sneak 248057a25d harden: show a personal message's hex and mark control characters in its text (closes #403) ...

The signature screen showed only the text a personal message decodes
to, with bidirectional and zero-width characters acting on it, so a
site could make the message read differently from the bytes that are
signed, and a message that was not hex was decoded into NUL
characters. The screen now shows the hex as "Raw data" alongside the
decoded text, and each control or format character in the text as a
U+XXXX mark. Signing takes the bytes from the hex, so a message that
is not hex cannot be signed: it is shown as plain text, with the error
line saying so and "Sign" disabled.

Model: opus-5-5

2026-10-04 16:52:46 +00:00

..

e2e

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

support

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

addressValue.test.js

fix: an address holding only unpriced tokens is no longer totalled at $0.00 (closes #261)

2026-08-17 08:38:10 +02:00

addWalletSeparatePassword.test.js

fix: say a second wallet's password is separate when one is chosen (closes #374)

2026-09-21 21:11:09 +02:00

alarms.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

approvalAmount.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

approvalDisplayFloor.test.js

fix: never render a nonzero approval amount as zero (closes #322)

2026-08-23 15:43:04 +02:00

approvalNonce.test.js

harden: ignore a nonce the page supplies with eth_sendTransaction (closes #404)

2026-10-04 18:43:04 +02:00

approvalOrigin.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

approvalTx.test.js

harden: ignore a nonce the page supplies with eth_sendTransaction (closes #404)

2026-10-04 18:43:04 +02:00

approvalVerify.test.js

harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

2026-09-21 21:45:34 +02:00

backgroundApproval.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

backgroundStateIsolation.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

backgroundStateLintRule.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

backNavigation.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

balanceLineEscaping.test.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

buildForbiddenInputs.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

chainSwitchGate.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

coldWorkerChainId.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

coldWorkerChainSwitch.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

coldWorkerSendTransaction.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

confirmTxFeeBound.test.js

harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399)

2026-09-21 21:45:34 +02:00

constants.test.js

build: assert DEBUG is off in every emitted bundle as a post-build check (closes #170)

2026-08-10 16:15:22 +02:00

contractCreation.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

debugBanner.test.js

chore: keep the internal view id out of the release banner (closes #375)

2026-09-22 00:45:06 +02:00

deleteAddress.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

deleteWalletLostPassword.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

dustThreshold.test.js

fix: keep the flash line to its one line at any message length (closes #252)

2026-10-04 10:22:51 +02:00

etherscanLabels.test.js

feat: expand confirm-tx warnings — closes #114 (#118)

2026-03-01 19:34:54 +01:00

exportPrivkey.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

extensionId.test.js

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)

2026-09-21 18:29:39 +02:00

fabricatedDecimals.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

flashLine.test.js

fix: keep the flash line to its one line at any message length (closes #252)

2026-10-04 10:22:51 +02:00

holders.test.js

fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230)

2026-08-12 10:34:45 +02:00

htmlEscape.test.js

harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

2026-08-20 13:47:28 +02:00

inpageErrors.test.js

fix: refuse an unsupported method with EIP-1193 code 4200 (closes #279)

2026-10-04 09:24:41 +02:00

inpageProviderUuid.test.js

security: announce a fresh EIP-6963 provider UUID per page load (closes #398)

2026-10-03 16:26:39 +02:00

manifest.test.js

fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371)

2026-08-23 21:26:14 +02:00

networkEndpoints.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

packaging.test.js

fix: declare and ship toolbar icons, so neither browser renders a puzzle piece (closes #371)

2026-08-23 21:26:14 +02:00

passwordMessages.test.js

fix: one wording for an empty password field on every screen (closes #265)

2026-08-17 08:59:59 +02:00

persistedEntryFloors.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

persistedFieldContract.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

personalSignDisplay.test.js

harden: show a personal message's hex and mark control characters in its text (closes #403)

2026-10-04 16:52:46 +00:00

phishingDomains.test.js

feat: vendor and censor the phishing blocklist at build time (closes #219)

2026-08-17 10:05:56 +02:00

popupElementIds.test.js

fix: floor malformed allowedSites, fraudContracts and selectedToken entries (closes #362)

2026-08-23 23:06:17 +02:00

resolveTokenSymbol.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

rpcOrigin.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

sendDisplayFloor.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

sendTokenSelect.test.js

fix: distinguish an unknown holder count from zero so a legitimate token is not filtered (closes #230)

2026-08-12 10:34:45 +02:00

settingsUtcTimestamps.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

showPhrase.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

state.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateMerge.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

stateRecovery.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

stateSchema.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

stateUnusableRpc.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

symbolSpoof.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

transactions.test.js

harden: stop the background reading the shared state singleton, and enforce it at build time (closes #324)

2026-08-23 17:57:30 +02:00

transferAmount.test.js

fix: sign the ERC-20 amount the confirmation screen displayed (closes #305)

2026-08-20 12:31:28 +02:00

txStatus.test.js

fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

2026-08-23 20:04:00 +02:00

txValidation.test.js

fix: count the network fee in the confirm-screen balance check (closes #154)

2026-08-11 15:41:37 +02:00

typedDataPermit.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00

uniswap.test.js

fix: decode Uniswap V2 exact-out swaps, input amount shown as a maximum (closes #283)

2026-10-04 15:09:09 +02:00

uniswapTokenOut.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

uniswapUndeterminedTokenIn.test.js

harden: state an undetermined swap input token as undetermined, not as ETH (closes #357)

2026-08-23 20:23:05 +02:00

uniswapUndeterminedTokenOut.test.js

harden: state an undetermined V4 output token as undetermined, not as ETH (closes #353)

2026-08-23 18:13:20 +02:00

uniswapUnknownDecimals.test.js

fix: name a tracked or explorer-known token instead of "Unknown token" (closes #323)

2026-09-21 21:28:06 +02:00

unknownScaleDisplay.test.js

fix: store an absent explorer decimals as unknown instead of fabricating 18 (closes #349)

2026-08-23 21:19:04 +02:00

unknownScaleSend.test.js

fix: say an unknown-scale balance the same way on Send and on confirm (closes #377)

2026-10-04 15:59:15 +02:00

vault.test.js

test: known-answer coverage for HD derivation and the vault (closes #159)

2026-08-11 15:06:35 +02:00

vaultBackend.test.js

fix: run libsodium on WebAssembly under the extension CSP (closes #182)

2026-08-12 10:30:15 +02:00

version.test.js

release: produce a versioned per-browser artifact and pin the Chrome extension id (closes #310)

2026-08-23 16:13:22 +02:00

wallet.test.js

harden: keep the test recovery phrase out of release bundles, match committed keys by content (closes #351)

2026-09-21 18:29:39 +02:00

walletDefects.test.js

fix: explain a stored non-master xprv wallet instead of throwing at signing time (closes #234)

2026-08-12 10:41:49 +02:00

walletDelete.test.js

harden: key remembered site permissions by full origin (closes #402)

2026-10-04 18:09:04 +02:00