From 35775c82e3abac496d86102d72e72a1ea0df007a Mon Sep 17 00:00:00 2001 From: KaffinPX Date: Mon, 24 Jun 2024 19:06:36 +0300 Subject: [PATCH] Some security measures --- .github/workflows/ci.yaml | 13 +++++++++++++ bun.lockb | Bin 178849 -> 180347 bytes package.json | 1 + src/contexts/Kaspa.tsx | 2 +- tests/security.ts | 20 ++++++++++++++++++++ vite.config.ts | 2 +- 6 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 tests/security.ts diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f9b6b38..e49f05b 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -3,6 +3,19 @@ name: Tests on: [ push, pull_request ] jobs: + Test: + name: Test + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Use bun + uses: oven-sh/setup-bun@v1 + with: + bun-version: 1.0.31 + - name: Install Dependencies + run: bun install + - name: Check Dependencies + run: bun run ./tests/security build: name: Build runs-on: ubuntu-latest diff --git a/bun.lockb b/bun.lockb index fd5fd63232d0357cff9fea6dcb0f9b34cb995257..698b47e4f2bc05f8412a6a9fef69914954a1bbbd 100755 GIT binary patch delta 27831 zcmeHwc|cZ0_y3&>4{}um1ce7gz+I3{zz0Qn6!(241($pfLD zI=sOQMo}Jc6cuDU@|63LTTfA(eSki|qsXrXESfl`&{34BY=oOF4%*!4-RhcIFc|Z^7uR}R+U{-E^I+e(*0sRsP#%Jec7dVQF_CTP4PnI~z zT~R#2zXz-XY%Ap%Q1Svl6i9{#)D-0!1M#2pro^kruMK`Ny!Qjn0#ZX>Mn2(0WR{SD z{YX&3|I5(b6_^HphY@nnG;Hdbc(+4lxt29hj9LYv#_YR`-4O)KyTU?9-Hu8=#y(*PD`7Ukzo%2aYOioxL1fz-?)Kyr7S zqbPrJo}xU1(WH7jgxwNnACxAAF-1k0MPn4@wu|5k@{5WgQ-;WGc5yZt&Mt~DqAt0C(ATB?hk>L&KC>_@v$dia z@-7f~1&I(F>nJLo00V`Y6N|{n!;n)8mo*fjbp}X7rAYmZ+(}fQ;?&Dsf=hfugj>gf z7!#*its`&hct`P=agM?)QdSD!28BTqW*jx6K_h|VfK*!~@>k2w}J*(kPA-X=YZ7W<82kC5pX4VFJK?EkPJovX~+^1MGr0mQpHx;0}M#~MGO)3%;)XV|ClV! zN!i7jkSXxPXxaG=VhjuOb8{yaV9f2p@M}QCy0a7*417?^M+3>hj=&ILC@>i40wn!& zNy6a+K&tq8Al17x3H?t63n8EanMLUnvvV_)CEY|%%mC8ZX9FoFhDv#7$w$llhEiTr z%CC17L-9F~${hsK&~2CUH9)evxNC_}m<9m_)mR`E7$6lpNW~UFW6Wg!Evygqq4zD2 z^gjbq`7`K2V=*htEH2K@EPNL{%?5ivu|&iHDRx=_N$y!96AStagIH=ExsHs?>ELOy zW&x>!?Jz|6;6NeI0aAtI28nV}Kr+~Qu#krWDMs9Y)YXHeULzpcO$1VpXvr|t0ts*Z zS@)=tZTE@d>wvVR(Sqs7EmHOk6SMXiAcfc>Aeq&rUK1dNES9s}2jFVM;d1eE6h(~9 zb!629PwtzWBkj86hPmk;NHapY#F+!bp~#4bL5l4hvH2+Tz}Epk7D$n@Y?N?d5|ARO zE96wJD0BRz%tA#mj}cQHxw+Xz#me#fMJVnE)`gxY^o>cLB36qA=!Ryr>nw-&6r-6~ z9`cH@=x2x#9VfAQrr?7l=4MXHLlMOTJUN_^nOP8#U8G!xKG{hHQcvD}o*9Q#pCY9% z@@e2&0GsM5HGQ%JkfNq~0x4Fqv-0u_VciY92HqSK*Brr*&Cbh+z%*S5p7du*EQrX> zAA`dgFnfGV@bDLS9o}TFWo=?kM_G^ymj`1(*DQ;ilO73`h(AHrS%j)`1Oy zQ-Bn!celuAq6nQlf35JFF7zxSQ`wa4o!o02oS7+bsrQ~o&wSonh&Ii z{%N|HnwSvAj0gi#e#4n!YI;a4lL(tevpZo4q@l2ZM}2P2c_h#~cm$@Ki_KQ2aCE~g z5zFSJ99tBTIi zPxMcLqp&D59`^)!#W=EM7R`p724??!F(DR%C$ky(<0lqp=N1)%r-?FFB90splgBxV zeHVyw%Yf9f^!)tXblkK|L-k~D1h65nClCYe;{0;q_VhaM)DAi1)^b-jv0mE1&fe9_@!MLr2H9C}Jr%$2>ZSPg z*URzSPq#L-vsHR3elO^y_zlv_@jG0%1{-qx{-T%Sw?Hq)??K%fVpo~Fo)(hC+Uunu zb~aBh$8WiA4W+`V_(jE`cI{O(sU5s`*F!^X+B7tXxEi{nrA^xnu01$6-O)P19eqWN zML!o}W1aN!Ms~}3$nMiewoKH1MJmZKLj`S!L*iWZa}8~l+2E4((;T_J(e4YQLw3qjQ2@-qg-|=+auq4;-7V zr?#|f`yop(En9vE*G>-#PGoI#YZwh%Dt@E%(lEO=8cBWUz0!2Clt+x0yh=LHCr76}b5d~RDb%os180tgdD(q@*Sm~mXr&8o-ZNLo>_M6!(^T8#NWy^k~ zx=>1W573v#Bx!vEL@cTLS`>Q-9JL+ehnRjFoQSNoc?s@Vx~Yvu6l){EQ3#4~e^PSj zGDP@EJvG*@)o!3DZ43`+xch)3Qy6Xp#sY8@7;Z-E-_cX!>?}ktjk8;Z;82sK2Q^J( z%XDkJoqegN#@jW&hQbyG5%&A)<&ZrMSx4A_teH)_3{DL5xkffEHds;YMr~_jsCUcT z*tIo~kq4MT2!vC5s?Dx73K2mCufl9vn&ez`2fAVzIBKuaChY<^3My!#KP$Y{VsO?G zVR^2NP0I!s2`!7!eH>gT!NJ4NzzKV>z{2$MwstmMx3;shLwagEyB6J8Q4*nD*JzIu zTx~@x*TRYmd z$HT-JyXfdi^hs$)JFBgiBWGZ^qU0E5&cXUgaHA@?wyngtFrA`o4mgT>gR>k3*UgxL z@eyXNWML7wF497Rdqq|#vIb)G#B3+Um%)uTtFrh;!MJ`pr@cE8eN3_TBDg_jotlbn zsPI4=1WrT^&HROWc^A8u*jmKCSdcd8sa@^bama*64pbX}f$t$KqW{vtk$uD=qUarP zG-lv1k7#g+LwlPgxPrM)4~k0EmLQd6h-or>2yTQ>g7Gly>tX1Uu1*8Jq3>HL@ijPJ_kq9hIJ2f zqYo;ibwF_c09Wbj4RE5dR6{Zr1Cd9*E&(UT4cmlv6P)nRs2z9V7)YAc!8Z1+Uf$Qv zuISc&c9x{4_On}l#8Q){kL;Id>5GXs!bm-f)F>lW151F&bs#m&knKQfw2`tR+JxR@ zq(s@HNM#tgw$2!PBef7IoEK2XS)_y&8$!k?%hu@S1F?Ug;a&C90~0M5km_!vA~762 zjnrhMMD80EG7Gv<==DKL}i-%qU<1~gyq#0vWrL=_O!Nr#X64Bz?wY|oLGNpY(CIa zhuO7$7*>h_tUnmb$H7tTxaw;oZS06{O|>(to{Hb6_0m+k_Iv-T7UFbknw?G7Q`79) zK?DT403|W=SgBr)oKw1WxZN@n6SAKkG(3^Lua^$DYbk@pihx;(dA?S+jK(*gJ^26uR?*}b?ZpupgPiS`7{Mp>!;f$YNs(JF-@@{V)50yhni<2%wN`7 zPaS2~oKl7ZLzGQ>30y1aV+x>&XTYI8TF8rC>PuMTgVPNQr4-OiFOnmDnKBA#L>3bh~8= zmKL0z+9X>WGg6s)5K_ZOk__$Eo9ngF*g{lH^7N4-6Ior|nq_A{=&4zD%YzxzprB@n+G~`8Wkq+S+q9TW zlcPO&yyUR9VO4$>9IX(FzBbOLm4lJ4WopmXiaLod&@Ydvy=X$!@b_Bc2(k%&7YIo#oZ z^Lju`BB9v>oEQ?gq%8zT<D}G=Ls1O zA~>RK(yfJd?KEUGV8-D@Yn(6Ihch#LNtGOIIBZ%eI0_o0Z`mh$YLOk`Ra#`%Mi-c2 z>xi?lUAnc{u3d$U1{Q6^JZ_7JE;JIx&7W2TZh*nTH_JY7Vou&fie?g40+fkBB+xL| zFnVwTIBKhLG`!c%B>PaeHnG!2Hp#BJ6^TB_@`%uF2Tt@AtwV+2$O949Z-K+ard0;5 zZdi@B@?ie0N_EG$tI6=fiWr|O)jr)4E+uRuT@fWc{E(|jk1 zJsAOj(@ix7v~*~YJ_Z5~?v$Kp?oDvXrW0DX$>ywryCSSLCuG>R&^>D#*tCP-1{oY? zw581y?D=|7R-)x$q;PIT>SLrvQA%q!Rn#lanbW|C~6cPEx;f>L&mp zv-E&DN$QwcdKzH+EPeT$B<nT&UW++! z1RPZ)Zn^6}B*slV4;lha3^3ZDEe0nvDJVX!sM1>PK5(K2Dz^e0^*^QuCd4OF z(^#!EkA*_hUB`N2=?N}HAK5Tbdm5>3!sBK(_1Z!`ZBe_DW*90Wx(I2Qn}h0uaJ*G& zfZ(8URYey_x`Rl+heXUE!9@ZxG*BWYpK%dVfgyr5&<*J{ z5IKOOgHaA=1mhwkxkIpbAlXj`5ss1hW2k;AFji({$qYi0V=prbU~e+6zd|yMy~xnV z?qOVnWT!x|22z8t8XH%kE5JqfSm9Sf#j)-fS9M5crh%w9rnPZZhomQZ^-d)FP7vWN z5M6|1Z;q*ogmDp42IAlFAMs^e)gd)uvCOZERQ^#ZCnUXPAaXzl(N&3ocMF6APZ(N# zANA8SR(df-pYf=l(YR8`$ah_@D&hUgw!)TKrWy+K$O2r;+sIa2uZ$M z=`AYQOHy2fWZ-RLa1oNB1H|AWq=E+}9s<%u=%RnHO7!Q4;7IEu5M6||K_@{ZKLsMI zXF+sThvdZ!9Y?OBK3x_5>arN%t!@N1@{A~V7lbT0X@Of zUoGH2WeR?%!UrWffmCijkjgCtQXnh>(nUzg#rUC~c^pW3oMwJaB-R4S;6@<+Q=Y*O z8GH^%L-88W5BL#~T1 z@nl)yU08CjjQ>w^jQ?F8{Zl**K~LGD>X3%AFY;-O2S~l@&}}pn?vo0H6s5y~G-e}! zWPtwIkFM&FvK%s>kjkY4NtA&fPyMv+r(e?DjV-2_#JH*=Mc+&*CnO6c5}iQGnvEaw zWS-<7lKjI!(q9Cmt16OwvCMx&mAeuWhM^_003r3&X-zfR&kg_(Z7-+gSfg{1Q_@N560-FIpA)!Q)p9D{aPf0l;CC^CyuaL@}mHOwT z{yBZ>6F&ONC%oDsQ#miC)ghJsLgo`v@+hlJNS=^-qpjqtB3Vs@oL281K-wk- zNWH2^;h!Sqgj8;*LNDd4D(Nz`6&OL6IO8$rUOQL7TqH=N|3q%(oH82Onl>6}~uSn4KS4akO zL4D0$Dj)_IA@xAT{SwlD-!9>{>F?Vm5h#D(E{T5l`*!K?+ofb$DRKR85xe`p zQ$Y;#Nv|60S^p`wcJcg^3K?NY2?fW%QGH4b*oXI4&k@I-}~%}36IVBgnc?= zcjlG&r;hv1nt86v()>bS_l(%spLZm@ve9yJ3);q%Tb{RorPNM&xlVicTDxm%zaIN{ zbgJR{ZJqV2i<8}h&+Q)Z(NmMIyUZ$Y^!(Xo1%ZVpt!!qa(8cvLXTG!Y%Jri6D=-&xZC^+DT?*=-MJj&m&bU4E)~!&_}W zE-FddQamnnVD#H;>As?*$DYcLb4hyAGI>H;`0^_5t*GkWn;CTnzI)=yWnqVdbFO@O z@kGj{Z_X`v=4`>Mg{NEJ?tR~~#_pcCcKkfhy1s47+Mydm7i@cX_!{@RbLN+Hcyqd| z|L5DT^FQDoetl5PU|0c?l3~;fG1EpdAG9 zZ6SD`&uR-nLLvlTkzgy2X$QeY5XLDxhGw)3Tl5cKE(!A~T3g?DNX z!3`2@Y!5*hzea-1Nf4xTfM5q-+W~@M_#+c;NrGS}AD9Gzdq)UfA;B)r>})7|ljCo+ zhO*s!8^NA3ts{V4D06gTAE_SO@sJ)5G@ZMEb@^<%^kh!wD+@mX7&7S7ZcV%PP z`7-ZrY&v5fmp#&*#k#Zpd~bi2$fC;r=+FF^`b3wqN4v8Vj9(qZ{Oe8ZEB;l48G|(5 zyUKzFvwViWd1MIdZvFT^@ozb*s_Q6mV z&Mc$H!CTU`3Ei@UG`56UUd9cuM&dClf3Z7TEDC*G1_P@ZNd_1aOH>k`^YYNa=p>_( zqB7()QH{*90b|&&Lr8glEvNivFhgJ=G2Se9mQby-E2W8-*e<+IojAt2{Qnpme=z)xUL{*|JlR`QqZjq;0UCNAy zU{Xf!OejfD?OKB9dQ$4qLu|ZPH!dz^^!kGyKao>UNg2ILNtMpf!oujeG(BKUjQjY>K6%+#6 z3mLUI40IJnLV^1s!+%ORh@5Ezd|S#|A)O5(r`~Z$VFZ{=5LNcBltm()2BOLiNLdup z!=>z?ltqJgfJpz4lsWexf$O<<`NR8IGoJefTcS2qc->trtRxHWjssJFL*;}3zFgQ)e?TI$MhesC8HY!-`T8;}h|Q=DF)v;!rA+Jop#XQ0Y! zzR8-E+(w%(gRX+Eflh!r4A4w^_D)ZqouEme$)G8qA~?953W8RF=o$J1P$7t(uhX-4 zT9fD@K0WyF3F-xE28ssJ()1FDmZO(JuY$@zuYq=ec7omj?NWOnK9Sf1+6#IMv=6i& z^bY7C=snQ;pbtPFf<6L$3_1cj3OWV~bK!-%S+msfNEd)6fHr}Kfl@(fpkAQfpgy2y z(5OwIXF<<_o&r4vS`1nUngyB-dJr@NG?QQ3%>vcV3a_(=rLj&tdk>2(X$ea&BbQd& zj-XDU&Y&)!Y)}rU08|Lt1-*Ab?}F$7{}Rwr&@#}Ypf!-M1;rrk4+;d)iz5wG6I2UC zw^*(qdb(Uhe~3_wgz-8HLVDfxJBVJf(Mz~5LFYkqe@d?cPlM$WP$_6RXa#68XbNZqy`LO~1U&_L0*1DNmVqEP{xE0?uqUV& zs1Jx%6y=1p_t2iS3$zvVENC-G18oA0hTeK09VOO)upB6>fpjjR^9scT zIlC5VIv&umVS^;%X*Z``9=m^uLdOEy%4w&i9hi3JS3$3UX!(2*L^4X#R{pXiQ;%d+ zj^rdWk>s@5(#}jfwkapuBq!N+79uL6t(t_im(egdk0XJrFpk$h!g~1Cgvk6?!S3i{ zafR{WN0>E`HjG+OF#nmbI~&zHIx;3YGCr9<28DPUc^r$J3wAzp#DDVPR#1pZh=fWE z4Nn8)%slTm|MPRn6Odz+v?xfc7Cl~A-b5Y3JWTF^XSp89j3qddZoha zd>a(lasJ*h7VC2ZdcM$mBxmyDC&xZiUu9Rg_a`ir)#kCEu-HI<42p*Q>HdkoWj{1z zEZIqjgqunzpY;jsMDi7Yz$EC^f!+(5yv`qw90@gCje#24@(~o`?