From c2a6b9da80c31a45d342354fcfc073b4437a8c6f Mon Sep 17 00:00:00 2001
From: Erik Marks <rekmarks@protonmail.com>
Date: Fri, 29 May 2020 09:26:23 -0700
Subject: [PATCH] don't add permissions middleware to trusted connections

---
 app/scripts/metamask-controller.js                    | 11 +++++++----
 .../permissions/permissions-controller-test.js        |  6 ++++--
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/app/scripts/metamask-controller.js b/app/scripts/metamask-controller.js
index 6fb68b182221..cf77ef7ca61c 100644
--- a/app/scripts/metamask-controller.js
+++ b/app/scripts/metamask-controller.js
@@ -1548,7 +1548,7 @@ export default class MetamaskController extends EventEmitter {
       tabId = sender.tab.id
     }
 
-    const engine = this.setupProviderEngine({ origin, location: sender.url, extensionId, tabId })
+    const engine = this.setupProviderEngine({ origin, location: sender.url, extensionId, tabId, isInternal })
 
     // setup connection
     const providerStream = createEngineStream({ engine })
@@ -1581,8 +1581,9 @@ export default class MetamaskController extends EventEmitter {
    * @param {string} options.location - The full URL of the sender
    * @param {extensionId} [options.extensionId] - The extension ID of the sender, if the sender is an external extension
    * @param {tabId} [options.tabId] - The tab ID of the sender - if the sender is within a tab
+   * @param {boolean} [options.isInternal] - True if called for a connection to an internal process
    **/
-  setupProviderEngine ({ origin, location, extensionId, tabId }) {
+  setupProviderEngine ({ origin, location, extensionId, tabId, isInternal = false }) {
     // setup json rpc engine stack
     const engine = new RpcEngine()
     const provider = this.provider
@@ -1610,8 +1611,10 @@ export default class MetamaskController extends EventEmitter {
     // filter and subscription polyfills
     engine.push(filterMiddleware)
     engine.push(subscriptionManager.middleware)
-    // permissions
-    engine.push(this.permissionsController.createMiddleware({ origin, extensionId }))
+    if (!isInternal) {
+      // permissions
+      engine.push(this.permissionsController.createMiddleware({ origin, extensionId }))
+    }
     // watch asset
     engine.push(this.preferencesController.requestWatchAsset.bind(this.preferencesController))
     // forward to metamask primary provider
diff --git a/test/unit/app/controllers/permissions/permissions-controller-test.js b/test/unit/app/controllers/permissions/permissions-controller-test.js
index 2d1de463014a..c8eae15c9ce8 100644
--- a/test/unit/app/controllers/permissions/permissions-controller-test.js
+++ b/test/unit/app/controllers/permissions/permissions-controller-test.js
@@ -102,8 +102,10 @@ describe('permissions controller', function () {
       assert.deepEqual(cAccounts, [], 'origin should have no accounts')
     })
 
-    it('does not handle "MetaMask" origin as special case', async function () {
-      const metamaskAccounts = await permController.getAccounts('MetaMask')
+    it('does not handle "MetaMask" or "metamask" origins as special cases', async function () {
+      let metamaskAccounts = await permController.getAccounts('MetaMask')
+      assert.deepEqual(metamaskAccounts, [], 'origin should have no accounts')
+      metamaskAccounts = await permController.getAccounts('metamask')
       assert.deepEqual(metamaskAccounts, [], 'origin should have no accounts')
     })
   })