etherscan.io")).toBe(false);
|
||||
expect(isPhishingDomain("example.com")).toBe(false);
|
||||
});
|
||||
|
||||
test("detects subdomain of blacklisted domain (vendored)", () => {
|
||||
expect(isPhishingDomain("app.hopprotocol.pro")).toBe(true);
|
||||
});
|
||||
|
||||
test("detects subdomain of blacklisted domain (delta)", () => {
|
||||
loadConfig({
|
||||
blacklist: ["delta-phish-xyz.com"],
|
||||
});
|
||||
expect(isPhishingDomain("sub.delta-phish-xyz.com")).toBe(true);
|
||||
});
|
||||
|
||||
test("case-insensitive matching", () => {
|
||||
loadConfig({
|
||||
blacklist: ["Delta-Scam-XYZ.COM"],
|
||||
});
|
||||
expect(isPhishingDomain("delta-scam-xyz.com")).toBe(true);
|
||||
expect(isPhishingDomain("DELTA-SCAM-XYZ.COM")).toBe(true);
|
||||
});
|
||||
|
||||
test("returns false for empty/null hostname", () => {
|
||||
expect(isPhishingDomain("")).toBe(false);
|
||||
expect(isPhishingDomain(null)).toBe(false);
|
||||
});
|
||||
|
||||
test("handles config with no blacklist key", () => {
|
||||
loadConfig({});
|
||||
expect(getDeltaSize()).toBe(0);
|
||||
// Vendored list still works
|
||||
expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
describe("extension storage persistence", () => {
|
||||
test("delta is persisted to extension storage, not localStorage", async () => {
|
||||
await loadConfig({
|
||||
blacklist: ["persisted-scam-xyz.com"],
|
||||
});
|
||||
const stored = storageStore[DELTA_STORAGE_KEY];
|
||||
expect(stored).toBeDefined();
|
||||
expect(stored.blacklist).toContain("persisted-scam-xyz.com");
|
||||
});
|
||||
|
||||
test("the fetch timestamp is persisted alongside the delta", async () => {
|
||||
const before = Date.now();
|
||||
await loadConfig({ blacklist: ["timestamped-scam-xyz.com"] });
|
||||
const stored = storageStore[DELTA_STORAGE_KEY];
|
||||
expect(typeof stored.lastFetchTime).toBe("number");
|
||||
expect(stored.lastFetchTime).toBeGreaterThanOrEqual(before);
|
||||
});
|
||||
|
||||
test("an oversized delta is dropped entirely, timestamp included", async () => {
|
||||
// A record above the 256 KiB cap is not worth keeping; the
|
||||
// timestamp goes with it so the next start re-fetches rather than
|
||||
// claiming freshness for a delta that was never stored.
|
||||
const huge = [];
|
||||
for (let i = 0; i < 20000; i++) {
|
||||
huge.push(`oversize-scam-${i}-xyzxyzxyzxyzxyz.com`);
|
||||
}
|
||||
await loadConfig({ blacklist: huge });
|
||||
expect(storageStore[DELTA_STORAGE_KEY]).toBeUndefined();
|
||||
});
|
||||
|
||||
test("delta is cleared on _reset", () => {
|
||||
loadConfig({
|
||||
blacklist: ["temp-scam-xyz.com"],
|
||||
});
|
||||
expect(getDeltaSize()).toBe(1);
|
||||
_reset();
|
||||
expect(getDeltaSize()).toBe(0);
|
||||
});
|
||||
});
|
||||
|
||||
describe("real-world blocklist patterns", () => {
|
||||
test("detects known phishing domains from vendored list", () => {
|
||||
expect(isPhishingDomain("uniswap-trade.web.app")).toBe(true);
|
||||
expect(isPhishingDomain("hopprotocol.pro")).toBe(true);
|
||||
expect(isPhishingDomain("blast-pools.pages.dev")).toBe(true);
|
||||
});
|
||||
|
||||
test("does not flag legitimate domains", () => {
|
||||
expect(isPhishingDomain("opensea.io")).toBe(false);
|
||||
expect(isPhishingDomain("etherscan.io")).toBe(false);
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe("phishing list across a service worker restart", () => {
|
||||
beforeEach(() => {
|
||||
clearStorage();
|
||||
jest.resetModules();
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
jest.dontMock("../src/shared/phishingBlocklist.json");
|
||||
delete global.fetch;
|
||||
});
|
||||
|
||||
test("the control artifact loads", () => {
|
||||
expect(loadWith(GOOD).getBlocklistSize()).toBe(2);
|
||||
test("a revived worker restores the persisted delta without re-fetching", async () => {
|
||||
const first = require("../src/shared/phishingDomains");
|
||||
await first.loadConfig({ blacklist: ["restart-scam-xyz.com"] });
|
||||
|
||||
const revived = restartWorker();
|
||||
// Nothing in memory yet — this is a brand new module instance.
|
||||
expect(revived.getDeltaSize()).toBe(0);
|
||||
|
||||
global.fetch = jest.fn();
|
||||
await revived.initPhishingList();
|
||||
|
||||
expect(global.fetch).not.toHaveBeenCalled();
|
||||
expect(revived.getDeltaSize()).toBe(1);
|
||||
expect(revived.isPhishingDomain("restart-scam-xyz.com")).toBe(true);
|
||||
});
|
||||
|
||||
test("a different digest algorithm throws", () => {
|
||||
expect(() => loadWith({ ...GOOD, algorithm: "md5" })).toThrow(
|
||||
/algorithm/,
|
||||
);
|
||||
test("repeated wakes inside the cache window never re-fetch", async () => {
|
||||
const first = require("../src/shared/phishingDomains");
|
||||
await first.loadConfig({ blacklist: ["no-storm-scam-xyz.com"] });
|
||||
|
||||
global.fetch = jest.fn();
|
||||
for (let i = 0; i < 5; i++) {
|
||||
const revived = restartWorker();
|
||||
await revived.initPhishingList();
|
||||
}
|
||||
expect(global.fetch).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test("a different digest width throws", () => {
|
||||
expect(() => loadWith({ ...GOOD, hashHexChars: 8 })).toThrow(
|
||||
/hex characters per entry/,
|
||||
);
|
||||
test("a persisted timestamp older than the TTL causes a fetch on startup", async () => {
|
||||
const first = require("../src/shared/phishingDomains");
|
||||
await first.loadConfig({ blacklist: ["stale-scam-xyz.com"] });
|
||||
|
||||
// Age the persisted record past the 24-hour TTL.
|
||||
storageStore[first.DELTA_STORAGE_KEY].lastFetchTime =
|
||||
Date.now() - first.CACHE_TTL_MS - 1000;
|
||||
|
||||
const revived = restartWorker();
|
||||
global.fetch = jest.fn(async () => ({
|
||||
ok: true,
|
||||
json: async () => ({ blacklist: ["refreshed-scam-xyz.com"] }),
|
||||
}));
|
||||
await revived.initPhishingList();
|
||||
|
||||
expect(global.fetch).toHaveBeenCalledTimes(1);
|
||||
expect(revived.isPhishingDomain("refreshed-scam-xyz.com")).toBe(true);
|
||||
expect(revived.isPhishingDomain("stale-scam-xyz.com")).toBe(false);
|
||||
});
|
||||
|
||||
test("a count that does not match the string length throws", () => {
|
||||
expect(() => loadWith({ ...GOOD, count: 3 })).toThrow(
|
||||
/which is not the/,
|
||||
);
|
||||
test("a first start with nothing persisted fetches immediately", async () => {
|
||||
const fresh = restartWorker();
|
||||
global.fetch = jest.fn(async () => ({
|
||||
ok: true,
|
||||
json: async () => ({ blacklist: ["first-run-scam-xyz.com"] }),
|
||||
}));
|
||||
await fresh.initPhishingList();
|
||||
|
||||
expect(global.fetch).toHaveBeenCalledTimes(1);
|
||||
expect(fresh.isPhishingDomain("first-run-scam-xyz.com")).toBe(true);
|
||||
});
|
||||
|
||||
test("a missing hashes string throws", () => {
|
||||
expect(() => loadWith({ ...GOOD, hashes: undefined })).toThrow(
|
||||
/no hashes string/,
|
||||
);
|
||||
});
|
||||
test("updatePhishingList honours the persisted timestamp on its own", async () => {
|
||||
// The startup path calls updatePhishingList() directly, so it must
|
||||
// load persisted state itself rather than relying on anything else
|
||||
// having finished first.
|
||||
const first = require("../src/shared/phishingDomains");
|
||||
await first.loadConfig({ blacklist: ["alarm-tick-scam-xyz.com"] });
|
||||
|
||||
test("an empty artifact throws rather than matching nothing", () => {
|
||||
expect(() => loadWith({ ...GOOD, count: 0, hashes: "" })).toThrow(
|
||||
/entry count/,
|
||||
);
|
||||
const revived = restartWorker();
|
||||
global.fetch = jest.fn();
|
||||
await revived.updatePhishingList();
|
||||
|
||||
expect(global.fetch).not.toHaveBeenCalled();
|
||||
expect(revived.isPhishingDomain("alarm-tick-scam-xyz.com")).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
// The alarm period alone must set the cadence. lastFetchTime is stamped when
|
||||
// the fetch completes, so it lands one fetch latency after the alarm that
|
||||
// caused it; a freshness guard timed to the alarm period therefore vetoes
|
||||
// every scheduled tick and halves the real refresh rate. These tests measure
|
||||
// the interval between fetches that actually happened.
|
||||
describe("phishing refresh steady-state cadence", () => {
|
||||
const { PHISHING_REFRESH_PERIOD_MINUTES } = require("../src/shared/alarms");
|
||||
const PERIOD_MS = PHISHING_REFRESH_PERIOD_MINUTES * 60 * 1000;
|
||||
|
||||
let clockSpy;
|
||||
let now;
|
||||
|
||||
beforeEach(() => {
|
||||
clearStorage();
|
||||
jest.resetModules();
|
||||
now = Date.UTC(2026, 0, 1, 0, 0, 0);
|
||||
clockSpy = jest.spyOn(Date, "now").mockImplementation(() => now);
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
clockSpy.mockRestore();
|
||||
delete global.fetch;
|
||||
});
|
||||
|
||||
function fetchStub(latencyMs, seen) {
|
||||
return jest.fn(async () => {
|
||||
seen.push(now);
|
||||
// A network fetch takes time, and lastFetchTime is stamped after
|
||||
// it, not when the alarm fired.
|
||||
now += latencyMs;
|
||||
return { ok: true, json: async () => ({ blacklist: [] }) };
|
||||
});
|
||||
}
|
||||
|
||||
test("ten alarm ticks produce ten fetches, one per period", async () => {
|
||||
const fetchedAt = [];
|
||||
global.fetch = fetchStub(5000, fetchedAt);
|
||||
|
||||
const startup = require("../src/shared/phishingDomains");
|
||||
const T0 = now;
|
||||
await startup.initPhishingList();
|
||||
expect(fetchedAt).toEqual([T0]);
|
||||
|
||||
const TICKS = 10;
|
||||
let tickAt = T0 + PERIOD_MS;
|
||||
for (let i = 0; i < TICKS; i++) {
|
||||
now = tickAt;
|
||||
tickAt += PERIOD_MS;
|
||||
// The browser wakes a terminated worker to deliver the alarm, so
|
||||
// every tick starts from cold memory and the persisted record.
|
||||
const revived = restartWorker();
|
||||
await revived.refreshPhishingListOnSchedule();
|
||||
}
|
||||
|
||||
expect(fetchedAt).toHaveLength(TICKS + 1);
|
||||
const intervals = fetchedAt.slice(1).map((t, i) => t - fetchedAt[i]);
|
||||
expect(intervals).toEqual(new Array(TICKS).fill(PERIOD_MS));
|
||||
});
|
||||
|
||||
test("the scheduled tick fetches whatever the last fetch's latency was", async () => {
|
||||
// The alarm fires one period after the previous alarm, which is
|
||||
// `latency` short of one period since the fetch it caused completed.
|
||||
for (const latency of [200, 1000, 5000]) {
|
||||
clearStorage();
|
||||
jest.resetModules();
|
||||
storageStore[DELTA_STORAGE_KEY] = {
|
||||
blacklist: [],
|
||||
lastFetchTime: now - PERIOD_MS + latency,
|
||||
lastAttemptTime: now - PERIOD_MS,
|
||||
};
|
||||
const mod = require("../src/shared/phishingDomains");
|
||||
const fetchedAt = [];
|
||||
global.fetch = fetchStub(latency, fetchedAt);
|
||||
|
||||
await mod.refreshPhishingListOnSchedule();
|
||||
expect(fetchedAt).toHaveLength(1);
|
||||
}
|
||||
});
|
||||
|
||||
test("a worker wake inside the cache window still does not fetch", async () => {
|
||||
// The TTL is not removed, only taken off the scheduled path. Chrome
|
||||
// revives the worker every ~30 seconds and every revival runs the
|
||||
// startup path, so the TTL still has to keep that off the network.
|
||||
storageStore[DELTA_STORAGE_KEY] = {
|
||||
blacklist: [],
|
||||
lastFetchTime: now - PERIOD_MS + 5000,
|
||||
lastAttemptTime: now - PERIOD_MS,
|
||||
};
|
||||
const mod = require("../src/shared/phishingDomains");
|
||||
global.fetch = jest.fn();
|
||||
|
||||
await mod.initPhishingList();
|
||||
expect(global.fetch).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe("phishing list timestamps that cannot be trusted", () => {
|
||||
let clockSpy;
|
||||
let now;
|
||||
|
||||
beforeEach(() => {
|
||||
clearStorage();
|
||||
jest.resetModules();
|
||||
now = Date.UTC(2026, 0, 1, 0, 0, 0);
|
||||
clockSpy = jest.spyOn(Date, "now").mockImplementation(() => now);
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
clockSpy.mockRestore();
|
||||
delete global.fetch;
|
||||
});
|
||||
|
||||
function okFetch() {
|
||||
return jest.fn(async () => ({
|
||||
ok: true,
|
||||
json: async () => ({ blacklist: ["recovered-scam-xyz.com"] }),
|
||||
}));
|
||||
}
|
||||
|
||||
// jest.resetModules() clears the call record of a jest.fn, and simulating
|
||||
// a worker restart is exactly that call. Anything counted across restarts
|
||||
// has to be counted outside the mock.
|
||||
function countingFetch(counter, response) {
|
||||
return async () => {
|
||||
counter.calls++;
|
||||
return response();
|
||||
};
|
||||
}
|
||||
|
||||
test("a lastFetchTime in the future is discarded rather than trusted", async () => {
|
||||
// Clock skew or a restored profile backup writes one. Every guard
|
||||
// measures `Date.now() - stamp` and only tests the lower bound, so a
|
||||
// stamp a year ahead would suppress updates for a year, and now that
|
||||
// the value is persisted it would outlive every worker.
|
||||
storageStore[DELTA_STORAGE_KEY] = {
|
||||
blacklist: ["poisoned-scam-xyz.com"],
|
||||
lastFetchTime: now + 365 * 24 * 60 * 60 * 1000,
|
||||
lastAttemptTime: 0,
|
||||
};
|
||||
const mod = require("../src/shared/phishingDomains");
|
||||
global.fetch = okFetch();
|
||||
|
||||
await mod.initPhishingList();
|
||||
|
||||
expect(global.fetch).toHaveBeenCalledTimes(1);
|
||||
expect(mod.isPhishingDomain("recovered-scam-xyz.com")).toBe(true);
|
||||
// And the record it leaves behind is sane, so recovery is permanent.
|
||||
expect(
|
||||
storageStore[DELTA_STORAGE_KEY].lastFetchTime,
|
||||
).toBeLessThanOrEqual(now);
|
||||
});
|
||||
|
||||
test("a lastAttemptTime in the future does not suppress the retry", async () => {
|
||||
storageStore[DELTA_STORAGE_KEY] = {
|
||||
lastAttemptTime: now + 365 * 24 * 60 * 60 * 1000,
|
||||
};
|
||||
const mod = require("../src/shared/phishingDomains");
|
||||
global.fetch = okFetch();
|
||||
|
||||
await mod.initPhishingList();
|
||||
expect(global.fetch).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
test("an oversized delta does not re-download on every worker wake", async () => {
|
||||
// The delta and its freshness claim are both dropped, which is right,
|
||||
// but nothing then says a fetch just happened. Chrome cycles the
|
||||
// worker roughly every 30 seconds idle, so without the attempt stamp
|
||||
// this is a full blocklist download per wake, forever.
|
||||
const huge = [];
|
||||
for (let i = 0; i < 20000; i++) {
|
||||
huge.push(`oversize-scam-${i}-xyzxyzxyzxyzxyz.com`);
|
||||
}
|
||||
const counter = { calls: 0 };
|
||||
global.fetch = countingFetch(counter, () => ({
|
||||
ok: true,
|
||||
json: async () => ({ blacklist: huge }),
|
||||
}));
|
||||
|
||||
for (let wake = 0; wake < 4; wake++) {
|
||||
const revived = restartWorker();
|
||||
await revived.initPhishingList();
|
||||
now += 30 * 1000; // idle timeout, worker torn down and revived
|
||||
}
|
||||
|
||||
expect(counter.calls).toBe(1);
|
||||
expect(storageStore[DELTA_STORAGE_KEY].blacklist).toBeUndefined();
|
||||
expect(typeof storageStore[DELTA_STORAGE_KEY].lastAttemptTime).toBe(
|
||||
"number",
|
||||
);
|
||||
});
|
||||
|
||||
test("a failing fetch is not retried on every worker wake either", async () => {
|
||||
const counter = { calls: 0 };
|
||||
global.fetch = countingFetch(counter, () => ({
|
||||
ok: false,
|
||||
status: 503,
|
||||
}));
|
||||
|
||||
for (let wake = 0; wake < 4; wake++) {
|
||||
const revived = restartWorker();
|
||||
await revived.initPhishingList();
|
||||
now += 30 * 1000;
|
||||
}
|
||||
|
||||
expect(counter.calls).toBe(1);
|
||||
});
|
||||
|
||||
test("the retry floor expires, so a failure is not permanent", async () => {
|
||||
const {
|
||||
MIN_FETCH_ATTEMPT_INTERVAL_MS,
|
||||
} = require("../src/shared/phishingDomains");
|
||||
const counter = { calls: 0 };
|
||||
global.fetch = countingFetch(counter, () => ({
|
||||
ok: false,
|
||||
status: 503,
|
||||
}));
|
||||
|
||||
await restartWorker().initPhishingList();
|
||||
expect(counter.calls).toBe(1);
|
||||
|
||||
// Still inside the floor: no retry.
|
||||
now += MIN_FETCH_ATTEMPT_INTERVAL_MS - 1000;
|
||||
await restartWorker().initPhishingList();
|
||||
expect(counter.calls).toBe(1);
|
||||
|
||||
// Past it: the extension goes back to the network.
|
||||
now += 2000;
|
||||
await restartWorker().initPhishingList();
|
||||
expect(counter.calls).toBe(2);
|
||||
});
|
||||
|
||||
test("the scheduled tick ignores the retry floor", async () => {
|
||||
// The alarm period is far above the floor, but the floor exists to
|
||||
// throttle wakes, not the schedule.
|
||||
storageStore[DELTA_STORAGE_KEY] = { lastAttemptTime: now - 1000 };
|
||||
const mod = require("../src/shared/phishingDomains");
|
||||
global.fetch = okFetch();
|
||||
|
||||
await mod.refreshPhishingListOnSchedule();
|
||||
expect(global.fetch).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -1,182 +0,0 @@
|
||||
// Every element id the popup views look up must exist in the markup they
|
||||
// look it up in.
|
||||
//
|
||||
// The failure this catches: `$("settings-hide-dsut")` is valid JavaScript
|
||||
// referring to a defined function, so neither jest (node environment, no
|
||||
// DOM) nor a linter has anything to object to. At runtime `$()` returns
|
||||
// null and the next property access throws, which in `init()` aborts the
|
||||
// rest of that view's wiring and takes the whole screen down. Settings is
|
||||
// the densest concentration of these lookups in the codebase.
|
||||
//
|
||||
// This is the cheap general half of the guard: it runs in `make check`
|
||||
// with no browser and covers every id in every view, not the ones some
|
||||
// test happens to click. The expensive specific half is the Settings
|
||||
// section of the end-to-end suite (tests/e2e/run.js), which proves the
|
||||
// screen actually comes up and its controls work.
|
||||
//
|
||||
// Scope and limits, stated rather than implied:
|
||||
// - Only literal string arguments are resolvable statically. A call
|
||||
// like `$(containerId)` is invisible here; those are covered by the
|
||||
// e2e run instead.
|
||||
// - `document.getElementById()` is checked too, minus the ids listed in
|
||||
// RUNTIME_CREATED_IDS, which name nodes the code creates itself and
|
||||
// which are legitimately absent from the static markup.
|
||||
|
||||
"use strict";
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const POPUP_DIR = path.join(__dirname, "..", "src", "popup");
|
||||
const POPUP_HTML_PATH = path.join(POPUP_DIR, "index.html");
|
||||
|
||||
// Nodes built at runtime rather than authored in index.html. Each one must
|
||||
// be created unconditionally by the code before it is ever looked up.
|
||||
const RUNTIME_CREATED_IDS = new Set([
|
||||
// Created by updateDebugBanner() in src/popup/views/helpers.js.
|
||||
"debug-banner",
|
||||
]);
|
||||
|
||||
// Every id lookup the popup performs with a literal argument, as
|
||||
// {id, file, line, source} records.
|
||||
//
|
||||
// showView("x") is included because it resolves to the element id
|
||||
// "view-x": a view name with no matching section is the same defect one
|
||||
// indirection further out.
|
||||
const PATTERNS = [
|
||||
{ re: /\$\(\s*"([^"\n]+)"\s*\)/g, id: (m) => m[1], source: "$()" },
|
||||
{
|
||||
re: /document\.getElementById\(\s*"([^"\n]+)"\s*\)/g,
|
||||
id: (m) => m[1],
|
||||
source: "getElementById()",
|
||||
},
|
||||
{
|
||||
re: /\b(?:showError|hideError)\(\s*"([^"\n]+)"/g,
|
||||
id: (m) => m[1],
|
||||
source: "showError()/hideError()",
|
||||
},
|
||||
{
|
||||
re: /\bshowView\(\s*"([^"\n]+)"\s*\)/g,
|
||||
id: (m) => "view-" + m[1],
|
||||
source: "showView()",
|
||||
},
|
||||
];
|
||||
|
||||
function jsFilesUnder(dir) {
|
||||
const out = [];
|
||||
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
|
||||
const full = path.join(dir, entry.name);
|
||||
if (entry.isDirectory()) {
|
||||
out.push(...jsFilesUnder(full));
|
||||
} else if (entry.name.endsWith(".js")) {
|
||||
out.push(full);
|
||||
}
|
||||
}
|
||||
return out.sort();
|
||||
}
|
||||
|
||||
function lineOf(text, index) {
|
||||
return text.slice(0, index).split("\n").length;
|
||||
}
|
||||
|
||||
function collectReferences() {
|
||||
const refs = [];
|
||||
for (const file of jsFilesUnder(POPUP_DIR)) {
|
||||
const text = fs.readFileSync(file, "utf8");
|
||||
const rel = path.relative(path.join(__dirname, ".."), file);
|
||||
for (const { re, id, source } of PATTERNS) {
|
||||
re.lastIndex = 0;
|
||||
let m;
|
||||
while ((m = re.exec(text)) !== null) {
|
||||
refs.push({
|
||||
id: id(m),
|
||||
file: rel,
|
||||
line: lineOf(text, m.index),
|
||||
source,
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
return refs;
|
||||
}
|
||||
|
||||
function collectHtmlIds(html) {
|
||||
const ids = [];
|
||||
const re = /\bid="([^"]+)"/g;
|
||||
let m;
|
||||
while ((m = re.exec(html)) !== null) ids.push(m[1]);
|
||||
return ids;
|
||||
}
|
||||
|
||||
const HTML = fs.readFileSync(POPUP_HTML_PATH, "utf8");
|
||||
const HTML_IDS = collectHtmlIds(HTML);
|
||||
const HTML_ID_SET = new Set(HTML_IDS);
|
||||
const REFERENCES = collectReferences();
|
||||
|
||||
describe("every element id the popup looks up exists in its markup", () => {
|
||||
// A guard that found nothing to check would pass forever. If a
|
||||
// refactor renames the directory, changes the helper, or moves the
|
||||
// markup, this fails instead of quietly covering zero call sites.
|
||||
// The floors are far below the counts measured when this was written
|
||||
// (434 lookups across 20 of the 24 files under src/popup/, against 274
|
||||
// ids in the markup), so ordinary churn does not trip them.
|
||||
test("the scan actually found the code and the markup", () => {
|
||||
const files = new Set(REFERENCES.map((r) => r.file));
|
||||
expect(files.size).toBeGreaterThanOrEqual(15);
|
||||
expect(REFERENCES.length).toBeGreaterThanOrEqual(300);
|
||||
expect(HTML_IDS.length).toBeGreaterThanOrEqual(200);
|
||||
|
||||
// The densest screen, named explicitly: a scan that stopped
|
||||
// covering src/popup/views/settings.js is the exact regression
|
||||
// this file was written for.
|
||||
expect(
|
||||
files.has(path.join("src", "popup", "views", "settings.js")),
|
||||
).toBe(true);
|
||||
expect(
|
||||
REFERENCES.some((r) => r.id === "settings-hide-spoofed-symbols"),
|
||||
).toBe(true);
|
||||
expect(REFERENCES.some((r) => r.id === "view-settings")).toBe(true);
|
||||
});
|
||||
|
||||
test("no lookup names an id that src/popup/index.html does not define", () => {
|
||||
const missing = REFERENCES.filter(
|
||||
(r) => !HTML_ID_SET.has(r.id) && !RUNTIME_CREATED_IDS.has(r.id),
|
||||
).map(
|
||||
(r) =>
|
||||
r.file +
|
||||
":" +
|
||||
r.line +
|
||||
" " +
|
||||
r.source +
|
||||
' looks up id "' +
|
||||
r.id +
|
||||
'", which is not in src/popup/index.html',
|
||||
);
|
||||
|
||||
expect(missing).toEqual([]);
|
||||
});
|
||||
|
||||
test("every id excused as runtime-created is still looked up somewhere", () => {
|
||||
// Otherwise the exception list becomes a place stale names
|
||||
// accumulate, and the next real miss can be waved through by
|
||||
// adding one more.
|
||||
for (const id of RUNTIME_CREATED_IDS) {
|
||||
expect(REFERENCES.some((r) => r.id === id)).toBe(true);
|
||||
expect(HTML_ID_SET.has(id)).toBe(false);
|
||||
}
|
||||
});
|
||||
|
||||
test("index.html defines no id twice", () => {
|
||||
// getElementById returns the first match, so a duplicate id means
|
||||
// one of the two elements can never be reached by the code that
|
||||
// thinks it owns it.
|
||||
const seen = new Set();
|
||||
const duplicated = [];
|
||||
for (const id of HTML_IDS) {
|
||||
if (seen.has(id)) duplicated.push(id);
|
||||
seen.add(id);
|
||||
}
|
||||
|
||||
expect(duplicated).toEqual([]);
|
||||
});
|
||||
});
|
||||
@@ -159,113 +159,3 @@ describe("hideSpoofedSymbols persistence", () => {
|
||||
expect(second.mod.state.hideSpoofedSymbols).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
// restoreView() refuses to reopen ONTO a non-restorable view, but the stack
|
||||
// behind it was restored verbatim, so Back could still walk onto a screen
|
||||
// whose content is deliberately never re-rendered — and "show-phrase" has no
|
||||
// Back control of its own to leave by. The stack is filtered on load, at the
|
||||
// first entry the popup would not render, and everything above it goes too:
|
||||
// those entries were reached THROUGH the dropped one.
|
||||
describe("restored viewStack is filtered against RESTORABLE_VIEWS", () => {
|
||||
const NON_RESTORABLE = ["export-privkey", "show-phrase"];
|
||||
|
||||
function restoredStack(viewStack, currentView = "settings") {
|
||||
return loadModuleWith({
|
||||
wallets: oneWallet(),
|
||||
currentView,
|
||||
viewStack,
|
||||
});
|
||||
}
|
||||
|
||||
test("a non-restorable view at the top of the stack is dropped", async () => {
|
||||
const { mod } = restoredStack(["main", "address", "export-privkey"]);
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual(["main", "address"]);
|
||||
});
|
||||
|
||||
test("a non-restorable view in the middle truncates the stack there", async () => {
|
||||
const { mod } = restoredStack(["main", "show-phrase", "address"]);
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual(["main"]);
|
||||
});
|
||||
|
||||
// Truncating a stack rooted at a non-restorable view leaves nothing, and
|
||||
// the restored view still needs somewhere for Back to go.
|
||||
test("a non-restorable view at the bottom leaves main to go back to", async () => {
|
||||
const { mod } = restoredStack(["export-privkey", "address", "receive"]);
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual(["main"]);
|
||||
});
|
||||
|
||||
test("no restored stack retains a secret-bearing view", async () => {
|
||||
for (const view of NON_RESTORABLE) {
|
||||
const { mod } = restoredStack(["main", "address", view, "receive"]);
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).not.toContain(view);
|
||||
}
|
||||
});
|
||||
|
||||
// The rule is "views the popup will render", not a blocklist of the two
|
||||
// secret screens: a name no longer in the set (or never a view at all)
|
||||
// has to go the same way.
|
||||
test("a name that is not a restorable view at all is dropped", async () => {
|
||||
const { mod } = restoredStack(["main", "welcome", "address"]);
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual(["main"]);
|
||||
});
|
||||
|
||||
// Restorable entries are kept verbatim. That they are then unhidden
|
||||
// without being re-rendered is a separate defect, tracked in #268; this
|
||||
// filter is only about views the popup declined to restore.
|
||||
test("an ordinary restorable stack is restored unchanged", async () => {
|
||||
const stack = ["main", "address", "address-token"];
|
||||
const { mod } = restoredStack(stack);
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual(stack);
|
||||
});
|
||||
|
||||
test("restoring onto main keeps the stack empty", async () => {
|
||||
const { mod } = restoredStack(["show-phrase"], "main");
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual([]);
|
||||
});
|
||||
|
||||
// main is not the only view that gets no ["main"] beneath it: restoreView()
|
||||
// will not reopen onto a non-restorable view either, so nothing is left for
|
||||
// Back to sit under and the stack stays empty.
|
||||
test("restoring onto a view the popup will not reopen keeps the stack empty", async () => {
|
||||
const { mod } = restoredStack(["export-privkey"], "show-phrase");
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual([]);
|
||||
});
|
||||
|
||||
// Not an array means nothing survives, but the never-empty rule still
|
||||
// applies: a corrupt stack must not leave a restored view with no Back
|
||||
// target of its own.
|
||||
test("a stack that is not an array still gets main beneath a restored view", async () => {
|
||||
const { mod } = restoredStack("main");
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual(["main"]);
|
||||
});
|
||||
|
||||
test("a stack that is not an array loads as empty under main", async () => {
|
||||
const { mod } = restoredStack({ 0: "main" }, "main");
|
||||
await mod.loadState();
|
||||
expect(mod.state.viewStack).toEqual([]);
|
||||
});
|
||||
|
||||
// Filtering belongs on load, not on save: the live in-session stack is
|
||||
// legitimate — the user really is one Back away from a screen that is
|
||||
// rendered right now — and only a load-side filter also cleans the
|
||||
// stacks already sitting in storage.
|
||||
test("saveState persists the live stack verbatim", async () => {
|
||||
const { mod, set } = loadModuleWith(null);
|
||||
mod.state.viewStack = ["main", "address", "export-privkey"];
|
||||
await mod.saveState();
|
||||
expect(set).toHaveBeenCalledWith({
|
||||
autistmask: expect.objectContaining({
|
||||
viewStack: ["main", "address", "export-privkey"],
|
||||
}),
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
@@ -56,7 +56,7 @@ global.chrome = {
|
||||
};
|
||||
|
||||
const { isSpoofedSymbol } = require("../src/shared/symbolSpoof");
|
||||
const { TOKENS, KNOWN_SYMBOLS } = require("../src/shared/tokenList");
|
||||
const { KNOWN_SYMBOLS } = require("../src/shared/tokenList");
|
||||
const { filterTransactions } = require("../src/shared/transactions");
|
||||
const {
|
||||
fetchTokenBalances,
|
||||
@@ -124,301 +124,6 @@ describe("the shared rule", () => {
|
||||
});
|
||||
});
|
||||
|
||||
// Issue #260: the symbol is whatever the ERC-20 contract returns, and HTML
|
||||
// collapses leading and trailing whitespace, so a token calling itself
|
||||
// `" ETH "` reaches the user's eye as `ETH` while missing a raw
|
||||
// KNOWN_SYMBOLS lookup. Normalizing inside the shared rule fixes all three
|
||||
// surfaces at once, which is what consolidating the rule bought.
|
||||
//
|
||||
// Every character under test here is built from its code point rather than
|
||||
// pasted in: most of them are invisible, and an invisible character in a
|
||||
// test file is unreviewable.
