Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add fix for event security (MessageEvent source issue) #79

Merged
merged 3 commits into from
Mar 7, 2023

Conversation

david0xd
Copy link
Contributor

@david0xd david0xd commented Mar 2, 2023

This PR will fix an issue after changing the prototype of the MessageEvent (source property).

This PR will unblock: MetaMask/snaps#1221

Related ticket: MetaMask/snaps#1132

Context

  • As part of the effort around securing snaps arch, we decided to scuttle all properties of Event based prototypes that might leak DOM/window objects.
  • However, when performing such scuttling, this dep is being affected because it counts on having a direct access to those properties that we scuttle.
  • We fix that by simply preserving the needed descriptors before we scuttle them so we can use them later instead of the direct props access.

@david0xd david0xd self-assigned this Mar 2, 2023
@weizman
Copy link
Member

weizman commented Mar 2, 2023

Explanation (context)

  • As part of the effort around securing snaps arch, we decided to scuttle all properties of Event based prototypes that might leak DOM/window objects.
  • However, when performing such scuttling, this dep is being affected because it counts on having a direct access to those properties that we scuttle.
  • We fix that by simply preserving the needed descriptors before we scuttle them so we can use them later instead of the direct props access.

Copy link
Member

@weizman weizman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are all those ts-expect-error really needed? no way around those?

@david0xd david0xd marked this pull request as ready for review March 2, 2023 15:43
src/window/WindowPostMessageStream.ts Outdated Show resolved Hide resolved
@david0xd david0xd merged commit 22fe341 into main Mar 7, 2023
@david0xd david0xd deleted the dd/fix-for-event-security branch March 7, 2023 08:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants