Skip to content

fix: strengthen explore portfolio site condition#25433

Merged
Prithpal-Sooriya merged 1 commit intomainfrom
cursor/portfolio-url-condition-a3a5
Jan 30, 2026
Merged

fix: strengthen explore portfolio site condition#25433
Prithpal-Sooriya merged 1 commit intomainfrom
cursor/portfolio-url-condition-a3a5

Conversation

@Prithpal-Sooriya
Copy link
Copy Markdown
Contributor

@Prithpal-Sooriya Prithpal-Sooriya commented Jan 30, 2026 •
edited by cursor bot
Loading

Description

Replaced URL substring check with hostname comparison for portfolio site identification to fix a security vulnerability.

This should be pretty safe since we own the underlying data, but still good practice to use stricter url condition.

Changelog

CHANGELOG entry: fix: strengthen explore portfolio site condition

Related issues

Fixes: https://github.com/MetaMask/metamask-mobile/security/code-scanning/134

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Open in Cursor Open in Web

Note

Low Risk
Low risk: small, localized change to Portfolio site detection logic; the main risk is accidentally missing/duplicating the Portfolio entry if URL parsing/normalization behaves unexpectedly for edge-case inputs.

Overview
Strengthens how the Explore sites list detects whether MetaMask Portfolio is already present by replacing a url.includes('portfolio.metamask.io') substring check with strict hostname parsing/comparison.

Adds PORTFOLIO_HOSTNAME and a new isPortfolioSiteUrl() normalizer (handles missing schemes/whitespace) and uses it in mergePortfolioSite to avoid false matches that could let non-Portfolio URLs bypass or trigger the Portfolio entry logic.

Written by Cursor Bugbot for commit 3214479. This will update automatically on new commits. Configure here.

@cursor
Copy link
Copy Markdown

cursor bot commented Jan 30, 2026

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
Learn more about Cursor Agents

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 30, 2026

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Jan 30, 2026

🔍 Smart E2E Test Selection

  • Selected E2E tags: SmokeWalletPlatform
  • Selected Performance tags: None (no tests recommended)
  • Risk Level: low
  • AI Confidence: 82%
click to see 🤖 AI reasoning details

E2E Test Selection:
Changed hook useSitesData adjusts how the Sites list for the Trending/Discovery tab is built (introduces PORTFOLIO_HOSTNAME, normalizes URL matching via isPortfolioSiteUrl, and ensures Portfolio is included without duplicates). This directly impacts the Trending Sites section and potential browser navigation from that list. No controllers, Engine, confirmations, or core flows were modified, so broader test suites are unnecessary. Running SmokeWalletPlatform covers the Trending tab browsing and browser navigation integration, which will validate this change.

Performance Test Selection:
The change is a small URL handling and list-merge logic update with negligible computational impact. It does not affect app startup, global state, token lists, or heavy rendering paths. No performance tests are warranted.

View GitHub Actions results

@Prithpal-Sooriya Prithpal-Sooriya marked this pull request as ready for review January 30, 2026 13:09
@Prithpal-Sooriya Prithpal-Sooriya changed the title Portfolio URL condition fix: strengthen explore portfolio site condition Jan 30, 2026
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Jan 30, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
92.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@Prithpal-Sooriya Prithpal-Sooriya added this pull request to the merge queue Jan 30, 2026
Merged via the queue into main with commit 85f52c7 Jan 30, 2026
112 of 115 checks passed
@Prithpal-Sooriya Prithpal-Sooriya deleted the cursor/portfolio-url-condition-a3a5 branch January 30, 2026 14:06
@github-actions github-actions bot locked and limited conversation to collaborators Jan 30, 2026
@metamaskbot metamaskbot added the release-7.65.0 Issue or pull request that will be included in release 7.65.0 label Jan 30, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@sahar-fehri sahar-fehri sahar-fehri approved these changes

@juanmigdr juanmigdr juanmigdr approved these changes

Assignees

No one assigned

Labels

release-7.65.0 Issue or pull request that will be included in release 7.65.0 size-S team-assets

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Prithpal-Sooriya @sahar-fehri @juanmigdr @metamaskbot