Merge pull request from GHSA-rc56-6qmj-qg85

* Patch react-native & react-native-webview to remove learning from Android keyboards * Initialize Android text input with BaseInputConnection * Opt out of safe browsing * Update bitrise.yml with NDK steps * Fix bitrise.yml. Remove ds store diffs. * Update README.md with NDK instructions
MetaMask · Sep 8, 2021 · 50984c8 · 50984c8
1 parent 8f5da8f
commit 50984c8
Show file tree

Hide file tree

Showing 7 changed files with 189 additions and 86 deletions.
diff --git a/README.md b/README.md
@@ -15,24 +15,27 @@ To learn how to develop MetaMask-compatible applications, visit our [Developer D
 ### Building Locally
 
 The code is built using React-Native and running code locally requires a Mac or Linux OS.
-- Install [sentry-cli](https://github.com/getsentry/sentry-cli) tools: `brew install getsentry/tools/sentry-cli`
 
-- Install [Node.js](https://nodejs.org) **version 10 (latest stable) and yarn@1 (latest)**
-  - If you are using [nvm](https://github.com/creationix/nvm#installation) (recommended) running `nvm use` will automatically choose the right node version for you.
+-   Install [sentry-cli](https://github.com/getsentry/sentry-cli) tools: `brew install getsentry/tools/sentry-cli`
 
-- Install the shared React Native dependencies (`React Native CLI`, _not_ `Expo CLI`)
-  - [macOS](https://facebook.github.io/react-native/docs/getting-started.html#installing-dependencies-1)
-  - [Linux](https://facebook.github.io/react-native/docs/getting-started.html#installing-dependencies-2)
+-   Install [Node.js](https://nodejs.org) **version 10 (latest stable) and yarn@1 (latest)**
 
-- Install [cocoapods](https://guides.cocoapods.org/using/getting-started.html) by running:
+    -   If you are using [nvm](https://github.com/creationix/nvm#installation) (recommended) running `nvm use` will automatically choose the right node version for you.
 
-```bash 
+-   Install the shared React Native dependencies (`React Native CLI`, _not_ `Expo CLI`)
+
+    -   [macOS](https://facebook.github.io/react-native/docs/getting-started.html#installing-dependencies-1)
+    -   [Linux](https://facebook.github.io/react-native/docs/getting-started.html#installing-dependencies-2)
+
+-   Install [cocoapods](https://guides.cocoapods.org/using/getting-started.html) by running:
+
+```bash
 sudo gem install cocoapods
 ```
 
-- _MetaMask Only:_ Rename the `.*.env.example` files (remove the `.example`) in the root of the project and fill in the appropriate values for each key. Get the values from another MetaMask Mobile developer.
+-   _MetaMask Only:_ Rename the `.*.env.example` files (remove the `.example`) in the root of the project and fill in the appropriate values for each key. Get the values from another MetaMask Mobile developer.
 
-- Clone this repo and install our dependencies:
+-   Clone this repo and install our dependencies:
 
 ```bash
 git clone ...
@@ -41,48 +44,57 @@ yarn install # this will run a lengthy postinstall flow
 cd ios && pod install && cd .. # install pods for iOS
 ```
 
-- _Non-MetaMask Only:_ In the project root folder run
+-   _Non-MetaMask Only:_ In the project root folder run
+
 ```
   cp .ios.env.example .ios.env && \
   cp .android.env.example .android.env && \
   cp .js.env.example .js.env
- ``` 
-- _Non-MetaMask Only:_ Create an account and generate your own API key at [Infura](https://infura.io) in order to connect to main and test nets. Fill `MM_INFURA_PROJECT_ID` in `.js.env`. (App will run without it, but will not be able to connect to actual network.)
+```
+
+-   _Non-MetaMask Only:_ Create an account and generate your own API key at [Infura](https://infura.io) in order to connect to main and test nets. Fill `MM_INFURA_PROJECT_ID` in `.js.env`. (App will run without it, but will not be able to connect to actual network.)
 
-- Then, in one terminal, run:
+-   Then, in one terminal, run:
 
 ```bash
 yarn watch
 ```
 
 #### Android
 
-- Install the Android SDK, via [Android Studio](https://developer.android.com/studio).
-  - _MetaMask Only:_ To create production builds, you need to install Google Play Licensing Library via the SDK Manager in Android Studio.
-- Linux only:
-  - Ensure that you have the `secret-tool` binary on your machine.
-    - Part of the [libsecret-tools](https://launchpad.net/ubuntu/bionic/+package/libsecret-tools) package on Debian/Ubuntu based distributions.
-- Install the correct emulator
-  - Follow the instructions at:
-    - [React Native Getting Started - Android](https://facebook.github.io/react-native/docs/getting-started.html#installing-dependencies-1) _(React Native CLI Quickstart -> [your OS] -> Android)_
-    - More details can be found [on the Android Developer site](https://developer.android.com/studio/run/emulator)
-  - You should use the following:
-    - **Android OS Version:** Latest, unless told otherwise
-    - **Device:** Google Pixel 3
-- Finally, start the emulator from Android Studio, and run:
+-   Install the Android SDK, via [Android Studio](https://developer.android.com/studio).
+    -   _MetaMask Only:_ To create production builds, you need to install Google Play Licensing Library via the SDK Manager in Android Studio.
+-   Install the Android NDK, via [Android Studio](https://developer.android.com/studio)'s SDK Manager.
+    -   In the SDK Manager, select the `SDK Tools` tab and install NDK version `17.2.4988734`.
+        -   In the `android` directory, update the `local.properties` file by adding line:
+        ```
+        ndk.dir=/Users/YOUR_HOME_DIRECTORY/Library/Android/sdk/ndk/17.2.4988734
+        ```
+        _(You may have to create local.properties if it doesn't exist.)_
+-   Linux only:
+    -   Ensure that you have the `secret-tool` binary on your machine.
+        -   Part of the [libsecret-tools](https://launchpad.net/ubuntu/bionic/+package/libsecret-tools) package on Debian/Ubuntu based distributions.
+-   Install the correct emulator
+    -   Follow the instructions at:
+        -   [React Native Getting Started - Android](https://facebook.github.io/react-native/docs/getting-started.html#installing-dependencies-1) _(React Native CLI Quickstart -> [your OS] -> Android)_
+        -   More details can be found [on the Android Developer site](https://developer.android.com/studio/run/emulator)
+    -   You should use the following:
+        -   **Android OS Version:** Latest, unless told otherwise
+        -   **Device:** Google Pixel 3
+-   Finally, start the emulator from Android Studio, and run:
 
 ```bash
 yarn start:android
 ```
 
 #### iOS
 
-- Install the iOS dependencies
-  - [React Native Getting Started - iOS](https://facebook.github.io/react-native/docs/getting-started.html#installing-dependencies-1) _(React Native CLI Quickstart -> [your OS] -> iOS)_
-    - You do **not** need CocoaPods
-- Install the correct simulator
-  - **iOS OS Version:** Latest, unless told otherwise
-  - **Device:** iPhone 11 Pro
+-   Install the iOS dependencies
+    -   [React Native Getting Started - iOS](https://facebook.github.io/react-native/docs/getting-started.html#installing-dependencies-1) _(React Native CLI Quickstart -> [your OS] -> iOS)_
+        -   You do **not** need CocoaPods
+-   Install the correct simulator
+    -   **iOS OS Version:** Latest, unless told otherwise
+    -   **Device:** iPhone 11 Pro
 
 ```bash
 yarn start:ios
@@ -117,48 +129,47 @@ If `yarn link` fails after going through these steps, try directly `yarn add`ing
 
 First, make sure you have the following running:
 
-- `yarn watch`
-- Your Android emulator or iOS simulator
-- `yarn start:android` or `yarn start:ios`
+-   `yarn watch`
+-   Your Android emulator or iOS simulator
+-   `yarn start:android` or `yarn start:ios`
 
 Next, check that the React Native Debugger is working:
 
-- Open your emulator or simulator, and select `Debug JS Remotely` (or something similar) from its developer menu
-- To open the developer menu:
-  - iOS Simulator: `Cmd + D`
-  - Android Emulator
-    - macOS: `Cmd + M`
-	- Windows, Linux: `Ctrl + M`
-- If it doesn't open automatically, try navigating to this URL in Chrome: http://localhost:8081/debugger-ui/
-- If these steps do not take you to the React Native Debugger, something is wrong
+-   Open your emulator or simulator, and select `Debug JS Remotely` (or something similar) from its developer menu
+-   To open the developer menu:
+    -   iOS Simulator: `Cmd + D`
+    -   Android Emulator
+        -   macOS: `Cmd + M` - Windows, Linux: `Ctrl + M`
+-   If it doesn't open automatically, try navigating to this URL in Chrome: http://localhost:8081/debugger-ui/
+-   If these steps do not take you to the React Native Debugger, something is wrong
 
 #### Debugging iOS (macOS Only)
 
 For more details, see [this page](https://medium.com/@mattcroak718/debugging-your-iphone-mobile-web-app-using-safari-development-tools-71240657c487).
 
-- You should be able to inspect the mobile app using the console in the React Native Debugger in Chrome
-- To debug a website (dapp) in the browser:
-  - Navigate to the website in the app's browser
-  - Open Safari
-    - Go to: _Preferences -> Advanced_ and select `Show Develop menu in menu bar`
-  - Select `Develop` in the menu bar
-    - Find your simulator in the second section from the top
-    - Select the relevant WebView from the list
-      - The simulator will highlight the WebView when you hover over it in Safari
+-   You should be able to inspect the mobile app using the console in the React Native Debugger in Chrome
+-   To debug a website (dapp) in the browser:
+    -   Navigate to the website in the app's browser
+    -   Open Safari
+        -   Go to: _Preferences -> Advanced_ and select `Show Develop menu in menu bar`
+    -   Select `Develop` in the menu bar
+        -   Find your simulator in the second section from the top
+        -   Select the relevant WebView from the list
+            -   The simulator will highlight the WebView when you hover over it in Safari
 
 #### Debugging Android
 
 For more details, see [this page](https://developers.google.com/web/tools/chrome-devtools/remote-debugging/webviews).
 
-- You should be able to inspect the mobile app using the console in the React Native Debugger in Chrome
-- To debug a website (dapp) in the browser:
-  - Navigate to the website in the app's browser
-  - Go to chrome://inspect
-  - Select the relevant WebView under **Remote Target**
+-   You should be able to inspect the mobile app using the console in the React Native Debugger in Chrome
+-   To debug a website (dapp) in the browser:
+    -   Navigate to the website in the app's browser
+    -   Go to chrome://inspect
+    -   Select the relevant WebView under **Remote Target**
 
 #### Miscellaneous
 
-- [Troubleshooting for React Native](https://facebook.github.io/react-native/docs/troubleshooting#content)
+-   [Troubleshooting for React Native](https://facebook.github.io/react-native/docs/troubleshooting#content)
 
 ### Running Tests
 

diff --git a/android/app/build.gradle b/android/app/build.gradle
@@ -243,6 +243,10 @@ android {
 	}
 }
 
+configurations.all {
+	exclude group: 'com.facebook.react', module: 'react-native'
+}
+
 dependencies {
 	implementation project(':lottie-react-native')
 
@@ -251,18 +255,14 @@ dependencies {
 	implementation 'androidx.multidex:multidex:2.0.1'
 	implementation 'androidx.annotation:annotation:1.1.0'
 	implementation 'androidx.appcompat:appcompat:1.2.0'
-	implementation "com.facebook.react:react-native:+"  // From node_modules
+	// Replace 'com.facebook.react:react-native:+' with project(':ReactAndroid') to respect changes that we make in native Android code
+	implementation project(':ReactAndroid')
 	implementation 'org.chromium:v8-android:+'
-
 	implementation 'com.google.android.gms:play-services-wallet:18.0.0'
-
 	implementation "io.branch.sdk.android:library:5.+"
-
 	implementation 'com.mixpanel.android:mixpanel-android:5.+'
-
 	androidTestImplementation('com.wix:detox:+') { transitive = true }
 	androidTestImplementation 'junit:junit:4.12'
-
 	implementation "androidx.swiperefreshlayout:swiperefreshlayout:1.0.0"
     debugImplementation("com.facebook.flipper:flipper:${FLIPPER_VERSION}") {
       exclude group:'com.facebook.fbjni'

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
@@ -102,6 +102,8 @@
 			</intent-filter>
 		</activity>
 		<activity android:name="com.facebook.react.devsupport.DevSettingsActivity" />
+		<!-- Explicitly opt-in to safe browsing -->
+		<meta-data android:name="android.webkit.WebView.EnableSafeBrowsing" android:value="true" />
 		<!-- Branch init -->
 		<meta-data android:name="io.branch.sdk.BranchKey" android:value="${MM_BRANCH_KEY_LIVE}" />
 		<meta-data android:name="io.branch.sdk.BranchKey.test" android:value="${MM_BRANCH_KEY_TEST}" />

diff --git a/android/settings.gradle b/android/settings.gradle
@@ -9,3 +9,5 @@ apply from: file("../node_modules/@react-native-community/cli-platform-android/n
 include ':react-native-video'
 project(':react-native-video').projectDir = new File(rootProject.projectDir, '../node_modules/react-native-video/android-exoplayer')
 include ':app'
+include ':ReactAndroid'
+project(':ReactAndroid').projectDir = new File(rootProject.projectDir, '../node_modules/react-native/ReactAndroid')
diff --git a/bitrise.yml b/bitrise.yml
@@ -94,6 +94,7 @@ workflows:
         steps:
             - install-missing-android-tools@2:
                   inputs:
+                      - ndk_revision: $NDK_VERSION
                       - gradlew_path: $PROJECT_LOCATION/gradlew
             - avd-manager@1:
                   inputs:
@@ -200,6 +201,7 @@ workflows:
                       - destination: android/keystores/release.keystore
             - install-missing-android-tools@2:
                   inputs:
+                      - ndk_revision: $NDK_VERSION
                       - gradlew_path: $PROJECT_LOCATION/gradlew
             - script@1:
                   inputs:
@@ -234,7 +236,7 @@ workflows:
                 - package_name: $MM_ANDROID_PACKAGE_NAME
         envs:
             - opts:
-                  is_expand: false
+                  is_expand: false 
               MM_ANDROID_PACKAGE_NAME: io.metamask
     ios_test_release_step:
         before_run:
@@ -276,6 +278,9 @@ app:
         - opts:
               is_expand: false
           PROJECT_LOCATION: android
+        - opts:
+                is_expand: false
+          NDK_VERSION: 17b
         - opts:
               is_expand: false
           MODULE: app

diff --git a/patches/react-native+0.63.4.patch b/patches/react-native+0.63.4.patch
@@ -28,3 +28,50 @@ index a4e0cc0..4f4c9ea 100644
  const BatchedBridge = require('react-native/Libraries/BatchedBridge/BatchedBridge');
 
  const {Recording: RecordingModule} = NativeModules;
+diff --git a/node_modules/react-native/ReactAndroid/src/main/java/com/facebook/react/views/textinput/ReactEditText.java b/node_modules/react-native/ReactAndroid/src/main/java/com/facebook/react/views/textinput/ReactEditText.java
+index d1783a3..3c5852c 100644
+--- a/node_modules/react-native/ReactAndroid/src/main/java/com/facebook/react/views/textinput/ReactEditText.java
++++ b/node_modules/react-native/ReactAndroid/src/main/java/com/facebook/react/views/textinput/ReactEditText.java
+@@ -29,6 +29,7 @@ import android.view.KeyEvent;
+ import android.view.MotionEvent;
+ import android.view.View;
+ import android.view.accessibility.AccessibilityNodeInfo;
++import android.view.inputmethod.BaseInputConnection;
+ import android.view.inputmethod.EditorInfo;
+ import android.view.inputmethod.InputConnection;
+ import android.view.inputmethod.InputMethodManager;
+@@ -74,6 +75,12 @@ public class ReactEditText extends AppCompatEditText {
+   /** A count of events sent to JS or C++. */
+   protected int mNativeEventCount;
+
++  /**
++   * Taken from EditorInfo.IME_FLAG_NO_PERSONALIZED_LEARNING We can't use that
++   * value directly as it was only added on Oreo, but we can apply the value
++   * anyway.
++   */
++  private static final int IME_FLAG_NO_PERSONALIZED_LEARNING = 0x1000000;
+   private static final int UNSET = -1;
+
+   private @Nullable ArrayList<TextWatcher> mListeners;
+@@ -215,15 +222,17 @@ public class ReactEditText extends AppCompatEditText {
+   @Override
+   public InputConnection onCreateInputConnection(EditorInfo outAttrs) {
+     ReactContext reactContext = getReactContext(this);
+-    InputConnection inputConnection = super.onCreateInputConnection(outAttrs);
++    InputConnection inputConnection = new BaseInputConnection(this, false);
+     if (inputConnection != null && mOnKeyPress) {
+       inputConnection =
+           new ReactEditTextInputConnectionWrapper(inputConnection, reactContext, this);
+     }
+
+-    if (isMultiline() && getBlurOnSubmit()) {
+-      // Remove IME_FLAG_NO_ENTER_ACTION to keep the original IME_OPTION
+-      outAttrs.imeOptions &= ~EditorInfo.IME_FLAG_NO_ENTER_ACTION;
++    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
++    	outAttrs.imeOptions = EditorInfo.IME_FLAG_NO_PERSONALIZED_LEARNING;
++    } else {
++    	// Cover OS versions below Oreo
++		outAttrs.imeOptions = IME_FLAG_NO_PERSONALIZED_LEARNING;
+     }
+     return inputConnection;
+   }