Skip to content

Commit

Permalink
chore: Patch security issue in snaps-utils (#25827)
Browse files Browse the repository at this point in the history
## **Description**

This is the same as #25823, but targeting `develop` instead of
`Version-v12.0.0`.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/25827?quickstart=1)
  • Loading branch information
Mrtenz authored Jul 15, 2024
1 parent f01ead7 commit a8639a2
Show file tree
Hide file tree
Showing 3 changed files with 68 additions and 4 deletions.
30 changes: 30 additions & 0 deletions .yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
diff --git a/dist/chunk-37VHIRUJ.js b/dist/chunk-37VHIRUJ.js
index a909a4ef20305665a07db5c25b4a9ff7eb0a447e..98dd75bf33a9716dc6cca96a38d184645f6ec033 100644
--- a/dist/chunk-37VHIRUJ.js
+++ b/dist/chunk-37VHIRUJ.js
@@ -53,8 +53,8 @@ function assertIsKeyringOrigins(value, ErrorWrapper) {
}
function createOriginRegExp(matcher) {
const escaped = matcher.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
- const regex = escaped.replace(/\*/gu, ".*");
- return RegExp(regex, "u");
+ const regex = escaped.replace(/\\\*/gu, '.*');
+ return RegExp(`${regex}$`, 'u');
}
function checkAllowedOrigin(matcher, origin) {
if (matcher === "*" || matcher === origin) {
diff --git a/dist/chunk-K2OTEZZZ.mjs b/dist/chunk-K2OTEZZZ.mjs
index 15be5da7563a5bdf464d7e9c28ed6f04863e378a..7f38bf328e71c1feb2b8850ba050ce9e55801668 100644
--- a/dist/chunk-K2OTEZZZ.mjs
+++ b/dist/chunk-K2OTEZZZ.mjs
@@ -53,8 +53,8 @@ function assertIsKeyringOrigins(value, ErrorWrapper) {
}
function createOriginRegExp(matcher) {
const escaped = matcher.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
- const regex = escaped.replace(/\*/gu, ".*");
- return RegExp(regex, "u");
+ const regex = escaped.replace(/\\\*/gu, '.*');
+ return RegExp(`${regex}$`, 'u');
}
function checkAllowedOrigin(matcher, origin) {
if (matcher === "*" || matcher === origin) {
7 changes: 5 additions & 2 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -253,7 +253,10 @@
"@metamask/network-controller": "patch:@metamask/network-controller@npm%3A19.0.0#~/.yarn/patches/@metamask-network-controller-npm-19.0.0-a5e0d1fe14.patch",
"@solana/web3.js/rpc-websockets": "^8.0.1",
"@metamask/network-controller@npm:^19.0.0": "patch:@metamask/network-controller@npm%3A19.0.0#~/.yarn/patches/@metamask-network-controller-npm-19.0.0-a5e0d1fe14.patch",
"@metamask/nonce-tracker@npm:^5.0.0": "patch:@metamask/nonce-tracker@npm%3A5.0.0#~/.yarn/patches/@metamask-nonce-tracker-npm-5.0.0-d81478218e.patch"
"@metamask/nonce-tracker@npm:^5.0.0": "patch:@metamask/nonce-tracker@npm%3A5.0.0#~/.yarn/patches/@metamask-nonce-tracker-npm-5.0.0-d81478218e.patch",
"@metamask/snaps-utils@npm:^7.7.0": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch",
"@metamask/snaps-utils@npm:^7.4.0": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch",
"@metamask/snaps-utils@npm:^7.5.0": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch"
},
"dependencies": {
"@babel/runtime": "patch:@babel/runtime@npm%3A7.24.0#~/.yarn/patches/@babel-runtime-npm-7.24.0-7eb1dd11a2.patch",
Expand Down Expand Up @@ -340,7 +343,7 @@
"@metamask/snaps-execution-environments": "^6.5.0",
"@metamask/snaps-rpc-methods": "^9.1.4",
"@metamask/snaps-sdk": "^6.0.0",
"@metamask/snaps-utils": "^7.7.0",
"@metamask/snaps-utils": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch",
"@metamask/transaction-controller": "^32.0.0",
"@metamask/user-operation-controller": "^10.0.0",
"@metamask/utils": "^8.2.1",
Expand Down
35 changes: 33 additions & 2 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -6402,7 +6402,7 @@ __metadata:
languageName: node
linkType: hard

"@metamask/snaps-utils@npm:^7.4.0, @metamask/snaps-utils@npm:^7.5.0, @metamask/snaps-utils@npm:^7.7.0":
"@metamask/snaps-utils@npm:7.7.0":
version: 7.7.0
resolution: "@metamask/snaps-utils@npm:7.7.0"
dependencies:
Expand Down Expand Up @@ -6433,6 +6433,37 @@ __metadata:
languageName: node
linkType: hard

"@metamask/snaps-utils@patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch":
version: 7.7.0
resolution: "@metamask/snaps-utils@patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch::version=7.7.0&hash=5f2735"
dependencies:
"@babel/core": "npm:^7.23.2"
"@babel/types": "npm:^7.23.0"
"@metamask/base-controller": "npm:^6.0.0"
"@metamask/key-tree": "npm:^9.1.1"
"@metamask/permission-controller": "npm:^10.0.0"
"@metamask/rpc-errors": "npm:^6.2.1"
"@metamask/slip44": "npm:^3.1.0"
"@metamask/snaps-registry": "npm:^3.1.0"
"@metamask/snaps-sdk": "npm:^6.0.0"
"@metamask/utils": "npm:^8.3.0"
"@noble/hashes": "npm:^1.3.1"
"@scure/base": "npm:^1.1.1"
chalk: "npm:^4.1.2"
cron-parser: "npm:^4.5.0"
fast-deep-equal: "npm:^3.1.3"
fast-json-stable-stringify: "npm:^2.1.0"
fast-xml-parser: "npm:^4.3.4"
marked: "npm:^12.0.1"
rfdc: "npm:^1.3.0"
semver: "npm:^7.5.4"
ses: "npm:^1.1.0"
superstruct: "npm:^1.0.3"
validate-npm-package-name: "npm:^5.0.0"
checksum: 10/9ac16da1c2c1c7e2b857078ff4d9d450db8d5dbf650143ffc7953d2aea70fd58c87d1c1f2429a5a1c1418334d27e87d4a6a03089a55ba86840c417dfdb73b2fe
languageName: node
linkType: hard

"@metamask/swappable-obj-proxy@npm:^2.2.0":
version: 2.2.0
resolution: "@metamask/swappable-obj-proxy@npm:2.2.0"
Expand Down Expand Up @@ -25254,7 +25285,7 @@ __metadata:
"@metamask/snaps-execution-environments": "npm:^6.5.0"
"@metamask/snaps-rpc-methods": "npm:^9.1.4"
"@metamask/snaps-sdk": "npm:^6.0.0"
"@metamask/snaps-utils": "npm:^7.7.0"
"@metamask/snaps-utils": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch"
"@metamask/test-bundler": "npm:^1.0.0"
"@metamask/test-dapp": "npm:^8.4.0"
"@metamask/transaction-controller": "npm:^32.0.0"
Expand Down

0 comments on commit a8639a2

Please sign in to comment.