Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: fix infura key displayed #8744

Merged
merged 2 commits into from
Feb 27, 2024
Merged

Conversation

salimtb
Copy link
Contributor

@salimtb salimtb commented Feb 27, 2024

Description

We are exposing our network API keys in the network verification details. Exposing API keys should be avoided due to their significant security risks.

To reproduce:
Go to networks view
Proceed to add any infura supported network from the popular network list. Polygon is a good example.
Notice in the network approval modal the Infura API key is exposed in the Network URL field.

Related issues

Fixes: #1574

Manual testing steps

  1. Go to the add network page
  2. Choose polygon and click on add
  3. A modal will be displayed, scroll down to see the RPC Url
  4. Infura url should not display the api key

Screenshots/Recordings

Before

before

After

Screenshot 2024-02-27 at 13 18 42
trim.88505A2C-3CE8-4514-B44E-EC105C1864C2.MOV

Pre-merge author checklist

  • I’ve followed MetaMask Coding Standards.
  • I've clearly explained what problem this PR is solving and how it is solved.
  • I've linked related issues
  • I've included manual testing steps
  • I've included screenshots/recordings if applicable
  • I’ve included tests if applicable
  • I’ve documented my code using JSDoc format if applicable
  • I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.
  • I’ve properly set the pull request status:
    • In case it's not yet "ready for review", I've set it to "draft".
    • In case it's "ready for review", I've changed it from "draft" to "non-draft".

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@salimtb salimtb requested a review from a team as a code owner February 27, 2024 12:19
Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@salimtb salimtb added team-assets team-mobile-ux DEPRECATED: please use "team-wallet-ux" label instead Sev1-high An issue that may have caused fund loss or access to wallet in the past & may still be ongoing regression-RC DEPRECATED: Please use "regresssion-RC-x.y.z" label instead Run Smoke E2E Triggers smoke e2e on Bitrise labels Feb 27, 2024

This comment was marked as outdated.

@salimtb salimtb force-pushed the salim/fix-infura-key-displayed branch from f077f16 to 2d26655 Compare February 27, 2024 12:28
@salimtb salimtb added the release-blocker This bug is blocking the next release label Feb 27, 2024
@salimtb salimtb force-pushed the salim/fix-infura-key-displayed branch from 2d26655 to d17c35a Compare February 27, 2024 15:08
@salimtb salimtb added Run Smoke E2E Triggers smoke e2e on Bitrise and removed Run Smoke E2E Triggers smoke e2e on Bitrise labels Feb 27, 2024
Copy link
Contributor

E2E test started on Bitrise: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/966032bd-ffbc-4e7d-bd9e-ca97d3d98038
You can also kick off another Bitrise E2E smoke test by removing and re-applying the (Run Smoke E2E) label

@salimtb salimtb force-pushed the salim/fix-infura-key-displayed branch from d17c35a to c25c73d Compare February 27, 2024 15:16
Copy link
Contributor

@Cal-L Cal-L left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a comment

app/core/RPCMethods/networkChecker.util.ts Outdated Show resolved Hide resolved
@salimtb salimtb added Run Smoke E2E Triggers smoke e2e on Bitrise and removed Run Smoke E2E Triggers smoke e2e on Bitrise labels Feb 27, 2024
Copy link
Contributor

E2E test started on Bitrise: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/78ee69f9-ceb0-4d9e-aec3-3c2088655df0
You can also kick off another Bitrise E2E smoke test by removing and re-applying the (Run Smoke E2E) label

Copy link

sonarcloud bot commented Feb 27, 2024

@codecov-commenter
Copy link

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 41.43%. Comparing base (6ddffcf) to head (dc03284).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #8744      +/-   ##
==========================================
+ Coverage   41.41%   41.43%   +0.01%     
==========================================
  Files        1270     1270              
  Lines       30826    30833       +7     
  Branches     3042     3043       +1     
==========================================
+ Hits        12768    12775       +7     
  Misses      17295    17295              
  Partials      763      763              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@gauthierpetetin gauthierpetetin added the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Feb 27, 2024
Copy link
Contributor

@Cal-L Cal-L left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sethkfman sethkfman merged commit 5fe71b8 into main Feb 27, 2024
35 checks passed
@sethkfman sethkfman deleted the salim/fix-infura-key-displayed branch February 27, 2024 19:28
@github-actions github-actions bot locked and limited conversation to collaborators Feb 27, 2024
@github-actions github-actions bot removed the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Feb 27, 2024
@metamaskbot metamaskbot added the release-7.18.0 Issue or pull request that will be included in release 7.18.0 label Feb 27, 2024
@metamaskbot metamaskbot added release-7.17.0 Issue or pull request that will be included in release 7.17.0 and removed release-7.18.0 Issue or pull request that will be included in release 7.18.0 labels Feb 29, 2024
@metamaskbot
Copy link
Collaborator

Missing release label release-7.17.0 on PR. Adding release label release-7.17.0 on PR and removing other release labels(release-7.18.0), as PR was cherry-picked in branch 7.17.0.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
regression-RC DEPRECATED: Please use "regresssion-RC-x.y.z" label instead release-7.17.0 Issue or pull request that will be included in release 7.17.0 release-blocker This bug is blocking the next release Run Smoke E2E Triggers smoke e2e on Bitrise Sev1-high An issue that may have caused fund loss or access to wallet in the past & may still be ongoing team-assets team-mobile-ux DEPRECATED: please use "team-wallet-ux" label instead
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

6 participants