sneak
e791e06fb1
A popup already open when the stored profile became unreadable stayed on the last good profile until reopened. Every save already runs the check loadState() runs at open; a save refused by it now raises the recovery screen, stops the ten-second refresh, and passes the screen to showView(), which runs the leave cleanup of the screen it replaces and records it as the current view. From then on showView() shows nothing else, so a transaction wait or a later save cannot take the user off it or clear an export or a typed confirmation. Any other failed save keeps the "NOT SAVED" banner. The popup test harness now honours clearInterval(). Model: opus-5-5
514 lines
21 KiB
JavaScript
514 lines
21 KiB
JavaScript
// A stored profile the popup cannot read must produce a SCREEN, not a blank
|
|
// popup (https://git.eeqj.de/sneak/AutistMask/issues/311).
|
|
//
|
|
// The three corrupt blobs below are the ones the pre-1.0 audit wrote into
|
|
// storage. Against the build this file was added to, each one rendered nothing
|
|
// at all — no view, no message, no control — because init() dereferenced
|
|
// `state.wallets[0].addresses` on a record nothing had validated and threw
|
|
// before the first showView().
|
|
//
|
|
// So the assertions here are deliberately made through the REAL popup entry
|
|
// point rather than against the recovery view module directly. A recovery
|
|
// screen that renders perfectly when something calls it, and that nothing
|
|
// calls, is exactly the defect: what has to be true is that BOOTING the popup
|
|
// on a bad blob lands on it.
|
|
//
|
|
// The boot harness and its DOM stub — built FROM src/popup/index.html, so
|
|
// "which views are visible" is answered against the real element set — live in
|
|
// tests/support/popupBoot.js, since tests/persistedEntryFloors.test.js needs
|
|
// the same boot.
|
|
//
|
|
// The fourth case is the upgrade one, and it is the case that must NOT reach
|
|
// the recovery screen: every install in the field has a valid profile with no
|
|
// version field, and showing those users a wipe prompt would be a worse defect
|
|
// than the one being fixed. It is migrated in place and keeps working.
|
|
|
|
const {
|
|
bootPopup,
|
|
cleanupPopup,
|
|
unversionedValidProfile,
|
|
ADDRESS,
|
|
TOKEN_ADDRESS,
|
|
} = require("./support/popupBoot");
|
|
|
|
// ------------------------------------------------------------- fixtures
|
|
|
|
// The three blobs from the issue, each with the error it produced.
|
|
const CORRUPT_BLOBS = [
|
|
{
|
|
name: "wallets is a string",
|
|
blob: { hasWallet: true, wallets: ADDRESS, activeAddress: ADDRESS },
|
|
},
|
|
{
|
|
name: "wallets is an array of garbage",
|
|
blob: {
|
|
hasWallet: true,
|
|
wallets: [null, 42, "wallet"],
|
|
activeAddress: ADDRESS,
|
|
},
|
|
},
|
|
{
|
|
name: "future-schema blob (unknown fields, no version)",
|
|
blob: {
|
|
hasWallet: true,
|
|
// A later schema that renamed the field and moved the key
|
|
// material, written by a build this one knows nothing about, and
|
|
// stamped with no version because this build never wrote one.
|
|
wallets: [
|
|
{
|
|
id: "wallet-1",
|
|
label: "Wallet 1",
|
|
accounts: [{ addr: ADDRESS, wei: "0x0" }],
|
|
keyring: { kind: "hd", vault: "…" },
|
|
},
|
|
],
|
|
profileFormat: "am-2",
|
|
activeAccount: ADDRESS,
|
|
},
|
|
},
|
|
];
|
|
|
|
afterEach(cleanupPopup);
|
|
|
|
// --------------------------------------------------------------- tests
|
|
|
|
describe("a stored profile the popup cannot read", () => {
|
|
for (const { name, blob } of CORRUPT_BLOBS) {
|
|
test(`${name}: the recovery screen, not a blank popup`, async () => {
|
|
const env = await bootPopup(blob);
|
|
|
|
// Asserted together, and in the audit's own shape: a failure here
|
|
// prints both what was on screen and what the console said, which
|
|
// is the pair that identifies this defect.
|
|
expect({
|
|
visibleViews: env.visibleViews(),
|
|
errors: env.pageErrors,
|
|
}).toEqual({ visibleViews: ["state-recovery"], errors: [] });
|
|
|
|
// The screen has to NAME the problem. A blank recovery screen is
|
|
// the same dead end with a border around it.
|
|
expect(env.text("state-recovery-problem").length).toBeGreaterThan(
|
|
10,
|
|
);
|
|
});
|
|
}
|
|
|
|
test("the Settings gear is hidden, since every screen behind it reads the profile", async () => {
|
|
const env = await bootPopup(CORRUPT_BLOBS[0].blob);
|
|
|
|
expect(env.hidden("btn-settings")).toBe(true);
|
|
});
|
|
|
|
test("it does not write over the record it could not read", async () => {
|
|
// The blob is evidence, and possibly the only copy of key material in
|
|
// a shape a later build could recover. A boot that normalized it back
|
|
// into storage would destroy exactly that.
|
|
const env = await bootPopup(CORRUPT_BLOBS[2].blob);
|
|
|
|
expect(env.storage.read("autistmask")).toEqual(CORRUPT_BLOBS[2].blob);
|
|
expect(env.storage.set).not.toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
describe("the export on the recovery screen", () => {
|
|
test("hands back the raw stored record verbatim", async () => {
|
|
const env = await bootPopup(CORRUPT_BLOBS[2].blob);
|
|
|
|
await env.click("btn-state-recovery-export");
|
|
|
|
// Shown in the page, which always works, whatever the browser does
|
|
// with a download from an extension popup.
|
|
expect(env.hidden("state-recovery-blob")).toBe(false);
|
|
expect(JSON.parse(env.value("state-recovery-blob"))).toEqual(
|
|
CORRUPT_BLOBS[2].blob,
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("the destructive reset on the recovery screen", () => {
|
|
test("erases nothing without the typed confirmation", async () => {
|
|
const env = await bootPopup(CORRUPT_BLOBS[0].blob);
|
|
|
|
env.node("state-recovery-reset-input").value = "yes";
|
|
await env.click("btn-state-recovery-reset");
|
|
|
|
expect(env.storage.read("autistmask")).toEqual(CORRUPT_BLOBS[0].blob);
|
|
expect(env.text("state-recovery-flash").length).toBeGreaterThan(10);
|
|
expect(env.reloaded()).toBe(0);
|
|
});
|
|
|
|
test("erases the stored profile once the phrase is typed", async () => {
|
|
const env = await bootPopup(CORRUPT_BLOBS[0].blob);
|
|
|
|
env.node("state-recovery-reset-input").value = "erase my wallet";
|
|
await env.click("btn-state-recovery-reset");
|
|
|
|
expect(env.storage.read("autistmask")).toBeUndefined();
|
|
expect(env.reloaded()).toBe(1);
|
|
});
|
|
});
|
|
|
|
describe("a popup already open when the stored profile becomes unreadable", () => {
|
|
// https://git.eeqj.de/sneak/AutistMask/issues/373. The popup used to stay
|
|
// on the wallet list with the last good balances, and only a reopen
|
|
// reached the recovery screen.
|
|
test("moves to the recovery screen at its next refresh", async () => {
|
|
const env = await bootPopup(unversionedValidProfile());
|
|
expect(env.visibleViews()).toEqual(["main"]);
|
|
|
|
env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
|
|
await env.tick();
|
|
|
|
expect(env.visibleViews()).toEqual(["state-recovery"]);
|
|
expect(env.text("state-recovery-problem").length).toBeGreaterThan(10);
|
|
expect(env.hidden("btn-settings")).toBe(true);
|
|
expect(env.storage.read("autistmask")).toEqual(CORRUPT_BLOBS[0].blob);
|
|
});
|
|
|
|
test("stops the ten-second refresh", async () => {
|
|
const env = await bootPopup(unversionedValidProfile());
|
|
env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
|
|
await env.tick();
|
|
const { refreshBalances } = require("../src/shared/balances");
|
|
const calls = refreshBalances.mock.calls.length;
|
|
|
|
await env.tick();
|
|
|
|
expect(refreshBalances).toHaveBeenCalledTimes(calls);
|
|
});
|
|
|
|
test("a later save does not clear what the user exported or typed", async () => {
|
|
const env = await bootPopup(unversionedValidProfile());
|
|
env.storage.write("autistmask", CORRUPT_BLOBS[2].blob);
|
|
await env.tick();
|
|
|
|
await env.click("btn-state-recovery-export");
|
|
env.node("state-recovery-reset-input").value = "erase my";
|
|
// Such as the save of a refresh already in flight when the screen
|
|
// went up.
|
|
const { saveState } = require("../src/shared/state");
|
|
await expect(saveState()).rejects.toThrow();
|
|
await env.settle();
|
|
|
|
expect(env.visibleViews()).toEqual(["state-recovery"]);
|
|
expect(env.hidden("state-recovery-blob")).toBe(false);
|
|
expect(env.value("state-recovery-reset-input")).toBe("erase my");
|
|
});
|
|
|
|
test("a transaction wait that ends under it does not replace it", async () => {
|
|
const env = await bootPopup(
|
|
unversionedValidProfile({
|
|
currentView: "wait-tx",
|
|
viewData: {
|
|
pendingWait: {
|
|
hash: "0x1",
|
|
txInfo: { to: ADDRESS, amount: "1", token: "ETH" },
|
|
broadcastTime: Date.now(),
|
|
},
|
|
},
|
|
}),
|
|
);
|
|
expect(env.visibleViews()).toEqual(["wait-tx"]);
|
|
env.storage.write("autistmask", CORRUPT_BLOBS[2].blob);
|
|
await env.tick();
|
|
await env.click("btn-state-recovery-export");
|
|
env.node("state-recovery-reset-input").value = "erase my";
|
|
|
|
// The test provider answers no receipt lookup, and six that fail in
|
|
// a row end the wait with an error.
|
|
for (let i = 0; i < 6; i++) await env.tick();
|
|
|
|
expect(env.text("error-tx-message")).toMatch(/could not be reached/);
|
|
expect(env.visibleViews()).toEqual(["state-recovery"]);
|
|
expect(env.hidden("state-recovery-blob")).toBe(false);
|
|
expect(env.value("state-recovery-reset-input")).toBe("erase my");
|
|
});
|
|
|
|
test("a storage read that fails once leaves the wallet list up", async () => {
|
|
const env = await bootPopup(unversionedValidProfile());
|
|
|
|
env.storage.local.get.mockRejectedValueOnce(
|
|
new Error("IO error: storage busy"),
|
|
);
|
|
await env.tick();
|
|
|
|
// Reported as a failed save, not mistaken for an unreadable profile.
|
|
expect(env.visibleViews()).toEqual(["main"]);
|
|
expect(env.node("save-failure-banner")).not.toBeNull();
|
|
|
|
await env.tick();
|
|
expect(env.visibleViews()).toEqual(["main"]);
|
|
});
|
|
|
|
// The screen it replaces is left as any navigation leaves it: the rules
|
|
// at the top of src/popup/views/showPhrase.js and exportPrivkey.js hold
|
|
// for this way off them too.
|
|
describe("from a screen holding a secret", () => {
|
|
const PHRASE =
|
|
"abandon abandon abandon abandon abandon abandon abandon" +
|
|
" abandon abandon abandon abandon about";
|
|
|
|
afterEach(() => jest.dontMock("../src/shared/vault"));
|
|
|
|
test("a recovery phrase on screen is wiped", async () => {
|
|
jest.doMock("../src/shared/vault", () => ({
|
|
decryptWithPassword: async () => PHRASE,
|
|
}));
|
|
const env = await bootPopup(unversionedValidProfile());
|
|
require("../src/popup/views/showPhrase").show(0);
|
|
env.node("show-phrase-password").value = "password";
|
|
await env.click("btn-show-phrase-reveal");
|
|
expect(env.text("show-phrase-value")).toBe(PHRASE);
|
|
|
|
env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
|
|
await env.tick();
|
|
|
|
expect(env.visibleViews()).toEqual(["state-recovery"]);
|
|
expect(env.text("show-phrase-value")).toBe("");
|
|
});
|
|
|
|
test("a private key still being decrypted is never written", async () => {
|
|
let answer;
|
|
jest.doMock("../src/shared/vault", () => ({
|
|
decryptWithPassword: () =>
|
|
new Promise((resolve) => {
|
|
answer = resolve;
|
|
}),
|
|
}));
|
|
const env = await bootPopup(unversionedValidProfile());
|
|
require("../src/popup/views/exportPrivkey").show(0, 0);
|
|
env.node("export-privkey-password").value = "password";
|
|
const revealing = env.click("btn-export-privkey-confirm");
|
|
|
|
env.storage.write("autistmask", CORRUPT_BLOBS[0].blob);
|
|
await env.tick();
|
|
expect(env.visibleViews()).toEqual(["state-recovery"]);
|
|
expect(env.value("export-privkey-password")).toBe("");
|
|
|
|
answer(PHRASE);
|
|
await revealing;
|
|
expect(env.text("export-privkey-value")).toBe("");
|
|
});
|
|
});
|
|
});
|
|
|
|
describe("an unversioned profile that is perfectly valid", () => {
|
|
// The upgrade case. Every install in the field is in this state, and the
|
|
// popup must load it, not offer to wipe it.
|
|
test("boots to the wallet list, not the recovery screen", async () => {
|
|
const env = await bootPopup(unversionedValidProfile());
|
|
|
|
expect(env.visibleViews()).toEqual(["main"]);
|
|
expect(env.pageErrors).toEqual([]);
|
|
});
|
|
|
|
test("is migrated in place: the version is stamped, the wallet survives", async () => {
|
|
const env = await bootPopup(unversionedValidProfile());
|
|
|
|
const stored = env.storage.read("autistmask");
|
|
expect(stored.schemaVersion).toBe(1);
|
|
expect(stored.wallets).toHaveLength(1);
|
|
expect(stored.wallets[0].encryptedSecret).toBe("encrypted-secret-1");
|
|
expect(stored.wallets[0].addresses[0].address).toBe(ADDRESS);
|
|
expect(stored.activeAddress).toBe(ADDRESS);
|
|
expect(stored.allowedSites).toEqual({
|
|
[ADDRESS]: ["https://dapp.example"],
|
|
});
|
|
});
|
|
});
|
|
|
|
describe("a first run with nothing in storage", () => {
|
|
test("boots to Welcome", async () => {
|
|
const env = await bootPopup(undefined);
|
|
|
|
expect(env.visibleViews()).toEqual(["welcome"]);
|
|
expect(env.pageErrors).toEqual([]);
|
|
});
|
|
});
|
|
|
|
describe("a garbage value in a field the gate does not check", () => {
|
|
// The gate refuses only what nothing can floor: the wallet list, the
|
|
// version, the network key. Everything else is normalizePersisted()'s job,
|
|
// and where that job was written as `saved.x || default` rather than a
|
|
// type check, a TRUTHY value of the wrong type walked straight through and
|
|
// threw on the first dereference — the same blank popup this issue is
|
|
// about, measured the same way. Every row below did, at the head named
|
|
// against it; none has ever been removed from this list.
|
|
//
|
|
// These belong on the floor rather than in the gate: none of these values
|
|
// carries key material, all have a sane default, and sending a user whose
|
|
// wallets are perfectly readable to an export-or-erase screen over a
|
|
// broken token list would destroy more than it saves.
|
|
//
|
|
// The CONTAINER and its ELEMENTS are separate defects. Round 2 floored the
|
|
// containers with Array.isArray(), which left every row whose container is
|
|
// a well-formed list of malformed entries still blanking the popup: the
|
|
// dereference is `t.address.toLowerCase()`, one level below the check.
|
|
const CORRUPT_FIELDS = [
|
|
// Container shapes. Observed at 2e2ecf9, before the round-2 floor:
|
|
// trackedTokens: "nope" -> views=[] "Cannot read properties of
|
|
// undefined (reading 'toLowerCase')"
|
|
// trackedTokens: 42 -> views=[] "trackedTokens is not iterable"
|
|
// trackedTokens: {a:1} -> views=[] "trackedTokens is not iterable"
|
|
// activeAddress: 42 -> views=[] "address.slice is not a
|
|
// function"
|
|
// activeAddress: {a:1} -> views=[] "address.slice is not a
|
|
// function"
|
|
{ name: "trackedTokens is a string", patch: { trackedTokens: "nope" } },
|
|
{ name: "trackedTokens is a number", patch: { trackedTokens: 42 } },
|
|
{
|
|
name: "trackedTokens is an object",
|
|
patch: { trackedTokens: { a: 1 } },
|
|
},
|
|
{ name: "activeAddress is a number", patch: { activeAddress: 42 } },
|
|
{
|
|
name: "activeAddress is an object",
|
|
patch: { activeAddress: { a: 1 } },
|
|
},
|
|
// Element shapes: a list, holding entries that are not token records.
|
|
// Observed at a10a984, AFTER the container floor:
|
|
// [1,2] -> views=[] "Cannot read properties of undefined
|
|
// (reading 'toLowerCase')"
|
|
// [null] -> views=[] "Cannot read properties of null
|
|
// (reading 'address')"
|
|
// [{}] -> views=[] "Cannot read properties of undefined
|
|
// (reading 'toLowerCase')"
|
|
// [{address:42}] -> views=[] "t.address.toLowerCase is not a
|
|
// function"
|
|
// ["0xAA…"] -> views=[] "Cannot read properties of undefined
|
|
// (reading 'toLowerCase')"
|
|
{
|
|
name: "trackedTokens holds numbers",
|
|
patch: { trackedTokens: [1, 2] },
|
|
},
|
|
{
|
|
name: "trackedTokens holds null",
|
|
patch: { trackedTokens: [null] },
|
|
},
|
|
{
|
|
name: "trackedTokens holds a record with no address",
|
|
patch: { trackedTokens: [{}] },
|
|
},
|
|
{
|
|
name: "trackedTokens holds a record whose address is a number",
|
|
patch: { trackedTokens: [{ address: 42 }] },
|
|
},
|
|
{
|
|
name: "trackedTokens holds bare address strings",
|
|
patch: { trackedTokens: [TOKEN_ADDRESS] },
|
|
},
|
|
];
|
|
|
|
// The same defect one level deeper, inside a wallet the gate accepted.
