Freeze Promise global on boot

[rekmarks]

Per a security advisory from an audit, freezes the Promise global and prevents its reassignment on boot, in both the background and UI.

• Pins the version of deep-freeze-strict as we use it to freeze the Promise, and the point here is to prevent certain supply chain attacks.

• Adds new tests (test:unit:global) that are run in CI. These tests must be separate as freezing the Promise global breaks our normal test environments (at least the unit tests).

• Removes tape from devDependencies, as we were not actually using that for anything.

Marked as needs QA since if a dependency modifies the Promise global, an error will be thrown that they probably won't catch. I imagine they'll usually do something like that in their entry file, but you never know.

[Gudahtt]

Interesting - I wonder if we still need to mutate the Promise global in tests. It looks like it was done to enable catching of uncaught exceptions, but V8 has gotten better at that since it was written 🤔

[rekmarks]

Interesting - I wonder if we still need to mutate the Promise global in tests.

When I attempted to run this as a normal unit test, the error seemed to come from a test dependency (bluebird):

.../metamask-extension_feature/node_modules/bluebird/js/release/queue.js:38
    this[(j + 0) & wrapMask] = fn;
                             ^
TypeError: Cannot add property 6, object is not extensible
    at Queue.push (.../metamask-extension_feature/node_modules/bluebird/js/release/queue.js:38:30)

@Gudahtt

Edit: ah, the point of Bluebird in the testing environment is to help with the uncaught exceptions?

[Gudahtt]

Yes, exactly. It's setup in test/helper.js in the enableFailureOnUnhandledPromiseRejection function

[rekmarks]

Yes, exactly. It's setup in test/helper.js in the enableFailureOnUnhandledPromiseRejection function

We overwrite the global Promise with bluebird in that function. Removing this overwrite causes unit tests to hang on my machine. We should probably figure that one out at some point and freeze the Promise global in tests but I don't have time at the moment and I think it should be dealt with in a separate PR.

[Gudahtt]

I'm guessing this was meant to be

Suggested change

	target[key] = deepFreeze()
	target[key] = deepFreeze(target[key])

In which case it could just be taken out of the condition altogether, as both branches are identical.

[Gudahtt]

Wait, no.... maybe it should be

Suggested change

	target[key] = deepFreeze()
	opts.value = deepFreeze(value)

As target[key] is getting overwritten 🤦‍♂️

[rekmarks]

Haha, yes, the latter. Now shortened to: opts.value = deepFreeze(value)

It's my facepalm, not yours!

[Gudahtt]

Looks good!

The lockfile has a conflict