fix: a page with an opaque origin is refused, not treated as a site (closes #527)

A page with an opaque origin, such as one its server sandboxes with a
Content-Security-Policy, is reported to the background with the origin
"null". The background took that as a site, so every such page on every
website was one site: a connection remembered for one covered them all,
and the phishing check never matched. A request whose origin is "null" is
now refused with 4100, like one with no origin, before any method runs,
and is not credited to the site its URL names. tests/rpcOrigin.test.js
sends one, and README's SiteApproval says so.

Model: opus-5-5

README.md

@@ -2065,9 +2065,12 @@ view would leave a wallet one click from deletion.
   `wallet_requestPermissions` and is on neither the allowed nor the denied list.
   A site is its full origin, `scheme://host[:port]`, on both lists and for a
   connection allowed without "Remember": a choice for `https://dapp.example`
-  says nothing about `http://dapp.example` or another port of that host. The
-  background script prefers the toolbar popup (`action.openPopup()`) and falls
-  back to a separate popup window (`src/background/index.js`,
+  says nothing about `http://dapp.example` or another port of that host. A page
+  with an opaque origin, such as one its server sandboxes with a
+  Content-Security-Policy, is reported with the origin `null`, which is no site:
+  every request from it is refused with EIP-1193 code `4100` and opens no
+  prompt. The background script prefers the toolbar popup (`action.openPopup()`)
+  and falls back to a separate popup window (`src/background/index.js`,
   `requestApproval()`). Only one exists per site at a time: a further connection
   request from a site whose prompt is still unanswered is refused with EIP-1193
   code `-32002` and opens no new prompt. If that prompt was in a toolbar popup
@@ -2100,8 +2103,10 @@ view would leave a wallet one click from deletion.
   artifact can be compared with it field for field. A nonce the site supplies is
   ignored: the nonce is always the account's next nonce from the node, so a site
   cannot replace one of the user's pending transactions or leave this one stuck
-  behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is used
-  in place of the node's estimate; a request giving both with different values
+  behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is the
+  one shown and signed in place of the node's estimate, but the node still
+  estimates the transaction with that limit, as the check that it neither
+  reverts nor runs out of gas; a request that gives both with different values
   is refused. A request that cannot be populated — unreachable node, reverting
   gas estimate — opens no window and is failed back to the site. Only one
   transaction approval exists at a time: populating fixes the nonce, so a second

src/background/index.js

@@ -1428,6 +1428,11 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
         // the origin of sender.url is used: the frame that sent the message,
         // not the tab's page, which may be another site embedding that
         // frame. With neither, the request is refused.
+        //
+        // A page with an opaque origin, such as one its server sandboxes with
+        // a Content-Security-Policy, is reported with the origin "null". That
+        // is no site, so the request is refused too, and not credited to the
+        // site its URL names.
         let trustedOrigin = sender.origin;
         if (!trustedOrigin && sender.url) {
             try {
@@ -1436,7 +1441,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                 // an unparseable URL leaves the origin unknown
             }
         }
-        if (!trustedOrigin) {
+        if (!trustedOrigin || trustedOrigin === "null") {
             sendResponse({
                 error: {
                     code: 4100,

src/shared/approvalTx.js

@@ -201,6 +201,7 @@ async function prepareApprovalTx(provider, from, txParams) {
         throw fail("There is no active address to send this transaction from.");
     }
     const request = requestFrom(txParams || {}, from);
+    const signer = new VoidSigner(getAddress(from), provider);
 
     let populated;
     try {
@@ -208,10 +209,20 @@ async function prepareApprovalTx(provider, from, txParams) {
         // nonce, gas, fee and chain id are populated exactly as they were when
         // the popup did this. VoidSigner cannot sign, which is the point: the
         // background prepares, the popup signs.
+        //
+        // ethers asks the node for a gas estimate only when the request has
+        // no gas limit, and that estimate is the only check that the
+        // transaction does not revert. So a request carrying the site's gas
+        // limit is estimated first, with that limit: one that reverts, or
+        // needs more gas than the site gave it, fails here as well. The
+        // site's gas limit is still the one populated.
         populated = await withTimeout(
-            new VoidSigner(getAddress(from), provider).populateTransaction(
-                request,
-            ),
+            (async () => {
+                if (present(request.gasLimit)) {
+                    await signer.estimateGas(request);
+                }
+                return signer.populateTransaction(request);
+            })(),
             POPULATE_TIMEOUT_MS,
             "The transaction could not be prepared: the network did not answer in time.",
         );

tests/approvalTx.test.js

@@ -139,14 +139,20 @@ describe("prepareApprovalTx", () => {
     });
 
     // `gas` is the JSON-RPC name for the gas limit and the one sites send.
-    // The node would estimate 21000; the site's 200000 is what is shown and
-    // what is signed.
+    // The node is still asked for its estimate, with the site's gas limit,
+    // because the estimate is the check that the transaction does not revert.
+    // It estimates 21000; the site's 200000 is what is shown and what is
+    // signed.
     test("uses the gas limit a site sends as gas", async () => {
+        const estimateGas = jest.fn(async () => 21000n);
         const approved = await prepareApprovalTx(
-            providerWith(),
+            providerWith({ estimateGas }),
             signer.address,
             { ...TX_PARAMS, gas: "0x30d40" },
         );
+        expect(estimateGas).toHaveBeenCalledWith(
+            expect.objectContaining({ gasLimit: 200000n }),
+        );
         expect(approved.gasLimit).toBe("0x30d40");
         const signed = Transaction.from(
             await signer.signTransaction({ ...approved }),
@@ -297,6 +303,22 @@ describe("prepareApprovalTx", () => {
         expect(thrown.message).toMatch(/^[A-Z].*\.$/);
     });
 
+    test("fails back a reverting request that sends its own gas limit", async () => {
+        const reverting = providerWith({
+            estimateGas: async () => {
+                throw new Error("execution reverted: ERC20: transfer amount");
+            },
+        });
+        await expect(
+            prepareApprovalTx(reverting, signer.address, {
+                ...TX_PARAMS,
+                gas: "0x30d40",
+            }),
+        ).rejects.toThrow(
+            /^The transaction could not be prepared: execution reverted/,
+        );
+    });
+
     // Without a bound, an unreachable node leaves the page's promise pending
     // with nothing on screen to explain it.
     test("gives up on a node that never answers", async () => {
@@ -319,6 +341,28 @@ describe("prepareApprovalTx", () => {
             jest.useRealTimers();
         }
     });
+
+    // The estimate of a request carrying the site's gas limit is a call of its
+    // own, made before populating, and is bounded the same way.
+    test("gives up on a node that never answers the estimate of a request that sends its own gas limit", async () => {
+        jest.useFakeTimers();
+        try {
+            const hanging = providerWith({
+                estimateGas: () => new Promise(() => {}),
+            });
+            const pending = prepareApprovalTx(hanging, signer.address, {
+                ...TX_PARAMS,
+                gas: "0x30d40",
+            });
+            const settled = expect(pending).rejects.toThrow(
+                /did not answer in time/,
+            );
+            await jest.advanceTimersByTimeAsync(POPULATE_TIMEOUT_MS + 1);
+            await settled;
+        } finally {
+            jest.useRealTimers();
+        }
+    });
 });
 
 describe("serializeApprovedTx", () => {

tests/rpcOrigin.test.js

@@ -8,8 +8,14 @@
 // and a request the browser said nothing about was credited to whatever the
 // page wrote (https://git.eeqj.de/sneak/AutistMask/issues/407).
 //
-// Every sender here lacks sender.origin, as on old Firefox. The connection
-// check on eth_accounts is what shows which site a request was credited to.
+// A page with an opaque origin, such as one its server sandboxes with a
+// Content-Security-Policy, is reported with the origin "null". That names no
+// site, so its request is refused
+// (https://git.eeqj.de/sneak/AutistMask/issues/527).
+//
+// Every other sender here lacks sender.origin, as on old Firefox. The
+// connection check on eth_accounts is what shows which site a request was
+// credited to.
 
 const { makeStorageStub } = require("./support/storageStub");
 
@@ -144,3 +150,23 @@ describe("a request the browser does not say the sender of", () => {
         });
     });
 });
+
+describe("a request from a page with an opaque origin", () => {
+    test("is refused, whatever the page's URL says", async () => {
+        const accounts = loadBackground();
+
+        const result = await accounts({
+            origin: "null",
+            url: CONNECTED_ORIGIN + "/sandboxed.html",
+            tab: { url: CONNECTED_ORIGIN + "/sandboxed.html" },
+        });
+
+        expect(result).toEqual({
+            error: {
+                code: 4100,
+                message:
+                    "The wallet could not tell which site sent this request.",
+            },
+        });
+    });
+});