fix: use streaming decompression with size limit for deeplink payloads#26542
fix: use streaming decompression with size limit for deeplink payloads#26542chakra-guy merged 1 commit intomainfrom
Conversation
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
a7f9da7 to
00fa1ea
Compare
…s (WAPI-1131) Switch to pako's streaming Inflate class to abort decompression early when cumulative output exceeds 5 MB, preventing decompression bomb attacks from exhausting heap memory. Replace mock-heavy tests with integration tests using real pako compression.
00fa1ea to
bc90319
Compare
🔍 Smart E2E Test Selection
click to see 🤖 AI reasoning detailsE2E Test Selection:
The changes are:
None of the available E2E test tags directly test SDKConnectV2 deeplink handling. The existing E2E tests focus on browser-based dApp connections (SmokeNetworkExpansion, SmokeMultiChainAPI) which use different code paths. The SDKConnectV2 module is used for QR code scanning and SDK disconnect modal, but these flows aren't covered by the available test tags. Since this is a security fix with comprehensive unit test coverage and doesn't change behavior for valid payloads, no E2E tests are required. Performance Test Selection: |
Description
The deeplink connection flow (
metamask://connect/mwp?p=<payload>&c=1) checks payload size only on the compressed, base64-encoded input (1 MB limit) but not on the decompressed output. A crafted compressed payload within this limit can expand to hundreds of megabytes during decompression, exhausting heap memory and crashing the app.This was identified as a finding in the Cyfrin security audit: Cyfrin audit issue #4
The fix switches from pako's one-shot
inflate()to the streamingInflateclass, wrapping the defaultonDatahandler with a size guard that tracks cumulative output bytes and throws as soon as output exceeds 5 MB. This aborts decompression early without ever allocating the full bomb payload in memory. The 5 MB limit is generous (real connection request payloads are well under 10 KB) and the existing 1 MB pre-decompression check remains in place as a first line of defense.Changelog
CHANGELOG entry: Fixed a potential decompression bomb vulnerability in the deeplink connection flow by adding streaming output size limits
Related issues
Fixes: https://consensyssoftware.atlassian.net/browse/WAPI-1131
Refs: https://github.com/Cyfrin/audit-2026-02-metamask-connect/issues/4
Manual testing steps
Not applicable.
Screenshots/Recordings
Not applicable.
Pre-merge author checklist
Pre-merge reviewer checklist