}tJ?D9q^g+ZgXB z#$SelF(T2*-CgX(>S4C~K(~Mg9cO)+lRt2r#j=O_>f@+T=Q|(_G`~JHr9t+`=N63m zp|ZkFJoHoOZR4R|!m-`3MM3m%Va~3Ry}o$|da>waIChBVe~K2G-${zj|EP4S-;8)D zAP&g&^L!T!1zwWg^#66=D{r`_FNZ=L1sOIQevNAK;I%%3o3r^jU)9P=dC_O^b{*dY zVW9aPuWtvAnLc1qi-`}VVkGk%8y+W*vZvsG4E3#=Hay@#go#(%8zA-F{hJ00k@u z)LQdPVwW<~Qckzu)5WOO2%*LN0~BS3h5GbeqKTZL1#CY*9imzT&F^XSi+XFF_0T?F z6vQG!v3HgCCq2<%c9RF62KPH(1z}({)wRWp!-{f;df>es7WS$$M5`mJ|C8T!`89vF zzALhV_}bG5-wphe(+FSl>u5E<85(3?v-mf(K+YZ~?{Egrnx94c)jRWnTX7$hLLnwH z4l$>^$R|Jn55pGym0p}OgzqK=^SfztUd;R`tZn}thN0+4>;bv_$20Kg8Q%OXpbsB@ z7G{k(XXTHc#WOZzB3luErzz)Y{>xdGg?jJ*9J5<|?M!iQT)3ujSif~iFiVpc4c)_^ z|D4TYU3k=b)ejM~{V)R*{h(_08t%rQz_K&xbBjaK)pMj#7gZvze zRnc?rpJV=k=2y*jw_0%`F~z@^(U8`WSekWy8;W>@hxMsG?|GgDvBNy;Ji3{-0WZYr zqKwD4y>a5;S(VX5i^tZojDK_}69 zu6*xTtgF_)shIv_x#!ogW$5_2VVH3I=AFN;u*;Wx&FZ#&yqVZF%@3#beD}>R&mVge zBYOpV876(jr`5{5p38b|N4qCv4!8fv>IG&tufDh!HojUHu<;q4VPzfpwOepzFn3%4 zEh@Z7Gk;RT)hxtXw!qULzY1Jh2q^C-MG&3ci10 zhMC_O+`l6F?HjY*n;Huv4)nOq<$Hg?O6P*LlvZNft{P=K8}xtISiQ03;Xukge`Hpl zyXUAEYsjx5Lu-hVbef;aNB)R|^`G?~GW4MC`4bDRCSTZTY}zqDi`cOA)aO%n*89fr z#MrrZ@rdiy)^L|6av?R!7|o0HH`0H0O%#-_naj(67C+U8`G029mmmHa5fH||BdB)D z$e5DBWPTFzjbAqYI`u>fSwR(6}Ly6PTc?o|K$B3}I<%Qd6gijMQ!70dp=USCyj|J0eX zeg9^k-nqHl8C!BYN#LP$B#;&SXWPktcU@h^y=!1ml%9#>3A=NZz4x;D&kwikm8$Xn zuaDuK(INNkzt}^}z2nX{%Erk-_-{0>TEFhBRMhqtTa;W?{>|k?co6t`d+|L*xAHS9 z7iH9&Bo-|?R{qs4eCLtpzY?6)PJ-%s1kYqD4@YK11pdWAl9$&|Q+)1zzUPHUJe}Ot zP`m^moaIe+0$& z(NLfVik{~W$F%zWz27Sp%#ZXgC|uF}^n#uql{uw6s3x2+zv}ySr>5>db?&miQsFos zSW}G+toXR?ncb_lwBFU$mEpkCHZmqg`IfJSg?RI8xPy{D4sQ_Ty{S^cx2t%_;s4uj zF@p}Z$*jz2!7o$g<_C78lb7FL=H{tZDh%MEwXkN4<%xhm^8>xvJKArKa~uD4rQTwm z4~2O1lfLVootbmRz3Guk1@oi7Te@YBEVMUYS($T??;_iuODDtXwuohmzF1qSaGhTx zA8PViwV`KzW%$CA#XqdI|GcwOFPht-5Z@UuOX!h~o_MKo&LhhgR4SMsF5dgq(#<}8 z-G8af$>xucZSzaV?%qk^ud&D9uT)sV_d%uOdi-i_)iu!kdT{KrG1K<0S~Ejs zfq2wRkC)=Orw6Q=pBtXhIx_ezAD2crn_V6EAAfx7OXEBWQ*p`yeijzwvyFI9)K7PY`A>c1IdefD?!|tDA$l189x^=0x7Ja^8!v<*I{BJk zF!t=+?WAXi%L%5UO^M>2eAIfu^ian9ym8RdUU_5I=#wk&R0r`GPt-b&_a+cU+^C4# zVD9u({o~CqCx1O)noHl5(lTKmk0+wdZ!355-I5)!^}gxIp~oONdpF`A2y4vCFlxXq z9^?nko8PXd`ng0zd-DF2+k}7bjrN)!IQ}kY`h2Zjo7JKkdUD^DuYz8n`K9C3X&ZL^ zRPW3Sra~+pIvgfLjrey2I*+OcSjU55Ry4@ZrH!(U5B65OvVFYNTTS`DE6w3E$jTz# zp)Tq+Kl9vf$D$!O>t(!T_CdU|k57PtS+~)Be*BHPY8%;=mev?C(W^#MdS^&v+w1WH z9|Upr$kHL)Pz{>XU74=p5Xy14|DxYfJ9eZhfAjRS|eyu6YE=w05AbvLJ^np)a>Was2 zcYJ{M=F>8Ej2BteEOvpPgdY2u|71m!=)7eB2G=cvj|xy*W5rww7RR%<30m-9 z3HtJgK$J-4?==FXatCqa_;iBG$K-{4D+#XigMldH!T%r#;xP>%Y|eWV7+fe%XrR^& zY@R6|>?J%I@p$OIx(D&t6YtTeKPU0;8$$U#?!cP`)N?ab4d5&YJG*NRZxDo?-TYej zeFNX?=kR)&Zs^;HMP(uHAA~NM$yY%ittksqXW`En+ctzSnLpGJF74+#396~Z%G(F4 zacmTy5RAf)@lGMCFJB$32CG^D-xG}3KgP?0)o^Wjfp|3&%{}l+Kxj&ct?mT@o}E*} z8uG_NQ1hMd6E0xLyDfw)@ z1D^#2a}3ZGuQWzi1Wpm*D`&|uw8jUmx$wf&r9;n8_{FFc&8JsmG>w=sSz>uk6LfSk zU)=-?koigP59{^lwBdTrMU;_u^k?