cacf2c683c
Merge branch 'main' into fix/low-severity-security
check / check (push) Successful in 22s
2026-02-27 23:18:53 +01:00
4fdbc5adae
fmt: prettier format content/index.js
check / check (push) Successful in 21s
2026-02-27 14:10:37 -08:00
85427e1fd4
Merge branch 'main' into fix/low-severity-security
check / check (push) Failing after 13s
2026-02-27 23:08:40 +01:00
user
27f16191b4
fix(L4): use location.origin for postMessage, one-shot UUID listener
...
check / check (push) Failing after 13s
- Content script sends UUID via location.origin instead of "*"
- Inpage UUID listener removes itself after first message to prevent
malicious pages from overriding the persisted UUID
2026-02-27 11:58:57 -08:00
909543e943
fix(L5): truncate token name/symbol from RPC responses
...
Limits token name to 64 chars and symbol to 12 chars to prevent
storage of excessively long values from malicious contracts.
2026-02-27 11:58:19 -08:00
04a34d1a5e
fix(L4): generate EIP-6963 provider UUID at install time
...
UUID is generated once via crypto.randomUUID(), persisted in
chrome.storage.local, and sent from the content script to the
inpage script via postMessage.
2026-02-27 11:58:19 -08:00
98f68adb11
fix(L3): isUnlocked() returns false when no accounts exposed
...
_metamask.isUnlocked() now checks provider.selectedAddress instead of
always returning true.
2026-02-27 11:58:19 -08:00