|
|
// tokenBalances is written WHOLESALE by refreshBalances(), so the partial
|
|
// write https://git.eeqj.de/sneak/AutistMask/issues/311 names as the live
|
|
// cause of a corrupt record lands exactly here. Observed at a10a984:
|
|
// "x" -> views=[] "Cannot read properties of undefined (reading
|
|
// 'toLowerCase')" (a string iterates as characters)
|
|
// [null] -> views=[] "Cannot read properties of null (reading
|
|
// 'balance')"
|
|
// [42] -> views=[] "Cannot read properties of undefined (reading
|
|
// 'toLowerCase')"
|
|
// 42 -> views=[] "number 42 is not iterable"
|
|
const CORRUPT_TOKEN_BALANCES = [
|
|
{ name: "a string", value: "x" },
|
|
{ name: "a list holding null", value: [null] },
|
|
{ name: "a list of numbers", value: [42] },
|
|
{ name: "a number", value: 42 },
|
|
];
|
|
|
|
function profileWithTokenBalances(value) {
|
|
const profile = unversionedValidProfile();
|
|
profile.wallets[0].addresses[0].tokenBalances = value;
|
|
return profile;
|
|
}
|
|
|
|
for (const { name, patch } of CORRUPT_FIELDS) {
|
|
test(`${name}: a working popup, not a blank one`, async () => {
|
|
const env = await bootPopup(
|
|
Object.assign(unversionedValidProfile(), patch),
|
|
);
|
|
|
|
expect({
|
|
visibleViews: env.visibleViews(),
|
|
errors: env.pageErrors,
|
|
}).toEqual({ visibleViews: ["main"], errors: [] });
|
|
});
|
|
}
|
|
|
|
for (const { name, value } of CORRUPT_TOKEN_BALANCES) {
|
|
test(`an address whose tokenBalances is ${name}: a working popup, not a blank one`, async () => {
|
|
const env = await bootPopup(profileWithTokenBalances(value));
|
|
|
|
expect({
|
|
visibleViews: env.visibleViews(),
|
|
errors: env.pageErrors,
|
|
}).toEqual({ visibleViews: ["main"], errors: [] });
|
|
});
|
|
}
|
|
|
|
test("the wallet is intact afterwards, and the bad value is gone", async () => {
|
|
const env = await bootPopup(
|
|
Object.assign(unversionedValidProfile(), {
|
|
trackedTokens: "nope",
|
|
activeAddress: 42,
|
|
}),
|
|
);
|
|
|
|
const stored = env.storage.read("autistmask");
|
|
expect(stored.wallets[0].encryptedSecret).toBe("encrypted-secret-1");
|
|
expect(stored.trackedTokens).toEqual([]);
|
|
// Floored to null, then filled in by init()'s auto-default.
|
|
expect(stored.activeAddress).toBe(ADDRESS);
|
|
});
|
|
|
|
test("an empty activeAddress does not leave the popup with none selected", async () => {
|
|
// "" is text, so a type check alone lets it through — and init()
|
|
// auto-selects the first address only on a STRICT null, so it has to
|
|
// be floored to null rather than kept.
|
|
const env = await bootPopup(
|
|
Object.assign(unversionedValidProfile(), { activeAddress: "" }),
|
|
);
|
|
|
|
expect(env.visibleViews()).toEqual(["main"]);
|
|
expect(env.storage.read("autistmask").activeAddress).toBe(ADDRESS);
|
|
});
|
|
|
|
test("a malformed token entry is dropped, and the well-formed ones beside it survive", async () => {
|
|
const env = await bootPopup(
|
|
Object.assign(unversionedValidProfile(), {
|
|
trackedTokens: [
|
|
1,
|
|
null,
|
|
{},
|
|
{ address: 42 },
|
|
TOKEN_ADDRESS,
|
|
{ address: TOKEN_ADDRESS, symbol: "AAA", decimals: 18 },
|
|
],
|
|
}),
|
|
);
|
|
|
|
const stored = env.storage.read("autistmask");
|
|
expect(stored.trackedTokens).toEqual([
|
|
{ address: TOKEN_ADDRESS, symbol: "AAA", decimals: 18 },
|
|
]);
|
|
});
|
|
|
|
test("a malformed tokenBalances entry is dropped, and the wallet and its address survive", async () => {
|
|
const env = await bootPopup(
|
|
profileWithTokenBalances([
|
|
null,
|
|
42,
|
|
{ address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
|
|
]),
|
|
);
|
|
|
|
const stored = env.storage.read("autistmask");
|
|
expect(stored.wallets[0].encryptedSecret).toBe("encrypted-secret-1");
|
|
expect(stored.wallets[0].addresses[0].address).toBe(ADDRESS);
|
|
expect(stored.wallets[0].addresses[0].tokenBalances).toEqual([
|
|
{ address: TOKEN_ADDRESS, symbol: "AAA", balance: "2.0" },
|
|
]);
|
|
});
|
|
});
|