Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add harden events utilities #1221

Merged
merged 2 commits into from
Mar 15, 2023
Merged

Add harden events utilities #1221

merged 2 commits into from
Mar 15, 2023

Conversation

david0xd
Copy link
Contributor

@david0xd david0xd commented Feb 21, 2023

Fixes: #1132

This PR will add utility functions with procedures for hardening Event related objects.

New lockdown procedure file is added exclusively for events lockdown-events.ts exporting function executeLockdownEvents that is called in packages/snaps-execution-environments/src/iframe/index.ts before other lockdown functions to ensure that this one will be executed before SES disallows further changes.

Currently blocked by (depends on): MetaMask/post-message-stream#79

@david0xd david0xd self-assigned this Feb 21, 2023
weizman
weizman previously approved these changes Feb 22, 2023
Copy link
Member

@weizman weizman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

important comments

@codecov
Copy link

codecov bot commented Mar 8, 2023

Codecov Report

Merging #1221 (8f54c08) into main (8dcb465) will increase coverage by 0.32%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##             main    #1221      +/-   ##
==========================================
+ Coverage   95.30%   95.62%   +0.32%     
==========================================
  Files         141      140       -1     
  Lines        4383     4388       +5     
  Branches      718      725       +7     
==========================================
+ Hits         4177     4196      +19     
+ Misses        206      192      -14     
Impacted Files Coverage Δ
...nvironments/src/common/lockdown/lockdown-events.ts 100.00% <100.00%> (ø)

... and 2 files with indirect coverage changes

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@david0xd david0xd marked this pull request as ready for review March 8, 2023 17:42
@david0xd david0xd requested a review from a team as a code owner March 8, 2023 17:42
Copy link
Member

@FrederikBolding FrederikBolding left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The lockdown events code should be a separate file that we can include in the index.html before the main bundle.

Change lockdown execution order

WIP: Experimental testing (for debugging purposes only)

Update with version of code that will work after updating post-message-stream

Add review refactoring (1)

Add review refactoring (2)

Add review refactoring (3)

Update post-message-stream version and add test to improve coverage

Fix coverage after rebase

Try to fix coverage

Refactor lockdown-events.ts

Fix yarn conflicts after rebase

Refactor test for events lockdown function

Add lockdown events in other environments

Revert "Add lockdown events in other environments"

This reverts commit 4e89e4e.

Add new proposal for implementing lockdown of events

Fix coverage issues
@david0xd david0xd merged commit 6885e48 into main Mar 15, 2023
@david0xd david0xd deleted the dd/harden-events branch March 15, 2023 09:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type-security Related to enforcing our security model.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Implement custom security for Events
4 participants