chore: connection updates and improvements

[sethkfman]

Description

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Adds origin validation to block connections/sessions when origin/title/url equals metamask, with comprehensive tests and WalletConnect handling.

• Security/Validation:
  • SDK Deeplink (DeeplinkProtocolService.ts): In setupBridge, reject clients whose originatorInfo.url or title equals ORIGIN_METAMASK.
  • SDKConnect Handler (handlers/setupBridge.ts): Same exact-match rejection before creating BackgroundBridge.
  • SDKConnectV2 (services/connection-registry.ts): In handleConnectDeeplink, block requests when metadata.dapp.url or name equals ORIGIN_METAMASK.
  • WalletConnect V2 (WalletConnectV2.ts):
    • Skip initializing sessions with peer.metadata.url === ORIGIN_METAMASK.
    • Reject session proposals whose metadata.url equals ORIGIN_METAMASK.
• Tests:
  • Add unit tests covering rejection on exact metamask origin and allowing valid URLs/substrings in: DeeplinkProtocolService.test.ts, handlers/setupBridge.test.ts, services/connection-registry.test.ts, and WalletConnectV2.test.ts.
  • Minor import updates to include ORIGIN_METAMASK where needed.

^{Written by Cursor Bugbot for commit bc90da8. This will update automatically on new commits. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.