harden: personal_sign display decodes only hex and renders control and bidirectional characters verbatim, without the raw bytes #403

New Issue

2026-09-21T20:37:56+02:00

clawbot commented

2026-09-21 20:37:56 +02:00

Severity: hardening.

Where. src/popup/views/approval.js:369-381 (decodeHexMessage) and
441-447 (the personal_sign message display).

What is wrong. decodeHexMessage slices two characters off the string and
parses the rest as hex byte pairs, so a message that is not 0x-prefixed hex
decodes to NUL/garbage; and a valid hex message that decodes to text containing
bidirectional overrides or zero-width characters is shown verbatim, so what the
user reads can differ from the byte order that signer.signMessage signs. The
raw hex is not shown alongside the decoded text.

Why it matters. A page can make the displayed message read differently from
what is signed.

Reproduction. A personal_sign request whose hex decodes to text containing
U+202E (right-to-left override) around a substituted clause renders reordered; a
non-hex message renders as invisible NUL characters.

Acceptable. Show the raw hex bytes alongside any decoded text; validate that
the input is hex before decoding; strip or visibly mark control and
bidirectional characters in the decoded view.

Definition of done.

The personal_sign screen shows the raw hex bytes as well as any decoded
text.
Control and bidirectional characters are escaped or visibly marked in the
decoded view.
A non-hex message is shown as such rather than as NUL characters.
A test asserts a bidi-override message is rendered without reordering the
visible text.

Model: fable-5-1 (review); opus-4-8 (filing)

Severity: hardening. **Where.** `src/popup/views/approval.js:369-381` (`decodeHexMessage`) and `441-447` (the personal_sign message display). **What is wrong.** `decodeHexMessage` slices two characters off the string and parses the rest as hex byte pairs, so a message that is not `0x`-prefixed hex decodes to NUL/garbage; and a valid hex message that decodes to text containing bidirectional overrides or zero-width characters is shown verbatim, so what the user reads can differ from the byte order that `signer.signMessage` signs. The raw hex is not shown alongside the decoded text. **Why it matters.** A page can make the displayed message read differently from what is signed. **Reproduction.** A personal_sign request whose hex decodes to text containing U+202E (right-to-left override) around a substituted clause renders reordered; a non-hex message renders as invisible NUL characters. **Acceptable.** Show the raw hex bytes alongside any decoded text; validate that the input is hex before decoding; strip or visibly mark control and bidirectional characters in the decoded view. **Definition of done.** - [ ] The personal_sign screen shows the raw hex bytes as well as any decoded text. - [ ] Control and bidirectional characters are escaped or visibly marked in the decoded view. - [ ] A non-hex message is shown as such rather than as NUL characters. - [ ] A test asserts a bidi-override message is rendered without reordering the visible text. Model: fable-5-1 (review); opus-4-8 (filing)

clawbot referenced this issue

2026-09-21 20:39:01 +02:00

security: pre-1.0 review of key handling, DEBUG mode and RPC/dApp input validation #383

~~clawbot referenced this issue 2026-10-03 14:21:22 +02:00~~

Review toward 1.0: identify and file all next steps #382

clawbot referenced this issue from a commit

2026-10-04 18:52:49 +02:00

harden: show a personal message's hex and mark control characters in its text (closes #403)

clawbot referenced a pull request that will close this issue

2026-10-04 19:11:53 +02:00

harden: show a personal message's hex and its text in byte order, hidden characters marked #435

clawbot commented

2026-10-04 19:19:29 +02:00

Built in #435. The signature screen now shows a personal message's hex under "Raw data" alongside the text it decodes to, and shows control, zero-width and bidirectional characters in that text as U+XXXX marks. A message that is not hex is shown as plain text with "Sign" disabled, because signing takes the bytes from the hex and such a message has none to sign.

Model: opus-5-5

Built in https://git.eeqj.de/sneak/AutistMask/pulls/435. The signature screen now shows a personal message's hex under "Raw data" alongside the text it decodes to, and shows control, zero-width and bidirectional characters in that text as `U+XXXX` marks. A message that is not hex is shown as plain text with "Sign" disabled, because signing takes the bytes from the hex and such a message has none to sign. Model: opus-5-5

clawbot referenced this issue from a commit

2026-10-04 19:59:52 +02:00

harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403)

clawbot referenced this issue from a commit

2026-10-04 20:29:37 +02:00

harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403)

clawbot referenced this issue from a commit

2026-10-04 21:01:07 +02:00

harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403)

clawbot referenced this issue from a commit

2026-10-04 21:28:53 +02:00

harden: show a personal message's hex and its text in byte order, hidden characters marked (closes #403)