1
0
mirror of https://github.com/kremalicious/metamask-extension.git synced 2024-11-22 09:57:02 +01:00
Commit Graph

87 Commits

Author SHA1 Message Date
Mark Stacey
2ee1e4d78b
Update LavaMoat policies (#19505)
The policy file for the build system was stale
2023-06-08 14:51:58 +09:00
Elliot Winkler
a4f3a5fdd0
Widen the number of test files that TS sees (#19403)
Currently, all test files are excluded from TypeScript's purview. That
means that if any test file fails to typecheck, we won't know about it.
In fact if we were to remove all test files from the `exclude` list,
then some files would indeed fail to be typechecked.

At the moment all we care about is the unit test file for
NetworkController. Due to how the `include`/`exclude` rules work in
`tsconfig.json`, we can't "un-exclude" that file after it's excluded, so
to fix this, we simply exclude fewer things.

While we're at it, we also:

- Add `esModuleInterop: true` to address warnings we sometimes see
  around imports
- Add `noEmit: true` so that we can run `tsc` to test typechecking on
  its own without producing any compiled files (so that ESLint doesn't
  accidentally pick them up)
- Clean up `tsconfig.json` slightly
2023-06-07 12:16:06 -06:00
Mark Stacey
7f82ea231c
Update @metamask/base-controller to v3 (#19343)
The `@metamask/base-controller` has been updated to v3, which is the
version released in the core monorepo v53 release. The other packages
released as part of v53 will be updated in later PRs.

Relates to #19271
2023-05-31 12:38:07 -02:30
Albert Olivé
057188d155
[MMI] Add code fences in signature-request (#18770)
* Started adding code fences in signature-request

* Finished code fencing

* Improving code

* Fixed storybook and code fences bundle

* Added missing dependency

* Fixed yarn.lock

* Fixing policies

* Updated package.json

* updating lavamoat

* lavamoat fix

* adds missing package

* runs yarn dedupe

* updates method name

* run lavamoat:auto again

* Added more code fences

* updates snapshot

* snapshot updates

* updates mmi packages to lighter versions

* updates mmi packages

* runs lavamoat auto

* updates yarn lock and runs lavamoat auto

* updates yarn lock

* updates targets file

* Removed console log and added tests

---------

Co-authored-by: António Regadas <apregadas@gmail.com>
Co-authored-by: Brad Decker <bhdecker84@gmail.com>
Co-authored-by: Antonio Regadas <antonio.regadas@consensys.net>
2023-05-24 13:41:21 +02:00
legobeat
8675c7863e
devDeps: storybook@7 (#19092)
* devDeps: pin @babel/core and @babel/runtime in resulotions
    Without this: misses patch, lavamoat error


* storybook 6 to 7 migration
* devDeps: add @storybook/addon-mdx-gfm
* fix lint deps
* devDeps: remove unused require-from-string
* devDeps/resolutions: @types/react@^16.9.53
* devDeps: add @storybook/cli
* storybook: new-frameworks migration
* iyarc: remove resolved dependency advisory
* deps: set globalthis@1.0.1 in resolutions
   This is required since a file is copied over from a set path in the dist
   package subdirectory as of d13aabde23 (#10014).
   A future update should either vendor the shim, or update to
   compatibility with a maintained upstream version.

* mdx2 migration fixes
* chore: bump ljharb packages
* devDeps: @storybook/*@^7.0.10->^7.0.11
* storybook: update preview.js to use v7 addon api
* ci/test/storybook: echo between storybook build&test
* ci/circleci: resources tweak
* info-tab: handle undefined global.platform
* update lavamoat build policy
* update lavamoat browserify policies
2023-05-18 11:07:42 +09:00
Frederik Bolding
125021e425
[FLASK] snaps-monorepo@0.33.1-flask.1 (#18913)
* snaps-monorepo@0.33.0-flask.1

* Add browser-passworder

* Patch babel/core

* Fix PermissionController messenger allowlist

* Update test-snaps

* Use latest patch

* Update LavaMoat policies

* Re-enable RPC E2E

* Make snaps iframe URL be a env variable and bump it

* Add new env variable to test env

* Add iframe URL to desktop build
2023-05-15 19:36:24 +02:00
OGPoyraz
37a2be0fbb
Add getCurrentChainId argument to SignatureController (#19078) 2023-05-11 10:22:42 +02:00
George Marshall
32688c2e3c
Adding ModalFocus component (#18979) 2023-05-09 14:33:29 -07:00
legobeat
1c199d3223
devDeps: storybook-dark-mode@1.1.2->2.1.1 (#18866)
* devDeps: @storybook/*->6.5.16