|xCMdIq*Jz4%4d#gi5A*z{YF426$?q3V?YtCP z)GDCT(W*7wV;dYx0X1$vnA&8HeT8iE8iL?|BzTCtm^YWTB^3dty1;LS9`B_x9z7W zj*e`NCB{4o8po@8d}f%Mt8SRZFNLZ8YQ}8t7Ou8#lRsP3^ZTd0)UHE5L_C=%o_pt@ zY+kt9NA;M?-w21Tz`6W5Y&9^y(mw1&{K!5jH$n_s##&N5k1vUU=InWVPb-{ppN&+5 z)W!37VJj3fKMw!ou=m>iBd;%BJsB^)&>2F#kGg+8uS3O6tZIfAN2md+S;1Wz7TmMm zDe~uDk!qakyMT9#R9jbPaiH|lpZi9^^0EayI!bLF_~k-zY<{bx-?{v=I}u#wtLQF# zMwDu;xhGCl=yJyMHBo9udUd80JF;^paqg8uAL|-AEn-Kp# zn^Nc2i}AvPFLv{PM5}$(^oeEPN2|AI^3ikD8ucdTMMXrVPt1#;n2(Pv&YA{>zmTVf zwje3}U-=YC4I^#n#l(?fN0B+1A0DDM;9gtR8a{dX8JW-~h!FE3hKJ5mn|n+qBa@3F SjOoKWZB|3eu54Ae*ZhCwFpI1J delta 26909 zcmeHPX?PVy*6wP!kVb(3fpBvPNq|IT2?15mUcs2G3E88j8@ZaF0jvuBl_*yOI67zIaF!Tc8Ty3~jL)8s zog2*0e*yvve5%Hr5W}breh;u3u!WWnf>J2>UO*b|Qbm>X0`aftl*Uhye&dzV{L|tkls9=7un&1>PHynK#t6r z!upIUc4>vE!Ya|qt%E>}Ns(J^aKiNQ!GaNEf_bBa{%ES-!Q$7a-Qpl~RVwKamA z`PG1QH!mwVq5$QB4V4#Xflf0tMkskik%a^+4o5+b@T9!>vFJ7<&0bnDywHS{^CN3Y z)`S9xzs5?yiJg9xVW6Ew2|y2dd1_OBkcsfwMxiZ`ea<+dNkQJrG8wO&$ zXb~_5I82x84&;RJL5@f$8V@_PccZqSlc?-i7-EK1L4Hp5aKxE05dyaGEEL$m9|Jja zwk4?!-K_Cd$XP)UNCO>#oKbN=Iu;6KL(U~A%xb0V_5!lUQZz;bX}=1v4wt@n{i@<* z^c`E)5Lg5F0Ss|U?*p=edx326!PbV+0Jsc%D6k`1NQ1FJ4q1Gf>cL_lE3U44;53GY z{QE%m%;C1^e^xLhyC4fP13m7v?A>;14D%-DMEkMM2(Gp-3Fi*<|0O?>W zU^Fls7zI3=uJqpl(&1e|R=feodKadn|5z^)$xWPvVPF-a@d2RdV> z^Z$u(uLHdgfz*Eu$ntNa2c5+%FRP#+J1g&5@SF`P*Qq6<36QZh)NebVqPC59|mNFL;I?7u|OJZeS?yR1KH(2L(Z=5ruFIqX*Utb z9|A&ccKXB=G} ztYRO#OY>1V!O;eIy6;fvt<1{L z&C7!Q1E`x5?^nnzU~t65Ja*qM$k_{Vla$=BmtGMb^V=x;m*}zgUlCRKIfk3D^%{^1 z|3=tiXfFcR2TlMoR)5wx``Mv zQ(3tK$SE`v$cX-OhMJoFpvM^jT_-;dKKXJmS?3}Ez;OW@|D96xt7mXF**?}>0RSRm(wU1PdD_k>AH$Rw{ zpOs=5xX-{HSyp~A?4~R~727Yb31i#1ZQvBAky-@+t$IienjXtL0(ER}e84lP4o5IECe2!n6h{kY8u-Phc4>UTiop7I9b^@q_!(no zv$Zpo8VXq@et$p_^|9a@nB^l)fw{Y&e-n;cfq#xGq?ognT#Q;8J4i?9SgxY zzcmva2S!hxdy2rSdCfQiEXp5 z&mPnu-MSq@x^L1kamX%73Rq@6!)OIrMVsT_5gcuxcj4Y_aCE4W(*-;2lH`D>W0xie zJUwuOl5S_lrio%ZBPAe?*d-|et7?5^3*89&*Vx`x0c$yA?O_8lH1Qwc)Og1<^jlX) z8AiaV?RcVJjIq7`fVBcLdLZnWIKOz)E`h8r*4b1?FWAIyU9Y(c_ImU|F*r8VX_Ivf z9HR^V$N9^=w62PA<1@zZw{8L#4=s<=Z;QcoP#ipb4V>&E_u?u;eS092Kpjv{F z#Jp-B5b<_K`+#+86E(&aZ1g1hq!c-(?d=e-x;8b8u}+zo!qgBjLluM2Y|%^&i*SN$ zIygqX;`W2nAu&HSq`6x!rj#`YT&D|0Ubv8l=(4(E0M*Q==4Noil*!oCkQT0eW(@*& z?FAzbfa`mq?lTuO8T{SQH#&GQV1>4~bHGZ(YMAcmbAeiAmq2z9GUXP#F%;w9O<6=Y z4g^R02uB3dPH=j{VLJV&IfORWiv*0=06ViqnzaBaRR<@<^WcUkd*f0?ihZO6EfcqRABU;$&F``{; zZ;ybOZ)fxfSbH()`Z+n&tJC`8vB?3adpyx^eGP87qsflE9!}{7VF2y`#|}bm;0}Xh z)L{WccXdR?9DK#y1FozEUxQPv#_C|DVo^|e^ko4!6+##m>l8TUr&BwgtTB?D-IxvQ zZ0~ge@v)tO-(t%@H$BS+TMeqT!wG$i8WwV@P#% zQjIVy-JR5Uq*U(X7i2#nrSv+YLsjlVq*RGFkm}`>jqL8qMj_SPk!?px<(lYJWu-e( zs_ZhPl)ZN@$fA3?CB`GAO8gC}o{qg=ky2&5VRk9YcOj)@?<3{dvs(00>p4aPYxfLr zT*Xz+9qdQ(e(|!Mkr5Ep?GpShw@Whu)_1)xw$Q}R z7!(lW?UF$O>p27j*dg2M4f!WDE{?3NRzDvoi;$iM@8|;DFWh2DKz0A~DgW zoiQX}p1;9fH6&dOuuF#oJWn8++SRKor$q$b#FGSfteoiREfKDSFo2RwNr*`Un0G;0e} zC}-H~hx@IovRsb)F`vDehjk81^Ez-`B@Fv`vfp|g9AihVL*b*8e~8FNe$mS=$qrZ& zGJ2%;_G94K9>g)Wg>XA#EbdH4yR~uKxer`>XdoIp`#m3n%d?MN(>7#`G7WLG-?IuF zA_{k)Zz9#nF~}vXPPQ5~#{sJ!I7S=p<*BMj)AfT&=5#|NzRvC1|&8F6qc zIF7t?`(eGTIo!%2uhKXbF-kKXoEi@JWEFyAIdmboXTh;!D%tB>riSFG7NXVY!Jgpg zmb&{a1jqiYY;zMk0FK4fUQ~0u%5z-ybOe{|+;*4Oi&K!x6#_wr>bGbPb}-RC1xMFl z2lKX(T{qhMQWWU&EXA}giPa)%&qK#;O3!I~HAe_fRD;wPP4#y6D3Y=c& zz?}leiG-oR^lzA_hPtxTi=)9&Qw`H)A2GR?O$}H-qXhdMDZvUE=6O&(F+yT zPlCg|MqhF$!wRq$fJ5)W`w`%dmuq4mG^mc@K>TjioNDkXa2;JYthQ6#X$6N>Y+F+x!`{W_*7IA> zf$QsVn9`nR)3EW|nWNJ@MM!mVQZFJklqoA=x~f;*XY#;}-G;Sv5~e3O4xXA1?}KZl ztYWyrZZ?b*a97yuwtnDRf9elg%LaNnF z?WMTeE-4CFhsmQn0;;*+Q*Raqk0nHooiQgMUbIW_i^pdCX4~Fd0%Dh)fnU=unHwsW)pso~&IEd!@CIaG%)aLjA8@S>JlL%^vTn71Ar zhY|6N06nTTomIxFRjf2aY^(#G-r)M%YwD+2_aW6qc^v0APZ!&(Zf{cU z^W$8^N}vo79T)wM=$9}8sZj8Qs+NI5nxrvSDh=eiuy zFt#2?AA5;&5orf&wsR5LAgr#=H7N{01uSh&K`c{-VP~!mcRFSYIb1|)Va_|nF*}{B zJfz-ioqsXXJsKqzfp`^x=*}%5UKe4ZlQ9oM8bo|KS9w?wIk)Nji;;#GYdMj6OF?vC z8Hm@v$6Cs>fb7Z&sFi#u@Cu+0h%BQXz0pX$CYt|uSorTU z{)n88chD97mst3F3;d7uG5(kHlta)>x2QbiSYC^Kj&X0TR~|BE_~&)Jhz!y}Krsf1 z!AQ`+P_0lNGHaO5CvvQVK#E4-he4Z1=HH;Oe_0-0$Pk>RwTQGbTVo-RS#$71Z{}%! zf#w$hsedbw*TqQrZ94yUolm5lC7K5oI zUmh~+0i91|@QH3dIvDUr!DnkUlQ zSuZeG`Oy`qU_bIeR1D2E(%Er3o5)2x z-qHGMrMhiP1jmu^Yb_!xN!9$tNULoi=StlbNNc^d-o?l;@2BNNmK&gXBJJPk_7)O+ zl!;mX(f`4upKc$EoMMFm=c$OUr-kcMXg z>BwxIPbBXIokmtL7jmjB(8#}*WDhT)P$PS2ISbOjT{@#YWW`eFBk4T$#4>@4$ntTZ zKk^7v*bN1Fm521O7l;n@2JyNWS@EBI1S)i%h1j@ZAYQ|qUxln72qF&Gaw7G!K$MRH z@gh>54Wj&Vk3PtD@&(_~{O)HU6lO&QAXfC(BM>@)k4CtuW2ErWhZpg$M<8^fuMF<2sX)JTL=cGLGS_v56K$sAP8v-!Q^%jJRS4nlaqRgSLC-hh>9Xa ze$`d16U*h|ZeoOZcgLx2Vulbe?ik-gB!!61a(!QPM(mDbeMPu1Z|k&ULJx67$T#|n zy0ypQArX)7MI0?&9L;Sze(5hJ3UuoD8%0;|ivye^gCb`0q6*J0s_cLVj|%02E$3v2 zsp3VsK8S8|ygIt$kwK!V@C+COZ>ftvCSt~px|!lm;n|#vTT6;Zn6hYqxLp-`aR&^n zQ;MG0beytCF#vtw*w5dQkSPiT)gM!)ibjdE{i@ul|MPI$owDmr(axC_=YLffJ$BE* zxpwe!d4?vBrFrp;oGnAc_+KZS>vk>UvA|$v;99I@e89d*%kI!J9usWl!6L6ETF5g9 z_Yn3@$XF>IX$<1EOzZKe$nQwhK|RFIAw3U5=)iKV$Mf~aXav_?+8)p9AJ;O;w+JlE zW1glcOs`hz!ffqGtyrRE2qq&-%lKa*S(Ya{qqOX92$(xcN2Z#gp4g_0Dc22^!_enTqAI(tNuLY_(X2l?RWQIvTPbPU9^%`{M3P&-gMs6D6y zs3YhaP$y6q&?c0{RCQ+N^}s%$zMu}Ej-YEmoj_ec^I&@ch>b-%M=s_<=C1n37Lc!M}l)D zD7Xr=8pN~NaiAO!&uw|8%L88?7Iy=62gQO~fVc#01##Kg2HFmK0<;74B#0k(cm}i+ zvF|fp$Xg1<;Eio*Lf@x(#$Ys2H>k@_RrD zNQZ+WKzzv%0o1rUqRJI7&;_7=1s56Lfzpn%FEjeFM+o*g4qSADorAFR%-UZ@(9T?n62nx|KkD<@5Kpfkh@lDb3GppclAFud4-0QfDw>KiMG>`QYs_hQ!$Bw{rcxud6LN4rQ&jxS18>%y zdZ?M3lbF~~M!qAwK1O#m6ka~~+KGtkhsHypReWMfe1dVO>;nZnzldil6F zTmkhSXZGiKzS+PhiQ@vX2J$gkcJN#cDO^RDokrw!TmT~XIp9qp+D{m`?I&aC=r z_l71sgJUUJ;N?Uprf`v~4TT4r-E!*<|MbN{p(Q=X9MVOr_q(HUw=Jt0=^Si;RSMXFch6J>*(vF!(Q5~ZKLQac?t@+dB36*a8SmUilka!YxTurr!GG_YGEByd@RS6 ziWp(a#mE=ccP%JP@=Wg; zJau@juHCQx)PYT!)#coX8h4HV3ONb!i5M|wXT7-hLIqbQS{Ws$9ud976#2ptk>o3a z)PgiIa9`}qxiunSfxV2TFOs#6LT|YY9)+)K%odW@)>~7{dCgW&C9;5Q~S;NFyu@RELZXyD5SXG zPWmNBJeJ#_(-A17#3ypJE%Y1X;LN!hWA+YQe!nTc!^ng~;+5?_fbCQ$R0BIQW8dDj z)$j3`q9G(4|1NS86jDZjmd%DsnJVME}#2JsHT74kauX@<3q~y zmdidLi_ut2p86PO@0DL+E{Z2)$y9FKRW)Q5oKR?YWMx_tp`F= z#vsS9I^lGL-1P|-QukX=O2S|RFMyThSD452NbrE&AIR#lwCh}gj|Mv<+d_`aadDs{YHefY00@hw1HaquH5{_ z8*M7CW{WZC2!F$Bs6OLxuI5Q!%_nNMHw8RNW-mp^Usz8ynfL{24a!3&0OMuW7Z57W zcNT@Ya(@2ct6XG z=A_E!PQpd^D^}0m{?9I9-%NkeywD>z%kNL37qp98Wrwd|K2>%&hXvm?qBF~v>Q?D? z{6RN$4GU!8d#C!}*GOHux;*vW?{r?5)NSy|UK|o_=hAUXk-;C3r<Cd%xkz9A` zclulY5R@;yv>Dp*Ki9+B$nOn8)yqEjyI;Q08_vvod_%DcZma~xf6@Q<%2z8O{`bk} zDgi!_0@FpPK{3xI$eBNgx*}Beru5RLUOH5|&*Nm`kLdc2vL_)ZmsCc%99c;2_qOg; zDNdu<$I^FNB$;Ou<@KjU-RAD++S)DX{qok8*ACQ6F!r9`-rk3bFxmSo?smeE8Hve1 zQSN}HTK}py%h3yQ_2e6;MMODjzcII2jz0tcw#kKO%C-6%b-hG7H!e<_;_Eu;e|1L{ zywn|cA^B60@^99kKWDRwZ2A*c!e~6)@OJLXDp~3E#zdViTVczcFFJa3*rdqgupxTM zpJ>YcP~L{MQPb9~xo28gJpbMh(#w#B%dHESt+c#F`ww>7yE5`TwuNf4&v`Vsp&Um@ zmg_D8?XB)MUC)IL?z2C)j9wZ}7v{hpilcJ7 z_%b_)yK`LHNZmR;3jdSVmFw80wd(5h4yBfw-@PYY8fu5-RtsbI-{0Q+PXh1K^;8FV zxos_Puzl{$XF2z_GU-aQf34=Yap3XG(iVdj$8B%dI#d+NyRS53@YeU)E6uybyYji_ zxTSW#(V6<~jNa8k7apo8lH*(REWlVO7gvRX`&G|p!s^t_TvBpNnZho)2MXdHd6atY zS3xTkyg4%GweQU`y>MB*n(0k(KO^eD>XFozKfTeVOu_xoX!VZ{B{uu{m7mLU@?<88 z`rI#*_F47y*X{2)biPbsi(Co?Jd{0D%}f%n$q!i5hd2o2k;BWCua{juAHTPvz|&Ui z_{2oR{lI76^f#K;i>$G+ET@WWUL7^LUj$w2OL+RNFGdV1Q%I6QD2Og{2KC%8itaVO z?i%-n*}hCKS3U}blv_G0ACAr))g^Jokv(M!?pI3h-86gb*CDZQmgQ`cztFb(S<^%7 zLnEJW{6+6Fg~Kv26h54gJpn!*(6gDt>-=n0j|%&-OfO6pLLtTdj%snmhsWGhqs_E3 z1@}vthr~FDQZBMXG8ASQoHURDreMgn&*^pj#b_7sm^K{ zAGNnug$C+5nbD}u`EbOrqlTH3@~^h9$2mW3yB}8lGA$U~-|{-kxvxx)Zq zNvoFG)GF+w9iy@6~2zhCH*+Zu) z62;Q)hhAe}c;JSsd}DE*rYcT0!et-=##+m&VKC-?0Ji!yU5-|7_f@K+=NuTt$_`Kv z3Vhr8tJB6=J8vjT+p|zNq$SQMD$Aufc}j7=plXcT_54?NPI?c9TB`Ff_hYa+_g#fn#t>PfHhh>Nn-X;AaKsnMIpHYjewQ}l z%=oW1^=xpfTT=HP4}Bl0ZFa_=^?YC3?C<+ep5X9cRvnmiKWBTO&biuEs-OD1Yc|1H zEw@4e_Ff@eY-vlo~&y|lyey5p0BDlxo6xD$o^i~ z{%?C;btNADPI=*2vAlvor~6HZpc6TK_j;kFZihvoQ7P`Xd0(to>-?H8s@HW#A;mZ- z_t2V09wj^>e~2)9`P?ty-(7phiHP|-$3Y!OJUo%oXQTfqgvIqTsu}F%%AQRC#d1Bl zhvm}7W|C}H&#Y;^GF;8lNO`EK8CJmujwH$`fE zN-H`sK|V@_MNq)seH67x?Ab43&Ib>}OMQ@Ai3gB%D&l!?qx_|w*$aP2hV$S$G8k$4 zQ``?G-?9Gj{=dw6opVSZg1eu}y}P8*u3q-Wf2v;M(sw|<8flIe$7G*avra_}`$^fm zzB7Vz0p`ymWWAv4g9P*x; zX+PX_?Xp)?tvu>2kV|5qUMM%kAZ*;vAh+0&7dWw}1ZaCkHZ+QxKWX z5M?$tz4F>dX3d6o=BgFe{pN9SZ_Eo_S9*VdcCw0N$EG&zm49nwMu^Sw^+u>IOn%V_ zUj4^+98N5Fal11P??S}qa(*mYX34i=QP>&Puu9Hr$8wq%At%P6H@=jo;#_6Cz?>}G zUuD)Uw>y0LgUCe>#SFan-27kpYLcOjc)MTjxeE0s$)kYFjMM>Hy)ib&8q=IV(kjvu z^MGWhxzp5{pQGXZSxi&WNPdG!>w6n(9M6{5#TGSdIzMZ8s7P;z+Y8kFgbZE{z3%cZ zLXq5mHKxcenaCNh?K>8|IQ+)M4y%MWT=>s<&dT6(zp1=*$G&~p4H9wEhPS|YM~1%| zk+0H%S}gR`YN=+3>r|~f;glCnjVcX1-oJV3C!r!*K8hK1>9XP#Gv$|@SMCR$*G}2l zJo`-#?{@t0eC4dYaottxl+0;nHoIU+uU*P3xw$bS#p#)*4c#TI0{&{G2AoNH@`dA{ zuH7-R>?R^iw!{5>E9bk=PvDR+V@VUlXE_s!Ewcl2ZrJ?A)+z{e_9*0R#Xvt+%-_GU9&MnM2^)?qd|GT~D&ag+HEZG=d6?%A;7mp=$>>T+~ z3$vv;d5%m-fJZJu-Xp=hwqC8d>V0I3kdOfb>!dxTYT%+3Ggm&IV79F1er9^$k(A79 z`=5!11~w&j|IPDOB*J9zJeiw>DwfTY*CnEW`(5i517B&gc|tF~TH@O&6oBSEEzR0; zYoh6I<$m6}`_R#!&)rb*fMeI$rv817u1a3t(u^=w_4O{Rjq2+DM~&L@i)C%k{PU&E5$Pn3x%W+0+rFD0IrnsQJ~t9Jg41Xa8Bw7fON?6u=~ig|kW Lj+eKa+p7E@yzEqL diff --git a/package.json b/package.json index 6ddb80c..632e5c6 100644 --- a/package.json +++ b/package.json @@ -12,6 +12,7 @@ "license": "GPL-3", "devDependencies": { "@crxjs/vite-plugin": "^2.0.0-beta.23", + "@types/bun": "^1.1.5", "@types/chrome": "^0.0.254", "@types/node": "^20.10.5", "@types/react": "^18.0.28", diff --git a/src/contexts/Kaspa.tsx b/src/contexts/Kaspa.tsx index b1b8c39..d4c0d7e 100644 --- a/src/contexts/Kaspa.tsx +++ b/src/contexts/Kaspa.tsx @@ -16,7 +16,7 @@ export interface IKaspa { export const defaultState: IKaspa = { status: Status.Uninitialized, connected: false, - addresses: [ [], [] ], + addresses: [[], []], balance: 0, utxos: [], connectedURL: "" diff --git a/tests/security.ts b/tests/security.ts new file mode 100644 index 0000000..500c9fc --- /dev/null +++ b/tests/security.ts @@ -0,0 +1,20 @@ +import { readdir } from "node:fs/promises" + +const files = await readdir('./node_modules', { recursive: true }) +let findings: string[] = [] + +for (const directory of files) { + const file = Bun.file('./node_modules/' + directory) + + if (file.type.startsWith('text/javascript')) { + const content = await file.text().catch(err => { + if (err.code === 'EISDIR') return + else throw err + }) + + + if (content && (content.includes('fetch') || content.includes('XMLHttpRequest') || content.includes('WebSocket'))) findings.push(directory) + } +} + +console.log(findings.join('\n')) \ No newline at end of file diff --git a/vite.config.ts b/vite.config.ts index 70196ac..e539400 100644 --- a/vite.config.ts +++ b/vite.config.ts @@ -33,7 +33,7 @@ const manifest: ManifestV3Export = { } }, content_security_policy: { - extension_pages: "script-src 'self' 'wasm-unsafe-eval'; object-src 'self'" + extension_pages: "script-src 'self'; object-src 'self'" }, default_locale: "en" }