release: 7.61.4 #24221
release: 7.61.4 #24221
Conversation
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Caution MetaMask internal reviewing guidelines:
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
metamaskbot
added
the
release-7.61.4
<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->
## **Description**
Dapp connection implementaion robustness
<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->
## **Changelog**
<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`
If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`
(This helps the Release Engineer do their job more quickly and
accurately)
-->
CHANGELOG entry:
## **Related issues**
Fixes:
## **Manual testing steps**
```gherkin
Feature: my feature name
Scenario: user [verb for user action]
Given [describe expected initial app state]
When user [verb for user action]
Then [describe expected outcome]
```
## **Screenshots/Recordings**
<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->
### **Before**
<!-- [screenshots/recordings] -->
### **After**
<!-- [screenshots/recordings] -->
## **Pre-merge author checklist**
- [ ] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [ ] I've completed the PR template to the best of my ability
- [ ] I’ve included tests if applicable
- [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [ ] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.
## **Pre-merge reviewer checklist**
- [ ] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [ ] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> Strengthens origin validation to prevent external dapps from using
internal MetaMask origins.
>
> - Enforces `INTERNAL_ORIGINS` checks and throws
`rpcErrors.invalidParams` in `eth_sendTransaction`, SDK deeplink
`processDappRpcRequest`, SDK `setupBridge`, SDKConnectV2
`handleConnectDeeplink`, WC2 `onSessionProposal`, and WC2 session
`handleSendTransaction`.
> - Normalizes use of origin/hostname where needed and persists origin
metadata for UI as before.
> - Updates WC2 tests: stubs `rejectSession` to resolve, adds
comprehensive origin-rejection cases (blocks plain `metamask`, allows
valid URLs including subdomains and `metamask.io`).
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
bd6a404. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| shouldShowTronReviewButton && renderReviewButton(isReviewButtonDisabled) | ||
| ///: END:ONLY_INCLUDE_IF | ||
| } | ||
| {!isTronEnabled && renderReviewButton(isReviewButtonDisabled)} |
There was a problem hiding this comment.
TRON variables used outside conditional build blocks
The variables isTronEnabled, isTronNative, and isTronStakeValidating are defined only within ONLY_INCLUDE_IF(tron) blocks but are accessed outside those blocks. In non-TRON builds, these variables would not exist, causing ReferenceErrors. The code correctly creates fallback variables like showTronStakingUI with default values, but then inconsistently uses the raw TRON-only variables directly in the quickAmounts useMemo, onRightActionPress callback, isReviewButtonDisabled calculation, and JSX conditionals. The condition {!isTronEnabled && renderReviewButton(...)} at line 1075 would crash in non-TRON builds instead of rendering the button.
Additional Locations (2)
metamaskbot
dismissed stale reviews from Cal-L and weitingsun
The merge-base changed after approval.
🔍 Smart E2E Test Selection
click to see 🤖 AI reasoning detailsThis PR implements a critical security fix that adds origin validation to prevent external connections from impersonating internal MetaMask origins. The changes span multiple critical areas:
The risk level is HIGH because:
Confidence is 90% because:
|
| if ( | ||
| INTERNAL_ORIGINS.includes(originatorInfo.url) || | ||
| INTERNAL_ORIGINS.includes(originatorInfo.title) | ||
| ) { |
There was a problem hiding this comment.
Missing truthiness guards may block legitimate connections
The new INTERNAL_ORIGINS.includes() check lacks truthiness guards, unlike the existing check at lines 29-34. The INTERNAL_ORIGINS array contains process.env.MM_FOX_CODE, which may be undefined in some environments. If originatorInfo.url or originatorInfo.title is also undefined (possible since these come from external SDK types with optional fields), then INTERNAL_ORIGINS.includes(undefined) would return true, incorrectly blocking legitimate connections. The check should follow the same pattern as lines 29-34 by adding truthiness guards like originatorInfo.url && INTERNAL_ORIGINS.includes(originatorInfo.url).
|
🚀 v7.61.4 Testing & Release Quality Process
Hi Team,
As part of our new MetaMask Release Quality Process, here’s a quick overview of the key processes, testing strategies, and milestones to ensure a smooth and high-quality deployment.
📋 Key Processes
Testing Strategy
Conduct regression and exploratory testing for your functional areas, including automated and manual tests for critical workflows.
Focus on exploratory testing across the wallet, prioritize high-impact areas, and triage any Sentry errors found during testing.
Validate new functionalities and provide feedback to support release monitoring.
GitHub Signoff
Issue Resolution
Cherry-Picking Criteria
🗓️ Timeline and Milestones
✅ Signoff Checklist
Each team is responsible for signing off via GitHub. Use the checkbox below to track signoff completion:
Team sign-off checklist
This process is a major step forward in ensuring release stability and quality. Let’s stay aligned and make this release a success! 🚀
Feel free to reach out if you have questions or need clarification.
Many thanks in advance
Reference
Note
Security hardening
INTERNAL_ORIGINSvalidation to reject external use of internal origins ineth_sendTransaction, SDK Deeplink protocol, SDK bridge setup, SDKConnectV2 connection registry, and WalletConnect (session proposal andeth_sendTransaction).Release/versioning
7.61.4and build/code to3335across Androidbuild.gradle, iOS project settings, Bitrise variables, andpackage.json.Written by Cursor Bugbot for commit 222b538. This will update automatically on new commits. Configure here.