Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sneak
|
dae958bec3 |
@@ -239,12 +239,8 @@ provide:
|
||||
`make check` stays non-mutating. Linting runs only in the container, because
|
||||
an ESLint result that depends on whichever ESLint the host happens to have is
|
||||
not a result, so docker is required to lint.
|
||||
- `script/fmt` — format all files (writes), on the host, with the `prettier`
|
||||
that `script/bootstrap` installs in `node_modules/`; when that one is missing
|
||||
it fails and says to run `script/bootstrap`, instead of using a `prettier`
|
||||
from the `PATH`
|
||||
- `script/fmt-check` — check formatting (read-only), on the host, with the same
|
||||
`prettier` and the same refusal
|
||||
- `script/fmt` — format all files (writes), on the host
|
||||
- `script/fmt-check` — check formatting (read-only), on the host
|
||||
- `script/check` — run `script/test`, `script/lint` and `script/fmt-check`
|
||||
- `script/check-censored` — assert the competitor name RULES.md bars appears
|
||||
nowhere in the working tree or under `dist/` outside its documented
|
||||
@@ -426,12 +422,11 @@ captured at `eth_sendRawTransaction` rather than against anything the extension
|
||||
reported, rejecting each prompt is required to return a rejection to the page
|
||||
rather than hang or resolve, a network switch request is required to leave the
|
||||
stored network unchanged and send no `chainChanged` until it is approved, a
|
||||
network switch in Settings is required to send the page `chainChanged` with the
|
||||
new chain id, a prompt raised while another approval window has focus is
|
||||
required to open a window of its own, and the password is required to be absent
|
||||
from every message the approval window sends to the background — with the
|
||||
message that would carry it required to be present, so that check cannot pass by
|
||||
observing nothing. That last one is the standing floor under
|
||||
prompt raised while another approval window has focus is required to open a
|
||||
window of its own, and the password is required to be absent from every message
|
||||
the approval window sends to the background — with the message that would carry
|
||||
it required to be present, so that check cannot pass by observing nothing. That
|
||||
last one is the standing floor under
|
||||
[#157](https://git.eeqj.de/sneak/AutistMask/issues/157).
|
||||
|
||||
The limits of that coverage and of the rest of the Chrome suite, none of them
|
||||
@@ -1790,12 +1785,10 @@ view would leave a wallet one click from deletion.
|
||||
plus a "+ Add token" button
|
||||
- Display: "Show tracked tokens with zero balance" checkbox, "UTC
|
||||
Timestamps" checkbox, and a Theme selector (System / Light / Dark)
|
||||
- Network: network selector (Ethereum Mainnet / Sepolia Testnet). The
|
||||
- Network: network selector (Ethereum Mainnet / Sepolia Testnet); switching
|
||||
resets the RPC and Blockscout endpoints to that network's defaults. The
|
||||
network changes only here, or when the user approves a site's request on
|
||||
**NetworkApproval**; either way, switching restores the RPC and Blockscout
|
||||
endpoints last used on that network, or that network's defaults if it has
|
||||
none, and sends `chainChanged` with the new chain id to every open tab.
|
||||
Choosing the network already active changes nothing and sends nothing
|
||||
**NetworkApproval**
|
||||
- Ethereum RPC: endpoint URL input + "Save" button (validated against
|
||||
`eth_chainId` before being saved)
|
||||
- Blockscout API: endpoint URL input + "Save" button (validated against
|
||||
@@ -2075,11 +2068,7 @@ view would leave a wallet one click from deletion.
|
||||
artifact can be compared with it field for field. A nonce the site supplies is
|
||||
ignored: the nonce is always the account's next nonce from the node, so a site
|
||||
cannot replace one of the user's pending transactions or leave this one stuck
|
||||
behind a gap. A gas limit the site supplies, as `gas` or `gasLimit`, is the
|
||||
one shown and signed in place of the node's estimate, but the node still
|
||||
estimates the transaction with that limit, as the check that it neither
|
||||
reverts nor runs out of gas; a request that gives both with different values
|
||||
is refused. A request that cannot be populated — unreachable node, reverting
|
||||
behind a gap. A request that cannot be populated — unreachable node, reverting
|
||||
gas estimate — opens no window and is failed back to the site. Only one
|
||||
transaction approval exists at a time: populating fixes the nonce, so a second
|
||||
`eth_sendTransaction` arriving while one is unanswered is refused with
|
||||
@@ -2168,13 +2157,6 @@ view would leave a wallet one click from deletion.
|
||||
- Typed data that states no primary type, or one other than the type it
|
||||
would be signed as, or that cannot be read → shown with the error line
|
||||
saying so and "Sign" disabled; only "Reject" remains
|
||||
- Typed data whose domain `chainId` names a chain other than the active
|
||||
network's → shown with the error line naming both chain ids and "Sign"
|
||||
disabled; only "Reject" remains. EIP-712 asks for this, because the
|
||||
signature is valid on the chain the domain names. Typed data with no
|
||||
`chainId` is not refused. The background refuses such a signature too,
|
||||
against the network active when the signature reaches it, and answers the
|
||||
site with the same sentence
|
||||
- A `personal_sign` or `eth_sign` message that is not hex (`0x` or `0X` and
|
||||
an even number of hex digits, the form ethers' `getBytes` reads when
|
||||
signing) → shown as plain text, with the error line "This message is plain
|
||||
@@ -2215,9 +2197,8 @@ view would leave a wallet one click from deletion.
|
||||
- "Switch" / "Reject" buttons
|
||||
- **Transitions**:
|
||||
- "Switch" → closes popup; the background switches the network as
|
||||
**Settings** does, restoring the RPC and Blockscout endpoints last used on
|
||||
that network (or that network's defaults if it has none), sends
|
||||
`chainChanged` to every open tab, and answers the site with success
|
||||
**Settings** does, sends `chainChanged` to every open tab, and answers the
|
||||
site with success
|
||||
- "Reject" → closes popup; the site is answered with EIP-1193 code 4001 and
|
||||
nothing changes
|
||||
- Popup window closed without answering → the same as "Reject"
|
||||
@@ -2667,8 +2648,7 @@ plaintext list of anyone's domain names.
|
||||
When a dApp on a blocklisted domain requests a wallet connection, transaction
|
||||
approval, or signature, the approval popup displays a prominent red warning
|
||||
banner alerting the user. The domain checker matches exact hostnames and all
|
||||
parent domains (subdomain matching), and checks a hostname written with a
|
||||
trailing dot (`name.`) as `name`.
|
||||
parent domains (subdomain matching).
|
||||
|
||||
#### Transaction Decoding
|
||||
|
||||
|
||||
@@ -2,9 +2,10 @@
|
||||
|
||||
- `git pull` `next` and cut a branch from it — one branch per issue, named
|
||||
`issue-<N>-<slug>`. Never branch from `main`.
|
||||
- Do the work as one commit whose title ends with ` (closes #N)`.
|
||||
- Add no entry to Completed Steps. What landed is recorded on the tracker and in
|
||||
`git log`, where each commit title names the issue it closes.
|
||||
- Do the work as one commit whose title ends with ` (closes #N)`, with the
|
||||
`TODO.md` update in that same commit.
|
||||
- Move Next Step to the top of Completed Steps; move the top item of Future
|
||||
Steps into Next Step.
|
||||
- Run `make fmt`, then `make check`. A feature branch may be red; `next` and
|
||||
`main` may not.
|
||||
- Rebase onto current `next` immediately before pushing — other branches land on
|
||||
@@ -43,25 +44,6 @@ then continue tagging as milestones land.
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-10-08: The browser suites no longer read a screen before the page has
|
||||
shown it ([#502](https://git.eeqj.de/sneak/AutistMask/issues/502)). Their wait
|
||||
for a screen used to pass as soon as the element laid out, which every view
|
||||
does until the page's stylesheet has applied, so an approval test could read
|
||||
the prompt's fields before the page's script had filled them. `visible()` in
|
||||
`tests/e2e/harness.js` and `waitVisible()` in `tests/e2e/firefox/driver.js`
|
||||
now also wait for the page to finish loading and for neither the element nor
|
||||
anything around it to carry the `hidden` class that `showView()` puts on every
|
||||
view but the current one. No caller changed.
|
||||
|
||||
- 2026-10-08: Switching the network in Settings now tells open pages
|
||||
([#500](https://git.eeqj.de/sneak/AutistMask/issues/500)). Once the switch is
|
||||
saved, Settings asks the background to send `chainChanged` with the new chain
|
||||
id to every open tab, through the same function an approved site request uses.
|
||||
Choosing the network already active changes nothing and sends nothing. Only
|
||||
the extension's own pages can ask for this. `tests/chainSwitchGate.test.js`
|
||||
drives the real Settings view against the background, and the Chrome suite
|
||||
checks that the test page hears both switches.
|
||||
|
||||
- 2026-10-07: A site can no longer switch the wallet's network by itself
|
||||
([#408](https://git.eeqj.de/sneak/AutistMask/issues/408)). A connected site's
|
||||
`wallet_switchEthereumChain` request for the other supported network opens a
|
||||
@@ -72,8 +54,7 @@ then continue tagging as milestones land.
|
||||
or closing the prompt answers 4001. One such prompt per site at a time. The
|
||||
approval window no longer shows the connection prompt while it waits for the
|
||||
background to describe the approval, because that prompt's "Allow" answers on
|
||||
the same port as the new one; `tests/approvalWindow.test.js` checks that it
|
||||
shows no screen until then. `tests/chainSwitchGate.test.js` and both browser
|
||||
the same port as the new one. `tests/chainSwitchGate.test.js` and both browser
|
||||
suites drive the prompt.
|
||||
|
||||
- 2026-10-07: Two contradictions between the documents and the code are resolved
|
||||
|
||||
@@ -25,13 +25,6 @@ run_yarn() {
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
# Without the repo's own prettier, yarn runs whatever prettier is on
|
||||
# the PATH, which may be a version that formats files differently.
|
||||
if [ ! -x node_modules/.bin/prettier ]; then
|
||||
echo "fmt: this repo's prettier is not installed in node_modules/," \
|
||||
"so run script/bootstrap first." >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "Formatting..."
|
||||
run_yarn run fmt
|
||||
}
|
||||
|
||||
@@ -26,13 +26,6 @@ run_yarn() {
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
# Without the repo's own prettier, yarn runs whatever prettier is on
|
||||
# the PATH, which may be a version that formats files differently.
|
||||
if [ ! -x node_modules/.bin/prettier ]; then
|
||||
echo "fmt-check: this repo's prettier is not installed in" \
|
||||
"node_modules/, so run script/bootstrap first." >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "Checking formatting..."
|
||||
run_yarn run fmt-check
|
||||
}
|
||||
|
||||
+4
-31
@@ -22,7 +22,6 @@ const { debugFetch, log } = require("../shared/log");
|
||||
const {
|
||||
verifySignedTx,
|
||||
verifySignature,
|
||||
typedDataChainRefusal,
|
||||
failureIsRetryable,
|
||||
describeTxFailure,
|
||||
sameAddress,
|
||||
@@ -633,9 +632,8 @@ function isExtensionSender(sender) {
|
||||
// had refused.
|
||||
//
|
||||
// TX and sign approvals do not decide here. They stay pending across a
|
||||
// disconnect. When their window closes, the windows.onRemoved listener below
|
||||
// rejects them, unless an approved attempt is still running, in which case
|
||||
// that attempt answers the page.
|
||||
// disconnect — the user can reopen the toolbar popup — and are rejected by the
|
||||
// windows.onRemoved listener below.
|
||||
runtime.onConnect.addListener((port) => {
|
||||
if (port.name.startsWith("approval:")) {
|
||||
const id = port.name.split(":")[1];
|
||||
@@ -663,9 +661,7 @@ runtime.onConnect.addListener((port) => {
|
||||
const approval = pendingApprovals[id];
|
||||
if (approval) {
|
||||
if (approval.type === "tx" || approval.type === "sign") {
|
||||
// When its window closes, windows.onRemoved rejects it,
|
||||
// unless an approved attempt is still running, in which
|
||||
// case that attempt answers the page.
|
||||
// Keep pending — user can reopen the toolbar popup
|
||||
return;
|
||||
}
|
||||
settleApproval(id, { approved: false, remember: false });
|
||||
@@ -1475,7 +1471,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
"AUTISTMASK_ADDRESSES_REMOVED",
|
||||
"AUTISTMASK_GET_CONNECTED_SITES",
|
||||
"AUTISTMASK_REMOVE_SITE",
|
||||
"AUTISTMASK_NETWORK_CHANGED",
|
||||
];
|
||||
if (POPUP_ONLY_TYPES.includes(msg.type) && !isExtensionSender(sender)) {
|
||||
sendResponse({ error: "Unauthorized sender" });
|
||||
@@ -1768,8 +1763,7 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
const s = await getState();
|
||||
const activeAddress = activeAddressOf(s);
|
||||
const activeAddress = await getActiveAddress();
|
||||
// Same as the transaction path: the address the approval named
|
||||
// is the one that must have signed, and a switch since then is
|
||||
// a refusal rather than a signature from another account.
|
||||
@@ -1788,20 +1782,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
signature,
|
||||
approval.approvedFrom,
|
||||
);
|
||||
// The sign screen refuses typed data whose domain names
|
||||
// another chain. A signature for it that arrives anyway is
|
||||
// refused here, against the network active now.
|
||||
const sp = approval.signParams;
|
||||
if (
|
||||
sp.method === "eth_signTypedData_v4" ||
|
||||
sp.method === "eth_signTypedData"
|
||||
) {
|
||||
const refusal = typedDataChainRefusal(
|
||||
JSON.parse(sp.typedData).domain,
|
||||
networkById(s.networkId),
|
||||
);
|
||||
if (refusal) throw new ApprovalMismatchError(refusal);
|
||||
}
|
||||
settleApproval(msg.id, { signature }, { holdsClaim: true });
|
||||
sendResponse({ signature });
|
||||
} catch (e) {
|
||||
@@ -1874,13 +1854,6 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
broadcastSiteRemoved(msg.origin);
|
||||
return false;
|
||||
}
|
||||
|
||||
// Settings switched the network and has saved it. Open tabs are told the
|
||||
// new chain id the same way as after a site's approved switch request.
|
||||
if (msg.type === "AUTISTMASK_NETWORK_CHANGED") {
|
||||
broadcastChainChanged(msg.chainId);
|
||||
return false;
|
||||
}
|
||||
});
|
||||
|
||||
module.exports = { PROXY_METHODS };
|
||||
|
||||
+8
-12
@@ -7,10 +7,9 @@
|
||||
<link rel="stylesheet" href="styles.css" />
|
||||
</head>
|
||||
<!-- Chrome gives extension pages a stylesheet of its own that sets the
|
||||
font and its size on body, and a Tailwind class beats it only when
|
||||
marked important: hence font-mono! and text-sm! rather than
|
||||
font-mono and text-sm. -->
|
||||
<body class="bg-bg text-fg font-mono! text-sm!">
|
||||
font on body, and a Tailwind class beats it only when marked
|
||||
important: hence font-mono! rather than font-mono. -->
|
||||
<body class="bg-bg text-fg font-mono! text-sm">
|
||||
<div id="app" class="p-2 pr-5 overflow-x-hidden">
|
||||
<!-- ============ GLOBAL TITLE BAR ============ -->
|
||||
<div
|
||||
@@ -88,14 +87,11 @@
|
||||
|
||||
<!-- Mnemonic form section -->
|
||||
<div id="add-wallet-section-mnemonic">
|
||||
<!-- The die button shares the instruction's row: on a row
|
||||
of its own it pushes Import below the fold at
|
||||
360x600. -->
|
||||
<div class="mb-2 flex justify-between items-start gap-2">
|
||||
<p>
|
||||
Enter your 12 or 24 word recovery phrase below, or
|
||||
click the button to roll the die for a new one.
|
||||
</p>
|
||||
<p class="mb-2">
|
||||
Enter your 12 or 24 word recovery phrase below, or click
|
||||
the button to roll the die for a new one.
|
||||
</p>
|
||||
<div class="mb-1 flex justify-end">
|
||||
<button
|
||||
id="btn-generate-phrase"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer text-xs"
|
||||
|
||||
@@ -12,7 +12,7 @@ const {
|
||||
formatFee,
|
||||
tokenLabel,
|
||||
} = require("./helpers");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const {
|
||||
networkById,
|
||||
networkByChainId,
|
||||
@@ -46,10 +46,7 @@ const {
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { walletDefect } = require("../../shared/walletDefects");
|
||||
const {
|
||||
describeSigningFailure,
|
||||
typedDataChainRefusal,
|
||||
} = require("../../shared/approvalVerify");
|
||||
const { describeSigningFailure } = require("../../shared/approvalVerify");
|
||||
const txStatus = require("./txStatus");
|
||||
const uniswap = require("../../shared/uniswap");
|
||||
const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
|
||||
@@ -332,9 +329,9 @@ function showTxApproval(details) {
|
||||
const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
|
||||
const usdStr = formatUsd(ethUsd);
|
||||
// In the native currency of the network the transaction is for, which the
|
||||
// Network line names, not the active network's: the active network can
|
||||
// change, in Settings or when the user approves a site's request, after
|
||||
// this transaction is prepared and change back before it is signed.
|
||||
// Network line names, not the active network's: a site can switch the
|
||||
// active network after this transaction is prepared and back before it is
|
||||
// signed.
|
||||
$("approve-tx-value").textContent =
|
||||
ethValueFormatted +
|
||||
" " +
|
||||
@@ -446,8 +443,7 @@ function signedPrimaryType(types) {
|
||||
// Why a signature request cannot be signed, as a sentence for the error line,
|
||||
// or null when it can. Only typed data is refused: the `primaryType` the page
|
||||
// states has to be the type ethers will sign, or this screen would name one
|
||||
// message while another is signed. Its domain may name no chain but the active
|
||||
// network's.
|
||||
// message while another is signed.
|
||||
function typedDataRefusal(sp) {
|
||||
if (sp.method === "personal_sign" || sp.method === "eth_sign") return null;
|
||||
let data;
|
||||
@@ -470,7 +466,7 @@ function typedDataRefusal(sp) {
|
||||
", so it cannot be signed."
|
||||
);
|
||||
}
|
||||
return typedDataChainRefusal(data.domain, currentNetwork());
|
||||
return null;
|
||||
}
|
||||
|
||||
// The largest amount a Permit2 allowance can hold, a uint160. Permit2 treats
|
||||
|
||||
@@ -316,11 +316,7 @@ function init(ctx) {
|
||||
const networkSelect = $("settings-network");
|
||||
networkSelect.addEventListener("change", async () => {
|
||||
const newId = networkSelect.value;
|
||||
if (newId === state.networkId) return;
|
||||
const net = await onChainSwitch(newId);
|
||||
// Open pages are told by the background, as after a site's approved
|
||||
// switch request.
|
||||
notify({ type: "AUTISTMASK_NETWORK_CHANGED", chainId: net.chainId });
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
showFlash("Switched to " + net.name + ".");
|
||||
|
||||
@@ -84,9 +84,8 @@ function show(tx) {
|
||||
contractAddress: tx.contractAddress || null,
|
||||
// The network the history entry was read from. The type line and
|
||||
// the fee are in its native currency, not the active network's:
|
||||
// the active network can change, in Settings or when the user
|
||||
// approves a site's request, before a later popup shows this
|
||||
// screen again.
|
||||
// a site can switch the active network before a later popup
|
||||
// shows this screen again.
|
||||
chainId: tx.chainId,
|
||||
},
|
||||
};
|
||||
|
||||
@@ -89,9 +89,8 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
|
||||
|
||||
// A native amount, here and on the success and error screens, is in the
|
||||
// native currency of txInfo.chainId, the network the transaction was sent
|
||||
// on, not the active network's: the active network can change, in
|
||||
// Settings or when the user approves a site's request, while this screen
|
||||
// is open or before a later popup resumes it.
|
||||
// on, not the active network's: a site can switch the active network
|
||||
// while this screen is open or before a later popup resumes it.
|
||||
const symbol =
|
||||
txInfo.token === "ETH"
|
||||
? nativeCurrencyByChainId(txInfo.chainId)
|
||||
|
||||
+15
-53
@@ -1,14 +1,13 @@
|
||||
// Preparation of the transaction an approval screen displays.
|
||||
//
|
||||
// A dApp's eth_sendTransaction normally fixes `to`, `value` and `data`, and
|
||||
// sometimes the gas limit. The nonce, the fees, and the gas limit when the
|
||||
// site gives none have to be filled in from the network before anything can
|
||||
// be signed, and whoever fills them in decides what the user is shown. That
|
||||
// work used to happen in the popup, after the user had already approved: the
|
||||
// numbers on the approval screen came from the popup and were compared against
|
||||
// nothing, so a compromised popup could display one fee and sign another, and
|
||||
// the ceilings in approvalVerify.js were all that stood between the user and a
|
||||
// fee that hands the validator the balance.
|
||||
// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
|
||||
// The nonce, the gas limit and the fees have to be filled in from the network
|
||||
// before anything can be signed, and whoever fills them in decides what the
|
||||
// user is shown. That work used to happen in the popup, after the user had
|
||||
// already approved: the numbers on the approval screen came from the popup and
|
||||
// were compared against nothing, so a compromised popup could display one fee
|
||||
// and sign another, and the ceilings in approvalVerify.js were all that stood
|
||||
// between the user and a fee that hands the validator the balance.
|
||||
//
|
||||
// So it happens here instead, in the background, before the approval window is
|
||||
// opened. The background populates the transaction, shows that object, and
|
||||
@@ -32,7 +31,6 @@ const {
|
||||
VoidSigner,
|
||||
accessListify,
|
||||
getAddress,
|
||||
getBigInt,
|
||||
getBytes,
|
||||
hexlify,
|
||||
toQuantity,
|
||||
@@ -49,11 +47,10 @@ const {
|
||||
// minutes long, which is not a wait anyone will sit through.
|
||||
const POPULATE_TIMEOUT_MS = 20000;
|
||||
|
||||
// The request fields taken from the page, plus `gas`, which requestFrom()
|
||||
// takes as the gas limit. Anything else is dropped rather than passed to
|
||||
// ethers: the object is page-controlled, and a future ethers that learns to
|
||||
// carry a new transaction field must not start picking one up out of it
|
||||
// without this module knowing.
|
||||
// The request fields taken from the page. Anything else is dropped rather than
|
||||
// passed to ethers: the object is page-controlled, and a future ethers that
|
||||
// learns to carry a new transaction field must not start picking one up out of
|
||||
// it without this module knowing.
|
||||
//
|
||||
// The nonce is not taken from the page; it is always the account's next nonce
|
||||
// from the network. A page that chose it could replace one of the user's
|
||||
@@ -87,16 +84,6 @@ function present(v) {
|
||||
return v !== null && v !== undefined && v !== "";
|
||||
}
|
||||
|
||||
// Whether two quantities from the page are the same number. One that is not a
|
||||
// number matches nothing.
|
||||
function sameQuantity(a, b) {
|
||||
try {
|
||||
return getBigInt(a) === getBigInt(b);
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// These strings reach the user through the requesting page, so they are full
|
||||
// sentences even when the tail of one came from ethers or from the node.
|
||||
function sentence(text) {
|
||||
@@ -124,20 +111,6 @@ function requestFrom(txParams, from) {
|
||||
for (const key of REQUEST_FIELDS) {
|
||||
if (present(txParams[key])) request[key] = txParams[key];
|
||||
}
|
||||
// JSON-RPC calls the gas limit `gas`, and that is the name sites send.
|
||||
// ethers only reads `gasLimit`: left as `gas` it would be dropped and an
|
||||
// estimate signed in its place.
|
||||
if (present(txParams.gas)) {
|
||||
if (
|
||||
present(request.gasLimit) &&
|
||||
!sameQuantity(request.gasLimit, txParams.gas)
|
||||
) {
|
||||
throw fail(
|
||||
"The site asked for two different gas limits for this transaction.",
|
||||
);
|
||||
}
|
||||
request.gasLimit = txParams.gas;
|
||||
}
|
||||
if (
|
||||
present(request.type) &&
|
||||
!ALLOWED_TX_TYPES.includes(Number(request.type))
|
||||
@@ -201,7 +174,6 @@ async function prepareApprovalTx(provider, from, txParams) {
|
||||
throw fail("There is no active address to send this transaction from.");
|
||||
}
|
||||
const request = requestFrom(txParams || {}, from);
|
||||
const signer = new VoidSigner(getAddress(from), provider);
|
||||
|
||||
let populated;
|
||||
try {
|
||||
@@ -209,20 +181,10 @@ async function prepareApprovalTx(provider, from, txParams) {
|
||||
// nonce, gas, fee and chain id are populated exactly as they were when
|
||||
// the popup did this. VoidSigner cannot sign, which is the point: the
|
||||
// background prepares, the popup signs.
|
||||
//
|
||||
// ethers asks the node for a gas estimate only when the request has
|
||||
// no gas limit, and that estimate is the only check that the
|
||||
// transaction does not revert. So a request carrying the site's gas
|
||||
// limit is estimated first, with that limit: one that reverts, or
|
||||
// needs more gas than the site gave it, fails here as well. The
|
||||
// site's gas limit is still the one populated.
|
||||
populated = await withTimeout(
|
||||
(async () => {
|
||||
if (present(request.gasLimit)) {
|
||||
await signer.estimateGas(request);
|
||||
}
|
||||
return signer.populateTransaction(request);
|
||||
})(),
|
||||
new VoidSigner(getAddress(from), provider).populateTransaction(
|
||||
request,
|
||||
),
|
||||
POPULATE_TIMEOUT_MS,
|
||||
"The transaction could not be prepared: the network did not answer in time.",
|
||||
);
|
||||
|
||||
@@ -53,7 +53,6 @@ const {
|
||||
accessListify,
|
||||
formatEther,
|
||||
getAddress,
|
||||
getBigInt,
|
||||
getBytes,
|
||||
toQuantity,
|
||||
verifyMessage,
|
||||
@@ -636,33 +635,6 @@ function verifySignature(signParams, signature, expectedFrom) {
|
||||
return recovered;
|
||||
}
|
||||
|
||||
// Why typed data cannot be signed while `network` is the active network, as a
|
||||
// sentence, or null when it can. EIP-712 has a wallet refuse typed data whose
|
||||
// domain names another chain, because the signature is valid on that chain.
|
||||
// ethers signs no chain id when the domain's is null or absent, and reads any
|
||||
// other with getBigInt(), so 1, "1" and "0x1" are the same chain here too.
|
||||
function typedDataChainRefusal(domain, network) {
|
||||
const chainId = domain?.chainId;
|
||||
if (chainId === undefined || chainId === null) return null;
|
||||
let named;
|
||||
try {
|
||||
named = getBigInt(chainId);
|
||||
} catch {
|
||||
return "This typed data cannot be read, so it cannot be signed.";
|
||||
}
|
||||
const active = getBigInt(network.chainId);
|
||||
if (named === active) return null;
|
||||
return (
|
||||
"This typed data is for chain id " +
|
||||
named +
|
||||
", but the active network is " +
|
||||
network.name +
|
||||
" (chain id " +
|
||||
active +
|
||||
"), so it cannot be signed."
|
||||
);
|
||||
}
|
||||
|
||||
// The stage a transaction approval failed at. Which stage it is decides
|
||||
// whether the approval survives the failure.
|
||||
const TX_STAGE_SIGN = "sign";
|
||||
@@ -824,7 +796,6 @@ function describeSigningFailure(response, fallbackMessage) {
|
||||
module.exports = {
|
||||
verifySignedTx,
|
||||
verifySignature,
|
||||
typedDataChainRefusal,
|
||||
assertNoForbiddenFields,
|
||||
assertNothingUnchecked,
|
||||
assertCanonicalBytes,
|
||||
|
||||
@@ -110,14 +110,11 @@ function hashListed(hash) {
|
||||
* Generate hostname variants for subdomain matching.
|
||||
* "sub.evil.com" yields ["sub.evil.com", "evil.com"].
|
||||
*
|
||||
* A trailing dot is dropped: "evil.com." is the fully qualified spelling of
|
||||
* "evil.com", and the browser loads the same site from either.
|
||||
*
|
||||
* @param {string} hostname
|
||||
* @returns {string[]}
|
||||
*/
|
||||
function hostnameVariants(hostname) {
|
||||
const h = hostname.toLowerCase().replace(/\.$/, "");
|
||||
const h = hostname.toLowerCase();
|
||||
const variants = [h];
|
||||
const parts = h.split(".");
|
||||
// Parent domains: a.b.c.d -> b.c.d, c.d
|
||||
|
||||
@@ -36,13 +36,11 @@ const DEFECTS = {
|
||||
"derivation path beneath that key instead of from a master " +
|
||||
"key, so the addresses listed here are not the ones that key " +
|
||||
"produces under the standard path.",
|
||||
"Signing, sending and private key export are disabled for this " +
|
||||
"wallet. Anything these addresses hold can be reached outside " +
|
||||
"this wallet with the extended private key you imported, if " +
|
||||
"you kept a copy of it, or with the master extended private " +
|
||||
"key or recovery phrase it came from, in software that " +
|
||||
"repeats the same non-standard derivation. Check the " +
|
||||
"addresses in a block explorer before deciding what to do.",
|
||||
"Signing and sending are disabled for this wallet. The addresses " +
|
||||
"do descend from the extended private key you imported, so " +
|
||||
"anything they hold is still reachable by software that " +
|
||||
"repeats the same non-standard derivation. Check them in a " +
|
||||
"block explorer before deciding what to do.",
|
||||
"To see the addresses this key produces under the standard path, " +
|
||||
"import the master extended private key, or the recovery " +
|
||||
"phrase it came from, as a new wallet. Nothing here has been " +
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
// requesting page or the RPC node can say turns it into an approval that
|
||||
// should never have been raised.
|
||||
|
||||
const { Network, Transaction, Wallet, toQuantity } = require("ethers");
|
||||
const { Network, Wallet } = require("ethers");
|
||||
const {
|
||||
prepareApprovalTx,
|
||||
serializeApprovedTx,
|
||||
@@ -138,49 +138,6 @@ describe("prepareApprovalTx", () => {
|
||||
expect(approved.maxFeePerGas).toBe("0x12a05f200");
|
||||
});
|
||||
|
||||
// `gas` is the JSON-RPC name for the gas limit and the one sites send.
|
||||
// The node is still asked for its estimate, with the site's gas limit,
|
||||
// because the estimate is the check that the transaction does not revert.
|
||||
// It estimates 21000; the site's 200000 is what is shown and what is
|
||||
// signed.
|
||||
test("uses the gas limit a site sends as gas", async () => {
|
||||
const estimateGas = jest.fn(async () => 21000n);
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith({ estimateGas }),
|
||||
signer.address,
|
||||
{ ...TX_PARAMS, gas: "0x30d40" },
|
||||
);
|
||||
expect(estimateGas).toHaveBeenCalledWith(
|
||||
expect.objectContaining({ gasLimit: 200000n }),
|
||||
);
|
||||
expect(approved.gasLimit).toBe("0x30d40");
|
||||
const signed = Transaction.from(
|
||||
await signer.signTransaction({ ...approved }),
|
||||
);
|
||||
expect(signed.gasLimit).toBe(200000n);
|
||||
});
|
||||
|
||||
test("accepts gas and gasLimit that name the same number", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{ ...TX_PARAMS, gas: "0x30d40", gasLimit: 200000 },
|
||||
);
|
||||
expect(approved.gasLimit).toBe("0x30d40");
|
||||
});
|
||||
|
||||
test("refuses gas and gasLimit that disagree", async () => {
|
||||
await expect(
|
||||
prepareApprovalTx(providerWith(), signer.address, {
|
||||
...TX_PARAMS,
|
||||
gas: "0x30d40",
|
||||
gasLimit: "0x5208",
|
||||
}),
|
||||
).rejects.toThrow(
|
||||
"The site asked for two different gas limits for this transaction.",
|
||||
);
|
||||
});
|
||||
|
||||
test("carries an access list the request asked for", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
@@ -255,15 +212,6 @@ describe("prepareApprovalTx", () => {
|
||||
).rejects.toThrow(/gas limit no network this wallet supports/);
|
||||
});
|
||||
|
||||
test("refuses a gas limit the site sent above the ceiling", async () => {
|
||||
await expect(
|
||||
prepareApprovalTx(providerWith(), signer.address, {
|
||||
...TX_PARAMS,
|
||||
gas: toQuantity(MAX_GAS_LIMIT + 1n),
|
||||
}),
|
||||
).rejects.toThrow(/gas limit no network this wallet supports/);
|
||||
});
|
||||
|
||||
// The combined bound at population: a gas limit and a fee that are each
|
||||
// under their own ceiling but multiply to thousands of ETH is refused
|
||||
// before the approval window opens, so the user is never shown a
|
||||
@@ -303,22 +251,6 @@ describe("prepareApprovalTx", () => {
|
||||
expect(thrown.message).toMatch(/^[A-Z].*\.$/);
|
||||
});
|
||||
|
||||
test("fails back a reverting request that sends its own gas limit", async () => {
|
||||
const reverting = providerWith({
|
||||
estimateGas: async () => {
|
||||
throw new Error("execution reverted: ERC20: transfer amount");
|
||||
},
|
||||
});
|
||||
await expect(
|
||||
prepareApprovalTx(reverting, signer.address, {
|
||||
...TX_PARAMS,
|
||||
gas: "0x30d40",
|
||||
}),
|
||||
).rejects.toThrow(
|
||||
/^The transaction could not be prepared: execution reverted/,
|
||||
);
|
||||
});
|
||||
|
||||
// Without a bound, an unreachable node leaves the page's promise pending
|
||||
// with nothing on screen to explain it.
|
||||
test("gives up on a node that never answers", async () => {
|
||||
|
||||
@@ -58,6 +58,7 @@ const TX_PARAMS = {
|
||||
to: RECIPIENT,
|
||||
value: "0x2386f26fc10000",
|
||||
data: "0xdeadbeef",
|
||||
gas: "0x5208",
|
||||
};
|
||||
|
||||
// The values populateTransaction() fills in when the dApp fixed none of them.
|
||||
|
||||
@@ -1,47 +0,0 @@
|
||||
// The approval window shows no screen until the background has described the
|
||||
// approval it answers (https://git.eeqj.de/sneak/AutistMask/issues/408). The
|
||||
// connection prompt's "Allow" and the network switch prompt's "Switch" answer
|
||||
// on the same port, so a window that showed the connection prompt while it
|
||||
// waited could approve a network switch.
|
||||
//
|
||||
// Booted through the real popup entry point, which is where the connection
|
||||
// prompt used to be put up before the background had answered.
|
||||
|
||||
const {
|
||||
bootPopup,
|
||||
cleanupPopup,
|
||||
settle,
|
||||
unversionedValidProfile,
|
||||
} = require("./support/popupBoot");
|
||||
|
||||
afterEach(cleanupPopup);
|
||||
|
||||
test("the approval window shows no screen until the background describes the approval", async () => {
|
||||
// The background's answer, held until the test gives it.
|
||||
let answer = null;
|
||||
const env = await bootPopup(unversionedValidProfile(), {
|
||||
search: "?approval=approval-1",
|
||||
runtime: {
|
||||
connect: () => ({ postMessage: () => {} }),
|
||||
sendMessage: (msg, reply) => {
|
||||
if (msg.type === "AUTISTMASK_GET_APPROVAL") answer = reply;
|
||||
},
|
||||
},
|
||||
});
|
||||
|
||||
expect(answer).not.toBeNull();
|
||||
// No screen at all, the connection prompt included.
|
||||
expect(env.visibleViews()).toEqual([]);
|
||||
|
||||
answer({
|
||||
type: "network",
|
||||
origin: "https://dapp.example",
|
||||
currentNetworkId: "mainnet",
|
||||
requestedNetworkId: "sepolia",
|
||||
isPhishingDomain: false,
|
||||
});
|
||||
await settle();
|
||||
|
||||
expect(env.visibleViews()).toEqual(["approve-network"]);
|
||||
expect(env.pageErrors).toEqual([]);
|
||||
});
|
||||
@@ -397,13 +397,7 @@ function loadBackground(options) {
|
||||
rpcResult = r;
|
||||
},
|
||||
);
|
||||
return {
|
||||
id: () =>
|
||||
new URL(created[created.length - 1].url).searchParams.get(
|
||||
"approval",
|
||||
),
|
||||
result: () => rpcResult,
|
||||
};
|
||||
return { result: () => rpcResult };
|
||||
}
|
||||
|
||||
// A dApp asking to connect. The origin defaults to one the persisted
|
||||
@@ -1490,55 +1484,6 @@ describe("what the approval is verified against", () => {
|
||||
});
|
||||
});
|
||||
|
||||
// Typed data whose domain names another chain is refused on the sign
|
||||
// screen; a signature for it that reaches the background anyway is not
|
||||
// handed to the page (https://git.eeqj.de/sneak/AutistMask/issues/519).
|
||||
// TYPED_DATA names mainnet.
|
||||
async function answerTypedData(bg, pending) {
|
||||
const { domain, types, message } = JSON.parse(TYPED_DATA);
|
||||
delete types.EIP712Domain;
|
||||
const signature = await signer.signTypedData(domain, types, message);
|
||||
const answer = bg.send(
|
||||
{
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: pending.id(),
|
||||
approved: true,
|
||||
signature,
|
||||
},
|
||||
{ url: bg.fromPopup.url },
|
||||
);
|
||||
await settle();
|
||||
return { answer, signature };
|
||||
}
|
||||
|
||||
test("typed data for the active chain is handed back signed", async () => {
|
||||
const bg = loadBackground();
|
||||
const pending = bg.requestTypedData();
|
||||
await settle();
|
||||
|
||||
const { answer, signature } = await answerTypedData(bg, pending);
|
||||
|
||||
expect(answer.sendResponse).toHaveBeenCalledWith({ signature });
|
||||
expect(pending.result()).toEqual({ result: signature });
|
||||
});
|
||||
|
||||
test("typed data for another chain is refused, not handed back", async () => {
|
||||
const bg = loadBackground();
|
||||
bg.setNetwork(SEPOLIA);
|
||||
const pending = bg.requestTypedData();
|
||||
await settle();
|
||||
|
||||
const { answer } = await answerTypedData(bg, pending);
|
||||
|
||||
const refusal =
|
||||
"This typed data is for chain id 1, but the active network is Sepolia Testnet (chain id 11155111), so it cannot be signed.";
|
||||
expect(answer.sendResponse).toHaveBeenCalledWith({
|
||||
error: refusal,
|
||||
retryable: false,
|
||||
});
|
||||
expect(pending.result()).toEqual({ error: { message: refusal } });
|
||||
});
|
||||
|
||||
test("a sign request from another address raises no approval at all", async () => {
|
||||
const bg = loadBackground();
|
||||
const pending = bg.requestSign(other.address);
|
||||
|
||||
@@ -16,9 +16,7 @@
|
||||
//
|
||||
// The endpoint half of #308 lives in tests/networkEndpoints.test.js, which
|
||||
// covers the popup's chain switch; this file covers the background's, which
|
||||
// goes through storage rather than the shared state singleton. The last block
|
||||
// covers what the background tells open tabs when the user switches the
|
||||
// network in Settings.
|
||||
// goes through storage rather than the shared state singleton.
|
||||
|
||||
const { networkById } = require("../src/shared/networks");
|
||||
const { makeStorageStub } = require("./support/storageStub");
|
||||
@@ -227,14 +225,6 @@ function loadBackground() {
|
||||
answerPrompt,
|
||||
closePrompt,
|
||||
opened,
|
||||
// A message to the background from `sender`, and its answer.
|
||||
send: (msg, sender) => {
|
||||
let reply = null;
|
||||
messageListener(msg, sender, (r) => {
|
||||
reply = r;
|
||||
});
|
||||
return reply;
|
||||
},
|
||||
walletState: () => storage.read("autistmask"),
|
||||
chainChangedEvents: () =>
|
||||
toTabs.filter((m) => m.eventName === "chainChanged"),
|
||||
@@ -400,109 +390,3 @@ describe("only the user switches the network", () => {
|
||||
expect(bg.walletState().rpcUrl).toBe(CUSTOM_RPC);
|
||||
});
|
||||
});
|
||||
|
||||
// Switching the network in Settings tells open pages, as an approved site
|
||||
// request does (https://git.eeqj.de/sneak/AutistMask/issues/500). These drive
|
||||
// the real Settings view over the background's storage, with what it sends
|
||||
// delivered to the background from the extension's own page.
|
||||
describe("switching the network in Settings tells every open tab", () => {
|
||||
const POPUP = { url: EXT_URL + "src/popup/index.html" };
|
||||
|
||||
// A stand-in for one DOM node: enough of an element for init() to set
|
||||
// properties on it and hang listeners off it.
|
||||
function fakeElement() {
|
||||
return {
|
||||
value: "",
|
||||
checked: false,
|
||||
textContent: "",
|
||||
style: {},
|
||||
dataset: {},
|
||||
classList: { add() {}, remove() {} },
|
||||
listeners: {},
|
||||
addEventListener(event, handler) {
|
||||
this.listeners[event] = handler;
|
||||
},
|
||||
querySelectorAll: () => [],
|
||||
};
|
||||
}
|
||||
|
||||
// Settings, opened the way the popup opens it. Returns its network
|
||||
// selector.
|
||||
async function openSettings(bg) {
|
||||
const elements = {};
|
||||
const element = (id) => (elements[id] ||= fakeElement());
|
||||
jest.doMock("../src/popup/views/helpers", () => ({
|
||||
$: element,
|
||||
showView: () => {},
|
||||
updateDebugBanner: () => {},
|
||||
showFlash: () => {},
|
||||
escapeHtml: (s) => s,
|
||||
flashCopyFeedback: () => {},
|
||||
goBack: () => {},
|
||||
pushCurrentView: () => {},
|
||||
onViewLeave: () => {},
|
||||
VIEWS: [],
|
||||
}));
|
||||
global.chrome.runtime.sendMessage = (msg) => {
|
||||
bg.send(msg, POPUP);
|
||||
};
|
||||
await require("../src/shared/state").loadState();
|
||||
require("../src/popup/views/settings").init({
|
||||
pageClosed: new AbortController().signal,
|
||||
});
|
||||
const select = element("settings-network");
|
||||
select.value = "mainnet";
|
||||
return select;
|
||||
}
|
||||
|
||||
// The user picks `networkId` in the selector.
|
||||
async function choose(select, networkId) {
|
||||
select.value = networkId;
|
||||
await select.listeners.change();
|
||||
await settle();
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
jest.dontMock("../src/popup/views/helpers");
|
||||
});
|
||||
|
||||
test("switching to the other network sends chainChanged once, with its chain id", async () => {
|
||||
const bg = loadBackground();
|
||||
const select = await openSettings(bg);
|
||||
|
||||
await choose(select, "sepolia");
|
||||
|
||||
expect(bg.walletState().networkId).toBe("sepolia");
|
||||
expect(bg.chainChangedEvents()).toEqual([
|
||||
{
|
||||
type: "AUTISTMASK_EVENT",
|
||||
eventName: "chainChanged",
|
||||
data: SEPOLIA.chainId,
|
||||
},
|
||||
]);
|
||||
});
|
||||
|
||||
test("choosing the network already active changes nothing and sends nothing", async () => {
|
||||
const bg = loadBackground();
|
||||
const select = await openSettings(bg);
|
||||
const before = bg.walletState();
|
||||
|
||||
await choose(select, "mainnet");
|
||||
|
||||
expect(bg.walletState()).toEqual(before);
|
||||
expect(bg.chainChangedEvents()).toEqual([]);
|
||||
});
|
||||
|
||||
test("a page cannot make the background send chainChanged", async () => {
|
||||
const bg = loadBackground();
|
||||
|
||||
const reply = bg.send(
|
||||
{ type: "AUTISTMASK_NETWORK_CHANGED", chainId: SEPOLIA.chainId },
|
||||
{ url: CONNECTED_ORIGIN + "/" },
|
||||
);
|
||||
await settle();
|
||||
|
||||
expect(reply).toEqual({ error: "Unauthorized sender" });
|
||||
expect(bg.chainChangedEvents()).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -279,18 +279,12 @@ class Driver {
|
||||
|
||||
// Shown means shown: in the popup a view is switched by toggling a
|
||||
// "hidden" class, and an element that is present but collapsed is not
|
||||
// the thing a test means by visible. Until the page's stylesheet has
|
||||
// applied that class hides nothing and every view lays out, so the page
|
||||
// must also have finished loading, which it does only after its
|
||||
// stylesheet, and neither the element nor anything enclosing it may
|
||||
// carry the class (https://git.eeqj.de/sneak/AutistMask/issues/502).
|
||||
// the thing a test means by visible.
|
||||
async waitVisible(selector, timeout = DEFAULT_WAIT_MS) {
|
||||
return this.waitFor(
|
||||
"selector " + selector + " to be visible",
|
||||
`const el = document.querySelector(arguments[0]);
|
||||
if (document.readyState !== "complete" || !el) return false;
|
||||
if (el.closest(".hidden")) return false;
|
||||
if (getComputedStyle(el).visibility !== "visible") return false;
|
||||
if (!el) return false;
|
||||
const r = el.getBoundingClientRect();
|
||||
return r.width > 0 && r.height > 0;`,
|
||||
[selector],
|
||||
|
||||
@@ -128,18 +128,6 @@ step("the popup is drawn in the monospace font it declares", async (env) => {
|
||||
);
|
||||
});
|
||||
|
||||
// The same check as the Chrome suite's (#456), so both browsers are held to
|
||||
// the same size.
|
||||
step("the popup's text is drawn at the 14px text-sm declares", async (env) => {
|
||||
const size = await env.driver.execute(
|
||||
"return getComputedStyle(document.body).fontSize;",
|
||||
);
|
||||
assert(
|
||||
size === "14px",
|
||||
"the popup's text is drawn at " + size + ", not at the 14px of text-sm",
|
||||
);
|
||||
});
|
||||
|
||||
// The recovery screen (#361): the Chrome suite's four cases, run before any
|
||||
// wallet exists for the same reason. With no wallet nothing saves on a timer,
|
||||
// so no save can write a good record over the unreadable one. The last of them
|
||||
|
||||
+1
-26
@@ -333,33 +333,8 @@ async function launch(routeOpts) {
|
||||
|
||||
const PASSWORD = "e2e-harness-password";
|
||||
|
||||
// Waits until the page shows `selector`, not only until it lays out. Until the
|
||||
// page's stylesheet has applied, the `hidden` class that showView() keeps on
|
||||
// every view but the current one hides nothing and every view lays out, so a
|
||||
// test could read a screen before the page's script had filled it
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/502). So the page must also
|
||||
// have finished loading, which it does only after its stylesheet, and neither
|
||||
// the element nor anything enclosing it may carry `hidden`. Polled on a timer:
|
||||
// animation frames are not guaranteed to a window that is not in front.
|
||||
async function visible(page, selector, timeout = 15000) {
|
||||
await page
|
||||
.waitForFunction(
|
||||
(sel) => {
|
||||
const el = document.querySelector(sel);
|
||||
if (document.readyState !== "complete" || !el) return false;
|
||||
if (el.closest(".hidden")) return false;
|
||||
if (getComputedStyle(el).visibility !== "visible") return false;
|
||||
const r = el.getBoundingClientRect();
|
||||
return r.width > 0 && r.height > 0;
|
||||
},
|
||||
selector,
|
||||
{ polling: 50, timeout },
|
||||
)
|
||||
.catch((e) => {
|
||||
throw new Error(
|
||||
"the page did not show " + selector + ": " + e.message,
|
||||
);
|
||||
});
|
||||
await page.waitForSelector(selector, { state: "visible", timeout });
|
||||
}
|
||||
|
||||
// An empty WebAssembly module: magic number and version header, no
|
||||
|
||||
@@ -113,18 +113,6 @@ test("the popup is drawn in the monospace font it declares (#418)", async (env)
|
||||
);
|
||||
});
|
||||
|
||||
// The same stylesheet sets the size on body to 75%, which would draw the
|
||||
// popup at 12px.
|
||||
test("the popup's text is drawn at the 14px text-sm declares (#456)", async (env) => {
|
||||
const size = await env.page.evaluate(
|
||||
() => getComputedStyle(document.body).fontSize,
|
||||
);
|
||||
assert(
|
||||
size === "14px",
|
||||
"the popup's text is drawn at " + size + ", not at the 14px of text-sm",
|
||||
);
|
||||
});
|
||||
|
||||
// The empirical half of #182. The manifest change is only a claim about
|
||||
// what the CSP permits; this is the observation. Two things have to hold
|
||||
// together, and the run covers both: the popup realm compiles WASM (here),
|
||||
@@ -4550,42 +4538,6 @@ test("a site's network switch changes nothing until the user approves it (#408)"
|
||||
);
|
||||
});
|
||||
|
||||
// Switching the network in Settings tells the page too, as an approved site
|
||||
// request does (https://git.eeqj.de/sneak/AutistMask/issues/500). The wallet
|
||||
// goes back to mainnet the same way at the end.
|
||||
test("a network switch in Settings tells the page (#500)", async (env) => {
|
||||
const { mainnet, sepolia } = NETWORKS;
|
||||
const before = await storedNetwork(env.page);
|
||||
assert(
|
||||
before.networkId === "mainnet",
|
||||
"this test starts on mainnet, not on " + before.networkId,
|
||||
);
|
||||
const eventsBefore = (await chainChangedEvents(env.dapp)).length;
|
||||
await openSettings(env.page);
|
||||
|
||||
await env.page.selectOption("#settings-network", "sepolia");
|
||||
let events = await chainChangedEvents(env.dapp, eventsBefore + 1);
|
||||
assert(
|
||||
events.length === eventsBefore + 1 &&
|
||||
events[events.length - 1].data === sepolia.chainId,
|
||||
"the page was not told of the switch to Sepolia: " +
|
||||
JSON.stringify(events),
|
||||
);
|
||||
|
||||
await env.page.selectOption("#settings-network", "mainnet");
|
||||
events = await chainChangedEvents(env.dapp, eventsBefore + 2);
|
||||
assert(
|
||||
events.length === eventsBefore + 2 &&
|
||||
events[events.length - 1].data === mainnet.chainId,
|
||||
"the page was not told of the switch back to mainnet: " +
|
||||
JSON.stringify(events),
|
||||
);
|
||||
assert(
|
||||
isDeepStrictEqual(await storedNetwork(env.page), before),
|
||||
"switching back did not restore the mainnet network and endpoints",
|
||||
);
|
||||
});
|
||||
|
||||
// The closing pass over both boundaries at once. Every message the section
|
||||
// put on either channel is re-read here and required to be free of the
|
||||
// password — and required to be there at all, method by method, so the
|
||||
|
||||
@@ -345,10 +345,10 @@ describe.each([
|
||||
});
|
||||
|
||||
// A transaction's value and fee are in the native currency of the network the
|
||||
// transaction is on, which need not be the active one. The active network can
|
||||
// change, in Settings or when the user approves a site's request, after a
|
||||
// transaction is prepared and change back before it is signed, and a popup
|
||||
// opened after a switch shows a sent or listed transaction again. The wallet's balances follow the active network; these do not.
|
||||
// transaction is on, which need not be the active one. A site can switch the
|
||||
// active network after its transaction is prepared and back before it is
|
||||
// signed, and a popup opened after a switch shows a sent or listed transaction
|
||||
// again. The wallet's balances follow the active network; these do not.
|
||||
describe.each([
|
||||
["mainnet", "sepolia", "ETH"],
|
||||
["sepolia", "mainnet", "SepoliaETH"],
|
||||
|
||||
@@ -89,12 +89,6 @@ describe("vendored blocklist", () => {
|
||||
expect(isPhishingDomain(LISTED[0].toUpperCase())).toBe(true);
|
||||
});
|
||||
|
||||
test("a hostname ending in a dot is the same host", () => {
|
||||
expect(isPhishingDomain(LISTED[1] + ".")).toBe(true);
|
||||
expect(isPhishingDomain("wallet." + LISTED[1] + ".")).toBe(true);
|
||||
expect(isPhishingDomain(CLEAN[0] + ".")).toBe(false);
|
||||
});
|
||||
|
||||
test("returns false for an empty or missing hostname", () => {
|
||||
expect(isPhishingDomain("")).toBe(false);
|
||||
expect(isPhishingDomain(null)).toBe(false);
|
||||
@@ -139,13 +133,6 @@ describe("hostnameVariants", () => {
|
||||
test("lowercases hostnames", () => {
|
||||
expect(hostnameVariants("Evil.COM")).toEqual(["evil.com"]);
|
||||
});
|
||||
|
||||
test("drops the trailing dot of a fully qualified hostname", () => {
|
||||
expect(hostnameVariants("sub.evil.com.")).toEqual([
|
||||
"sub.evil.com",
|
||||
"evil.com",
|
||||
]);
|
||||
});
|
||||
});
|
||||
|
||||
describe("domain hashing", () => {
|
||||
|
||||
@@ -238,10 +238,6 @@ async function settle() {
|
||||
* @param {object} [options]
|
||||
* @param {object} [options.storage] a storage stub from makeStorageStub(), for
|
||||
* a test that needs to make writes fail or to watch the round trips.
|
||||
* @param {string} [options.search] the page URL's query string, such as
|
||||
* "?approval=" and an id for the popup opened as an approval window.
|
||||
* @param {object} [options.runtime] members of chrome.runtime that replace the
|
||||
* stub's own, for a test that has to answer the background's messages.
|
||||
* @returns {Promise<object>} handles onto the booted page.
|
||||
*/
|
||||
async function bootPopup(stored, options) {
|
||||
@@ -285,13 +281,12 @@ async function bootPopup(stored, options) {
|
||||
sendMessage: jest.fn(async () => ({})),
|
||||
getURL: (p) => "chrome-extension://autistmask/" + p,
|
||||
onMessage: { addListener: () => {} },
|
||||
...(options && options.runtime),
|
||||
},
|
||||
};
|
||||
globalThis.document = document;
|
||||
globalThis.window = {
|
||||
location: {
|
||||
search: (options && options.search) || "",
|
||||
search: "",
|
||||
href: "chrome-extension://autistmask/src/popup/index.html",
|
||||
reload: () => reloads.push(Date.now()),
|
||||
},
|
||||
|
||||
@@ -240,7 +240,6 @@ function request(data) {
|
||||
beforeEach(() => {
|
||||
state.trackedTokens = [];
|
||||
state.wallets = [];
|
||||
state.networkId = "mainnet";
|
||||
});
|
||||
|
||||
describe("a token permission is warned about, naming spender and amount", () => {
|
||||
@@ -533,66 +532,3 @@ describe("the sign screen refuses a mismatched primary type", () => {
|
||||
expect(node("btn-approve-sign").disabled).toBe(true);
|
||||
});
|
||||
});
|
||||
|
||||
// EIP-712: a wallet refuses typed data whose domain names a chain other than
|
||||
// the active one, because the signature is valid on the chain it names
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/519). The wallet is on Sepolia
|
||||
// and the site asks for a mainnet USDC Permit.
|
||||
describe("the sign screen refuses typed data for another chain", () => {
|
||||
const REFUSAL =
|
||||
"This typed data is for chain id 1, but the active network is Sepolia Testnet (chain id 11155111), so it cannot be signed.";
|
||||
|
||||
function withChainId(chainId) {
|
||||
return { ...PERMIT, domain: { ...PERMIT.domain, chainId } };
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
decryptWithPassword.mockClear();
|
||||
state.networkId = "sepolia";
|
||||
});
|
||||
|
||||
test("another chain shows the error, with Sign disabled", async () => {
|
||||
await openSignScreen(PERMIT);
|
||||
expect(node("approve-sign-error").textContent).toBe(REFUSAL);
|
||||
expect(node("btn-approve-sign").disabled).toBe(true);
|
||||
});
|
||||
|
||||
test("Sign clicked anyway decrypts and signs nothing", async () => {
|
||||
const sent = await openSignScreen(PERMIT);
|
||||
node("approve-sign-password").value = "any password";
|
||||
await click("btn-approve-sign");
|
||||
|
||||
expect(decryptWithPassword).not.toHaveBeenCalled();
|
||||
expect(sent.map((msg) => msg.type)).not.toContain(
|
||||
"AUTISTMASK_SIGN_RESPONSE",
|
||||
);
|
||||
expect(node("approve-sign-error").textContent).toBe(REFUSAL);
|
||||
});
|
||||
|
||||
// ethers signs 1, "1" and "0x1" as the same chain id.
|
||||
test("the chain id is refused in each form ethers signs", () => {
|
||||
for (const chainId of [1, "1", "0x1"]) {
|
||||
expect(typedDataRefusal(request(withChainId(chainId)))).toBe(
|
||||
REFUSAL,
|
||||
);
|
||||
}
|
||||
});
|
||||
|
||||
test("a chain id that is not a number is refused", () => {
|
||||
expect(typedDataRefusal(request(withChainId("mainnet")))).toBe(
|
||||
"This typed data cannot be read, so it cannot be signed.",
|
||||
);
|
||||
});
|
||||
|
||||
test("the active chain leaves Sign enabled", async () => {
|
||||
await openSignScreen(withChainId("0xaa36a7"));
|
||||
expect(node("approve-sign-error").textContent).toBe("");
|
||||
expect(node("btn-approve-sign").disabled).toBe(false);
|
||||
});
|
||||
|
||||
test("no chain id leaves Sign enabled", async () => {
|
||||
await openSignScreen(withChainId(undefined));
|
||||
expect(node("approve-sign-error").textContent).toBe("");
|
||||
expect(node("btn-approve-sign").disabled).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -153,18 +153,6 @@ describe("the explanatory copy", () => {
|
||||
expect(all).not.toMatch(/\blost\b|\bstolen\b|\bgone\b/i);
|
||||
});
|
||||
|
||||
// The wallet holds the imported key but will not export it, so the copy
|
||||
// must name every key the user may hold that reaches the addresses
|
||||
// outside it.
|
||||
test("it names the keys that reach the addresses outside this wallet", () => {
|
||||
const body = defect.paragraphs.join(" ");
|
||||
|
||||
expect(body).toMatch(/private key export are disabled/);
|
||||
expect(body).toMatch(
|
||||
/with the extended private key you imported, if you kept a copy of it, or with the master extended private key or recovery phrase it came from, in software that repeats the same non-standard derivation/,
|
||||
);
|
||||
});
|
||||
|
||||
test("it says the wallet is not deleted and what the user can do", () => {
|
||||
const body = defect.paragraphs.join(" ");
|
||||
|
||||
|
||||
Reference in New Issue
Block a user