Closed
Conversation
- throws and handles rpc error - no longer throws uncaught error
Contributor
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
legobeat
reviewed
Mar 16, 2023
Comment on lines
+3220
to
+3229
| msgParams.siwe = siwe; | ||
|
|
||
| if (siwe.isSIWEMessage && req.origin) { | ||
| const { host } = new URL(req.origin); | ||
| if (siwe.parsedMessage.domain !== host) { | ||
| throw ethErrors.rpc.invalidParams( | ||
| `SIWE domain is not valid: "${host}" !== "${siwe.parsedMessage.domain}"`, | ||
| ); | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
Not every message is SIWE, right?
Suggested change
| msgParams.siwe = siwe; | |
| if (siwe.isSIWEMessage && req.origin) { | |
| const { host } = new URL(req.origin); | |
| if (siwe.parsedMessage.domain !== host) { | |
| throw ethErrors.rpc.invalidParams( | |
| `SIWE domain is not valid: "${host}" !== "${siwe.parsedMessage.domain}"`, | |
| ); | |
| } | |
| } | |
| if (siwe) { | |
| if (siwe.isSIWEMessage && req.origin) { | |
| const { host } = new URL(req.origin); | |
| if (siwe.parsedMessage.domain !== host) { | |
| throw ethErrors.rpc.invalidParams( | |
| `SIWE domain is not valid: "${host}" !== "${siwe.parsedMessage.domain}"`, | |
| ); | |
| } | |
| } | |
| msgParams.siwe = siwe; | |
| } |
Contributor
Author
There was a problem hiding this comment.
Correct. I'm unfamiliar with the decision to add the siwe property to msgParams for non-SIWE, but it appears detectSIWE returns an object with the check included as a boolean property
Contributor
Author
There was a problem hiding this comment.
In this case, siwe will pass the condition for non-SIWE messages as well
Contributor
Author
There was a problem hiding this comment.
@skgbafa, do you know if the siwe msgParams property is being used for non-SIWE? is this a property we can remove for non-SIWE?
Merged
8 tasks
digiwand
added a commit
that referenced
this pull request
Mar 17, 2023
…disable domain binding (#18200) * siwe: re-enable warning UI for mismatched domains - unblocks mismatched domain support - we may re-add error handling here #18184 - reverts logic from #16616 * siwe: fix mismatch domain warning msg UI * lint: rm whitespace EOL * siwe: rm unit test * lint: fix whitespace * Revert "siwe: rm unit test" This reverts commit c80a4a2. --------- Co-authored-by: legobeat <109787230+legobeat@users.noreply.github.com>
danjm
pushed a commit
that referenced
this pull request
Mar 17, 2023
…disable domain binding (#18200) * siwe: re-enable warning UI for mismatched domains - unblocks mismatched domain support - we may re-add error handling here #18184 - reverts logic from #16616 * siwe: fix mismatch domain warning msg UI * lint: rm whitespace EOL * siwe: rm unit test * lint: fix whitespace * Revert "siwe: rm unit test" This reverts commit c80a4a2. --------- Co-authored-by: legobeat <109787230+legobeat@users.noreply.github.com>
digiwand
added a commit
that referenced
this pull request
Mar 21, 2023
…n with Ethereum page (#18207) * siwe: re-enable warning UI for mismatched domains - unblocks mismatched domain support - we may re-add error handling here #18184 - reverts logic from #16616 * siwe: fix mismatch domain warning msg UI * lint: rm whitespace EOL * siwe: rm unit test * lint: fix whitespace * Icon: support .mm-icon - apply to SIWE actionable-message - .mm-icon is a <span> * lint: fix newline * Revert "siwe: rm unit test" This reverts commit c80a4a2. * ActionableMessage: add deprecation * siwe: replace actionable-msg w/ banner-alert * ActionableMessage: add param for lint * revert .mm_icon ActionableMessage support * siwe: create tests * siwe: fix typo in tests * siwe: fix - do not allow nested <p> elements * Update ui/components/app/signature-request-siwe/signature-request-siwe.js Co-authored-by: George Marshall <george.marshall@consensys.net> * Update ui/components/app/signature-request-siwe/signature-request-siwe.js Co-authored-by: George Marshall <george.marshall@consensys.net> * eslint fix --------- Co-authored-by: legobeat <109787230+legobeat@users.noreply.github.com> Co-authored-by: George Marshall <george.marshall@consensys.net>
PeterYinusa
pushed a commit
that referenced
this pull request
Mar 31, 2023
…disable domain binding (#18200) * siwe: re-enable warning UI for mismatched domains - unblocks mismatched domain support - we may re-add error handling here #18184 - reverts logic from #16616 * siwe: fix mismatch domain warning msg UI * lint: rm whitespace EOL * siwe: rm unit test * lint: fix whitespace * Revert "siwe: rm unit test" This reverts commit c80a4a2. --------- Co-authored-by: legobeat <109787230+legobeat@users.noreply.github.com>
Contributor
Author
|
closing for now. We may resurrect logic from this PR when we strict enforce domain-binding with the developer-mode feature. More details here #18191 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
** This PR is placed on hold while we plan how we'd like to update Sign-in with Ethereum guardrails **
Fixes #17707
Related to #16616
Handle SIWE mismatched domain error and return the appropriate RPC error.
Todo:
Screenshots/Screencaps
Before
SIWE.mov
After
Screen.Recording.2023-03-16.at.2.52.09.AM.mov
Manual Testing Steps
Pre-merge author checklist
Pre-merge reviewer checklist
If further QA is required (e.g. new feature, complex testing steps, large refactor), add the
Extension QA Boardlabel.In this case, a QA Engineer approval will be be required.