|
||||
const cp = (...codes) => String.fromCodePoint(...codes);
|
||||
const NBSP = cp(0x00a0); // no-break space
|
||||
const FIGURE_SPACE = cp(0x2007);
|
||||
const IDEOGRAPHIC_SPACE = cp(0x3000);
|
||||
const ZWSP = cp(0x200b); // zero-width space
|
||||
const BOM = cp(0xfeff); // zero-width no-break space
|
||||
const WORD_JOINER = cp(0x2060);
|
||||
const SOFT_HYPHEN = cp(0x00ad);
|
||||
const LRM = cp(0x200e); // left-to-right mark
|
||||
const RLO = cp(0x202e); // right-to-left override
|
||||
const HANGUL_FILLER = cp(0x3164);
|
||||
const CHOSEONG_FILLER = cp(0x115f);
|
||||
const VS16 = cp(0xfe0f); // variation selector-16
|
||||
const VS1 = cp(0xfe00); // variation selector-1
|
||||
const NEL = cp(0x0085); // next line, a C1 control
|
||||
const DEL = cp(0x007f);
|
||||
const FULLWIDTH_ETH = cp(0xff25, 0xff34, 0xff28);
|
||||
const FULLWIDTH_USDC = cp(0xff55, 0xff53, 0xff44, 0xff43); // lowercase
|
||||
const CYRILLIC_CAPITAL_IE = cp(0x0415);
|
||||
|
||||
describe("the shared rule: symbols that render as a known symbol", () => {
|
||||
test("ASCII padding does not buy a pass", () => {
|
||||
expect(isSpoofedSymbol(" ETH ", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(isSpoofedSymbol("\tETH\n", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(isSpoofedSymbol(" usdc ", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
test("non-breaking and other Unicode spaces do not either", () => {
|
||||
expect(isSpoofedSymbol(NBSP + "ETH" + NBSP, FAKE_ETH_CONTRACT)).toBe(
|
||||
true,
|
||||
);
|
||||
expect(
|
||||
isSpoofedSymbol(
|
||||
FIGURE_SPACE + "ETH" + IDEOGRAPHIC_SPACE,
|
||||
FAKE_ETH_CONTRACT,
|
||||
),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
// These render as nothing at all, in any position, so they are removed
|
||||
// wherever they sit rather than only at the ends.
|
||||
test("zero-width characters are stripped wherever they sit", () => {
|
||||
expect(isSpoofedSymbol("E" + ZWSP + "TH", FAKE_ETH_CONTRACT)).toBe(
|
||||
true,
|
||||
);
|
||||
expect(isSpoofedSymbol(BOM + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(
|
||||
isSpoofedSymbol("ET" + WORD_JOINER + "H", FAKE_ETH_CONTRACT),
|
||||
).toBe(true);
|
||||
expect(
|
||||
isSpoofedSymbol("E" + SOFT_HYPHEN + "TH", FAKE_ETH_CONTRACT),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
// An LRM is invisible and, in all-Latin text, moves nothing: dropping it
|
||||
// leaves exactly the string the user saw.
|
||||
test("an invisible bidi mark does not hide a known symbol", () => {
|
||||
expect(isSpoofedSymbol(LRM + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
// Invisibility is not confined to \p{Cf}. A Hangul filler is Lo and a
|
||||
// variation selector is Mn, yet each of these four measures 32.00px in
|
||||
// the repo's pinned e2e Chromium at 16px sans-serif — exactly the width
|
||||
// of a plain `ETH` — so each reaches the user's eye as `ETH`. They are
|
||||
// caught by \p{Default_Ignorable_Code_Point}, not by \p{Cf}.
|
||||
test("invisible non-format characters are stripped too", () => {
|
||||
expect(isSpoofedSymbol(HANGUL_FILLER + "ETH", FAKE_ETH_CONTRACT)).toBe(
|
||||
true,
|
||||
);
|
||||
expect(
|
||||
isSpoofedSymbol(CHOSEONG_FILLER + "ETH", FAKE_ETH_CONTRACT),
|
||||
).toBe(true);
|
||||
expect(isSpoofedSymbol("ETH" + VS16, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(isSpoofedSymbol("E" + VS1 + "TH", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
// Nor is it confined to the Unicode classes. U+007F is a control (Cc)
|
||||
// and is not default-ignorable, so neither class reaches it, but it
|
||||
// measures 32.00px in the same browser — it paints nothing, so a
|
||||
// symbol carrying it reaches the eye as `ETH`. It is named on its own
|
||||
// in the strip for exactly that reason.
|
||||
test("U+007F paints nothing and is stripped", () => {
|
||||
expect(isSpoofedSymbol(DEL + "ETH", FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
// The other side of the boundary, which is not the class boundary but
|
||||
// the visibility one: the remaining C0 and C1 controls render as a
|
||||
// visible 48.00px box in the same browser, so a symbol carrying one
|
||||
// does not look like `ETH` and must not be judged a spoof. Widening
|
||||
// the strip to \p{Cc} — the obvious over-correction once U+007F is in
|
||||
// it — fails this test.
|
||||
test("visible control characters do not make a symbol a spoof", () => {
|
||||
expect(isSpoofedSymbol(NEL + "ETH", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
expect(isSpoofedSymbol(cp(0x0001) + "ETH", FAKE_ETH_CONTRACT)).toBe(
|
||||
false,
|
||||
);
|
||||
expect(isSpoofedSymbol(cp(0x0090) + "ETH", FAKE_ETH_CONTRACT)).toBe(
|
||||
false,
|
||||
);
|
||||
});
|
||||
|
||||
test("compatibility forms fold onto the symbol they imitate", () => {
|
||||
expect(isSpoofedSymbol(FULLWIDTH_ETH, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
expect(isSpoofedSymbol(FULLWIDTH_USDC, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
});
|
||||
|
||||
// The two knowingly open classes, asserted here so that the boundary is
|
||||
// a fact in the suite and not a claim in a PR body. A Cyrillic capital
|
||||
// Ie is a distinct letter rather than a compatibility variant, so NFKC
|
||||
// leaves it alone; and a right-to-left override reverses the rendering
|
||||
// of what follows it, which dropping the control character does not
|
||||
// undo. Closing either needs a confusables table or a bidi resolver,
|
||||
// and both are a separate change from this one.
|
||||
test("a Cyrillic homoglyph is knowingly still not caught", () => {
|
||||
expect(
|
||||
isSpoofedSymbol(CYRILLIC_CAPITAL_IE + "TH", FAKE_ETH_CONTRACT),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
test("a bidi-reordered symbol is knowingly still not caught", () => {
|
||||
expect(isSpoofedSymbol(RLO + "HTE", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
});
|
||||
|
||||
// Normalization does not reach the native-asset exemption, which turns
|
||||
// on the absence of a contract address and never on the symbol.
|
||||
test("a padded symbol with no contract is still not a spoof", () => {
|
||||
expect(isSpoofedSymbol(" ETH ", null)).toBe(false);
|
||||
expect(isSpoofedSymbol(NBSP + "ETH", "")).toBe(false);
|
||||
});
|
||||
|
||||
test("a genuine contract still bears its own padded symbol", () => {
|
||||
expect(isSpoofedSymbol(" USDC ", USDC_CONTRACT)).toBe(false);
|
||||
expect(isSpoofedSymbol(ZWSP + "WETH", WETH_CONTRACT)).toBe(false);
|
||||
});
|
||||
|
||||
// Normalization must not invent a match. Interior ASCII whitespace is
|
||||
// left alone: `E T H` renders as `E T H`, not as `ETH`, so folding it
|
||||
// would filter a token no user could confuse with the native asset.
|
||||
test("a symbol that renders differently is not judged a spoof", () => {
|
||||
expect(isSpoofedSymbol("E T H", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
expect(isSpoofedSymbol("ETH2", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
expect(isSpoofedSymbol("MY ETH", FAKE_ETH_CONTRACT)).toBe(false);
|
||||
});
|
||||
|
||||
// The false-positive question, answered against the shipped data rather
|
||||
// than by assertion: no bundled symbol carries whitespace or a
|
||||
// non-ASCII character, so the normalization cannot newly filter one.
|
||||
// The character class starts at `!` rather than at the space so that it
|
||||
// asserts the claim it stands for — `[ -~]` would admit an interior
|
||||
// space and let a whitespace-bearing entry through the guard.
|
||||
test("no bundled symbol is touched by the normalization", () => {
|
||||
for (const [symbol, addresses] of KNOWN_SYMBOLS) {
|
||||
expect(symbol).toBe(symbol.trim());
|
||||
expect(symbol).toMatch(/^[!-~]+$/);
|
||||
if (addresses === null) continue;
|
||||
for (const address of addresses) {
|
||||
expect(isSpoofedSymbol(symbol, address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Issue #276: the guard that was missing. The suite walked KNOWN_SYMBOLS,
|
||||
// which is built from TOKENS, so it could only ever assert that the table
|
||||
// agrees with itself. Seven symbols appear twice in the bundled list at two
|
||||
// different real contracts, and the table kept whichever came first, so the
|
||||
// other seven contracts — tokens in our own shipped list, at their own
|
||||
// addresses — were judged spoofs and hidden from the balance list, the
|
||||
// history and the send selector. That is the over-filtering direction: it
|
||||
// hides a holding the user cannot then spend.
|
||||
//
|
||||
// This walk is over TOKENS, the data the wallet actually ships, so it fails
|
||||
// whenever a bundled token would be filtered at its own address no matter
|
||||
// which side of the table the mistake is on.
|
||||
describe("the shipped token list", () => {
|
||||
test("no bundled token is filtered at its own address", () => {
|
||||
const filtered = TOKENS.filter((t) =>
|
||||
isSpoofedSymbol(t.symbol, t.address),
|
||||
).map((t) => t.symbol + " @ " + t.address);
|
||||
expect(filtered).toEqual([]);
|
||||
});
|
||||
|
||||
// The third failure mode the issue asks about: a symbol whose table entry
|
||||
// names an address that is in neither the table nor the list would be a
|
||||
// contract we vouch for and do not ship. There is none, and the table is
|
||||
// built from the list, so this asserts the derivation has not acquired a
|
||||
// hand-written entry.
|
||||
test("every address the table vouches for is a bundled token", () => {
|
||||
const bundled = new Set(TOKENS.map((t) => t.address.toLowerCase()));
|
||||
for (const [symbol, addresses] of KNOWN_SYMBOLS) {
|
||||
if (addresses === null) continue;
|
||||
expect(addresses.size).toBeGreaterThan(0);
|
||||
for (const address of addresses) {
|
||||
expect(address).toBe(address.toLowerCase());
|
||||
expect(bundled.has(address)).toBe(true);
|
||||
// And it is the token that actually reports that symbol.
|
||||
const token = TOKENS.find(
|
||||
(t) => t.address.toLowerCase() === address,
|
||||
);
|
||||
expect(token.symbol.toUpperCase()).toBe(symbol);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// Both contracts behind a shared ticker must pass, from either side: a
|
||||
// rule that admits only the one the table happens to visit first is the
|
||||
// bug, not the fix.
|
||||
test("both contracts behind a shared ticker are admitted", () => {
|
||||
const bySymbol = new Map();
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!bySymbol.has(upper)) bySymbol.set(upper, []);
|
||||
bySymbol.get(upper).push(t);
|
||||
}
|
||||
const shared = [...bySymbol].filter(([, list]) => list.length > 1);
|
||||
// The shared tickers are a fact about the shipped data; if a future
|
||||
// list has none, this test would silently assert nothing.
|
||||
expect(shared.length).toBeGreaterThan(0);
|
||||
for (const [, list] of shared) {
|
||||
for (const t of list) {
|
||||
expect(isSpoofedSymbol(t.symbol, t.address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// The seven from issue #276, named so that the reconciliation is a fact
|
||||
// in the suite: each is two real contracts from the same source fetch,
|
||||
// and the table now holds both rather than the one that came first.
|
||||
test("the seven shared tickers each name both bundled contracts", () => {
|
||||
const expected = {
|
||||
TON: [
|
||||
"0x582d872a1b094fc48f5de31d3b73f2d9be47def1", // Toncoin
|
||||
"0x2be5e8c109e2197d077d13a82daead6a9b3433c5", // Tokamak Network
|
||||
],
|
||||
FRAX: [
|
||||
"0x853d955acef822db058eb8505911ed77f175b99e", // Legacy Frax Dollar
|
||||
"0x3432b6a60d23ca0dfca7761b7ab56459d9c964d0", // Frax (prev. FXS)
|
||||
],
|
||||
REUSD: [
|
||||
"0x5086bf358635b81d8c47c66d1c8b9e567db70c72", // Re Protocol reUSD
|
||||
"0x57ab1e0003f623289cd798b1824be09a793e4bec", // Resupply USD
|
||||
],
|
||||
EURE: [
|
||||
"0x39b8b6385416f4ca36a20319f70d28621895279d", // Monerium EUR emoney
|
||||
"0x3231cb76718cdef2155fc47b5286d82e6eda273f", // Monerium EUR emoney [OLD]
|
||||
],
|
||||
MSUSD: [
|
||||
"0x4ba01f22827018b4772cd326c7627fb4956a7c00", // Main Street USD
|
||||
"0xab5eb14c09d416f0ac63661e57edb7aecdb9befa", // Metronome Synth USD
|
||||
],
|
||||
MUSD: [
|
||||
"0xaca92e438df0b2401ff60da7e4337b687a2435da",
|
||||
"0xdd468a1ddc392dcdbef6db6e34e89aa338f9f186", // Mezo USD
|
||||
],
|
||||
JPYC: [
|
||||
"0x431d5dff03120afa4bdf332c61a6e1766ef37bdb", // JPY Coin
|
||||
"0x2370f9d504c7a6e775bf6e14b3f12846b594cd53", // JPY Coin v1
|
||||
],
|
||||
};
|
||||
for (const [symbol, addresses] of Object.entries(expected)) {
|
||||
expect([...KNOWN_SYMBOLS.get(symbol)].sort()).toEqual(
|
||||
[...addresses].sort(),
|
||||
);
|
||||
for (const address of addresses) {
|
||||
expect(isSpoofedSymbol(symbol, address)).toBe(false);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
// The other direction, on the same symbols: widening the table to hold
|
||||
// every bundled address for a ticker must not turn it into a pass for
|
||||
// any other contract.
|
||||
test("a shared ticker from a third contract is still a spoof", () => {
|
||||
const bySymbol = new Map();
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!bySymbol.has(upper)) bySymbol.set(upper, []);
|
||||
bySymbol.get(upper).push(t);
|
||||
}
|
||||
for (const [symbol, list] of bySymbol) {
|
||||
if (list.length < 2) continue;
|
||||
expect(isSpoofedSymbol(symbol, FAKE_ETH_CONTRACT)).toBe(true);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("surface 1: the transaction history", () => {
|
||||
function fakeEthTransfer() {
|
||||
return {
|
||||
@@ -442,22 +147,6 @@ describe("surface 1: the transaction history", () => {
|
||||
expect(result.transactions).toEqual([]);
|
||||
});
|
||||
|
||||
// Issue #260 on this surface: the same transfer with a padded symbol.
|
||||
test("a padded fake ETH token transfer is filtered too", () => {
|
||||
const padded = { ...fakeEthTransfer(), symbol: " ETH " };
|
||||
const result = filterTransactions([padded], {
|
||||
hideSpoofedSymbols: true,
|
||||
hideFraudContracts: true,
|
||||
hideLowHolderTokens: true,
|
||||
hideDustTransactions: true,
|
||||
dustThresholdGwei: 100000,
|
||||
});
|
||||
expect(result.transactions).toEqual([]);
|
||||
// The contract is learned as fraudulent, exactly as for the
|
||||
// unpadded symbol: the padding must not cost the blocklist entry.
|
||||
expect(result.newFraudContracts).toEqual([FAKE_ETH_CONTRACT]);
|
||||
});
|
||||
|
||||
test("a real native ETH transfer survives", () => {
|
||||
const native = {
|
||||
hash: "0x" + "2".repeat(64),
|
||||
@@ -512,36 +201,6 @@ describe("surface 2: the Send token selector", () => {
|
||||
expect(select.children).toEqual([]);
|
||||
});
|
||||
|
||||
// Issue #260 on this surface: the option text is rendered into HTML,
|
||||
// which collapses the padding, so an unfiltered padded token would sit
|
||||
// in the selector reading exactly `ETH`.
|
||||
test("a padded fake ETH token is not selectable either", () => {
|
||||
render([
|
||||
{
|
||||
address: FAKE_ETH_CONTRACT,
|
||||
symbol: " ETH ",
|
||||
decimals: 18,
|
||||
balance: "0.005",
|
||||
holders: 900000,
|
||||
},
|
||||
]);
|
||||
expect(select.children).toEqual([]);
|
||||
});
|
||||
|
||||
test("a genuine token with a padded symbol stays selectable", () => {
|
||||
render([
|
||||
{
|
||||
address: USDC_CONTRACT,
|
||||
symbol: " USDC ",
|
||||
decimals: 6,
|
||||
balance: "12.5",
|
||||
holders: 900000,
|
||||
},
|
||||
]);
|
||||
expect(select.children).toHaveLength(1);
|
||||
expect(select.children[0].value).toBe(USDC_CONTRACT);
|
||||
});
|
||||
|
||||
test("native ETH remains the always-present option", () => {
|
||||
render([]);
|
||||
expect(select.innerHTML).toBe('<option value="ETH">ETH</option>');
|
||||
@@ -592,35 +251,6 @@ describe("surface 3: the balance list", () => {
|
||||
expect(balances).toEqual([]);
|
||||
});
|
||||
|
||||
// Issue #260 on this surface: the balance list is where the user forms
|
||||
// their belief about what they own, and it renders the symbol into HTML.
|
||||
test("a padded fake ETH token is filtered too", async () => {
|
||||
respondWith([fakeEthItem({ symbol: " ETH " })]);
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
});
|
||||
|
||||
test("a fake ETH token padded with a no-break space is filtered", async () => {
|
||||
respondWith([fakeEthItem({ symbol: NBSP + "ETH" + NBSP })]);
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
});
|
||||
|
||||
// The false-positive direction on the surface that matters most: a real
|
||||
// holding whose symbol happens to carry padding is still listed, and the
|
||||
// list still shows the symbol the token actually reports.
|
||||
test("a genuine token with a padded symbol is not newly filtered", async () => {
|
||||
respondWith([
|
||||
fakeEthItem({
|
||||
address_hash: USDC_CONTRACT,
|
||||
symbol: " USDC ",
|
||||
name: "USD Coin",
|
||||
decimals: "6",
|
||||
}),
|
||||
]);
|
||||
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
|
||||
expect(balances).toHaveLength(1);
|
||||
expect(balances[0].symbol).toBe(" USDC ");
|
||||
});
|
||||
|
||||
test("a genuine token keeps its place in the list", async () => {
|
||||
respondWith([
|
||||
fakeEthItem({
|
||||
@@ -644,33 +274,6 @@ describe("surface 3: the balance list", () => {
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
});
|
||||
|
||||
// The adjacent finding from the same review as issue #260: the type gate
|
||||
// compared exactly, so an explorer that ever varied the casing would
|
||||
// silently drop a real holding before any filter ran. The comparison is
|
||||
// now case-insensitive, which changes nothing about which types are
|
||||
// admitted.
|
||||
test("a differently-cased ERC-20 type still lists a real holding", async () => {
|
||||
respondWith([
|
||||
fakeEthItem({
|
||||
type: "erc-20",
|
||||
address_hash: USDC_CONTRACT,
|
||||
symbol: "USDC",
|
||||
name: "USD Coin",
|
||||
decimals: "6",
|
||||
}),
|
||||
]);
|
||||
const balances = await fetchTokenBalances(HOLDER, BLOCKSCOUT, []);
|
||||
expect(balances).toHaveLength(1);
|
||||
expect(balances[0].symbol).toBe("USDC");
|
||||
});
|
||||
|
||||
test("case insensitivity does not admit another token type", async () => {
|
||||
respondWith([fakeEthItem({ type: "erc-721" })]);
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
respondWith([fakeEthItem({ type: "ERC-20-EXTRA" })]);
|
||||
expect(await fetchTokenBalances(HOLDER, BLOCKSCOUT, [])).toEqual([]);
|
||||
});
|
||||
|
||||
// The money test: the user holds real ETH and has been airdropped a fake
|
||||
// ETH ERC-20. The fake is gone from the list of tokens; the real balance
|
||||
// is exactly what the node reported.
|
||||
|
||||
@@ -207,8 +207,8 @@ describe("token list assumptions the fixtures rely on", () => {
|
||||
});
|
||||
|
||||
test("USDC and WETH map to their genuine lowercased contracts", () => {
|
||||
expect([...KNOWN_SYMBOLS.get("USDC")]).toEqual([USDC_CONTRACT]);
|
||||
expect([...KNOWN_SYMBOLS.get("WETH")]).toEqual([WETH_CONTRACT]);
|
||||
expect(KNOWN_SYMBOLS.get("USDC")).toBe(USDC_CONTRACT);
|
||||
expect(KNOWN_SYMBOLS.get("WETH")).toBe(WETH_CONTRACT);
|
||||
});
|
||||
|
||||
test("the spam fixture symbol is not in the known token list", () => {
|
||||
|
||||
@@ -1,128 +0,0 @@
|
||||
// The scale an ERC-20 transfer from the wallet's own Send screen is encoded
|
||||
// with (issue #305). The screen renders from the block explorer's cached
|
||||
// decimals; the transfer used to be encoded from decimals() read off the
|
||||
// contract at signing time, with nothing comparing the two, so a token whose
|
||||
// on-chain scale differed signed an amount that was never displayed.
|
||||
|
||||
const { parseUnits } = require("ethers");
|
||||
const {
|
||||
displayedDecimals,
|
||||
transferAmountUnits,
|
||||
MAX_DECIMALS,
|
||||
UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
|
||||
UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
|
||||
} = require("../src/shared/transferAmount");
|
||||
|
||||
describe("displayedDecimals", () => {
|
||||
test("accepts what the explorer and the contract each answer with", () => {
|
||||
// A string is what fetchTokenBalances() parses out of Blockscout, a
|
||||
// number is what it stores, and a bigint is what ethers hands back
|
||||
// from a uint8 return.
|
||||
expect(displayedDecimals("6")).toBe(6);
|
||||
expect(displayedDecimals(6)).toBe(6);
|
||||
expect(displayedDecimals(6n)).toBe(6);
|
||||
expect(displayedDecimals(0)).toBe(0);
|
||||
expect(displayedDecimals(MAX_DECIMALS)).toBe(MAX_DECIMALS);
|
||||
});
|
||||
|
||||
test("refuses anything that is not a uint8", () => {
|
||||
for (const bad of [
|
||||
null,
|
||||
undefined,
|
||||
"",
|
||||
"eighteen",
|
||||
NaN,
|
||||
6.5,
|
||||
-1,
|
||||
MAX_DECIMALS + 1,
|
||||
true,
|
||||
{},
|
||||
[],
|
||||
]) {
|
||||
expect(() => displayedDecimals(bad)).toThrow(
|
||||
UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
|
||||
);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("transferAmountUnits", () => {
|
||||
test("encodes with the displayed scale when the contract agrees", () => {
|
||||
expect(transferAmountUnits("0.25", 6, 6n)).toBe(parseUnits("0.25", 6));
|
||||
expect(transferAmountUnits("0.25", "6", 6n)).toBe(
|
||||
parseUnits("0.25", 6),
|
||||
);
|
||||
expect(transferAmountUnits("1.5", 18, 18n)).toBe(parseUnits("1.5", 18));
|
||||
});
|
||||
|
||||
// The reproduction on the issue: 0.25 of a token displayed at 6 decimals,
|
||||
// signed against a contract answering 18, moves 10^12 times the amount
|
||||
// that was approved.
|
||||
test("refuses the reproduction rather than signing either amount", () => {
|
||||
expect(() => transferAmountUnits("0.25", 6, 18n)).toThrow(
|
||||
/contract reports 18 decimal places, but the amount was displayed using 6/,
|
||||
);
|
||||
});
|
||||
|
||||
test("refuses a disagreement in the other direction too", () => {
|
||||
expect(() => transferAmountUnits("0.25", 18, 6n)).toThrow(
|
||||
/contract reports 6 decimal places, but the amount was displayed using 18/,
|
||||
);
|
||||
});
|
||||
|
||||
test("never returns the amount at either scale on a disagreement", () => {
|
||||
// The point of the refusal: both candidate encodings exist, and the
|
||||
// wallet must produce neither.
|
||||
let thrown = null;
|
||||
try {
|
||||
transferAmountUnits("0.25", 6, 18n);
|
||||
} catch (e) {
|
||||
thrown = e;
|
||||
}
|
||||
expect(thrown).toBeInstanceOf(Error);
|
||||
expect(thrown.message).toMatch(/was not sent/);
|
||||
});
|
||||
|
||||
test("refuses when the screen's scale is unknown", () => {
|
||||
expect(() => transferAmountUnits("0.25", null, 6n)).toThrow(
|
||||
UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
|
||||
);
|
||||
expect(() => transferAmountUnits("0.25", undefined, 6n)).toThrow(
|
||||
UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
|
||||
);
|
||||
});
|
||||
|
||||
test("refuses when the contract's answer is not a uint8", () => {
|
||||
for (const bad of [null, undefined, "", "eighteen", 6.5, -1, 256]) {
|
||||
expect(() => transferAmountUnits("0.25", 6, bad)).toThrow(
|
||||
UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
test("rejects an amount finer than the token's scale", () => {
|
||||
// parseUnits' own refusal, reached only once the scales agree: a
|
||||
// fractional base unit cannot be sent and must not be truncated.
|
||||
expect(() => transferAmountUnits("0.0000001", 6, 6n)).toThrow();
|
||||
});
|
||||
|
||||
test("every refusal is a full sentence", () => {
|
||||
const messages = [];
|
||||
for (const args of [
|
||||
["0.25", 6, 18n],
|
||||
["0.25", null, 6n],
|
||||
["0.25", 6, "eighteen"],
|
||||
]) {
|
||||
try {
|
||||
transferAmountUnits(...args);
|
||||
} catch (e) {
|
||||
messages.push(e.message);
|
||||
}
|
||||
}
|
||||
expect(messages).toHaveLength(3);
|
||||
for (const m of messages) {
|
||||
expect(m).toMatch(/^[A-Z]/);
|
||||
expect(m).toMatch(/\.$/);
|
||||
}
|
||||
});
|
||||
});
|
||||
@@ -1,4 +1,4 @@
|
||||
const { AbiCoder, Interface, solidityPacked } = require("ethers");
|
||||
const { AbiCoder, Interface, solidityPacked, getBytes } = require("ethers");
|
||||
const uniswap = require("../src/shared/uniswap");
|
||||
|
||||
const ROUTER_ADDR = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
|
||||
|
||||
380
yarn.lock
380
yarn.lock
@@ -427,90 +427,6 @@
|
||||
resolved "https://registry.yarnpkg.com/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz#0eaf705c941a218a43dba8e09f1df1d6cd2f1f17"
|
||||
integrity sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==
|
||||
|
||||
"@eslint-community/eslint-utils@^4.8.0":
|
||||
version "4.10.1"
|
||||
resolved "https://registry.yarnpkg.com/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz#8911bd72b2c3640a543609e0400b8c4d2e7e7cb6"
|
||||
integrity sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==
|
||||
dependencies:
|
||||
eslint-visitor-keys "^3.4.3"
|
||||
|
||||
"@eslint-community/regexpp@^4.12.2":
|
||||
version "4.12.2"
|
||||
resolved "https://registry.yarnpkg.com/@eslint-community/regexpp/-/regexpp-4.12.2.tgz#bccdf615bcf7b6e8db830ec0b8d21c9a25de597b"
|
||||
integrity sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==
|
||||
|
||||
"@eslint/config-array@^0.23.5":
|
||||
version "0.23.5"
|
||||
resolved "https://registry.yarnpkg.com/@eslint/config-array/-/config-array-0.23.5.tgz#56e86d243049195d8acc0c06a1b3dfdc3fa3de95"
|
||||
integrity sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA==
|
||||
dependencies:
|
||||
"@eslint/object-schema" "^3.0.5"
|
||||
debug "^4.3.1"
|
||||
minimatch "^10.2.4"
|
||||
|
||||
"@eslint/config-helpers@^0.7.0":
|
||||
version "0.7.0"
|
||||
resolved "https://registry.yarnpkg.com/@eslint/config-helpers/-/config-helpers-0.7.0.tgz#09ee4aa07b73f059ec2d4c74bf4b2ff02b322377"
|
||||
integrity sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==
|
||||
dependencies:
|
||||
"@eslint/core" "^1.2.1"
|
||||
|
||||
"@eslint/core@^1.2.1":
|
||||
version "1.2.1"
|
||||
resolved "https://registry.yarnpkg.com/@eslint/core/-/core-1.2.1.tgz#c1da7cd1b82fa8787f98b5629fb811848a1b63ce"
|
||||
integrity sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==
|
||||
dependencies:
|
||||
"@types/json-schema" "^7.0.15"
|
||||
|
||||
"@eslint/js@10.0.1":
|
||||
version "10.0.1"
|
||||
resolved "https://registry.yarnpkg.com/@eslint/js/-/js-10.0.1.tgz#1e8a876f50117af8ab67e47d5ad94d38d6622583"
|
||||
integrity sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==
|
||||
|
||||
"@eslint/object-schema@^3.0.5":
|
||||
version "3.0.5"
|
||||
resolved "https://registry.yarnpkg.com/@eslint/object-schema/-/object-schema-3.0.5.tgz#88e9bf4d11d2b19c082e78ebe7ce88724a5eb091"
|
||||
integrity sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==
|
||||
|
||||
"@eslint/plugin-kit@^0.7.2":
|
||||
version "0.7.2"
|
||||
resolved "https://registry.yarnpkg.com/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz#4b0962f3f2c7ce8bc98b3ecfe34525c09d2cb729"
|
||||
integrity sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==
|
||||
dependencies:
|
||||
"@eslint/core" "^1.2.1"
|
||||
levn "^0.4.1"
|
||||
|
||||
"@humanfs/core@^0.19.2":
|
||||
version "0.19.2"
|
||||
resolved "https://registry.yarnpkg.com/@humanfs/core/-/core-0.19.2.tgz#a8272ca03b2acf492670222b2320b6c421bfde60"
|
||||
integrity sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==
|
||||
dependencies:
|
||||
"@humanfs/types" "^0.15.0"
|
||||
|
||||
"@humanfs/node@^0.16.6":
|
||||
version "0.16.8"
|
||||
resolved "https://registry.yarnpkg.com/@humanfs/node/-/node-0.16.8.tgz#8f800cccc13f4f8cd3116e2d9c0a94939da3e3ed"
|
||||
integrity sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==
|
||||
dependencies:
|
||||
"@humanfs/core" "^0.19.2"
|
||||
"@humanfs/types" "^0.15.0"
|
||||
"@humanwhocodes/retry" "^0.4.0"
|
||||
|
||||
"@humanfs/types@^0.15.0":
|
||||
version "0.15.0"
|
||||
resolved "https://registry.yarnpkg.com/@humanfs/types/-/types-0.15.0.tgz#f2a09f62012390b2bff3fc6fb248ddec8c09a090"
|
||||
integrity sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==
|
||||
|
||||
"@humanwhocodes/module-importer@^1.0.1":
|
||||
version "1.0.1"
|
||||
resolved "https://registry.yarnpkg.com/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz#af5b2691a22b44be847b0ca81641c5fb6ad0172c"
|
||||
integrity sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==
|
||||
|
||||
"@humanwhocodes/retry@^0.4.0", "@humanwhocodes/retry@^0.4.2":
|
||||
version "0.4.3"
|
||||
resolved "https://registry.yarnpkg.com/@humanwhocodes/retry/-/retry-0.4.3.tgz#c2b9d2e374ee62c586d3adbea87199b1d7a7a6ba"
|
||||
integrity sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==
|
||||
|
||||
"@isaacs/cliui@^8.0.2":
|
||||
version "8.0.2"
|
||||
resolved "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz"
|
||||
@@ -1092,16 +1008,6 @@
|
||||
dependencies:
|
||||
"@babel/types" "^7.28.2"
|
||||
|
||||
"@types/esrecurse@^4.3.1":
|
||||
version "4.3.1"
|
||||
resolved "https://registry.yarnpkg.com/@types/esrecurse/-/esrecurse-4.3.1.tgz#6f636af962fbe6191b830bd676ba5986926bccec"
|
||||
integrity sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==
|
||||
|
||||
"@types/estree@^1.0.6", "@types/estree@^1.0.8":
|
||||
version "1.0.9"
|
||||
resolved "https://registry.yarnpkg.com/@types/estree/-/estree-1.0.9.tgz#cf3f0e876d7bee15a93ab925b82bf570a3904a24"
|
||||
integrity sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==
|
||||
|
||||
"@types/istanbul-lib-coverage@*", "@types/istanbul-lib-coverage@^2.0.1", "@types/istanbul-lib-coverage@^2.0.6":
|
||||
version "2.0.6"
|
||||
resolved "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz"
|
||||
@@ -1121,11 +1027,6 @@
|
||||
dependencies:
|
||||
"@types/istanbul-lib-report" "*"
|
||||
|
||||
"@types/json-schema@^7.0.15":
|
||||
version "7.0.15"
|
||||
resolved "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.15.tgz#596a1747233694d50f6ad8a7869fcb6f56cf5841"
|
||||
integrity sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==
|
||||
|
||||
"@types/node@*", "@types/node@22.7.5":
|
||||
version "22.7.5"
|
||||
resolved "https://registry.npmjs.org/@types/node/-/node-22.7.5.tgz"
|
||||
@@ -1252,31 +1153,11 @@
|
||||
resolved "https://registry.yarnpkg.com/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.11.1.tgz#538b1e103bf8d9864e7b85cc96fa8d6fb6c40777"
|
||||
integrity sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==
|
||||
|
||||
acorn-jsx@^5.3.2:
|
||||
version "5.3.2"
|
||||
resolved "https://registry.yarnpkg.com/acorn-jsx/-/acorn-jsx-5.3.2.tgz#7ed5bb55908b3b2f1bc55c6af1653bada7f07937"
|
||||
integrity sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==
|
||||
|
||||
acorn@^8.16.0:
|
||||
version "8.18.0"
|
||||
resolved "https://registry.yarnpkg.com/acorn/-/acorn-8.18.0.tgz#4faf01b2d6d326bfeed97aea1f52220b5f4c1940"
|
||||
integrity sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==
|
||||
|
||||
aes-js@4.0.0-beta.5:
|
||||
version "4.0.0-beta.5"
|
||||
resolved "https://registry.npmjs.org/aes-js/-/aes-js-4.0.0-beta.5.tgz"
|
||||
integrity sha512-G965FqalsNyrPqgEGON7nIx1e/OVENSgiEIzyC63haUMuvNnwIgIjMs52hlTCKhkBny7A2ORNlfY9Zu+jmGk1Q==
|
