Skip to content

Commit 7c12e4b

Browse files
gauthierpetetingauthierpetetin
authored
Merge pull request #38244 from MetaMask/release/13.10.4
release: 13.10.4
2 parents d99f030 + 2f9dbbc commit 7c12e4b

File tree

16 files changed

+193
-38
lines changed

16 files changed

+193
-38
lines changed

‎.yarn/patches/@metamask-assets-controllers-npm-88.0.0-3dfc0ab8f1.patch‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,16 @@ index 420934fb16ed6151b5b80fb7be04f81352b4aaf4..d735379adcaf77cbd46b4659f9bfd320
4646
}
4747
}
4848
});
49+
diff --git a/dist/token-prices-service/codefi-v2.cjs b/dist/token-prices-service/codefi-v2.cjs
50+
index f3c24e32ab755ae5c00e7d439600c4bab1587c71..df2932739853ab963f41a1d1270b1a6769c0ce88 100644
51+
--- a/dist/token-prices-service/codefi-v2.cjs
52+
+++ b/dist/token-prices-service/codefi-v2.cjs
53+
@@ -98,6 +98,8 @@ exports.SUPPORTED_CURRENCIES = [
54+
'mxn',
55+
// Malaysian Ringgit
56+
'myr',
57+
+ // Monad
58+
+ 'mon',
59+
// Nigerian Naira
60+
'ngn',
61+
// Norwegian Krone

‎.yarnrc.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,12 @@ npmAuditIgnoreAdvisories:
8080
- 'ts-custom-error (deprecation)'
8181
- 'text-encoding (deprecation)'
8282

83+
# Issue: `body-parser` denial of service vulnerability
84+
# Seemingly only impacts v2.2.0, but we're on v1. The advisory range is overly wide.
85+
# The attack vector also does not apply to how we use the package.
86+
# URL: https://github.com/advisories/GHSA-wqch-xfxh-vrr4
87+
- 1110857
88+
8389
### Package Deprecations:
8490

8591
# React-tippy brings in popper.js and react-tippy has not been updated in

‎CHANGELOG.md‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
## [13.10.4]
11+
12+
### Fixed
13+
14+
- Signed deep links with empty `sig_params` with extra params as valid (#38142)
15+
- Adds mon as currency to fetch prices (#38261)
16+
- Removes sidepanel from chrome manifest files (#38242)
17+
1018
## [13.10.3]
1119

1220
### Fixed
@@ -1239,7 +1247,8 @@ authorized by the user.` error until the user fully revoked dapp
12391247
- This changelog was split off with 12.22.0
12401248
- All older changes can be found in [docs/CHANGELOG_older.md](https://github.com/MetaMask/metamask-extension/blob/main/docs/CHANGELOG_older.md)
12411249

1242-
[Unreleased]: https://github.com/MetaMask/metamask-extension/compare/v13.10.3...HEAD
1250+
[Unreleased]: https://github.com/MetaMask/metamask-extension/compare/v13.10.4...HEAD
1251+
[13.10.4]: https://github.com/MetaMask/metamask-extension/compare/v13.10.3...v13.10.4
12431252
[13.10.3]: https://github.com/MetaMask/metamask-extension/compare/v13.10.2...v13.10.3
12441253
[13.10.2]: https://github.com/MetaMask/metamask-extension/compare/v13.10.1...v13.10.2
12451254
[13.10.1]: https://github.com/MetaMask/metamask-extension/compare/v13.10.0...v13.10.1

‎app/manifest/v3/_base.json‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,6 @@
8181
"webRequest",
8282
"offscreen",
8383
"identity",
84-
"sidePanel",
8584
"contextMenus"
8685
],
8786
"sandbox": {

‎app/manifest/v3/chrome.json‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,5 @@
1010
"matches": ["http://*/*", "https://*/*"],
1111
"ids": ["*"]
1212
},
13-
"minimum_chrome_version": "115",
14-
"side_panel": {
15-
"default_path": "sidepanel.html"
16-
}
13+
"minimum_chrome_version": "115"
1714
}

‎builds.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ buildTypes:
3333
- REJECT_INVALID_SNAPS_PLATFORM_VERSION: true
3434
- IFRAME_EXECUTION_ENVIRONMENT_URL: https://execution.metamask.io/iframe/10.2.3/index.html
3535
- ACCOUNT_SNAPS_DIRECTORY_URL: https://snaps.metamask.io/account-management
36-
- IS_SIDEPANEL: true
36+
- IS_SIDEPANEL: false
3737
# for seedless onboarding (social login)
3838
- GOOGLE_PROD_CLIENT_ID
3939
- APPLE_PROD_CLIENT_ID
@@ -67,7 +67,7 @@ buildTypes:
6767
- REJECT_INVALID_SNAPS_PLATFORM_VERSION: true
6868
- IFRAME_EXECUTION_ENVIRONMENT_URL: https://execution.metamask.io/iframe/10.2.3/index.html
6969
- ACCOUNT_SNAPS_DIRECTORY_URL: https://snaps.metamask.io/account-management
70-
- IS_SIDEPANEL: true
70+
- IS_SIDEPANEL: false
7171
# for seedless onboarding (social login)
7272
- GOOGLE_BETA_CLIENT_ID
7373
- APPLE_BETA_CLIENT_ID
@@ -136,7 +136,7 @@ buildTypes:
136136
- SEGMENT_WRITE_KEY_REF: SEGMENT_FLASK_WRITE_KEY
137137
- ACCOUNT_SNAPS_DIRECTORY_URL: https://metamask.github.io/snaps-directory-staging/main/account-management
138138
- EIP_4337_ENTRYPOINT: '0x5FF137D4b0FDCD49DcA30c7CF57E578a026d2789'
139-
- IS_SIDEPANEL: true
139+
- IS_SIDEPANEL: false
140140
# for seedless onboarding (social login)
141141
- GOOGLE_FLASK_CLIENT_ID
142142
- APPLE_FLASK_CLIENT_ID

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "metamask-crx",
3-
"version": "13.10.3",
3+
"version": "13.10.4",
44
"private": true,
55
"repository": {
66
"type": "git",

‎shared/lib/deep-links/canonicalize.test.ts‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,4 +82,36 @@ describe('canonicalize', () => {
8282
expect(original.searchParams.get(SIG_PARAM)).toBe('abc');
8383
expect(original.searchParams.get(SIG_PARAMS_PARAM)).toBe('a,b');
8484
});
85+
86+
it('removes all params when `sig_params` is present but empty (no params signed)', () => {
87+
const url = new URL(
88+
`https://example.com/path?a=2&b=1&${SIG_PARAM}=abc&${SIG_PARAMS_PARAM}`,
89+
);
90+
// No a or b params should be included, only sig_params= should remain
91+
expect(canonicalize(url)).toBe('https://example.com/path?sig_params=');
92+
});
93+
94+
it('removes all params when `sig_params=` is present but empty (no params signed)', () => {
95+
const url = new URL(
96+
`https://example.com/path?a=2&b=1&${SIG_PARAM}=abc&${SIG_PARAMS_PARAM}=`,
97+
);
98+
// No a or b params should be included, only sig_params= should remain
99+
expect(canonicalize(url)).toBe('https://example.com/path?sig_params=');
100+
});
101+
102+
it('treats URLs with `sig_params` (when no other params are included) as valid sig_params', () => {
103+
const url = new URL(
104+
`https://example.com/path?${SIG_PARAM}=abc&${SIG_PARAMS_PARAM}`,
105+
);
106+
// No params were included, but sig_params should still remain
107+
expect(canonicalize(url)).toBe('https://example.com/path?sig_params=');
108+
});
109+
110+
it('treats URLs with `sig_params=` (when no other params are included) as valid sig_params', () => {
111+
const url = new URL(
112+
`https://example.com/path?${SIG_PARAM}=abc&${SIG_PARAMS_PARAM}=`,
113+
);
114+
// No params were included, but sig_params should still remain
115+
expect(canonicalize(url)).toBe('https://example.com/path?sig_params=');
116+
});
85117
});

‎shared/lib/deep-links/canonicalize.ts‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,14 +13,18 @@ export function canonicalize(url: URL): string {
1313

1414
const sigParams = url.searchParams.get(SIG_PARAMS_PARAM);
1515

16-
if (sigParams) {
17-
const allowedParams = sigParams.split(',');
16+
if (typeof sigParams === 'string') {
1817
const signedParams = new URLSearchParams();
18+
// sigParams might be "" (empty), in which case we
19+
// don't need to split and search
20+
if (sigParams) {
21+
const allowedParams = sigParams.split(',');
1922

20-
for (const allowedParam of allowedParams) {
21-
const values = url.searchParams.getAll(allowedParam);
22-
for (const value of values) {
23-
signedParams.append(allowedParam, value);
23+
for (const allowedParam of allowedParams) {
24+
const values = url.searchParams.getAll(allowedParam);
25+
for (const value of values) {
26+
signedParams.append(allowedParam, value);
27+
}
2428
}
2529
}
2630

‎shared/lib/deep-links/parse.test.ts‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,4 +132,39 @@ describe('parse', () => {
132132

133133
expect(mockVerify).toHaveBeenCalledWith(new URL(urlStr));
134134
});
135+
136+
it("removes the SIG_PARAMS_PARAM from the handler's query parameters", async () => {
137+
mockRoutes.set('/test', { handler: mockHandler } as unknown as Route);
138+
mockVerify.mockResolvedValue(VALID);
139+
140+
const urlStr1 = 'https://example.com/test?sig=bar&sig_params=';
141+
await parse(new URL(urlStr1));
142+
// `sig_params` should be removed from the handler's searchParams
143+
expect(mockHandler).toHaveBeenCalledWith(new URLSearchParams());
144+
145+
const urlStr2 =
146+
'https://example.com/test?sig=bar&sig_params=value&value=123';
147+
await parse(new URL(urlStr2));
148+
// `sig_params` should be removed from the handler's searchParams, `value`
149+
// should remain because it is listed in `sig_params`
150+
expect(mockHandler).toHaveBeenCalledWith(
151+
new URLSearchParams([['value', '123']]),
152+
);
153+
154+
const urlStr3 = 'https://example.com/test?sig=bar&sig_params=&value=123';
155+
await parse(new URL(urlStr3));
156+
// `sig_params` should be removed from the handler's searchParams, `value`
157+
// should also be removed because it is not in `sig_params`
158+
expect(mockHandler).toHaveBeenCalledWith(new URLSearchParams());
159+
160+
const urlStr4 =
161+
'https://example.com/test?sig=bar&sig_params=value&value=123&foo=bar';
162+
await parse(new URL(urlStr4));
163+
// `sig_params` should be removed from the handler's searchParams, `value`
164+
// should remain because it is listed in `sig_params`, `foo` should be removed
165+
// because it is not listed in `sig_params`
166+
expect(mockHandler).toHaveBeenCalledWith(
167+
new URLSearchParams([['value', '123']]),
168+
);
169+
});
135170
});

0 commit comments

Comments
 (0)