* devDeps: storybook-dark-mode@1.1.2->2.1.1

* add lavamoat build policy override
2023-05-08 22:48:29 +09:00
Brad Decker
b60b9f441f
Bundle size reduction: Upgrading ethereumjs/tx and ethereumjs/common (#18302)
* upgrade ethereumjs/tx and deps

* Yarn dedupe

---------

Co-authored-by: Dan J Miller <danjm.com@gmail.com>
2023-05-05 10:55:41 -05:00
Frederik Bolding
910b9e713f
Use separate versions for Flask and Stable snaps (#18875)
* Use separate versions for Flask and Stable snaps

* Update LM policy override

* Add deps to depcheck

* Improve import
2023-05-03 15:16:43 +02:00
legobeat
576eee7adf
devDeps: eslint@8.14.0,8.20.0->8.36.0 (#18748)
* devDeps: eslint@8.14.0,8.20.0->8.36.0

- CVE-2021-4279 / CVE-2021-4279
- consolidate eslint into single version
  - port patches

* add eslintignore directive

* lavamoat: update build policy overrides
2023-04-28 07:45:15 +09:00
legobeat
2943ec3310
devDeps: bumps source-map related dependencies (#18830)
* devDeps: bumps source-map related dependencies

* update lavamoat build policy
2023-04-27 00:07:04 +09:00
Brad Decker
08f775796c
Policy formatting issue (#18810) 2023-04-25 15:54:13 -05:00
legobeat
2c1ed4e8f0
deps: replace gulp-dart-sass with gulp-sass. (#16302)
Co-authored-by: Brad Decker <bhdecker84@gmail.com>
2023-04-25 09:37:30 -05:00
legobeat
a827c444fb
devDeps: security updates roundup (#18739)
* devDeps: resolutions: git-url-parse@^12=>13.1.0
  - CVE-2022-2900 / GHSA-j9fq-vwqv-2fm2

Depended on from now abandoned @storybook/storybook-deployer
  - https://github.com/storybook-eol/storybook-deployer/pull/131
  - https://github.com/IonicaBizau/git-url-parse/releases/tag/13.0.0
  - https://github.com/IonicaBizau/git-up/releases/tag/7.0.0

* devDeps: source-map-explorer@2.4.2->2.5.3
* devDeps: bump terser dependencies
   - CVE-2022-25858 / GHSA-4wf5-vphf-c2xc
* devDeps: shelljs@0.8.4->0.8.5
   - CVE-2022-0144 / GHSA-4rq4-32rv-6wp6
* devDeps: serve-handler@6.1.3->6.1.5, minimatch@3.0.4->3.1.2
  - CVE-2022-3517 / GHSA-f8q6-p94x-37v3
* devDeps: bump x-default-browser-id in resolutions
  - CVE-2021-33623 / CVE-2021-33623
  - https://npm-diff.app/x-default-browser@0.4.0...x-default-browser@0.5.2
* devDeps: pin glob-parent@^6.0.2 in resolutions
  - CVE-2020-28469 / GHSA-ww39-953v-wcq6
2023-04-25 17:09:22 +09:00
Mark Stacey
3776f4ad4c
Remove mobile sync feature (#18692)
The mobile sync feature has been removed. It has been disabled for
years. When we enable sync again, it will be using a different
implementation. This has already been removed on the mobile side.
2023-04-20 14:29:30 -02:30
legobeat
5d2c4c143a
devdeps: mocha@7.2.0->9.2.2 (#18195)
* devdeps: mocha@7.2.0->9.2.2

Maintenance upgrade

- Closes subdependency flat advisory
  - CVE-2020-36632 / GHSA-2j2x-2gpw-d8fm
- upgrade eslint-plugin-mocha to match
  - previously used `eslint-plugin-mocha` depended on mocha@^8.2.0

* devdeps: patch-bump ansi-regex

closes GHSA-93q8-gq69-wqmw

* update lavamoat policies
2023-04-14 10:49:22 +09:00
witmicko
fde18dec0c
link component (#17897)
Added externlalLink to ButtonLink

Co-authored-by: George Marshall <george.marshall@consensys.net>
2023-03-10 17:47:01 +00:00
Hassan Malik
7086494b72
[FLASK] BREAKING - snaps-monorepo@0.30.0 (#17718)
* updated snap permission to wallet_snap, updated tests and added migration

* updated snap packages

* yarn.lock fix

* fixed errors

* override policy

* update policy

* undo override

* updated localization message descriptions

* updated lavamoat policy

* more policy updates

* update permission controller version

* update policy

* update fixture builder

* updated code to include permission value to satisfy wallet_snap permission description call

* fix import issue

* update test-snaps version

* added missing actions, added snap permission dedupe function

* prettier fix

* fix fencing

* add more fencing

* prettier fix

* fix fencing (again)

* added new action and selector and updated view snap accordingly

* update test snaps website version

* unfence request variable

* add fencing

* add optional chaining to fix type error

* update migration #

* remove old migration

* prettier fix

* fix migration test

* fix fencing

* added missing fencing

* updated code to workaround fencing

* update test-snaps site version and remove snap confirm test

* update snap packages

* update policies

* fix merge marker issue

* update test

* more fixes

* fix permissions

* update test

* fixed test

* Bump test-snaps and iframe-execution-environment

* remove unused snap permission from fixture builder

* update policies

* undo comment removal, update selector implementation

* removed unnecessary function, updated migration, updated caveat action

* remove optional chaining

* fix type issue

* more type fixes

* fix migration test

* remove isFlask check, make migration logic more robust

* update coverage

* Update LavaMoat policies

* Update test/e2e/snaps/enums.js

* add extra bail condition

* Revert "add extra bail condition"

This reverts commit b45c53dcfc6e6e35a5e283d4955d6d6ea9ca5965.

* Revert "Revert "add extra bail condition""

This reverts commit cd2ded677935c9cdab0c02b6af55474c83727f60.

* fix test

* add SnapController entry to state object

* updated permission name and caveat type with hardcoded values

* add extra test for non-flask scenario

* update lavamoat policies

* fix locale messages

* change coverage target

* re-enable rpc snap test

* revert locale message change

* fix el message

* reverted changes

---------

Co-authored-by: Frederik Bolding <frederik.bolding@gmail.com>
2023-03-08 13:29:23 -05:00
Thomas Huang
4735978b8d
Removal of enzyme pkge dep (#17261)
Co-authored-by: Brad Decker <bhdecker84@gmail.com>
2023-02-14 12:14:00 -06:00
Brad Decker
c1f9c778c9
Add error module for safely handling errors (#17511)
Co-authored-by: Danica Shen <zhaodanica@gmail.com>
2023-02-02 13:30:57 -06:00
amerkadicE
dd09245ff6
Fix/use etherjs specific imports (#15461)
* replace ethers with submodules

Co-authored-by: Alex <adonesky@gmail.com>
2023-01-24 08:10:36 -06:00
Brad Decker
a9ef2a049a
add numeric module (#17324) 2023-01-20 15:16:56 -06:00
Nidhi Kumari
c5368c152b
Added storybook check to CI (#17092)
* added storybook test runner

* added test runner in ci

* updated test for ci and fixed lint error

* updated lavamoat policy

* updated test command

* updated playwright

* changed command to storybook;ci

* updated command

* updated instance for test-storybook

* updated playwright

* added playwright step

* replaced concurrently with start-server-and-test

* updated the static storybook directory

* replaced first with last

* updated lock file

* replaced first with last

* updated test-storybook with maxworkers

* updated .depchechrc

* updated yml

* removed id from banner base

* replaced broken stories with .stories-to-do.js extesnsion

* updated token allowance story

* removed duplicacies from yarn

* fixed lavamoat

* removed filename comment

* updated links for docs

* fixed file extension for stories

* updated path for stories.json

* updated stories.json path

* yarn updated

* updated stories

* updated yarn

* updated wait on
2023-01-21 00:57:46 +05:30
weizman
6d551f10fe
Update LavaMoat (core/lavapack) (#17061) 2023-01-18 14:35:37 +02:00
Alex Donesky
dc253068f9
update build system policy override config (#17163) 2023-01-12 14:01:29 -06:00
weizman
3cf5ef642f
Revert "Integrate new LavaMoat scuttling protection feature (#16994)" (#17043) 2022-12-22 17:26:53 +02:00
weizman
5d320ceec6
Integrate new LavaMoat scuttling protection feature (#16994)
Co-authored-by: kumavis <kumavis@users.noreply.github.com>
Co-authored-by: kumavis <aaron@kumavis.me>
Co-authored-by: Brad Decker <bhdecker84@gmail.com>
2022-12-21 12:54:30 -06:00
Dan J Miller
b3dbf62860
Add lavamoat policy override for react-responsive-carousel (#16955) 2022-12-14 14:35:28 -06:00
Alex Donesky
5d285f7be5
fix cached detected token results (#16866) 2022-12-14 12:26:08 +05:30
Frederik Bolding
659063b335
[FLASK] Allow Snaps UI to use Markdown for text formatting (#16911)
* Allow Snaps UI to use Markdown for text formatting

