Skip to content

fix: fix infura key displayed#8744

Merged
sethkfman merged 2 commits into
mainfrom
salim/fix-infura-key-displayed
Feb 27, 2024
Merged

fix: fix infura key displayed#8744
sethkfman merged 2 commits into
mainfrom
salim/fix-infura-key-displayed

Conversation

@salimtb

@salimtb salimtb commented Feb 27, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Description

We are exposing our network API keys in the network verification details. Exposing API keys should be avoided due to their significant security risks.

To reproduce:
Go to networks view
Proceed to add any infura supported network from the popular network list. Polygon is a good example.
Notice in the network approval modal the Infura API key is exposed in the Network URL field.

Related issues

Fixes: #1574

Manual testing steps

  1. Go to the add network page
  2. Choose polygon and click on add
  3. A modal will be displayed, scroll down to see the RPC Url
  4. Infura url should not display the api key

Screenshots/Recordings

Before

before

After

Screenshot 2024-02-27 at 13 18 42
trim.88505A2C-3CE8-4514-B44E-EC105C1864C2.MOV

Pre-merge author checklist

  • I’ve followed MetaMask Coding Standards.
  • I've clearly explained what problem this PR is solving and how it is solved.
  • I've linked related issues
  • I've included manual testing steps
  • I've included screenshots/recordings if applicable
  • I’ve included tests if applicable
  • I’ve documented my code using JSDoc format if applicable
  • I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.
  • I’ve properly set the pull request status:
    • In case it's not yet "ready for review", I've set it to "draft".
    • In case it's "ready for review", I've changed it from "draft" to "non-draft".

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@salimtb salimtb requested a review from a team as a code owner February 27, 2024 12:19
@github-actions

github-actions Bot commented Feb 27, 2024

Copy link
Copy Markdown
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@salimtb salimtb added team-assets team-mobile-ux Mobile UX team Sev1-high An issue that may have caused fund loss or access to wallet in the past & may still be ongoing regression-RC DEPRECATED: Please use "regresssion-RC-x.y.z" label instead Run Smoke E2E labels Feb 27, 2024
@github-actions

This comment was marked as outdated.

Sign in to view
@salimtb salimtb force-pushed the salim/fix-infura-key-displayed branch from f077f16 to 2d26655 Compare February 27, 2024 12:28
@salimtb salimtb added the release-blocker This bug is blocking the next release label Feb 27, 2024
@salimtb salimtb force-pushed the salim/fix-infura-key-displayed branch from 2d26655 to d17c35a Compare February 27, 2024 15:08
@github-actions

github-actions Bot commented Feb 27, 2024

Copy link
Copy Markdown
Contributor

E2E test started on Bitrise: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/966032bd-ffbc-4e7d-bd9e-ca97d3d98038
You can also kick off another Bitrise E2E smoke test by removing and re-applying the (Run Smoke E2E) label

@salimtb salimtb force-pushed the salim/fix-infura-key-displayed branch from d17c35a to c25c73d Compare February 27, 2024 15:16
Cal-L
Cal-L reviewed Feb 27, 2024
View reviewed changes

@Cal-L Cal-L left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a comment

Comment thread app/core/RPCMethods/networkChecker.util.ts Outdated
@github-actions

github-actions Bot commented Feb 27, 2024

Copy link
Copy Markdown
Contributor

E2E test started on Bitrise: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/78ee69f9-ceb0-4d9e-aec3-3c2088655df0
You can also kick off another Bitrise E2E smoke test by removing and re-applying the (Run Smoke E2E) label

@sonarqubecloud

sonarqubecloud Bot commented Feb 27, 2024

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

@codecov-commenter

codecov-commenter commented Feb 27, 2024

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 41.43%. Comparing base (6ddffcf) to head (dc03284).

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8744      +/-   ##
==========================================
+ Coverage   41.41%   41.43%   +0.01%     
==========================================
  Files        1270     1270              
  Lines       30826    30833       +7     
  Branches     3042     3043       +1     
==========================================
+ Hits        12768    12775       +7     
  Misses      17295    17295              
  Partials      763      763

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@gauthierpetetin gauthierpetetin added the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Feb 27, 2024
Cal-L
Cal-L approved these changes Feb 27, 2024
View reviewed changes

@Cal-L Cal-L left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sethkfman sethkfman merged commit 5fe71b8 into main Feb 27, 2024
@sethkfman sethkfman deleted the salim/fix-infura-key-displayed branch February 27, 2024 19:28
@github-actions github-actions Bot locked and limited conversation to collaborators Feb 27, 2024
@github-actions github-actions Bot removed the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Feb 27, 2024
@metamaskbot metamaskbot added the release-7.18.0 Issue or pull request that will be included in release 7.18.0 label Feb 27, 2024
@metamaskbot metamaskbot added release-7.17.0 Issue or pull request that will be included in release 7.17.0 and removed release-7.18.0 Issue or pull request that will be included in release 7.18.0 labels Feb 29, 2024
@metamaskbot

metamaskbot commented Feb 29, 2024

Copy link
Copy Markdown
Collaborator

Missing release label release-7.17.0 on PR. Adding release label release-7.17.0 on PR and removing other release labels(release-7.18.0), as PR was cherry-picked in branch 7.17.0.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@Cal-L Cal-L Cal-L approved these changes

Assignees

No one assigned

Labels

regression-RC DEPRECATED: Please use "regresssion-RC-x.y.z" label instead release-7.17.0 Issue or pull request that will be included in release 7.17.0 release-blocker This bug is blocking the next release Sev1-high An issue that may have caused fund loss or access to wallet in the past & may still be ongoing team-assets team-mobile-ux Mobile UX team

Projects

PR review queue
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@salimtb @codecov-commenter @metamaskbot @Cal-L @gauthierpetetin @sethkfman