||||
|
||||
ajv@^6.14.0:
|
||||
version "6.15.0"
|
||||
resolved "https://registry.yarnpkg.com/ajv/-/ajv-6.15.0.tgz#07e982c74626167aa7a2495c53817892d7139492"
|
||||
integrity sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==
|
||||
dependencies:
|
||||
fast-deep-equal "^3.1.1"
|
||||
fast-json-stable-stringify "^2.0.0"
|
||||
json-schema-traverse "^0.4.1"
|
||||
uri-js "^4.2.2"
|
||||
|
||||
ansi-escapes@^4.3.2:
|
||||
version "4.3.2"
|
||||
resolved "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz"
|
||||
@@ -1416,13 +1297,6 @@ brace-expansion@^5.0.2:
|
||||
dependencies:
|
||||
balanced-match "^4.0.2"
|
||||
|
||||
brace-expansion@^5.0.8:
|
||||
version "5.0.9"
|
||||
resolved "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-5.0.9.tgz#7c72438809b5fa5babf54199a1f1c281a6984fcf"
|
||||
integrity sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==
|
||||
dependencies:
|
||||
balanced-match "^4.0.2"
|
||||
|
||||
braces@^3.0.3:
|
||||
version "3.0.3"
|
||||
resolved "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz"
|
||||
@@ -1555,7 +1429,7 @@ cross-spawn@^7.0.3, cross-spawn@^7.0.6:
|
||||
shebang-command "^2.0.0"
|
||||
which "^2.0.1"
|
||||
|
||||
debug@^4.1.0, debug@^4.1.1, debug@^4.3.1, debug@^4.3.2:
|
||||
debug@^4.1.0, debug@^4.1.1, debug@^4.3.1:
|
||||
version "4.4.3"
|
||||
resolved "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz"
|
||||
integrity sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==
|
||||
@@ -1572,11 +1446,6 @@ dedent@^1.6.0:
|
||||
resolved "https://registry.npmjs.org/dedent/-/dedent-1.7.1.tgz"
|
||||
integrity sha512-9JmrhGZpOlEgOLdQgSm0zxFaYoQon408V1v49aqTWuXENVlnCuY9JBZcXZiCsZQWDjTm5Qf/nIvAy77mXDAjEg==
|
||||
|
||||
deep-is@^0.1.3:
|
||||
version "0.1.4"
|
||||
resolved "https://registry.yarnpkg.com/deep-is/-/deep-is-0.1.4.tgz#a6f2dce612fadd2ef1f519b73551f17e85199831"
|
||||
integrity sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==
|
||||
|
||||
deepmerge@^4.3.1:
|
||||
version "4.3.1"
|
||||
resolved "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz"
|
||||
@@ -1679,105 +1548,11 @@ escape-string-regexp@^2.0.0:
|
||||
resolved "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz"
|
||||
integrity sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==
|
||||
|
||||
escape-string-regexp@^4.0.0:
|
||||
version "4.0.0"
|
||||
resolved "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz#14ba83a5d373e3d311e5afca29cf5bfad965bf34"
|
||||
integrity sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==
|
||||
|
||||
eslint-scope@^9.1.2:
|
||||
version "9.1.2"
|
||||
resolved "https://registry.yarnpkg.com/eslint-scope/-/eslint-scope-9.1.2.tgz#b9de6ace2fab1cff24d2e58d85b74c8fcea39802"
|
||||
integrity sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==
|
||||
dependencies:
|
||||
"@types/esrecurse" "^4.3.1"
|
||||
"@types/estree" "^1.0.8"
|
||||
esrecurse "^4.3.0"
|
||||
estraverse "^5.2.0"
|
||||
|
||||
eslint-visitor-keys@^3.4.3:
|
||||
version "3.4.3"
|
||||
resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz#0cd72fe8550e3c2eae156a96a4dddcd1c8ac5800"
|
||||
integrity sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==
|
||||
|
||||
eslint-visitor-keys@^5.0.1:
|
||||
version "5.0.1"
|
||||
resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz#9e3c9489697824d2d4ce3a8ad12628f91e9f59be"
|
||||
integrity sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==
|
||||
|
||||
eslint@10.8.1:
|
||||
version "10.8.1"
|
||||
resolved "https://registry.yarnpkg.com/eslint/-/eslint-10.8.1.tgz#fb37d514c19b6dd5b2d6b70169fd26fddfa97967"
|
||||
integrity sha512-wqA7W2jbsC/BnV9Iv1UZpKVFkO1AdNoSmYW8NWG4HNOBbkAMvIqDZ27pI2f07dqn583NcIC44ckjAcOXDL1QbQ==
|
||||
dependencies:
|
||||
"@eslint-community/eslint-utils" "^4.8.0"
|
||||
"@eslint-community/regexpp" "^4.12.2"
|
||||
"@eslint/config-array" "^0.23.5"
|
||||
"@eslint/config-helpers" "^0.7.0"
|
||||
"@eslint/core" "^1.2.1"
|
||||
"@eslint/plugin-kit" "^0.7.2"
|
||||
"@humanfs/node" "^0.16.6"
|
||||
"@humanwhocodes/module-importer" "^1.0.1"
|
||||
"@humanwhocodes/retry" "^0.4.2"
|
||||
"@types/estree" "^1.0.6"
|
||||
ajv "^6.14.0"
|
||||
cross-spawn "^7.0.6"
|
||||
debug "^4.3.2"
|
||||
escape-string-regexp "^4.0.0"
|
||||
eslint-scope "^9.1.2"
|
||||
eslint-visitor-keys "^5.0.1"
|
||||
espree "^11.2.0"
|
||||
esquery "^1.7.0"
|
||||
esutils "^2.0.2"
|
||||
fast-deep-equal "^3.1.3"
|
||||
file-entry-cache "^8.0.0"
|
||||
find-up "^5.0.0"
|
||||
glob-parent "^6.0.2"
|
||||
ignore "^5.2.0"
|
||||
imurmurhash "^0.1.4"
|
||||
is-glob "^4.0.0"
|
||||
json-stable-stringify-without-jsonify "^1.0.1"
|
||||
minimatch "^10.2.5"
|
||||
natural-compare "^1.4.0"
|
||||
optionator "^0.9.3"
|
||||
|
||||
espree@^11.2.0:
|
||||
version "11.2.0"
|
||||
resolved "https://registry.yarnpkg.com/espree/-/espree-11.2.0.tgz#01d5e47dc332aaba3059008362454a8cc34ccaa5"
|
||||
integrity sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==
|
||||
dependencies:
|
||||
acorn "^8.16.0"
|
||||
acorn-jsx "^5.3.2"
|
||||
eslint-visitor-keys "^5.0.1"
|
||||
|
||||
esprima@^4.0.0:
|
||||
version "4.0.1"
|
||||
resolved "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz"
|
||||
integrity sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==
|
||||
|
||||
esquery@^1.7.0:
|
||||
version "1.7.0"
|
||||
resolved "https://registry.yarnpkg.com/esquery/-/esquery-1.7.0.tgz#08d048f261f0ddedb5bae95f46809463d9c9496d"
|
||||
integrity sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==
|
||||
dependencies:
|
||||
estraverse "^5.1.0"
|
||||
|
||||
esrecurse@^4.3.0:
|
||||
version "4.3.0"
|
||||
resolved "https://registry.yarnpkg.com/esrecurse/-/esrecurse-4.3.0.tgz#7ad7964d679abb28bee72cec63758b1c5d2c9921"
|
||||
integrity sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==
|
||||
dependencies:
|
||||
estraverse "^5.2.0"
|
||||
|
||||
estraverse@^5.1.0, estraverse@^5.2.0:
|
||||
version "5.3.0"
|
||||
resolved "https://registry.yarnpkg.com/estraverse/-/estraverse-5.3.0.tgz#2eea5290702f26ab8fe5370370ff86c965d21123"
|
||||
integrity sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==
|
||||
|
||||
esutils@^2.0.2:
|
||||
version "2.0.3"
|
||||
resolved "https://registry.yarnpkg.com/esutils/-/esutils-2.0.3.tgz#74d2eb4de0b8da1293711910d50775b9b710ef64"
|
||||
integrity sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==
|
||||
|
||||
ethereum-blockies-base64@^1.0.2:
|
||||
version "1.0.2"
|
||||
resolved "https://registry.npmjs.org/ethereum-blockies-base64/-/ethereum-blockies-base64-1.0.2.tgz"
|
||||
@@ -1830,21 +1605,11 @@ expect@30.2.0:
|
||||
jest-mock "30.2.0"
|
||||
jest-util "30.2.0"
|
||||
|
||||
fast-deep-equal@^3.1.1, fast-deep-equal@^3.1.3:
|
||||
version "3.1.3"
|
||||
resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525"
|
||||
integrity sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==
|
||||
|
||||
fast-json-stable-stringify@^2.0.0, fast-json-stable-stringify@^2.1.0:
|
||||
fast-json-stable-stringify@^2.1.0:
|
||||
version "2.1.0"
|
||||
resolved "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz"
|
||||
integrity sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==
|
||||
|
||||
fast-levenshtein@^2.0.6:
|
||||
version "2.0.6"
|
||||
resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917"
|
||||
integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==
|
||||
|
||||
fb-watchman@^2.0.2:
|
||||
version "2.0.2"
|
||||
resolved "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz"
|
||||
@@ -1852,13 +1617,6 @@ fb-watchman@^2.0.2:
|
||||
dependencies:
|
||||
bser "2.1.1"
|
||||
|
||||
file-entry-cache@^8.0.0:
|
||||
version "8.0.0"
|
||||
resolved "https://registry.yarnpkg.com/file-entry-cache/-/file-entry-cache-8.0.0.tgz#7787bddcf1131bffb92636c69457bbc0edd6d81f"
|
||||
integrity sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==
|
||||
dependencies:
|
||||
flat-cache "^4.0.0"
|
||||
|
||||
fill-range@^7.1.1:
|
||||
version "7.1.1"
|
||||
resolved "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz"
|
||||
@@ -1874,27 +1632,6 @@ find-up@^4.0.0, find-up@^4.1.0:
|
||||
locate-path "^5.0.0"
|
||||
path-exists "^4.0.0"
|
||||
|
||||
find-up@^5.0.0:
|
||||
version "5.0.0"
|
||||
resolved "https://registry.yarnpkg.com/find-up/-/find-up-5.0.0.tgz#4c92819ecb7083561e4f4a240a86be5198f536fc"
|
||||
integrity sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==
|
||||
dependencies:
|
||||
locate-path "^6.0.0"
|
||||
path-exists "^4.0.0"
|
||||
|
||||
flat-cache@^4.0.0:
|
||||
version "4.0.1"
|
||||
resolved "https://registry.yarnpkg.com/flat-cache/-/flat-cache-4.0.1.tgz#0ece39fcb14ee012f4b0410bd33dd9c1f011127c"
|
||||
integrity sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==
|
||||
dependencies:
|
||||
flatted "^3.2.9"
|
||||
keyv "^4.5.4"
|
||||
|
||||
flatted@^3.2.9:
|
||||
version "3.4.4"
|
||||
resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.4.4.tgz#aeeca2a506303f0cee61c59e6c9f2a88d2f29fc6"
|
||||
integrity sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==
|
||||
|
||||
foreground-child@^3.1.0:
|
||||
version "3.3.1"
|
||||
resolved "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz"
|
||||
@@ -1933,13 +1670,6 @@ get-stream@^6.0.0:
|
||||
resolved "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz"
|
||||
integrity sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==
|
||||
|
||||
glob-parent@^6.0.2:
|
||||
version "6.0.2"
|
||||
resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-6.0.2.tgz#6d237d99083950c79290f24c7642a3de9a28f9e3"
|
||||
integrity sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==
|
||||
dependencies:
|
||||
is-glob "^4.0.3"
|
||||
|
||||
glob@^10.3.10:
|
||||
version "10.5.0"
|
||||
resolved "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz"
|
||||
@@ -1964,11 +1694,6 @@ glob@^7.1.4:
|
||||
once "^1.3.0"
|
||||
path-is-absolute "^1.0.0"
|
||||
|
||||
globals@17.11.0:
|
||||
version "17.11.0"
|
||||
resolved "https://registry.yarnpkg.com/globals/-/globals-17.11.0.tgz#d643485bb30220d7751e511cf4f68c73d3870d87"
|
||||
integrity sha512-Z2I8hM+PbJDXQDq3Icgpzv+mPdwr68iZUU9d5WW4FuXfDUQfkZaZuvjMv42/5crNyw154+9+VWXbYrUgDXbxNw==
|
||||
|
||||
graceful-fs@^4.2.11, graceful-fs@^4.2.4:
|
||||
version "4.2.11"
|
||||
resolved "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz"
|
||||
@@ -1989,11 +1714,6 @@ human-signals@^2.1.0:
|
||||
resolved "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz"
|
||||
integrity sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==
|
||||
|
||||
ignore@^5.2.0:
|
||||
version "5.3.2"
|
||||
resolved "https://registry.yarnpkg.com/ignore/-/ignore-5.3.2.tgz#3cd40e729f3643fd87cb04e50bf0eb722bc596f5"
|
||||
integrity sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==
|
||||
|
||||
import-local@^3.2.0:
|
||||
version "3.2.0"
|
||||
resolved "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz"
|
||||
@@ -2040,7 +1760,7 @@ is-generator-fn@^2.1.0:
|
||||
resolved "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz"
|
||||
integrity sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==
|
||||
|
||||
is-glob@^4.0.0, is-glob@^4.0.3:
|
||||
is-glob@^4.0.3:
|
||||
version "4.0.3"
|
||||
resolved "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz"
|
||||
integrity sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==
|
||||
@@ -2492,51 +2212,21 @@ jsesc@^3.0.2:
|
||||
resolved "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz"
|
||||
integrity sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==
|
||||
|
||||
json-buffer@3.0.1:
|
||||
version "3.0.1"
|
||||
resolved "https://registry.yarnpkg.com/json-buffer/-/json-buffer-3.0.1.tgz#9338802a30d3b6605fbe0613e094008ca8c05a13"
|
||||
integrity sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==
|
||||
|
||||
json-parse-even-better-errors@^2.3.0:
|
||||
version "2.3.1"
|
||||
resolved "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz"
|
||||
integrity sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==
|
||||
|
||||
json-schema-traverse@^0.4.1:
|
||||
version "0.4.1"
|
||||
resolved "https://registry.yarnpkg.com/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz#69f6a87d9513ab8bb8fe63bdb0979c448e684660"
|
||||
integrity sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==
|
||||
|
||||
json-stable-stringify-without-jsonify@^1.0.1:
|
||||
version "1.0.1"
|
||||
resolved "https://registry.yarnpkg.com/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz#9db7b59496ad3f3cfef30a75142d2d930ad72651"
|
||||
integrity sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==
|
||||
|
||||
json5@^2.2.3:
|
||||
version "2.2.3"
|
||||
resolved "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz"
|
||||
integrity sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==
|
||||
|
||||
keyv@^4.5.4:
|
||||
version "4.5.4"
|
||||
resolved "https://registry.yarnpkg.com/keyv/-/keyv-4.5.4.tgz#a879a99e29452f942439f2a405e3af8b31d4de93"
|
||||
integrity sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==
|
||||
dependencies:
|
||||
json-buffer "3.0.1"
|
||||
|
||||
leven@^3.1.0:
|
||||
version "3.1.0"
|
||||
resolved "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz"
|
||||
integrity sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==
|
||||
|
||||
levn@^0.4.1:
|
||||
version "0.4.1"
|
||||
resolved "https://registry.yarnpkg.com/levn/-/levn-0.4.1.tgz#ae4562c007473b932a6200d403268dd2fffc6ade"
|
||||
integrity sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==
|
||||
dependencies:
|
||||
prelude-ls "^1.2.1"
|
||||
type-check "~0.4.0"
|
||||
|
||||
libsodium-sumo@^0.8.0:
|
||||
version "0.8.2"
|
||||
resolved "https://registry.npmjs.org/libsodium-sumo/-/libsodium-sumo-0.8.2.tgz"
|
||||
@@ -2635,13 +2325,6 @@ locate-path@^5.0.0:
|
||||
dependencies:
|
||||
p-locate "^4.1.0"
|
||||
|
||||
locate-path@^6.0.0:
|
||||
version "6.0.0"
|
||||
resolved "https://registry.yarnpkg.com/locate-path/-/locate-path-6.0.0.tgz#55321eb309febbc59c4801d931a72452a681d286"
|
||||
integrity sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==
|
||||
dependencies:
|
||||
p-locate "^5.0.0"
|
||||
|
||||
lru-cache@^10.2.0:
|
||||
version "10.4.3"
|
||||
resolved "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz"
|
||||
@@ -2693,13 +2376,6 @@ mimic-fn@^2.1.0:
|
||||
resolved "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz"
|
||||
integrity sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==
|
||||
|
||||
minimatch@^10.2.4, minimatch@^10.2.5:
|
||||
version "10.2.6"
|
||||
resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-10.2.6.tgz#fd956bbe0b77241e9f15ac5dccb1c638060968ef"
|
||||
integrity sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==
|
||||
dependencies:
|
||||
brace-expansion "^5.0.8"
|
||||
|
||||
minimatch@^3.0.4, minimatch@^3.1.1:
|
||||
version "3.1.3"
|
||||
resolved "https://registry.npmjs.org/minimatch/-/minimatch-3.1.3.tgz"
|
||||
@@ -2780,18 +2456,6 @@ onetime@^5.1.2:
|
||||
dependencies:
|
||||
mimic-fn "^2.1.0"
|
||||
|
||||
optionator@^0.9.3:
|
||||
version "0.9.4"
|
||||
resolved "https://registry.yarnpkg.com/optionator/-/optionator-0.9.4.tgz#7ea1c1a5d91d764fb282139c88fe11e182a3a734"
|
||||
integrity sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==
|
||||
dependencies:
|
||||
deep-is "^0.1.3"
|
||||
fast-levenshtein "^2.0.6"
|
||||
levn "^0.4.1"
|
||||
prelude-ls "^1.2.1"
|
||||
type-check "^0.4.0"
|
||||
word-wrap "^1.2.5"
|
||||
|
||||
p-limit@^2.2.0:
|
||||
version "2.3.0"
|
||||
resolved "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz"
|
||||
@@ -2799,7 +2463,7 @@ p-limit@^2.2.0:
|
||||
dependencies:
|
||||
p-try "^2.0.0"
|
||||
|
||||
p-limit@^3.0.2, p-limit@^3.1.0:
|
||||
p-limit@^3.1.0:
|
||||
version "3.1.0"
|
||||
resolved "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz"
|
||||
integrity sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==
|
||||
@@ -2813,13 +2477,6 @@ p-locate@^4.1.0:
|
||||
dependencies:
|
||||
p-limit "^2.2.0"
|
||||
|
||||
p-locate@^5.0.0:
|
||||
version "5.0.0"
|
||||
resolved "https://registry.yarnpkg.com/p-locate/-/p-locate-5.0.0.tgz#83c8315c6785005e3bd021839411c9e110e6d834"
|
||||
integrity sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==
|
||||
dependencies:
|
||||
p-limit "^3.0.2"
|
||||
|
||||
p-try@^2.0.0:
|
||||
version "2.2.0"
|
||||
resolved "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz"
|
||||
@@ -2905,11 +2562,6 @@ pnglib@0.0.1:
|
||||
resolved "https://registry.npmjs.org/pnglib/-/pnglib-0.0.1.tgz"
|
||||
integrity sha512-95ChzOoYLOPIyVmL+Y6X+abKGXUJlvOVLkB1QQkyXl7Uczc6FElUy/x01NS7r2GX6GRezloO/ecCX9h4U9KadA==
|
||||
|
||||
prelude-ls@^1.2.1:
|
||||
version "1.2.1"
|
||||
resolved "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.2.1.tgz#debc6489d7a6e6b0e7611888cec880337d316396"
|
||||
integrity sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==
|
||||
|
||||
prettier@^3.8.1:
|
||||
version "3.8.1"
|
||||
resolved "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz"
|
||||
@@ -2924,11 +2576,6 @@ pretty-format@30.2.0:
|
||||
ansi-styles "^5.2.0"
|
||||
react-is "^18.3.1"
|
||||
|
||||
punycode@^2.1.0:
|
||||
version "2.3.1"
|
||||
resolved "https://registry.yarnpkg.com/punycode/-/punycode-2.3.1.tgz#027422e2faec0b25e1549c3e1bd8309b9133b6e5"
|
||||
integrity sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==
|
||||
|
||||
pure-rand@^7.0.0:
|
||||
version "7.0.1"
|
||||
resolved "https://registry.npmjs.org/pure-rand/-/pure-rand-7.0.1.tgz"
|
||||
@@ -3175,13 +2822,6 @@ tslib@^2.8.1:
|
||||
resolved "https://registry.yarnpkg.com/tslib/-/tslib-2.8.1.tgz#612efe4ed235d567e8aba5f2a5fab70280ade83f"
|
||||
integrity sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==
|
||||
|
||||
type-check@^0.4.0, type-check@~0.4.0:
|
||||
version "0.4.0"
|
||||
resolved "https://registry.yarnpkg.com/type-check/-/type-check-0.4.0.tgz#07b8203bfa7056c0657050e3ccd2c37730bab8f1"
|
||||
integrity sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==
|
||||
dependencies:
|
||||
prelude-ls "^1.2.1"
|
||||
|
||||
type-detect@4.0.8:
|
||||
version "4.0.8"
|
||||
resolved "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz"
|
||||
@@ -3232,13 +2872,6 @@ update-browserslist-db@^1.2.0:
|
||||
escalade "^3.2.0"
|
||||
picocolors "^1.1.1"
|
||||
|
||||
uri-js@^4.2.2:
|
||||
version "4.4.1"
|
||||
resolved "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.1.tgz#9b1a52595225859e55f669d928f88c6c57f2a77e"
|
||||
integrity sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==
|
||||
dependencies:
|
||||
punycode "^2.1.0"
|
||||
|
||||
v8-to-istanbul@^9.0.1:
|
||||
version "9.3.0"
|
||||
resolved "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz"
|
||||
@@ -3267,11 +2900,6 @@ which@^2.0.1:
|
||||
dependencies:
|
||||
isexe "^2.0.0"
|
||||
|
||||
word-wrap@^1.2.5:
|
||||
version "1.2.5"
|
||||
resolved "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.5.tgz#d2c45c6dd4fbce621a66f136cbe328afd0410b34"
|
||||
integrity sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==
|
||||
|
||||
"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
|
||||
version "7.0.0"
|
||||
resolved "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz"
|
||||
|
||||
Reference in New Issue
Block a user