Skip to content

Conversation

@chloeYue
Copy link
Contributor

@chloeYue chloeYue commented Dec 4, 2025

Description

  1. Adds E2E tests to verify that with maximum privacy settings enabled during onboarding, only allowlisted network calls are made. Covers both import wallet and create new wallet user flows.
  2. Add allowlist file privacy-max-allowlist-onboarding.json
  3. Add code owner for allowlist

So we ensure users who enable maximum privacy during onboarding only make expected network calls.
example log when test fails:

Screenshot 2025-12-03 at 15 34 04

Open in GitHub Codespaces

Changelog

CHANGELOG entry: null

Related issues

Fixes: https://consensyssoftware.atlassian.net/browse/MMQA-1154

Manual testing steps

Test pass and stable.
Test should fail if new host is called during onboarding which is not in allowlist

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Adds E2E tests that verify only allowlisted hosts are contacted during and after onboarding, introduces the allowlist JSON, and updates CODEOWNERS.

  • E2E Tests:
    • Add test/e2e/tests/privacy/onboarding-maximum-privacy.spec.ts to enforce maximum-privacy networking during onboarding.
      • Covers both importSRPOnboardingFlow and createNewWalletOnboardingFlow.
      • Mocks Infura RPC and feature flags, captures request hosts, and asserts against duringOnboarding and untilOnboardingComplete allowlists.
  • Test Data:
    • Add test/e2e/tests/privacy/privacy-max-allowlist-onboarding.json defining allowlisted hosts for onboarding phases.
  • Repo Ownership:
    • Update .github/CODEOWNERS to include QA and extension-privacy-reviewers for the new allowlist and E2E paths.

Written by Cursor Bugbot for commit 163d4b7. This will update automatically on new commits. Configure here.

@chloeYue chloeYue requested a review from a team December 4, 2025 13:56
@chloeYue chloeYue self-assigned this Dec 4, 2025
@chloeYue chloeYue requested a review from a team as a code owner December 4, 2025 13:56
@chloeYue chloeYue added e2e-test End to end test for the MetaMask extension team-qa QA team no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed labels Dec 4, 2025
@chloeYue chloeYue marked this pull request as draft December 4, 2025 13:56
@github-actions
Copy link
Contributor

github-actions bot commented Dec 4, 2025

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot
Copy link
Collaborator

✨ Files requiring CODEOWNER review ✨

🔒 @MetaMask/extension-security-team (1 files, +11 -10)
  • 📁 .github/
    • 📄 CODEOWNERS +11 -10

@github-actions github-actions bot added the size-M label Dec 4, 2025
@chloeYue chloeYue changed the title test: privacy max e2e test: add E2E tests for maximum privacy settings during onboarding Dec 4, 2025
@@ -0,0 +1,20 @@
{
"duringOnboarding": ["accounts.google.com", "metamask.github.io"],
"toBeRemoved": {
Copy link
Contributor Author

@chloeYue chloeYue Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this toBeRemoved list is a reminder, we need to remove the 2 hosts from allowlist once they are addressed

@metamaskbot
Copy link
Collaborator

Builds ready [05a8e37]
UI Startup Metrics (1233 ± 100 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup12331010151110012941419
load103086912969410741221
domContentLoaded102486312929310701217
domInteractive2615137212182
firstPaint4787512693909431186
backgroundConnect21719426714224243
firstReactRender312161103754
getState3816144214486
initialActions107115
loadScripts813659108290860988
setupStore1263651325
numNetworkReqs1157117561
BrowserifyPower User HomeuiStartup20611686262725323422515
load1047907163514310811378
domContentLoaded1033895162714210721365
domInteractive3317124213185
firstPaint58510114754309871369
backgroundConnect275207841131250634
firstReactRender554190106075
getState19414868957207260
initialActions104112
loadScripts81669114031338431129
setupStore17115281739
numNetworkReqs81632243275154
WebpackStandard HomeuiStartup804694126384832982
load623560102372637787
domContentLoaded618557101272633781
domInteractive2615124212287
firstPaint22085717149209627
backgroundConnect1062751225
firstReactRender2820132123237
getState271389123546
initialActions107111
loadScripts616555100871632771
setupStore1163951219
numNetworkReqs1056915555
WebpackPower User HomeuiStartup16371306221723118712073
load703598984105705967
domContentLoaded695591975104701962
domInteractive39162073733134
firstPaint298116970205338717
backgroundConnect103758418587559
firstReactRender60469696678
getState18114628923190221
initialActions103112
loadScripts692589964103699952
setupStore171082101640
numNetworkReqs80632713373151
FirefoxBrowserifyStandard HomeuiStartup12691068166413913681550
load105392913639011141258
domContentLoaded105292413639011131258
domInteractive54301682777111
firstPaint------
backgroundConnect4021149234282
firstReactRender22185062236
getState1167281020
initialActions102012
loadScripts102891512758110831203
setupStore145171211135
numNetworkReqs1256516661
BrowserifyPower User HomeuiStartup31372106624391039864711
load14361011276551114462566
domContentLoaded14361011276451114462566
domInteractive1043344871111277
firstPaint------
backgroundConnect2893312353474091176
firstReactRender68371892971143
getState285871065249314939
initialActions3161723
loadScripts1302991256038913542462
setupStore15451135239113799
numNetworkReqs76551422372127
WebpackStandard HomeuiStartup15141206211216416121892
load12461042149110813201466
domContentLoaded12461042149110813191466
domInteractive62272003881148
firstPaint------
backgroundConnect52192784054133
firstReactRender28207993039
getState167199221547
initialActions107122
loadScripts1217102514669812961400
setupStore156159201239
numNetworkReqs1256617762
WebpackPower User HomeuiStartup32582285535389741824812
load16111081294352020662676
domContentLoaded16101081294152020662676
domInteractive142281238224132380
firstPaint------
backgroundConnect2092513452922101109
firstReactRender68382413669170
getState292861848287267875
initialActions2060623
loadScripts14981067277644015302609
setupStore1034116217499514
numNetworkReqs76511272172122
📊 Page Load Benchmark Results

Current Commit: 05a8e37 | Date: 12/4/2025

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.06s (±42ms) 🟡 | historical mean value: 1.04s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 741ms (±38ms) 🟢 | historical mean value: 725ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 81ms (±12ms) 🟢 | historical mean value: 79ms ⬆️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.06s 42ms 1.03s 1.33s 1.12s 1.33s
domContentLoaded 741ms 38ms 712ms 989ms 781ms 989ms
firstPaint 81ms 12ms 64ms 180ms 92ms 180ms
firstContentfulPaint 81ms 12ms 64ms 180ms 92ms 180ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 58 Bytes (0%)
  • ui: -37 Bytes (0%)
  • common: 20 Bytes (0%)

@metamaskbot
Copy link
Collaborator

Builds ready [3349536]
UI Startup Metrics (1226 ± 88 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup1226102814188812881359
load102986612127810781171
domContentLoaded102386112057810701164
domInteractive251590172277
firstPaint46110312113679321129
backgroundConnect21519524911222237
firstReactRender29206483148
getState3615105154563
initialActions106112
loadScripts81465597775863963
setupStore1263551323
numNetworkReqs1056716559
BrowserifyPower User HomeuiStartup20951685268223422192634
load1068914143412411101373
domContentLoaded1055900142212210981366
domInteractive3217122203194
firstPaint57195141842510121311
backgroundConnect269211855113254553
firstReactRender5740130146081
getState20715772765218311
initialActions103112
loadScripts83069612141198691143
setupStore1674461636
numNetworkReqs78652372375125
WebpackStandard HomeuiStartup794682125277824928
load619552103173641754
domContentLoaded614544102472633748
domInteractive2414119192077
firstPaint24992820174225643
backgroundConnect1052841118
firstReactRender27195063139
getState241255103245
initialActions105111
loadScripts611541101671629741
setupStore1053241118
numNetworkReqs1056715557
WebpackPower User HomeuiStartup15961231238127918492088
load674579955100693896
domContentLoaded66657394799685888
domInteractive33171402630111
firstPaint27586910197303722
backgroundConnect1197722209104578
firstReactRender56458486171
getState18914172694181248
initialActions104112
loadScripts66457193897684882
setupStore16761101544
numNetworkReqs79612482774145
FirefoxBrowserifyStandard HomeuiStartup13271075180915914161647
load1099925151412111621362
domContentLoaded1099925151412211621362
domInteractive63302643584112
firstPaint------
backgroundConnect51191913473120
firstReactRender23185462335
getState127160181024
initialActions103112
loadScripts1067909149611211141336
setupStore145192241050
numNetworkReqs1256416662
BrowserifyPower User HomeuiStartup30551892509794438644823
load1358943298648113932529
domContentLoaded1357942298648113922529
domInteractive112321169128114303
firstPaint------
backgroundConnect3342520344364111169
firstReactRender62361873162133
getState342781370299520997
initialActions203122
loadScripts1189924279629912232002
setupStore15261395246114745
numNetworkReqs77591462373132
WebpackStandard HomeuiStartup15251244190114316101809
load12541076152610013291425
domContentLoaded12541076152610013291425
domInteractive69281813690140
firstPaint------
backgroundConnect49221812962111
firstReactRender27208882940
getState197215321462
initialActions103122
loadScripts1227106014969512931384
setupStore146101141342
numNetworkReqs1256617764
WebpackPower User HomeuiStartup33992440727391542654952
load17321243561069121312949
domContentLoaded17321237561069121312949
domInteractive164303985413126301
firstPaint------
backgroundConnect208281301258214712
firstReactRender72433504469113
getState318811230272457860
initialActions207126
loadScripts16421218558564316382859
setupStore1136825159111490
numNetworkReqs77521372274127
📊 Page Load Benchmark Results

Current Commit: 3349536 | Date: 12/4/2025

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.03s (±38ms) 🟡 | historical mean value: 1.04s ⬇️ (historical data)
  • domContentLoaded-> current mean value: 718ms (±36ms) 🟢 | historical mean value: 727ms ⬇️ (historical data)
  • firstContentfulPaint-> current mean value: 76ms (±11ms) 🟢 | historical mean value: 80ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.03s 38ms 1.01s 1.31s 1.06s 1.31s
domContentLoaded 718ms 36ms 700ms 983ms 747ms 983ms
firstPaint 76ms 11ms 60ms 164ms 92ms 164ms
firstContentfulPaint 76ms 11ms 60ms 164ms 92ms 164ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 58 Bytes (0%)
  • ui: 3.17 KiB (0.04%)
  • common: 20 Bytes (0%)

{
"duringOnboarding": [
"accounts.google.com",
"firefox.settings.services.mozilla.com",
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

firefox browser-level call, only exists on firefox, not initiated by extension

@metamaskbot
Copy link
Collaborator

Builds ready [163d4b7]
UI Startup Metrics (1219 ± 93 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup1219104314529313021384
load101885812838210691158
domContentLoaded101285512768110661148
domInteractive251498192086
firstPaint4698912363869861127
backgroundConnect21319325613220242
firstReactRender2919101113251
getState361695154171
initialActions106114
loadScripts805650107379854944
setupStore1172431218
numNetworkReqs1056516558
BrowserifyPower User HomeuiStartup19931652283623421442435
load1023894167313610641366
domContentLoaded1011884166413510541359
domInteractive3218113203290
firstPaint60811616704359881371
backgroundConnect261202736118232645
firstReactRender52408185865
getState18314129230200246
initialActions102112
loadScripts80167813771288291138
setupStore1683861632
numNetworkReqs80652532676143
WebpackStandard HomeuiStartup8257041037778581014
load64456583369687796
domContentLoaded63956082068684791
domInteractive2715113222390
firstPaint234102838172199700
backgroundConnect1053461225
firstReactRender29209093139
getState281369133759
initialActions102111
loadScripts63755781066682781
setupStore1062631117
numNetworkReqs1157317559
WebpackPower User HomeuiStartup16271224238428718492170
load6865841104105718906
domContentLoaded6785781093105706900
domInteractive35172533331109
firstPaint282931099211291711
backgroundConnect91875218323569
firstReactRender594498116479
getState18214167856187230
initialActions103112
loadScripts6755761091103704898
setupStore17962111546
numNetworkReqs79631612374149
FirefoxBrowserifyStandard HomeuiStartup13511078189016114061761
load111193113319611831306
domContentLoaded111093113319611831306
domInteractive68312203985135
firstPaint------
backgroundConnect50221903663155
firstReactRender24175762536
getState156249261226
initialActions103122
loadScripts107991012858711351248
setupStore146199221131
numNetworkReqs1256416661
BrowserifyPower User HomeuiStartup30891998580885838194903
load14871009297256614332785
domContentLoaded14861009297156614322784
domInteractive11736963118108305
firstPaint------
backgroundConnect2642714953343341143
firstReactRender65402863167111
getState326691239265483861
initialActions3033427
loadScripts1393984275748713892676
setupStore1465792204145734
numNetworkReqs76511492272129
WebpackStandard HomeuiStartup15881324229218116671937
load13041109160311413861527
domContentLoaded13031109160111413861526
domInteractive63261923486121
firstPaint------
backgroundConnect58201973871158
firstReactRender28219993038
getState167216271225
initialActions103122
loadScripts12721096152310913611471
setupStore155141181355
numNetworkReqs1256617763
WebpackPower User HomeuiStartup32762183565487342364693
load16521137292954317472804
domContentLoaded16521137292354317462804
domInteractive155291573237139980
firstPaint------
backgroundConnect2402812593043451031
firstReactRender71393594465175
getState3299219533284891020
initialActions2153526
loadScripts15471117286346915672712
setupStore1146115620294679
numNetworkReqs78581382373132
📊 Page Load Benchmark Results

Current Commit: 163d4b7 | Date: 12/4/2025

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.05s (±56ms) 🟡 | historical mean value: 1.04s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 731ms (±53ms) 🟢 | historical mean value: 723ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 78ms (±10ms) 🟢 | historical mean value: 79ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.05s 56ms 1.01s 1.37s 1.08s 1.37s
domContentLoaded 731ms 53ms 704ms 1.03s 762ms 1.03s
firstPaint 78ms 10ms 60ms 156ms 88ms 156ms
firstContentfulPaint 78ms 10ms 60ms 156ms 88ms 156ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 58 Bytes (0%)
  • ui: 0 Bytes (0%)
  • common: 20 Bytes (0%)

@chloeYue chloeYue marked this pull request as ready for review December 4, 2025 15:59
@chloeYue chloeYue changed the title test: add E2E tests for maximum privacy settings during onboarding test: add E2E tests for maximum privacy security check during onboarding Dec 4, 2025
@DDDDDanica
Copy link
Contributor

LGTM !

Copy link
Member

@seaona seaona left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

awesome tests 🙌

Copy link
Member

@Gudahtt Gudahtt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@chloeYue chloeYue added this pull request to the merge queue Dec 5, 2025
Merged via the queue into main with commit 84ce04b Dec 5, 2025
180 checks passed
@chloeYue chloeYue deleted the privacy-max-e2e branch December 5, 2025 14:09
@github-actions github-actions bot locked and limited conversation to collaborators Dec 5, 2025
@metamaskbot metamaskbot added the release-13.14.0 Issue or pull request that will be included in release 13.14.0 label Dec 5, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

e2e-test End to end test for the MetaMask extension no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed release-13.14.0 Issue or pull request that will be included in release 13.14.0 size-M team-qa QA team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants