MetaMask / eth-snap-keyring

Snap Keyring bridge
6 stars 2 forks source link

feat: enforce async request redirect URL is in the snaps 'allowedOrigins' #228

Closed k-g-j closed 6 months ago

k-g-j commented 6 months ago

Description

Currently, in the async flow, we do not check that the redirect URL matches a domain of one of the allowed origins present in the Snap's manifest, and this has to be checked during the Snap review process. This change will add an additional check when receiving an async request that verifies whether or not the URL domain is within the Snap's allowed origins.

Testing

Coverage remains at 100%

Test Coverage Report

File % Stmts % Branch % Funcs % Lines Uncovered Line #s
All files 100 100 100 100
CaseInsensitiveMap.ts 100 100 100 100
DeferredPromise.ts 100 100 100 100
KeyringSnapControllerClient.ts 100 100 100 100
SnapIdMap.ts 100 100 100 100
SnapKeyring.ts 100 100 100 100
index.ts 100 100 100 100
types.ts 100 100 100 100
util.ts 100 100 100 100

Jest

yarn jest src/SnapKeyring.test.ts -t "throws an error if async request redirect url is not an allowed origin" yarn jest src/SnapKeyring.test.ts -t "throws an error if no allowed origins and async request redirect url"