Skip to content

fix: host permissions for cx.metamask.io#23958

Merged
cryptotavares merged 1 commit intodevelopfrom
fix/firefox-cors-for-cx-metamask-io-requests
Apr 11, 2024
Merged

fix: host permissions for cx.metamask.io#23958
cryptotavares merged 1 commit intodevelopfrom
fix/firefox-cors-for-cx-metamask-io-requests

Conversation

@cryptotavares
Copy link
Copy Markdown
Contributor

@cryptotavares cryptotavares commented Apr 11, 2024

Description

When host permissions do not exist for a given domain, firefox sets cors policy to cross-origin.
This was preventing getting the blockaid files from our cdn and thus making the feature unusable in firefox.

This is fixed by adding "https://*.cx.metamask.io/" to the manifest file permissions.

Open in GitHub Codespaces

Related issues

Fixes:

Manual testing steps

  1. Install the extension in Firefox
  2. Make sure that you have security alerts enabled.
  3. Go to the test-dapp
  4. Try a malicous transaction
  5. You should see the This is a deceptive request.

Screenshots/Recordings

Before

Screenshot 2024-04-11 at 10 25 37

After

Screenshot 2024-04-11 at 09 48 46

Pre-merge author checklist

  • I’ve followed MetaMask Coding Standards.
  • I've completed the PR template to the best of my ability
  • I’ve included tests if applicable
  • I’ve documented my code using JSDoc format if applicable
  • I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

When host permissions do not exist for a given
domain, firefox sets cors policy to cross-origin.
This was preventing getting the blockaid files
from our cdn and thus making the feature unusable
in firefox.
@cryptotavares cryptotavares added the team-confirmations-secure-ux-deprecated DEPRECATED: please use "team-confirmations" instead label Apr 11, 2024
@cryptotavares cryptotavares requested a review from a team as a code owner April 11, 2024 09:13
@github-actions
Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 11, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.46%. Comparing base (f5c0d84) to head (c478aa9).

Additional details and impacted files
@@           Coverage Diff            @@
##           develop   #23958   +/-   ##
========================================
  Coverage    67.46%   67.46%           
========================================
  Files         1244     1244           
  Lines        48777    48777           
  Branches     12724    12724           
========================================
  Hits         32907    32907           
  Misses       15870    15870           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@metamaskbot
Copy link
Copy Markdown
Collaborator

Builds ready [c478aa9]
Page Load Metrics (295 ± 287 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint833881236431
domContentLoaded96430147
load702196295597287
domInteractive96430147
Bundle size diffs
  • background: 0 Bytes (0.00%)
  • ui: 0 Bytes (0.00%)
  • common: 0 Bytes (0.00%)

@cryptotavares cryptotavares merged commit 255a961 into develop Apr 11, 2024
@cryptotavares cryptotavares deleted the fix/firefox-cors-for-cx-metamask-io-requests branch April 11, 2024 10:14
@github-actions github-actions bot locked and limited conversation to collaborators Apr 11, 2024
@metamaskbot metamaskbot added the release-11.15.0 Issue or pull request that will be included in release 11.15.0 label Apr 11, 2024
@cryptotavares cryptotavares restored the fix/firefox-cors-for-cx-metamask-io-requests branch April 11, 2024 10:16
@cryptotavares cryptotavares deleted the fix/firefox-cors-for-cx-metamask-io-requests branch April 11, 2024 10:17
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-11.15.0 Issue or pull request that will be included in release 11.15.0 team-confirmations-secure-ux-deprecated DEPRECATED: please use "team-confirmations" instead

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants