Currently, in the async flow, we do not check that the redirect URL matches a domain of one of the allowed origins present in the Snap's manifest, and this has to be checked during the Snap review process. This change will add an additional check when receiving an async request that verifies whether or not the URL domain is within the Snap's allowed origins.
yarn jest src/SnapKeyring.test.ts -t "throws an error if async request redirect url is not an allowed origin"yarn jest src/SnapKeyring.test.ts -t "throws an error if no allowed origins and async request redirect url"
Description
Currently, in the async flow, we do not check that the redirect URL matches a domain of one of the allowed origins present in the Snap's manifest, and this has to be checked during the Snap review process. This change will add an additional check when receiving an async request that verifies whether or not the URL domain is within the Snap's allowed origins.
Testing
Coverage remains at 100%
Test Coverage Report
Jest
yarn jest src/SnapKeyring.test.ts -t "throws an error if async request redirect url is not an allowed origin"
yarn jest src/SnapKeyring.test.ts -t "throws an error if no allowed origins and async request redirect url"