Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sneak
|
969a40e898 |
@@ -1641,12 +1641,6 @@ view would leave a wallet one click from deletion.
|
||||
the contract's own answer is read at signing time only to be compared with
|
||||
it, and a disagreement is a refusal rather than a preference for either
|
||||
value (`src/shared/transferAmount.js`)
|
||||
- "Sign & Send" after the active network was switched in Settings while this
|
||||
screen was open → nothing is signed; "The active network changed after
|
||||
this transaction was reviewed, so it was not sent. Please go back and
|
||||
review it again." in the errors box, no screen change. The transaction
|
||||
carries the chain id of the network the screen was shown for, so it cannot
|
||||
be signed for another
|
||||
- "Sign & Send" (wrong password) → "Wrong password." on the password error
|
||||
line, no screen change
|
||||
- "Back" → **Send**
|
||||
@@ -2077,7 +2071,9 @@ view would leave a wallet one click from deletion.
|
||||
artifact can be compared with it field for field. A nonce the site supplies is
|
||||
ignored: the nonce is always the account's next nonce from the node, so a site
|
||||
cannot replace one of the user's pending transactions or leave this one stuck
|
||||
behind a gap. A request that cannot be populated — unreachable node, reverting
|
||||
behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is used
|
||||
in place of the node's estimate; a request giving both with different values
|
||||
is refused. A request that cannot be populated — unreachable node, reverting
|
||||
gas estimate — opens no window and is failed back to the site. Only one
|
||||
transaction approval exists at a time: populating fixes the nonce, so a second
|
||||
`eth_sendTransaction` arriving while one is unanswered is refused with
|
||||
@@ -2166,13 +2162,6 @@ view would leave a wallet one click from deletion.
|
||||
- Typed data that states no primary type, or one other than the type it
|
||||
would be signed as, or that cannot be read → shown with the error line
|
||||
saying so and "Sign" disabled; only "Reject" remains
|
||||
- Typed data whose domain `chainId` names a chain other than the active
|
||||
network's → shown with the error line naming both chain ids and "Sign"
|
||||
disabled; only "Reject" remains. EIP-712 asks for this, because the
|
||||
signature is valid on the chain the domain names. Typed data with no
|
||||
`chainId` is not refused. The background refuses such a signature too,
|
||||
against the network active when the signature reaches it, and answers the
|
||||
site with the same sentence
|
||||
- A `personal_sign` or `eth_sign` message that is not hex (`0x` or `0X` and
|
||||
an even number of hex digits, the form ethers' `getBytes` reads when
|
||||
signing) → shown as plain text, with the error line "This message is plain
|
||||
|
||||
+1
-17
@@ -22,7 +22,6 @@ const { debugFetch, log } = require("../shared/log");
|
||||
const {
|
||||
verifySignedTx,
|
||||
verifySignature,
|
||||
typedDataChainRefusal,
|
||||
failureIsRetryable,
|
||||
describeTxFailure,
|
||||
sameAddress,
|
||||
@@ -1765,8 +1764,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
const s = await getState();
|
||||
const activeAddress = activeAddressOf(s);
|
||||
const activeAddress = await getActiveAddress();
|
||||
// Same as the transaction path: the address the approval named
|
||||
// is the one that must have signed, and a switch since then is
|
||||
// a refusal rather than a signature from another account.
|
||||
@@ -1785,20 +1783,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
signature,
|
||||
approval.approvedFrom,
|
||||
);
|
||||
// The sign screen refuses typed data whose domain names
|
||||
// another chain. A signature for it that arrives anyway is
|
||||
// refused here, against the network active now.
|
||||
const sp = approval.signParams;
|
||||
if (
|
||||
sp.method === "eth_signTypedData_v4" ||
|
||||
sp.method === "eth_signTypedData"
|
||||
) {
|
||||
const refusal = typedDataChainRefusal(
|
||||
JSON.parse(sp.typedData).domain,
|
||||
networkById(s.networkId),
|
||||
);
|
||||
if (refusal) throw new ApprovalMismatchError(refusal);
|
||||
}
|
||||
settleApproval(msg.id, { signature }, { holdsClaim: true });
|
||||
sendResponse({ signature });
|
||||
} catch (e) {
|
||||
|
||||
+8
-12
@@ -7,10 +7,9 @@
|
||||
<link rel="stylesheet" href="styles.css" />
|
||||
</head>
|
||||
<!-- Chrome gives extension pages a stylesheet of its own that sets the
|
||||
font and its size on body, and a Tailwind class beats it only when
|
||||
marked important: hence font-mono! and text-sm! rather than
|
||||
font-mono and text-sm. -->
|
||||
<body class="bg-bg text-fg font-mono! text-sm!">
|
||||
font on body, and a Tailwind class beats it only when marked
|
||||
important: hence font-mono! rather than font-mono. -->
|
||||
<body class="bg-bg text-fg font-mono! text-sm">
|
||||
<div id="app" class="p-2 pr-5 overflow-x-hidden">
|
||||
<!-- ============ GLOBAL TITLE BAR ============ -->
|
||||
<div
|
||||
@@ -88,14 +87,11 @@
|
||||
|
||||
<!-- Mnemonic form section -->
|
||||
<div id="add-wallet-section-mnemonic">
|
||||
<!-- The die button shares the instruction's row: on a row
|
||||
of its own it pushes Import below the fold at
|
||||
360x600. -->
|
||||
<div class="mb-2 flex justify-between items-start gap-2">
|
||||
<p>
|
||||
Enter your 12 or 24 word recovery phrase below, or
|
||||
click the button to roll the die for a new one.
|
||||
</p>
|
||||
<p class="mb-2">
|
||||
Enter your 12 or 24 word recovery phrase below, or click
|
||||
the button to roll the die for a new one.
|
||||
</p>
|
||||
<div class="mb-1 flex justify-end">
|
||||
<button
|
||||
id="btn-generate-phrase"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"
|
||||
|
||||
@@ -12,7 +12,7 @@ const {
|
||||
formatFee,
|
||||
tokenLabel,
|
||||
} = require("./helpers");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const {
|
||||
networkById,
|
||||
networkByChainId,
|
||||
@@ -46,10 +46,7 @@ const {
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { walletDefect } = require("../../shared/walletDefects");
|
||||
const {
|
||||
describeSigningFailure,
|
||||
typedDataChainRefusal,
|
||||
} = require("../../shared/approvalVerify");
|
||||
const { describeSigningFailure } = require("../../shared/approvalVerify");
|
||||
const txStatus = require("./txStatus");
|
||||
const uniswap = require("../../shared/uniswap");
|
||||
const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
|
||||
@@ -446,8 +443,7 @@ function signedPrimaryType(types) {
|
||||
// Why a signature request cannot be signed, as a sentence for the error line,
|
||||
// or null when it can. Only typed data is refused: the `primaryType` the page
|
||||
// states has to be the type ethers will sign, or this screen would name one
|
||||
// message while another is signed. Its domain may name no chain but the active
|
||||
// network's.
|
||||
// message while another is signed.
|
||||
function typedDataRefusal(sp) {
|
||||
if (sp.method === "personal_sign" || sp.method === "eth_sign") return null;
|
||||
let data;
|
||||
@@ -470,7 +466,7 @@ function typedDataRefusal(sp) {
|
||||
", so it cannot be signed."
|
||||
);
|
||||
}
|
||||
return typedDataChainRefusal(data.domain, currentNetwork());
|
||||
return null;
|
||||
}
|
||||
|
||||
// The largest amount a Permit2 allowance can hold, a uint160. Permit2 treats
|
||||
|
||||
@@ -101,10 +101,6 @@ function show(txInfo) {
|
||||
feeStatus = FEE_PENDING;
|
||||
feeWei = null;
|
||||
maxSendFees = null;
|
||||
// The network this screen is drawn for, and the only one it sends on:
|
||||
// Settings can switch the active network while the screen is open. The
|
||||
// wait, success and error screens label the amount by it too.
|
||||
txInfo.chainId = currentNetwork().chainId;
|
||||
|
||||
const isErc20 = txInfo.token !== "ETH";
|
||||
// The raw symbol is the price-table key; the capped one is what the
|
||||
@@ -494,12 +490,7 @@ async function populateVerifyAndSend(connectedSigner, tx, fees = null) {
|
||||
);
|
||||
request = await contract.transfer.populateTransaction(tx.to, amount);
|
||||
}
|
||||
// The chain id of the network the screen was drawn for: ethers refuses to
|
||||
// populate it for a provider on any other network.
|
||||
const populated = await connectedSigner.populateTransaction({
|
||||
...request,
|
||||
chainId: tx.chainId,
|
||||
});
|
||||
const populated = await connectedSigner.populateTransaction(request);
|
||||
assertWithinCeilings(populated);
|
||||
return connectedSigner.sendTransaction(populated);
|
||||
}
|
||||
@@ -556,17 +547,6 @@ function init(_ctx) {
|
||||
return;
|
||||
}
|
||||
|
||||
// Back from Settings only unhides this screen, still drawn for the
|
||||
// network that was active when it was shown.
|
||||
if (currentNetwork().chainId !== pendingTx.chainId) {
|
||||
showSendError(
|
||||
"The active network changed after this transaction was" +
|
||||
" reviewed, so it was not sent. Please go back and review" +
|
||||
" it again.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
|
||||
const password = $("confirm-tx-password").value;
|
||||
if (!password) {
|
||||
showError(
|
||||
@@ -595,6 +575,10 @@ function init(_ctx) {
|
||||
$("btn-confirm-send").disabled = true;
|
||||
$("btn-confirm-send").classList.add("text-muted");
|
||||
|
||||
// The network it is sent on. The wait, success and error screens
|
||||
// label its amount by this, not by the network active when they draw.
|
||||
pendingTx.chainId = currentNetwork().chainId;
|
||||
|
||||
let tx;
|
||||
try {
|
||||
const signer = getSignerForAddress(
|
||||
|
||||
@@ -31,6 +31,7 @@ const {
|
||||
VoidSigner,
|
||||
accessListify,
|
||||
getAddress,
|
||||
getBigInt,
|
||||
getBytes,
|
||||
hexlify,
|
||||
toQuantity,
|
||||
@@ -47,10 +48,11 @@ const {
|
||||
// minutes long, which is not a wait anyone will sit through.
|
||||
const POPULATE_TIMEOUT_MS = 20000;
|
||||
|
||||
// The request fields taken from the page. Anything else is dropped rather than
|
||||
// passed to ethers: the object is page-controlled, and a future ethers that
|
||||
// learns to carry a new transaction field must not start picking one up out of
|
||||
// it without this module knowing.
|
||||
// The request fields taken from the page, plus `gas`, which requestFrom()
|
||||
// takes as the gas limit. Anything else is dropped rather than passed to
|
||||
// ethers: the object is page-controlled, and a future ethers that learns to
|
||||
// carry a new transaction field must not start picking one up out of it
|
||||
// without this module knowing.
|
||||
//
|
||||
// The nonce is not taken from the page; it is always the account's next nonce
|
||||
// from the network. A page that chose it could replace one of the user's
|
||||
@@ -84,6 +86,16 @@ function present(v) {
|
||||
return v !== null && v !== undefined && v !== "";
|
||||
}
|
||||
|
||||
// Whether two quantities from the page are the same number. One that is not a
|
||||
// number matches nothing.
|
||||
function sameQuantity(a, b) {
|
||||
try {
|
||||
return getBigInt(a) === getBigInt(b);
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// These strings reach the user through the requesting page, so they are full
|
||||
// sentences even when the tail of one came from ethers or from the node.
|
||||
function sentence(text) {
|
||||
@@ -111,6 +123,20 @@ function requestFrom(txParams, from) {
|
||||
for (const key of REQUEST_FIELDS) {
|
||||
if (present(txParams[key])) request[key] = txParams[key];
|
||||
}
|
||||
// JSON-RPC calls the gas limit `gas`, and that is the name sites send.
|
||||
// ethers only reads `gasLimit`: left as `gas` it would be dropped and an
|
||||
// estimate signed in its place.
|
||||
if (present(txParams.gas)) {
|
||||
if (
|
||||
present(request.gasLimit) &&
|
||||
!sameQuantity(request.gasLimit, txParams.gas)
|
||||
) {
|
||||
throw fail(
|
||||
"The site asked for two different gas limits for this transaction.",
|
||||
);
|
||||
}
|
||||
request.gasLimit = txParams.gas;
|
||||
}
|
||||
if (
|
||||
present(request.type) &&
|
||||
!ALLOWED_TX_TYPES.includes(Number(request.type))
|
||||
|
||||
@@ -53,7 +53,6 @@ const {
|
||||
accessListify,
|
||||
formatEther,
|
||||
getAddress,
|
||||
getBigInt,
|
||||
getBytes,
|
||||
toQuantity,
|
||||
verifyMessage,
|
||||
@@ -636,33 +635,6 @@ function verifySignature(signParams, signature, expectedFrom) {
|
||||
return recovered;
|
||||
}
|
||||
|
||||
// Why typed data cannot be signed while `network` is the active network, as a
|
||||
// sentence, or null when it can. EIP-712 has a wallet refuse typed data whose
|
||||
// domain names another chain, because the signature is valid on that chain.
