MetaMask / metamask-mobile

Mobile web browser providing access to websites that use the Ethereum blockchain
https://metamask.io
Other
2.04k stars 1.06k forks source link

RNWebView: (inpage provider) Replace script tag with straight code execution #10053

Closed jpcloureiro closed 1 week ago

jpcloureiro commented 1 week ago

Description

CSP directives might block inline script execution, thus preventing our web3 provider from being injected with a script tag creation.

Replacing it with a direct function call avoids being blocked.

inpage-bridge build process updated to include initial validations prior to inpage-content execution

Related issues

Fixes: https://github.com/MetaMask/mobile-planning/issues/1618#issuecomment-2147362799

Manual testing steps

  1. Go to this page...

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

github-actions[bot] commented 1 week ago

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

Cal-L commented 1 week ago

@jpcloureiro Nice job getting this to work! Could you provide context into the change in underlying logic here and what makes this solution work?

jpcloureiro commented 1 week ago

Loading two JS files from the filesystem & passing them through the RN bridge to the native webview is too heavy and affects the user experience too much.

Reverting this portion of the code

github-actions[bot] commented 1 week ago

https://bitrise.io/ Bitrise

🔄🔄🔄 pr_smoke_e2e_pipeline started on Bitrise...🔄🔄🔄

Commit hash: b877182007ce193a972b3d2e3be983f244c45e61 Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/a07991c1-9d83-45e6-98da-75fbef8e8734

[!NOTE]

  • This comment will auto-update when build completes
  • You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request
github-actions[bot] commented 1 week ago

https://bitrise.io/ Bitrise

❌❌❌ pr_smoke_e2e_pipeline failed on Bitrise! ❌❌❌

Commit hash: 47e7a5771d4f28e9a24ca5c43660c081facc2fc2 Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/5b640f89-daf6-47d9-a608-5f54e704b034

[!NOTE]

  • You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request
github-actions[bot] commented 1 week ago

https://bitrise.io/ Bitrise

❌❌❌ pr_smoke_e2e_pipeline failed on Bitrise! ❌❌❌

Commit hash: 8d5e6455f5e949b018a613af9a5595cd4f600493 Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/734560c5-95c9-49b2-a2af-19ae76a7eda1

[!NOTE]

  • You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request
jpcloureiro commented 1 week ago

Development will continue on the main feature branch upgrade/react-native-webview