Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix (cherry-pick):Add main frame URL property to req object whenever req is triggered from an iframe #29337 #29405

Merged
merged 2 commits into from
Dec 20, 2024

Conversation

AugmentedMode
Copy link
Contributor

Chery pick PR: #29337 into V12.9.3

Description

See the attached issue in metamask planning for more details.

Open in GitHub Codespaces

Related issues

Fixes:

Manual testing steps

  1. Go to https://develop.d3bkcslj57l47p.amplifyapp.com/
  2. Click on Proceed anyways (This phishing warning page here is expected)
  3. Open the network tab to monitor network requests
  4. Connect your wallet and click on a signature or transaction
  5. Verify that mainFrameOrigin is included in the payload of the network request to the security alerts API
Screenshot 2024-12-20 at 10 46 05 AM

Screenshots/Recordings

Below are screenshots demonstrating the behavior of a test HTML page I created:

  1. In the first screenshot, before the iframe is loaded, the console shows only the origin of the main frame.
  2. In the second screenshot, after clicking the button to load an iframe pointing to example.com, the solution correctly identifies both the mainFrameOrigin (main frame) and the origin (iframe).
Screenshot 2024-12-18 at 10 24 48 PM Screenshot 2024-12-18 at 10 24 54 PM

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

…red from an iframe (#29337)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**

<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

See the attached issue in metamask planning for more details.

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/29337?quickstart=1)

## **Related issues**

Fixes:

## **Manual testing steps**

1. Go to `https://develop.d3bkcslj57l47p.amplifyapp.com/`
2. Click on Proceed anyways (This phishing warning page here is
expected)
3. Open the network tab to monitor network requests
4. Connect your wallet and click on a signature or transaction
5. Verify that mainFrameOrigin is included in the payload of the network
request to the security alerts API

<img width="1727" alt="Screenshot 2024-12-20 at 10 46 05 AM"
src="https://github.com/user-attachments/assets/71a0868d-21cf-4ce2-af20-11f092beb2ce"
/>

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

Below are screenshots demonstrating the behavior of a test HTML page I
created:

1. In the first screenshot, before the iframe is loaded, the console
shows only the origin of the main frame.
2. In the second screenshot, after clicking the button to load an iframe
pointing to example.com, the solution correctly identifies both the
mainFrameOrigin (main frame) and the origin (iframe).

<img width="1728" alt="Screenshot 2024-12-18 at 10 24 48 PM"
src="https://github.com/user-attachments/assets/244a1f9a-a0c1-4c82-b89e-8b20a8238d8e"
/>


<img width="1728" alt="Screenshot 2024-12-18 at 10 24 54 PM"
src="https://github.com/user-attachments/assets/ac28aacd-ec4a-4fd0-b644-8564345ea3d4"
/>




### **Before**

<!-- [screenshots/recordings] -->

### **After**

<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [ ] I've followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask
Extension Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
@AugmentedMode AugmentedMode requested a review from a team as a code owner December 20, 2024 18:04
Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-product-safety Push issues to Product Safety team label Dec 20, 2024
@AugmentedMode AugmentedMode self-assigned this Dec 20, 2024
@metamaskbot
Copy link
Collaborator

Builds ready [afcab17]
Page Load Metrics (1779 ± 72 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint32921931712351169
domContentLoaded14902134174915173
load14992151177915072
domInteractive26167544019
backgroundConnect97227189
firstReactRender1677322010
getState46121199
initialActions01000
loadScripts10701630130513565
setupStore65115147
uiStartup17122384198215776

@danjm danjm merged commit 5069950 into Version-v12.9.3 Dec 20, 2024
70 of 71 checks passed
@danjm danjm deleted the fix/cherry-pick-29337 branch December 20, 2024 19:39
@github-actions github-actions bot locked and limited conversation to collaborators Dec 20, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
team-product-safety Push issues to Product Safety team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants