Skip to content

Commit a8639a2

Browse files
MrtenzMrtenz
authored
chore: Patch security issue in snaps-utils (#25827)
## **Description** This is the same as #25823, but targeting `develop` instead of `Version-v12.0.0`. [![Open in GitHub Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/25827?quickstart=1)
1 parent f01ead7 commit a8639a2

File tree

3 files changed

+68
-4
lines changed

3 files changed

+68
-4
lines changed

‎.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
diff --git a/dist/chunk-37VHIRUJ.js b/dist/chunk-37VHIRUJ.js
2+
index a909a4ef20305665a07db5c25b4a9ff7eb0a447e..98dd75bf33a9716dc6cca96a38d184645f6ec033 100644
3+
--- a/dist/chunk-37VHIRUJ.js
4+
+++ b/dist/chunk-37VHIRUJ.js
5+
@@ -53,8 +53,8 @@ function assertIsKeyringOrigins(value, ErrorWrapper) {
6+
}
7+
function createOriginRegExp(matcher) {
8+
const escaped = matcher.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
9+
- const regex = escaped.replace(/\*/gu, ".*");
10+
- return RegExp(regex, "u");
11+
+ const regex = escaped.replace(/\\\*/gu, '.*');
12+
+ return RegExp(`${regex}$`, 'u');
13+
}
14+
function checkAllowedOrigin(matcher, origin) {
15+
if (matcher === "*" || matcher === origin) {
16+
diff --git a/dist/chunk-K2OTEZZZ.mjs b/dist/chunk-K2OTEZZZ.mjs
17+
index 15be5da7563a5bdf464d7e9c28ed6f04863e378a..7f38bf328e71c1feb2b8850ba050ce9e55801668 100644
18+
--- a/dist/chunk-K2OTEZZZ.mjs
19+
+++ b/dist/chunk-K2OTEZZZ.mjs
20+
@@ -53,8 +53,8 @@ function assertIsKeyringOrigins(value, ErrorWrapper) {
21+
}
22+
function createOriginRegExp(matcher) {
23+
const escaped = matcher.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
24+
- const regex = escaped.replace(/\*/gu, ".*");
25+
- return RegExp(regex, "u");
26+
+ const regex = escaped.replace(/\\\*/gu, '.*');
27+
+ return RegExp(`${regex}$`, 'u');
28+
}
29+
function checkAllowedOrigin(matcher, origin) {
30+
if (matcher === "*" || matcher === origin) {

‎package.json‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -253,7 +253,10 @@
253253
"@metamask/network-controller": "patch:@metamask/network-controller@npm%3A19.0.0#~/.yarn/patches/@metamask-network-controller-npm-19.0.0-a5e0d1fe14.patch",
254254
"@solana/web3.js/rpc-websockets": "^8.0.1",
255255
"@metamask/network-controller@npm:^19.0.0": "patch:@metamask/network-controller@npm%3A19.0.0#~/.yarn/patches/@metamask-network-controller-npm-19.0.0-a5e0d1fe14.patch",
256-
"@metamask/nonce-tracker@npm:^5.0.0": "patch:@metamask/nonce-tracker@npm%3A5.0.0#~/.yarn/patches/@metamask-nonce-tracker-npm-5.0.0-d81478218e.patch"
256+
"@metamask/nonce-tracker@npm:^5.0.0": "patch:@metamask/nonce-tracker@npm%3A5.0.0#~/.yarn/patches/@metamask-nonce-tracker-npm-5.0.0-d81478218e.patch",
257+
"@metamask/snaps-utils@npm:^7.7.0": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch",
258+
"@metamask/snaps-utils@npm:^7.4.0": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch",
259+
"@metamask/snaps-utils@npm:^7.5.0": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch"
257260
},
258261
"dependencies": {
259262
"@babel/runtime": "patch:@babel/runtime@npm%3A7.24.0#~/.yarn/patches/@babel-runtime-npm-7.24.0-7eb1dd11a2.patch",
@@ -340,7 +343,7 @@
340343
"@metamask/snaps-execution-environments": "^6.5.0",
341344
"@metamask/snaps-rpc-methods": "^9.1.4",
342345
"@metamask/snaps-sdk": "^6.0.0",
343-
"@metamask/snaps-utils": "^7.7.0",
346+
"@metamask/snaps-utils": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch",
344347
"@metamask/transaction-controller": "^32.0.0",
345348
"@metamask/user-operation-controller": "^10.0.0",
346349
"@metamask/utils": "^8.2.1",

‎yarn.lock‎

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6402,7 +6402,7 @@ __metadata:
64026402
languageName: node
64036403
linkType: hard
64046404

6405-
"@metamask/snaps-utils@npm:^7.4.0, @metamask/snaps-utils@npm:^7.5.0, @metamask/snaps-utils@npm:^7.7.0":
6405+
"@metamask/snaps-utils@npm:7.7.0":
64066406
version: 7.7.0
64076407
resolution: "@metamask/snaps-utils@npm:7.7.0"
64086408
dependencies:
@@ -6433,6 +6433,37 @@ __metadata:
64336433
languageName: node
64346434
linkType: hard
64356435

6436+
"@metamask/snaps-utils@patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch":
6437+
version: 7.7.0
6438+
resolution: "@metamask/snaps-utils@patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch::version=7.7.0&hash=5f2735"
6439+
dependencies:
6440+
"@babel/core": "npm:^7.23.2"
6441+
"@babel/types": "npm:^7.23.0"
6442+
"@metamask/base-controller": "npm:^6.0.0"
6443+
"@metamask/key-tree": "npm:^9.1.1"
6444+
"@metamask/permission-controller": "npm:^10.0.0"
6445+
"@metamask/rpc-errors": "npm:^6.2.1"
6446+
"@metamask/slip44": "npm:^3.1.0"
6447+
"@metamask/snaps-registry": "npm:^3.1.0"
6448+
"@metamask/snaps-sdk": "npm:^6.0.0"
6449+
"@metamask/utils": "npm:^8.3.0"
6450+
"@noble/hashes": "npm:^1.3.1"
6451+
"@scure/base": "npm:^1.1.1"
6452+
chalk: "npm:^4.1.2"
6453+
cron-parser: "npm:^4.5.0"
6454+
fast-deep-equal: "npm:^3.1.3"
6455+
fast-json-stable-stringify: "npm:^2.1.0"
6456+
fast-xml-parser: "npm:^4.3.4"
6457+
marked: "npm:^12.0.1"
6458+
rfdc: "npm:^1.3.0"
6459+
semver: "npm:^7.5.4"
6460+
ses: "npm:^1.1.0"
6461+
superstruct: "npm:^1.0.3"
6462+
validate-npm-package-name: "npm:^5.0.0"
6463+
checksum: 10/9ac16da1c2c1c7e2b857078ff4d9d450db8d5dbf650143ffc7953d2aea70fd58c87d1c1f2429a5a1c1418334d27e87d4a6a03089a55ba86840c417dfdb73b2fe
6464+
languageName: node
6465+
linkType: hard
6466+
64366467
"@metamask/swappable-obj-proxy@npm:^2.2.0":
64376468
version: 2.2.0
64386469
resolution: "@metamask/swappable-obj-proxy@npm:2.2.0"
@@ -25254,7 +25285,7 @@ __metadata:
2525425285
"@metamask/snaps-execution-environments": "npm:^6.5.0"
2525525286
"@metamask/snaps-rpc-methods": "npm:^9.1.4"
2525625287
"@metamask/snaps-sdk": "npm:^6.0.0"
25257-
"@metamask/snaps-utils": "npm:^7.7.0"
25288+
"@metamask/snaps-utils": "patch:@metamask/snaps-utils@npm%3A7.7.0#~/.yarn/patches/@metamask-snaps-utils-npm-7.7.0-2cc1f044af.patch"
2525825289
"@metamask/test-bundler": "npm:^1.0.0"
2525925290
"@metamask/test-dapp": "npm:^8.4.0"
2526025291
"@metamask/transaction-controller": "npm:^32.0.0"

0 commit comments

Comments
 (0)