|
||||
// ethers signs no chain id when the domain's is null or absent, and reads any
|
||||
// other with getBigInt(), so 1, "1" and "0x1" are the same chain here too.
|
||||
function typedDataChainRefusal(domain, network) {
|
||||
const chainId = domain?.chainId;
|
||||
if (chainId === undefined || chainId === null) return null;
|
||||
let named;
|
||||
try {
|
||||
named = getBigInt(chainId);
|
||||
} catch {
|
||||
return "This typed data cannot be read, so it cannot be signed.";
|
||||
}
|
||||
const active = getBigInt(network.chainId);
|
||||
if (named === active) return null;
|
||||
return (
|
||||
"This typed data is for chain id " +
|
||||
named +
|
||||
", but the active network is " +
|
||||
network.name +
|
||||
" (chain id " +
|
||||
active +
|
||||
"), so it cannot be signed."
|
||||
);
|
||||
}
|
||||
|
||||
// The stage a transaction approval failed at. Which stage it is decides
|
||||
// whether the approval survives the failure.
|
||||
const TX_STAGE_SIGN = "sign";
|
||||
@@ -824,7 +796,6 @@ function describeSigningFailure(response, fallbackMessage) {
|
||||
module.exports = {
|
||||
verifySignedTx,
|
||||
verifySignature,
|
||||
typedDataChainRefusal,
|
||||
assertNoForbiddenFields,
|
||||
assertNothingUnchecked,
|
||||
assertCanonicalBytes,
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
// requesting page or the RPC node can say turns it into an approval that
|
||||
// should never have been raised.
|
||||
|
||||
const { Network, Wallet } = require("ethers");
|
||||
const { Network, Transaction, Wallet, toQuantity } = require("ethers");
|
||||
const {
|
||||
prepareApprovalTx,
|
||||
serializeApprovedTx,
|
||||
@@ -138,6 +138,43 @@ describe("prepareApprovalTx", () => {
|
||||
expect(approved.maxFeePerGas).toBe("0x12a05f200");
|
||||
});
|
||||
|
||||
// `gas` is the JSON-RPC name for the gas limit and the one sites send.
|
||||
// The node would estimate 21000; the site's 200000 is what is shown and
|
||||
// what is signed.
|
||||
test("uses the gas limit a site sends as gas", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{ ...TX_PARAMS, gas: "0x30d40" },
|
||||
);
|
||||
expect(approved.gasLimit).toBe("0x30d40");
|
||||
const signed = Transaction.from(
|
||||
await signer.signTransaction({ ...approved }),
|
||||
);
|
||||
expect(signed.gasLimit).toBe(200000n);
|
||||
});
|
||||
|
||||
test("accepts gas and gasLimit that name the same number", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{ ...TX_PARAMS, gas: "0x30d40", gasLimit: 200000 },
|
||||
);
|
||||
expect(approved.gasLimit).toBe("0x30d40");
|
||||
});
|
||||
|
||||
test("refuses gas and gasLimit that disagree", async () => {
|
||||
await expect(
|
||||
prepareApprovalTx(providerWith(), signer.address, {
|
||||
...TX_PARAMS,
|
||||
gas: "0x30d40",
|
||||
gasLimit: "0x5208",
|
||||
}),
|
||||
).rejects.toThrow(
|
||||
"The site asked for two different gas limits for this transaction.",
|
||||
);
|
||||
});
|
||||
|
||||
test("carries an access list the request asked for", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
@@ -212,6 +249,15 @@ describe("prepareApprovalTx", () => {
|
||||
).rejects.toThrow(/gas limit no network this wallet supports/);
|
||||
});
|
||||
|
||||
test("refuses a gas limit the site sent above the ceiling", async () => {
|
||||
await expect(
|
||||
prepareApprovalTx(providerWith(), signer.address, {
|
||||
...TX_PARAMS,
|
||||
gas: toQuantity(MAX_GAS_LIMIT + 1n),
|
||||
}),
|
||||
).rejects.toThrow(/gas limit no network this wallet supports/);
|
||||
});
|
||||
|
||||
// The combined bound at population: a gas limit and a fee that are each
|
||||
// under their own ceiling but multiply to thousands of ETH is refused
|
||||
// before the approval window opens, so the user is never shown a
|
||||
|
||||
@@ -397,13 +397,7 @@ function loadBackground(options) {
|
||||
rpcResult = r;
|
||||
},
|
||||
);
|
||||
return {
|
||||
id: () =>
|
||||
new URL(created[created.length - 1].url).searchParams.get(
|
||||
"approval",
|
||||
),
|
||||
result: () => rpcResult,
|
||||
};
|
||||
return { result: () => rpcResult };
|
||||
}
|
||||
|
||||
// A dApp asking to connect. The origin defaults to one the persisted
|
||||
@@ -1490,55 +1484,6 @@ describe("what the approval is verified against", () => {
|
||||
});
|
||||
});
|
||||
|
||||
// Typed data whose domain names another chain is refused on the sign
|
||||
// screen; a signature for it that reaches the background anyway is not
|
||||
// handed to the page (https://git.eeqj.de/sneak/AutistMask/issues/519).
|
||||
// TYPED_DATA names mainnet.
|
||||
async function answerTypedData(bg, pending) {
|
||||
const { domain, types, message } = JSON.parse(TYPED_DATA);
|
||||
delete types.EIP712Domain;
|
||||
const signature = await signer.signTypedData(domain, types, message);
|
||||
const answer = bg.send(
|
||||
{
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: pending.id(),
|
||||
approved: true,
|
||||
signature,
|
||||
},
|
||||
{ url: bg.fromPopup.url },
|
||||
);
|
||||
await settle();
|
||||
return { answer, signature };
|
||||
}
|
||||
|
||||
test("typed data for the active chain is handed back signed", async () => {
|
||||
const bg = loadBackground();
|
||||
const pending = bg.requestTypedData();
|
||||
await settle();
|
||||
|
||||
const { answer, signature } = await answerTypedData(bg, pending);
|
||||
|
||||
expect(answer.sendResponse).toHaveBeenCalledWith({ signature });
|
||||
expect(pending.result()).toEqual({ result: signature });
|
||||
});
|
||||
|
||||
test("typed data for another chain is refused, not handed back", async () => {
|
||||
const bg = loadBackground();
|
||||
bg.setNetwork(SEPOLIA);
|
||||
const pending = bg.requestTypedData();
|
||||
await settle();
|
||||
|
||||
const { answer } = await answerTypedData(bg, pending);
|
||||
|
||||
const refusal =
|
||||
"This typed data is for chain id 1, but the active network is Sepolia Testnet (chain id 11155111), so it cannot be signed.";
|
||||
expect(answer.sendResponse).toHaveBeenCalledWith({
|
||||
error: refusal,
|
||||
retryable: false,
|
||||
});
|
||||
expect(pending.result()).toEqual({ error: { message: refusal } });
|
||||
});
|
||||
|
||||
test("a sign request from another address raises no approval at all", async () => {
|
||||
const bg = loadBackground();
|
||||
const pending = bg.requestSign(other.address);
|
||||
|
||||
@@ -1,259 +0,0 @@
|
||||
// A transfer is sent only on the network its confirmation screen was drawn for
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/524).
|
||||
//
|
||||
// Settings is reachable from the confirmation screen, and Back from it only
|
||||
// unhides the screen, still labelled for the network it was drawn for. Sign &
|
||||
// Send used to take the network at the moment of the click, so 1 SepoliaETH
|
||||
// reviewed on Sepolia went out as 1 ETH on mainnet once mainnet was chosen in
|
||||
// Settings in between.
|
||||
//
|
||||
// Driven through the real confirmation screen, signer and chain switch, with
|
||||
// only the node and the DOM stubbed. The stub node is on the network its
|
||||
// provider was built for, so a broadcast records the network it went to.
|
||||
|
||||
"use strict";
|
||||
|
||||
// The signed transactions the stub node was handed, with its network's chain id.
|
||||
const mockNode = { broadcast: [] };
|
||||
|
||||
jest.mock("ethers", () => {
|
||||
const actual = jest.requireActual("ethers");
|
||||
class StubProvider {
|
||||
constructor(url, network) {
|
||||
this.network = network;
|
||||
}
|
||||
async getNetwork() {
|
||||
return this.network;
|
||||
}
|
||||
async getFeeData() {
|
||||
return {
|
||||
maxFeePerGas: 20000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
gasPrice: 10000000000n,
|
||||
};
|
||||
}
|
||||
async estimateGas() {
|
||||
return 21000n;
|
||||
}
|
||||
async getCode() {
|
||||
return "0x";
|
||||
}
|
||||
async getTransactionCount() {
|
||||
return 1;
|
||||
}
|
||||
async lookupAddress() {
|
||||
return null;
|
||||
}
|
||||
async broadcastTransaction(signed) {
|
||||
mockNode.broadcast.push({ chainId: this.network.chainId, signed });
|
||||
return { hash: "0x" + "ab".repeat(32) };
|
||||
}
|
||||
}
|
||||
return { ...actual, JsonRpcProvider: StubProvider };
|
||||
});
|
||||
|
||||
jest.mock("../src/shared/log", () => ({
|
||||
log: {
|
||||
debugf: () => {},
|
||||
infof: () => {},
|
||||
warnf: () => {},
|
||||
errorf: () => {},
|
||||
},
|
||||
debugFetch: jest.fn(async () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
json: async () => ({ items: [] }),
|
||||
})),
|
||||
urlOrigin: () => "",
|
||||
setRuntimeDebug: () => {},
|
||||
isDebug: () => false,
|
||||
}));
|
||||
|
||||
// The wait screen polls for a receipt; these tests stop at the broadcast.
|
||||
jest.mock("../src/popup/views/txStatus", () => ({
|
||||
showWait: jest.fn(),
|
||||
showError: jest.fn(),
|
||||
}));
|
||||
|
||||
global.fetch = jest.fn(() => {
|
||||
throw new Error("tests must not perform network requests");
|
||||
});
|
||||
|
||||
const { makeStorageStub } = require("./support/storageStub");
|
||||
global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
|
||||
|
||||
// A stub DOM: every id resolves to a recording element.
|
||||
const elements = new Map();
|
||||
|
||||
function makeEl(id) {
|
||||
const handlers = new Map();
|
||||
return {
|
||||
id,
|
||||
textContent: "",
|
||||
innerHTML: "",
|
||||
value: "",
|
||||
disabled: false,
|
||||
style: {},
|
||||
dataset: {},
|
||||
classList: {
|
||||
add() {},
|
||||
remove() {},
|
||||
toggle() {},
|
||||
contains: () => false,
|
||||
},
|
||||
handlers,
|
||||
addEventListener(name, fn) {
|
||||
handlers.set(name, fn);
|
||||
},
|
||||
querySelectorAll: () => [],
|
||||
querySelector: () => null,
|
||||
remove() {},
|
||||
focus() {},
|
||||
};
|
||||
}
|
||||
|
||||
global.document = {
|
||||
getElementById(id) {
|
||||
if (!elements.has(id)) elements.set(id, makeEl(id));
|
||||
return elements.get(id);
|
||||
},
|
||||
createElement: (tag) => makeEl(tag),
|
||||
body: { prepend() {}, appendChild() {} },
|
||||
addEventListener() {},
|
||||
};
|
||||
global.navigator = { clipboard: { writeText() {} } };
|
||||
|
||||
const { BaseWallet, Transaction, Wallet } = require("ethers");
|
||||
const { encryptWithPassword } = require("../src/shared/vault");
|
||||
const { state, loadState } = require("../src/shared/state");
|
||||
const { onChainSwitch } = require("../src/shared/chainSwitch");
|
||||
const { NETWORKS } = require("../src/shared/networks");
|
||||
const txStatus = require("../src/popup/views/txStatus");
|
||||
const confirmTx = require("../src/popup/views/confirmTx");
|
||||
|
||||
const PRIVATE_KEY = "0x" + "11".repeat(32);
|
||||
const HOLDER = new Wallet(PRIVATE_KEY).address;
|
||||
const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
|
||||
const PASSWORD = "correct horse battery staple";
|
||||
|
||||
function el(id) {
|
||||
return global.document.getElementById(id);
|
||||
}
|
||||
|
||||
let encryptedSecret;
|
||||
let signTransaction;
|
||||
|
||||
beforeAll(async () => {
|
||||
await loadState();
|
||||
encryptedSecret = await encryptWithPassword(PRIVATE_KEY, PASSWORD);
|
||||
});
|
||||
|
||||
beforeEach(() => {
|
||||
elements.clear();
|
||||
mockNode.broadcast = [];
|
||||
txStatus.showWait.mockClear();
|
||||
txStatus.showError.mockClear();
|
||||
signTransaction = jest.spyOn(BaseWallet.prototype, "signTransaction");
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
signTransaction.mockRestore();
|
||||
});
|
||||
|
||||
// Show the confirmation screen for 1 of the native token on `networkId`, as
|
||||
// Review on the Send screen does, with its fee estimate settled.
