Missing runtime schema verification for profile sync store/retrieve (#157)

* validate profile sync storage objects

* manifest

* add better check of zod validation

* update mock auth position

* use extractZodError

Author: MoMannn

packages/gator-permissions-snap/snap.manifest.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snap-7715-permissions.git"
   },
   "source": {
-    "shasum": "Vs9lYGeC2uo7E6/p4eYFQG8i5gv0RJFqGEeuAxbV980=",
+    "shasum": "DK0xWacmpY2VdHt48Tn5iw8Rpivla7dufa88PvDvPCw=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

packages/gator-permissions-snap/src/profileSync/profileSync.ts

@@ -1,7 +1,11 @@
 /* eslint-disable @typescript-eslint/naming-convention */
 /* eslint-disable no-restricted-globals */
 import type { PermissionResponse } from '@metamask/7715-permissions-shared/types';
-import { logger } from '@metamask/7715-permissions-shared/utils';
+import { zPermissionResponse } from '@metamask/7715-permissions-shared/types';
+import {
+  logger,
+  extractZodError,
+} from '@metamask/7715-permissions-shared/utils';
 import {
   hashDelegation,
   decodeDelegations,
@@ -12,7 +16,78 @@ import type {
   JwtBearerAuth,
   UserStorage,
 } from '@metamask/profile-sync-controller/sdk';
-import { UnsupportedMethodError } from '@metamask/snaps-sdk';
+import {
+  InvalidInputError,
+  LimitExceededError,
+  ParseError,
+  UnsupportedMethodError,
+} from '@metamask/snaps-sdk';
+import { z } from 'zod';
+
+// Constants for validation
+const MAX_STORAGE_SIZE_BYTES = 400 * 1024; // 400kb limit as documented
+
+// Zod schema for runtime validation of StoredGrantedPermission
+const zStoredGrantedPermission = z.object({
+  permissionResponse: zPermissionResponse,
+  siteOrigin: z.string().min(1, 'Site origin cannot be empty'),
+});
+
+/**
+ * Safely deserializes and validates a JSON string as StoredGrantedPermission.
+ * @param jsonString - The JSON string to deserialize.
+ * @returns The validated StoredGrantedPermission object.
+ * @throws InvalidInputError if validation fails.
+ * @throws ParseError if parsing fails.
+ */
+function safeDeserializeStoredGrantedPermission(
+  jsonString: string,
+): StoredGrantedPermission {
+  try {
+    const parsed = JSON.parse(jsonString);
+    const validated = zStoredGrantedPermission.parse(parsed);
+    return validated;
+  } catch (error) {
+    logger.error('Error deserializing stored granted permission:', error);
+    if (error instanceof z.ZodError) {
+      throw new InvalidInputError(extractZodError(error.errors));
+    }
+    throw new ParseError(`Failed to parse JSON`);
+  }
+}
+
+/**
+ * Safely serializes a StoredGrantedPermission object with size validation.
+ * @param permission - The permission object to serialize.
+ * @returns The JSON string.
+ * @throws LimitExceededError if size limit exceeded.
+ */
+function safeSerializeStoredGrantedPermission(
+  permission: StoredGrantedPermission,
+): string {
+  try {
+    // Validate the object structure first
+    const validated = zStoredGrantedPermission.parse(permission);
+
+    // Serialize to JSON
+    const jsonString = JSON.stringify(validated);
+
+    // Check size limit
+    const sizeBytes = new TextEncoder().encode(jsonString).length;
+    if (sizeBytes > MAX_STORAGE_SIZE_BYTES) {
+      throw new LimitExceededError(
+        `Permission data exceeds size limit: ${sizeBytes} bytes > ${MAX_STORAGE_SIZE_BYTES} bytes`,
+      );
+    }
+
+    return jsonString;
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      throw new InvalidInputError(extractZodError(error.errors));
+    }
+    throw error;
+  }
+}
 
 export type ProfileSyncManager = {
   getAllGrantedPermissions: () => Promise<StoredGrantedPermission[]>;
@@ -109,9 +184,22 @@ export function createProfileSyncManager(
       await authenticate();
 
       const items = await userStorage.getAllFeatureItems(FEATURE);
-      return (
-        items?.map((item) => JSON.parse(item) as StoredGrantedPermission) ?? []
-      );
+      if (!items) {
+        return [];
+      }
+
+      const validPermissions: StoredGrantedPermission[] = [];
+
+      for (const item of items) {
+        try {
+          const permission = safeDeserializeStoredGrantedPermission(item);
+          validPermissions.push(permission);
+        } catch (error) {
+          logger.warn('Skipping invalid permission data:', error);
+        }
+      }
+
+      return validPermissions;
     } catch (error) {
       logger.error('Error fetching all granted permissions:', error);
       throw error;
@@ -133,9 +221,11 @@ export function createProfileSyncManager(
       const path: UserStorageGenericPathWithFeatureAndKey = `${FEATURE}.${generateObjectKey(permissionContext)}`;
       const permission = await userStorage.getItem(path);
 
-      return permission
-        ? (JSON.parse(permission) as StoredGrantedPermission)
-        : null;
+      if (!permission) {
+        return null;
+      }
+
+      return safeDeserializeStoredGrantedPermission(permission);
     } catch (error) {
       logger.error('Error fetching granted permissions:', error);
       throw error;
@@ -147,7 +237,7 @@ export function createProfileSyncManager(
    *
    * Persisting "<permissionContext>" key under "gator_7715_permissions" feature
    * value has to be serialized to string and does not exceed 400kb
-   * it is up to the SDK consumer to enforce proper schema management
+   * Runtime schema validation is enforced to prevent corrupted data storage
    * will result in PUT /api/v1/userstorage/gator_7715_permissions/Hash(<storage_key+<permissionContext>">)
    * VALUE: encrypted("JSONstringifyPermission", storage_key).
    * @param storedGrantedPermission - The permission response to store.
@@ -158,8 +248,13 @@ export function createProfileSyncManager(
     try {
       await authenticate();
 
+      // Validate and serialize with size check
+      const serializedPermission = safeSerializeStoredGrantedPermission(
+        storedGrantedPermission,
+      );
+
       const path: UserStorageGenericPathWithFeatureAndKey = `${FEATURE}.${generateObjectKey(storedGrantedPermission.permissionResponse.context)}`;
-      await userStorage.setItem(path, JSON.stringify(storedGrantedPermission));
+      await userStorage.setItem(path, serializedPermission);
     } catch (error) {
       logger.error('Error storing granted permission:', error);
       throw error;
@@ -171,7 +266,7 @@ export function createProfileSyncManager(
    *
    * Batch set multiple items under the "gator_7715_permissions" feature
    * values have to be serialized to string and does not exceed 400kb
-   * it is up to the SDK consumer to enforce proper schema management
+   * Runtime schema validation is enforced to prevent corrupted data storage
    * will result in PUT /api/v1/userstorage/gator_7715_permissions/
    * VALUES: encrypted("JSONstringifyPermission1", storage_key), encrypted("JSONstringifyPermission2", storage_key).
    * @param storedGrantedPermissions - The permission responses to store.
@@ -182,15 +277,31 @@ export function createProfileSyncManager(
     try {
       await authenticate();
 
-      await userStorage.batchSetItems(
-        FEATURE,
-        storedGrantedPermissions.map((storedGrantedPermission) => [
-          generateObjectKey(storedGrantedPermission.permissionResponse.context), // key
-          JSON.stringify(storedGrantedPermission), // value
-        ]),
-      );
+      // Validate and serialize all permissions with size checks
+      const validatedItems: [string, string][] = [];
+
+      for (const permission of storedGrantedPermissions) {
+        try {
+          const serializedPermission =
+            safeSerializeStoredGrantedPermission(permission);
+          validatedItems.push([
+            generateObjectKey(permission.permissionResponse.context), // key
+            serializedPermission, // value
+          ]);
+        } catch (error) {
+          logger.warn('Skipping invalid permission in batch:', error);
+        }
+      }
+
+      if (validatedItems.length === 0) {
+        throw new InvalidInputError(
+          'No valid permissions to store in batch operation',
+        );
+      }
+
+      await userStorage.batchSetItems(FEATURE, validatedItems);
     } catch (error) {
-      logger.error('Error storing granted permission:', error);
+      logger.error('Error storing granted permission batch:', error);
       throw error;
     }
   }