* Fix yarn audit and dedupe errors

* Update LavaMoat policies

* Fix lint

* Add paragraph wrapper component

* Fix lint
2022-12-13 15:37:20 +01:00
Brad Decker
6d1170f06c
upgrade yarn to version 3 (#16232)
Co-authored-by: Mark Stacey <markjstacey@gmail.com>
Co-authored-by: ricky <ricky.miller@gmail.com>
Co-authored-by: Elliot Winkler <elliot.winkler@gmail.com>
Co-authored-by: legobeat <109787230+legobeat@users.noreply.github.com>
Co-authored-by: legobt <6wbvkn0j@anonaddy.me>
Co-authored-by: Pedro Figueiredo <pedro.figueiredo@consensys.net>
2022-12-08 10:38:04 -06:00
Maarten Zuidhoorn
c341abaea6
Use Webpack 5 for Storybook (#16678)
* Fix storybook

* Update policies

* Bump all Storybook dependencies to the latest version

* Add Storybook dependencies to depcheck ignore list

* Update policy-override.json

* Fix SectionShape circular dependency

* Change policy override for eslint-scope

* Fix some Webpack build issues

* Add missing dependency

Co-authored-by: Frederik Bolding <frederik.bolding@gmail.com>
2022-11-29 19:23:36 +01:00
Elliot Winkler
51cffa15dd
Migrate to new controller packages (#16547)
* Migrate to new controller packages

`@metamask/controllers` is deprecated, and most of the controllers that
lived here are now located in their own package ([1]). This commit
replaces `@metamask/controllers` in `package.json` with references to
these packages and updates `import` lines to match.

[1]: https://github.com/MetaMask/controllers/pull/831

* Support GitHub registry for draft PRs (#16549)

* Add additional allowed host to lockfile linter

* Update LavaMoat policies

* Add policy exception for nanoid

* Add additional nanoid overrides

* Update LavaMoat policies again

* Bump controller packages

* Update lavamoat

* Bump controller packages

* Update packages to v1.0.0

* Expand gitignore comment

* Unpin controller dependencies, using ^ range instead

Co-authored-by: Mark Stacey <markjstacey@gmail.com>
2022-11-24 16:29:07 -03:30
David Walsh
266d7d93d5
Fix #15050 - MV3: Keep the user logged in when service worker restarts (#15558) 2022-11-23 18:49:24 -06:00
Brad Decker
c9527e745f
upgrade gulp-autoprefixer (#16439) 2022-11-15 08:40:56 -06:00
Erik Marks
a8c1756816
Remove 3box feature and delete ThreeBoxController (#14571)
* Remove 3box feature and delete ThreeBoxController

Lint locale messages

lavamoat policy updates

* Restore 3Box user trait with value `false`

The 3Box user trait has been restored and hard-coded as `false`. This
ensures that users don't get stuck in our metrics as having this trait.

A deprecation comment has been left in various places for this trait.

* Remove unused state

* Remove additional 3box-related things

* Run `yarn-deduplicate`

* Restore migration that was lost while rebasing

* Remove obsolete override

* Remove additional unused resolutions/dependencies

* Update LavaMoat policies

* Remove obsolete security advisory ignore entries

* Remove 3Box fixture builder method

* Update unit tests

Co-authored-by: Mark Stacey <markjstacey@gmail.com>
2022-10-31 13:50:50 -02:30
Jyoti Puri
6995174cbc
MV3 Segment Fix (#16020) 2022-10-11 20:34:32 +05:30
Mark Stacey
f6f8edfd15
Update eth-json-rpc-middleware to v9.0.1 (#16096)
This update includes fixes for our `block-ref` and `retry-on-empty`
middleware.

The `block-ref` middleware resolves the block reference `latest` to a
specific block number, the latest one we are aware of. This is meant to
protect against situations where the network gives inconsistent answers
for what the latest block number is due to some nodes being out-of-sync
with each other (this was a frequent problem years ago with Infura).

It was broken in that the `latest` resolution was failing, and we were
submitting an additional redundant request to Infura for each request.

The `retry-on-empty` middleware is meant to retry certain methods
when they return an empty response. This was also meant to deal with
network synchronization issues that were more common years ago. This
middleware works by making a "child" request over and over until either
a retry limit is reached, or a non-empty response is received.

It was broken in that the final response recieved was thrown away, so
it's as though the middleware was not used. Except that it did result
in additional redundant network requests.

As a result of this update we should see that the extension is more
resilient to certain network synchronization issues. But this is
difficult to test, and these issues may not happen in production
anymore today.

We should see a reduction in requests to Infura as well. This should
be easier to test.
2022-10-10 13:16:58 -02:30
Alex Donesky
3b63ecff07
Update eth-lattice-keyring to v0.12.3 (#15997) 2022-10-03 19:02:38 -05:00
Elliot Winkler
d7a812f42f
Add remaining tests for createInfuraClient (#15717)
Add tests for the `block-tracker-inspector` middleware — which makes
sure that the block tracker never has a reference to the latest block
which is less than a block number that shows up in an RPC method's
response — and the Infura middleware — which takes care of sending the
request to Infura, and will retry the request up to 5 times if Infura
sends back a certain type of error.

Note that the `retry-on-empty` middleware is not tested because it
currently has a [bug][1] which is making it ineffective.

[1]: https://github.com/MetaMask/eth-json-rpc-middleware/issues/139
2022-09-29 10:39:35 -06:00
Alex Donesky
d3bd5b0d6b
Bump keystone package versions to latest (#15878) 2022-09-22 10:04:24 -05:00
Mark Stacey
929a1a0d52
Update eth-json-rpc-infura (#15845)
* Update `eth-json-rpc-infura`

The package `eth-json-rpc-infura@5` has been updated to
`@metamask/eth-json-rpc-infura@7`. This update includes TypeScript
support, and it drops support for older node.js versions. The exports
have also been changed from default to named exports.

See here for a full list of changes: https://github.com/MetaMask/eth-json-rpc-infura/blob/main/CHANGELOG.md#700

* Fix LavaMoat policy issue

The `web3` package used by `@metamask/controllers` unintentionally
overwrites the `XMLHttpRequest` global, which breaks things. This was
fixed by revoking `web3`'s write access to that global using a policy
override.

Previously this policy override was applied to `web3`, but for some
unknown reason, this update caused that override to no longer apply.
2022-09-15 14:41:18 -02:30
amerkadicE
7aa2a8a983
Replace web3js package with ethersjs package (#15386)
Co-authored-by: Alex Donesky <adonesky@gmail.com>
2022-09-12 15:46:48 -05:00
George Marshall
100fbbfaca
Upgrading storybook from 6.3 to 6.5 fixing shell-quote vulnerability (#15684)
* Updating storybook from 6.3 to 6.5

* Some lavamoat policy overrides for eslint
2022-09-06 15:58:22 -07:00
Alex Miller
21e3b4785d
[GridPlus] Version bump (#15711)
* [GridPlus] Bumps packages
Significant updates:
* Reverts build system changes to reduce bundle size (`gridplus-sdk` #461)
* Adds support for nested ABI definitions if firmware allows it (`gridplus-sdk` #462, #450)
Full changes:
* `eth-lattice-keyring`: https://github.com/GridPlus/eth-lattice-keyring/compare/v0.11.0...v0.12.0
* `gridplus-sdk`: https://github.com/GridPlus/gridplus-sdk/compare/v2.2.2...v2.2.7

* [GridPlus] Lavamoat changes
2022-08-25 18:11:17 -02:30
Brad Decker
0d862d4032
upgrade jest (#15642) 2022-08-23 15:13:02 -05:00
Mark Stacey
1f36ba4b75
Fix Sentry deduplication of events that were never sent (#15677)
The Sentry `Dedupe` integration has been filtering out our events, even
when they were never sent due to our `beforeSend` handler. It was
wrongly identifying them as duplicates because it has no knowledge of
`beforeSend` or whether they were actually sent or not.

To resolve this, the filtering we were doing in `beforeSend` has been
moved to a Sentry integration. This integration is installed ahead of
the `Dedupe` integration, so `Dedupe` should never find out about any
events that we filter out, and thus will never consider them as sent
when they were not.
2022-08-23 16:14:14 -02:30
Mark Stacey
22552a0152
Fix LavaMoat policy generation script (#15668)
Recently in #15468 the name of the scripts task used by the LavaMoat
policy generation script was renamed from `scripts:prod` to
`scripts:dist`, but we neglected to change this name in the LavaMoat
policy generation script itself.

The script task has now been updated so that the script works again,
and the LavaMoat policy generation script has been re-run.
2022-08-22 21:22:47 -02:30