|
||||
async function review(networkId) {
|
||||
await onChainSwitch(networkId);
|
||||
state.wallets = [
|
||||
{
|
||||
type: "key",
|
||||
name: "Wallet 1",
|
||||
encryptedSecret,
|
||||
addresses: [{ address: HOLDER, balance: "5.0" }],
|
||||
},
|
||||
];
|
||||
state.selectedWallet = 0;
|
||||
state.selectedAddress = 0;
|
||||
confirmTx.init({});
|
||||
confirmTx.show({
|
||||
from: HOLDER,
|
||||
to: RECIPIENT,
|
||||
ensName: null,
|
||||
amount: "1",
|
||||
token: "ETH",
|
||||
balance: "5.0",
|
||||
tokenSymbol: null,
|
||||
tokenBalance: null,
|
||||
tokenDecimals: null,
|
||||
max: false,
|
||||
});
|
||||
for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
|
||||
}
|
||||
|
||||
async function signAndSend() {
|
||||
el("confirm-tx-password").value = PASSWORD;
|
||||
await el("btn-confirm-send").handlers.get("click")();
|
||||
}
|
||||
|
||||
test("a transfer reviewed on Sepolia and sent goes out on Sepolia", async () => {
|
||||
await review("sepolia");
|
||||
expect(el("confirm-type").textContent).toBe("Native SepoliaETH transfer");
|
||||
expect(el("btn-confirm-send").disabled).toBe(false);
|
||||
await signAndSend();
|
||||
expect(mockNode.broadcast).toHaveLength(1);
|
||||
expect(mockNode.broadcast[0].chainId).toBe(11155111n);
|
||||
expect(Transaction.from(mockNode.broadcast[0].signed).chainId).toBe(
|
||||
11155111n,
|
||||
);
|
||||
expect(txStatus.showWait).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
describe.each([
|
||||
["sepolia", "mainnet", "SepoliaETH"],
|
||||
["mainnet", "sepolia", "ETH"],
|
||||
])(
|
||||
"a transfer reviewed on %s, with %s chosen in Settings before Sign & Send",
|
||||
(reviewedOn, switchedTo, symbol) => {
|
||||
test("is neither signed nor sent, and the screen says why", async () => {
|
||||
await review(reviewedOn);
|
||||
expect(el("confirm-type").textContent).toBe(
|
||||
"Native " + symbol + " transfer",
|
||||
);
|
||||
// Settings' network select, then Back, which only unhides the
|
||||
// screen as it was drawn.
|
||||
await onChainSwitch(switchedTo);
|
||||
await signAndSend();
|
||||
|
||||
expect(signTransaction).not.toHaveBeenCalled();
|
||||
expect(mockNode.broadcast).toEqual([]);
|
||||
expect(txStatus.showWait).not.toHaveBeenCalled();
|
||||
expect(txStatus.showError).not.toHaveBeenCalled();
|
||||
expect(el("confirm-errors").style.visibility).toBe("visible");
|
||||
expect(el("confirm-errors").innerHTML).toContain(
|
||||
"The active network changed after this transaction was" +
|
||||
" reviewed, so it was not sent. Please go back and review" +
|
||||
" it again.",
|
||||
);
|
||||
});
|
||||
},
|
||||
);
|
||||
|
||||
// The check in the click handler tells the user; the send itself carries the
|
||||
// chain id the screen was drawn for, so a signer on another network's node
|
||||
// cannot sign it even if the network changes after that check.
|
||||
test("the send is refused by a signer on another network's node", async () => {
|
||||
const { getProvider } = require("../src/shared/balances");
|
||||
const signer = new Wallet(PRIVATE_KEY).connect(
|
||||
getProvider("https://rpc.example.invalid", "mainnet"),
|
||||
);
|
||||
await expect(
|
||||
confirmTx.populateVerifyAndSend(signer, {
|
||||
token: "ETH",
|
||||
to: RECIPIENT,
|
||||
amount: "1",
|
||||
chainId: NETWORKS.sepolia.chainId,
|
||||
}),
|
||||
).rejects.toThrow("transaction chainId mismatch");
|
||||
expect(signTransaction).not.toHaveBeenCalled();
|
||||
expect(mockNode.broadcast).toEqual([]);
|
||||
});
|
||||
@@ -128,18 +128,6 @@ step("the popup is drawn in the monospace font it declares", async (env) => {
|
||||
);
|
||||
});
|
||||
|
||||
// The same check as the Chrome suite's (#456), so both browsers are held to
|
||||
// the same size.
|
||||
step("the popup's text is drawn at the 14px text-sm declares", async (env) => {
|
||||
const size = await env.driver.execute(
|
||||
"return getComputedStyle(document.body).fontSize;",
|
||||
);
|
||||
assert(
|
||||
size === "14px",
|
||||
"the popup's text is drawn at " + size + ", not at the 14px of text-sm",
|
||||
);
|
||||
});
|
||||
|
||||
// The recovery screen (#361): the Chrome suite's four cases, run before any
|
||||
// wallet exists for the same reason. With no wallet nothing saves on a timer,
|
||||
// so no save can write a good record over the unreadable one. The last of them
|
||||
|
||||
@@ -113,18 +113,6 @@ test("the popup is drawn in the monospace font it declares (#418)", async (env)
|
||||
);
|
||||
});
|
||||
|
||||
// The same stylesheet sets the size on body to 75%, which would draw the
|
||||
// popup at 12px.
|
||||
test("the popup's text is drawn at the 14px text-sm declares (#456)", async (env) => {
|
||||
const size = await env.page.evaluate(
|
||||
() => getComputedStyle(document.body).fontSize,
|
||||
);
|
||||
assert(
|
||||
size === "14px",
|
||||
"the popup's text is drawn at " + size + ", not at the 14px of text-sm",
|
||||
);
|
||||
});
|
||||
|
||||
// The empirical half of #182. The manifest change is only a claim about
|
||||
// what the CSP permits; this is the observation. Two things have to hold
|
||||
// together, and the run covers both: the popup realm compiles WASM (here),
|
||||
|
||||
@@ -240,7 +240,6 @@ function request(data) {
|
||||
beforeEach(() => {
|
||||
state.trackedTokens = [];
|
||||
state.wallets = [];
|
||||
state.networkId = "mainnet";
|
||||
});
|
||||
|
||||
describe("a token permission is warned about, naming spender and amount", () => {
|
||||
@@ -533,66 +532,3 @@ describe("the sign screen refuses a mismatched primary type", () => {
|
||||
expect(node("btn-approve-sign").disabled).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
// EIP-712: a wallet refuses typed data whose domain names a chain other than
|
||||
// the active one, because the signature is valid on the chain it names
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/519). The wallet is on Sepolia
|
||||
// and the site asks for a mainnet USDC Permit.
|
||||
describe("the sign screen refuses typed data for another chain", () => {
|
||||
const REFUSAL =
|
||||
"This typed data is for chain id 1, but the active network is Sepolia Testnet (chain id 11155111), so it cannot be signed.";
|
||||
|
||||
function withChainId(chainId) {
|
||||
return { ...PERMIT, domain: { ...PERMIT.domain, chainId } };
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
decryptWithPassword.mockClear();
|
||||
state.networkId = "sepolia";
|
||||
});
|
||||
|
||||
test("another chain shows the error, with Sign disabled", async () => {
|
||||
await openSignScreen(PERMIT);
|
||||
expect(node("approve-sign-error").textContent).toBe(REFUSAL);
|
||||
expect(node("btn-approve-sign").disabled).toBe(true);
|
||||
});
|
||||
|
||||
test("Sign clicked anyway decrypts and signs nothing", async () => {
|
||||
const sent = await openSignScreen(PERMIT);
|
||||
node("approve-sign-password").value = "any password";
|
||||
await click("btn-approve-sign");
|
||||
|
||||
expect(decryptWithPassword).not.toHaveBeenCalled();
|
||||
expect(sent.map((msg) => msg.type)).not.toContain(
|
||||
"AUTISTMASK_SIGN_RESPONSE",
|
||||
);
|
||||
expect(node("approve-sign-error").textContent).toBe(REFUSAL);
|
||||
});
|
||||
|
||||
// ethers signs 1, "1" and "0x1" as the same chain id.
|
||||
test("the chain id is refused in each form ethers signs", () => {
|
||||
for (const chainId of [1, "1", "0x1"]) {
|
||||
expect(typedDataRefusal(request(withChainId(chainId)))).toBe(
|
||||
REFUSAL,
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
test("a chain id that is not a number is refused", () => {
|
||||
expect(typedDataRefusal(request(withChainId("mainnet")))).toBe(
|
||||
"This typed data cannot be read, so it cannot be signed.",
|
||||
);
|
||||
});
|
||||
|
||||
test("the active chain leaves Sign enabled", async () => {
|
||||
await openSignScreen(withChainId("0xaa36a7"));
|
||||
expect(node("approve-sign-error").textContent).toBe("");
|
||||
expect(node("btn-approve-sign").disabled).toBe(false);
|
||||
});
|
||||
|
||||
test("no chain id leaves Sign enabled", async () => {
|
||||
await openSignScreen(withChainId(undefined));
|
||||
expect(node("approve-sign-error").textContent).toBe("");
|
||||
expect(node("btn-approve-sign").disabled).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user