An externally hosted phishing warning page is now used rather than the built-in phishing warning page.The phishing page warning URL is set via configuration file or environment variable. The default URL is either the expected production URL or `http://localhost:9999/` for e2e testing environments. The new external phishing page includes a design change when it is loaded within an iframe. In that case it now shows a condensed message, and prompts the user to open the full warning page in a new tab to see more details or bypass the warning. This is to prevent a clickjacking attack from safelisting a site without user consent. The new external phishing page also includes a simple caching service worker to ensure it continues to work offline (or if our hosting goes offline), as long as the user has successfully loaded the page at least once. We also load the page temporarily during the extension startup process to trigger the service worker installation. The old phishing page and all related lines have been removed. The property `web_accessible_resources` has also been removed from the manifest. The only entry apart from the phishing page was `inpage.js`, and we don't need that to be web accessible anymore because we inject the script inline into each page rather than loading the file directly. New e2e tests have been added to cover more phishing warning page functionality, including the "safelist" action and the "iframe" case. |
||
---|---|---|
.circleci | ||
.github | ||
.storybook | ||
app | ||
development | ||
docs | ||
lavamoat | ||
patches | ||
shared | ||
test | ||
ui | ||
.depcheckrc.yml | ||
.editorconfig | ||
.eslintrc.babel.js | ||
.eslintrc.base.js | ||
.eslintrc.js | ||
.eslintrc.jsdoc.js | ||
.eslintrc.node.js | ||
.eslintrc.typescript-compat.js | ||
.gitattributes | ||
.gitignore | ||
.metamaskrc.dist | ||
.mocharc.js | ||
.nvmrc | ||
.prettierignore | ||
.prettierrc.yml | ||
.yarnrc | ||
babel.config.js | ||
CHANGELOG.md | ||
crowdin.yml | ||
jest.config.js | ||
jest.stories.config.js | ||
LICENSE | ||
nyc.config.js | ||
package.json | ||
README.md | ||
stylelint.config.js | ||
tsconfig.json | ||
yarn.lock |
MetaMask Browser Extension
You can find the latest version of MetaMask on our official website. For help using MetaMask, visit our User Support Site.
For general questions, feature requests, or developer questions, visit our Community Forum.
MetaMask supports Firefox, Google Chrome, and Chromium-based browsers. We recommend using the latest available browser version.
For up to the minute news, follow our Twitter or Medium pages.
To learn how to develop MetaMask-compatible applications, visit our Developer Docs.
To learn how to contribute to the MetaMask project itself, visit our Internal Docs.
Building locally
- Install Node.js version 14
- If you are using nvm (recommended) running
nvm use
will automatically choose the right node version for you.
- If you are using nvm (recommended) running
- Install Yarn
- Install dependencies:
yarn setup
(not the usual install command) - Copy the
.metamaskrc.dist
file to.metamaskrc
- Replace the
INFURA_PROJECT_ID
value with your own personal Infura Project ID. - If debugging MetaMetrics, you'll need to add a value for
SEGMENT_WRITE_KEY
Segment write key.
- Replace the
- Build the project to the
./dist/
folder withyarn dist
.
Uncompressed builds can be found in /dist
, compressed builds can be found in /builds
once they're built.
See the build system readme for build system usage information.
Contributing
Development builds
To start a development build (e.g. with logging and file watching) run yarn start
.
React and Redux DevTools
To start the React DevTools, run yarn devtools:react
with a development build installed in a browser. This will open in a separate window; no browser extension is required.
To start the Redux DevTools Extension:
- Install the package
remotedev-server
globally (e.g.yarn global add remotedev-server
) - Install the Redux Devtools extension.
- Open the Redux DevTools extension and check the "Use custom (local) server" checkbox in the Remote DevTools Settings, using the default server configuration (host
localhost
, port8000
, secure connection checkbox unchecked).
Then run the command yarn devtools:redux
with a development build installed in a browser. This will enable you to use the Redux DevTools extension to inspect MetaMask.
To create a development build and run both of these tools simultaneously, run yarn start:dev
.
Test Dapp
This test site can be used to execute different user flows.
Running Unit Tests and Linting
Run unit tests and the linter with yarn test
. To run just unit tests, run yarn test:unit
.
You can run the linter by itself with yarn lint
, and you can automatically fix some lint problems with yarn lint:fix
. You can also run these two commands just on your local changes to save time with yarn lint:changed
and yarn lint:changed:fix
respectively.
Running E2E Tests
Our e2e test suite can be run on either Firefox or Chrome. In either case, start by creating a test build by running yarn build:test
.
Firefox e2e tests can be run with yarn test:e2e:firefox
.
Chrome e2e tests can be run with yarn test:e2e:chrome
, but they will only work if you have Chrome v79 installed. Update the chromedriver
package to a version matching your local Chrome installation to run e2e tests on newer Chrome versions.
Changing dependencies
Whenever you change dependencies (adding, removing, or updating, either in package.json
or yarn.lock
), there are various files that must be kept up-to-date.
yarn.lock
:- Run
yarn setup
again after your changes to ensureyarn.lock
has been properly updated. - Run
yarn yarn-deduplicate
to remove duplicate dependencies from the lockfile.
- Run
- The
allow-scripts
configuration inpackage.json
- Run
yarn allow-scripts auto
to update theallow-scripts
configuration automatically. This config determines whether the package's install/postinstall scripts are allowed to run. Review each new package to determine whether the install script needs to run or not, testing if necessary. - Unfortunately,
yarn allow-scripts auto
will behave inconsistently on different platforms. macOS and Windows users may see extraneous changes relating to optional dependencies.
- Run
- The LavaMoat policy files. The tl;dr is to run
yarn lavamoat:auto
to update these files, but there can be devils in the details. Continue reading for more information.- There are two sets of LavaMoat policy files:
- The production LavaMoat policy files (
lavamoat/browserify/*/policy.json
), which are re-generated usingyarn lavamoat:background:auto
.- These should be regenerated whenever the production dependencies for the background change.
- The build system LavaMoat policy file (
lavamoat/build-system/policy.json
), which is re-generated usingyarn lavamoat:build:auto
.- This should be regenerated whenever the dependencies used by the build system itself change.
- The production LavaMoat policy files (
- Whenever you regenerate a policy file, review the changes to determine whether the access granted to each package seems appropriate.
- Unfortunately,
yarn lavamoat:auto
will behave inconsistently on different platforms. macOS and Windows users may see extraneous changes relating to optional dependencies. - Keep in mind that any kind of dynamic import or dynamic use of globals may elude LavaMoat's static analysis. Refer to the LavaMoat documentation or ask for help if you run into any issues.
- There are two sets of LavaMoat policy files: