-
Notifications
You must be signed in to change notification settings - Fork 5.4k
test: add E2E tests for maximum privacy security check during onboarding #38555
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
✨ Files requiring CODEOWNER review ✨🔒 @MetaMask/extension-security-team (1 files, +11 -10)
|
| @@ -0,0 +1,20 @@ | |||
| { | |||
| "duringOnboarding": ["accounts.google.com", "metamask.github.io"], | |||
| "toBeRemoved": { | |||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this toBeRemoved list is a reminder, we need to remove the 2 hosts from allowlist once they are addressed
Builds ready [05a8e37]
UI Startup Metrics (1233 ± 100 ms)
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Builds ready [3349536]
UI Startup Metrics (1226 ± 88 ms)
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
| { | ||
| "duringOnboarding": [ | ||
| "accounts.google.com", | ||
| "firefox.settings.services.mozilla.com", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
firefox browser-level call, only exists on firefox, not initiated by extension
Builds ready [163d4b7]
UI Startup Metrics (1219 ± 93 ms)
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
|
LGTM ! |
seaona
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
awesome tests 🙌
Gudahtt
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
Description
privacy-max-allowlist-onboarding.jsonSo we ensure users who enable maximum privacy during onboarding only make expected network calls.
example log when test fails:
Changelog
CHANGELOG entry: null
Related issues
Fixes: https://consensyssoftware.atlassian.net/browse/MMQA-1154
Manual testing steps
Test pass and stable.
Test should fail if new host is called during onboarding which is not in allowlist
Screenshots/Recordings
Before
After
Pre-merge author checklist
Pre-merge reviewer checklist
Note
Adds E2E tests that verify only allowlisted hosts are contacted during and after onboarding, introduces the allowlist JSON, and updates CODEOWNERS.
test/e2e/tests/privacy/onboarding-maximum-privacy.spec.tsto enforce maximum-privacy networking during onboarding.importSRPOnboardingFlowandcreateNewWalletOnboardingFlow.duringOnboardinganduntilOnboardingCompleteallowlists.test/e2e/tests/privacy/privacy-max-allowlist-onboarding.jsondefining allowlisted hosts for onboarding phases..github/CODEOWNERSto include QA and extension-privacy-reviewers for the new allowlist and E2E paths.Written by Cursor Bugbot for commit 163d4b7. This will update automatically on new commits. Configure here.