File tree Expand file tree Collapse file tree 2 files changed +3
-10
lines changed
snaps-controllers/src/services/webview
snaps-execution-environments/src/webview Expand file tree Collapse file tree 2 files changed +3
-10
lines changed Original file line number Diff line number Diff line change @@ -2,7 +2,7 @@ import type { PostMessageEvent } from '@metamask/post-message-stream';
22import { BasePostMessageStream } from '@metamask/post-message-stream' ;
33import { isValidStreamMessage } from '@metamask/post-message-stream/dist/utils' ;
44import { logError } from '@metamask/snaps-utils' ;
5- import { assert , bytesToBase64 , stringToBytes } from '@metamask/utils' ;
5+ import { assert } from '@metamask/utils' ;
66
77export type WebViewInterface = {
88 injectJavaScript ( js : string ) : void ;
@@ -65,12 +65,7 @@ export class WebViewMessageStream extends BasePostMessageStream {
6565 data,
6666 } ) ;
6767
68- // To prevent XSS, we base64 encode the message before injecting it.
69- // This adds significant performance overhead.
70- // TODO: Should we use mobile native base64 here?
71- const bytes = stringToBytes ( json ) ;
72- const base64 = bytesToBase64 ( bytes ) ;
73- this . #webView. injectJavaScript ( `window.postMessage('${ base64 } ')` ) ;
68+ this . #webView. injectJavaScript ( `window.postMessage('${ json } ')` ) ;
7469 }
7570
7671 private _onMessage ( event : PostMessageEvent ) : void {
Original file line number Diff line number Diff line change 11import type { PostMessageEvent } from '@metamask/post-message-stream' ;
22import { BasePostMessageStream } from '@metamask/post-message-stream' ;
33import { isValidStreamMessage } from '@metamask/post-message-stream/dist/utils' ;
4- import { base64ToBytes , bytesToString } from '@metamask/utils' ;
54
65type WebViewExecutorStreamArgs = {
76 name : string ;
@@ -66,8 +65,7 @@ export class WebViewExecutorStream extends BasePostMessageStream {
6665 return ;
6766 }
6867
69- const bytes = base64ToBytes ( event . data ) ;
70- const message = JSON . parse ( bytesToString ( bytes ) ) ;
68+ const message = JSON . parse ( event . data ) ;
7169
7270 // Notice that we don't check targetWindow or targetOrigin here.
7371 // This doesn't seem possible to do in RN.
You can’t perform that action at this time.
0 commit comments