Skip to content

feat: Update SES lockdown options#8413

Merged
sethkfman merged 2 commits into
mainfrom
feat/ses-lockdown-repairIntrinsics-options
Jan 30, 2024
Merged

feat: Update SES lockdown options#8413
sethkfman merged 2 commits into
mainfrom
feat/ses-lockdown-repairIntrinsics-options

Conversation

@leotm

@leotm leotm commented Jan 26, 2024

Copy link
Copy Markdown
Contributor

Description

Update SES lockdown options to improve error stacks

Set error taming to unsafe

  • make error stacks also available by the error instance stack
  • preserve error stack filtered content
  • like we do in metamask-extension

Set stack filtering to verbose

  • show full raw error info for each deep stack level
  • preserve noise that the (default) concise option was removing

Follow-up to

Ref: https://github.com/endojs/endo/blob/master/packages/ses/docs/reference.md#options-quick-reference

Nb: we're looking into a lockdown/repairIntrinsics option to disable touching errors entirely (for cases like ours involving React Native surfacing JS/Android/iOS errors, then later newer engine Hermes)

Related issues

Manual testing steps

Local testing in debug-mode:

  • Update InitializeCore to enable SES in debug/dev mode
  • Trigger an error somewhere in the app
    • new Error('test')
    • Sentry.captureException(new Error('test'))
  • Check simulator
    • ensure original error preserved in call stack
    • ensure tapping error redirects to source code
  • Check Sentry event
    • ensure original error preserved in call stack

But note above we're looking into a better lockdown option for React Native debug-mode,
since we disabled SES in debug-mode earlier from React Devtools interfering

Production testing:
After we merge #8373, we'll be able to ft toggle lockdown via our in-app settings menu, which will persist the choice and apply after the app has been rebooted

Screenshots/Recordings

Before

After

Pre-merge author checklist

  • I’ve followed MetaMask Coding Standards.
  • I've clearly explained what problem this PR is solving and how it is solved.
  • I've linked related issues
  • I've included manual testing steps
  • I've included screenshots/recordings if applicable
  • I’ve included tests if applicable
  • I’ve documented my code using JSDoc format if applicable
  • I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.
  • I’ve properly set the pull request status:
    • In case it's not yet "ready for review", I've set it to "draft".
    • In case it's "ready for review", I've changed it from "draft" to "non-draft".

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@github-actions

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@leotm leotm changed the title Set SES lockdown errorTaming to 'unsafe' feat: Update SES lockdown options Jan 26, 2024
@leotm leotm force-pushed the feat/ses-lockdown-repairIntrinsics-options branch from e6d6785 to a0ce650 Compare January 26, 2024 13:42
@codecov-commenter

codecov-commenter commented Jan 26, 2024

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (ea21001) 40.43% compared to head (174c6f7) 40.43%.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #8413   +/-   ##
=======================================
  Coverage   40.43%   40.43%           
=======================================
  Files        1239     1239           
  Lines       29976    29976           
  Branches     2875     2875           
=======================================
  Hits        12122    12122           
  Misses      17157    17157           
  Partials      697      697           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@leotm leotm force-pushed the feat/ses-lockdown-repairIntrinsics-options branch from a0ce650 to 164b9cd Compare January 26, 2024 13:53
- Make error stacks also available by the error instance stack
- Preserve error stack filtered content
- Like we do in metamask-extension
- Improve error debugging in Sentry

https://github.com/endojs/endo/blob/master/packages/ses/docs/reference.md#options-quick-reference

https://github.com/MetaMask/metamask-extension/blob/develop/app/scripts/lockdown-run.js#L6
@leotm leotm force-pushed the feat/ses-lockdown-repairIntrinsics-options branch from 164b9cd to d9a9c6e Compare January 26, 2024 13:57
- Show full raw error info for each deep stack lvl
- Preserve 'noise' that the default 'concise' option removes
- Improve error debugging in Sentry

https://github.com/endojs/endo/blob/master/packages/ses/docs/reference.md#options-quick-reference
@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@leotm leotm requested review from Cal-L and Gudahtt January 26, 2024 14:14
@leotm leotm marked this pull request as ready for review January 26, 2024 14:17
@leotm leotm requested a review from a team as a code owner January 26, 2024 14:17
@leotm leotm requested a review from naugtur January 26, 2024 14:18
@github-actions

github-actions Bot commented Jan 26, 2024

Copy link
Copy Markdown
Contributor

E2E test started on Bitrise: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/7526129e-61ba-40cf-af57-62d2bf4e8f50
You can also kick off another Bitrise E2E smoke test by removing and re-applying the (Run Smoke E2E) label

ios_e2e_build ✅
android_e2e_build ✅

run_smoke_e2e_ios_android_stage ✅

@leotm leotm mentioned this pull request Jan 30, 2024
29 tasks

@sethkfman sethkfman left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sethkfman sethkfman merged commit a3ea469 into main Jan 30, 2024
@sethkfman sethkfman deleted the feat/ses-lockdown-repairIntrinsics-options branch January 30, 2024 18:54
@github-actions github-actions Bot locked and limited conversation to collaborators Jan 30, 2024
@metamaskbot metamaskbot added release-7.17.0 Issue or pull request that will be included in release 7.17.0 release-7.16.0 Issue or pull request that will be included in release 7.16.0 and removed release-7.17.0 Issue or pull request that will be included in release 7.17.0 labels Jan 30, 2024
@metamaskbot

Copy link
Copy Markdown
Collaborator

Missing release label release-7.16.0 on PR. Adding release label release-7.16.0 on PR and removing other release labels(release-7.17.0), as PR was cherry-picked in branch 7.16.0.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-7.16.0 Issue or pull request that will be included in release 7.16.0 team-lavamoat

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants