release: 7.61.4

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.61.4]
+
+### Fixed
+
+- chore: robust implementation dapp connection ([#24222](https://github.com/MetaMask/metamask-mobile/pull/24222))
+
 ## [7.61.3]
 
 ### Fixed
@@ -9661,7 +9667,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - [#957](https://github.com/MetaMask/metamask-mobile/pull/957): fix timeouts (#957)
 - [#954](https://github.com/MetaMask/metamask-mobile/pull/954): Bugfix: onboarding navigation (#954)
 
-[Unreleased]: https://github.com/MetaMask/metamask-mobile/compare/v7.61.3...HEAD
+[Unreleased]: https://github.com/MetaMask/metamask-mobile/compare/v7.61.4...HEAD
+[7.61.4]: https://github.com/MetaMask/metamask-mobile/compare/v7.61.3...v7.61.4
 [7.61.3]: https://github.com/MetaMask/metamask-mobile/compare/v7.61.2...v7.61.3
 [7.61.2]: https://github.com/MetaMask/metamask-mobile/compare/v7.61.1...v7.61.2
 [7.61.1]: https://github.com/MetaMask/metamask-mobile/compare/v7.61.0...v7.61.1

android/app/build.gradle

@@ -187,8 +187,8 @@ android {
         applicationId "io.metamask"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionName "7.61.3"
-        versionCode 3327
+        versionName "7.61.4"
+        versionCode 3335
         testBuildType System.getProperty('testBuildType', 'debug')
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         manifestPlaceholders.MM_BRANCH_KEY_TEST = "$System.env.MM_BRANCH_KEY_TEST"

app/core/RPCMethods/eth_sendTransaction.ts

@@ -13,6 +13,7 @@ import { rpcErrors } from '@metamask/rpc-errors';
 import ppomUtil, { PPOMRequest } from '../../lib/ppom/ppom-util';
 import { updateConfirmationMetric } from '../redux/slices/confirmationMetrics';
 import { store } from '../../store';
+import { INTERNAL_ORIGINS } from '../../constants/transaction';
 
 /**
  * A JavaScript object that is not `null`, a function, or an array.
@@ -112,6 +113,12 @@ async function eth_sendTransaction({
     from: req.params[0].from,
     chainId: nChainId,
   });
+  // Prevent external transactions from using internal origins
+  if (INTERNAL_ORIGINS.includes(hostname)) {
+    throw rpcErrors.invalidParams({
+      message: 'External transactions cannot use internal origins',
+    });
+  }
 
   const { result, transactionMeta } = await sendTransaction(req.params[0], {
     deviceConfirmedOn: WalletDevice.MM_MOBILE,

app/core/SDKConnect/SDKDeeplinkProtocol/DeeplinkProtocolService.ts

@@ -35,6 +35,8 @@ import {
   getDefaultCaip25CaveatValue,
   getPermittedAccounts,
 } from '../../Permissions';
+import { INTERNAL_ORIGINS } from '../../../constants/transaction';
+import { rpcErrors } from '@metamask/rpc-errors';
 import { areAddressesEqual, toFormattedAddress } from '../../../util/address';
 
 export default class DeeplinkProtocolService {
@@ -492,7 +494,6 @@ export default class DeeplinkProtocolService {
 
       return;
     }
-
     await SDKConnect.getInstance().addDappConnection({
       id: clientInfo.clientId,
       lastAuthorized: Date.now(),
@@ -533,6 +534,16 @@ export default class DeeplinkProtocolService {
       params: any;
     };
 
+    // Prevent external transactions from using internal origins
+    // This is an external connection (SDK), so block any internal origin
+    if (requestObject.method === 'eth_sendTransaction') {
+      if (INTERNAL_ORIGINS.includes(params.url)) {
+        throw rpcErrors.invalidParams({
+          message: 'External transactions cannot use internal origins',
+        });
+      }
+    }
+
     // Handle custom rpc method
     const processedRpc = await handleCustomRpcCalls({
       batchRPCManager: this.batchRPCManager,

app/core/SDKConnect/handlers/setupBridge.ts

@@ -11,6 +11,8 @@ import { Connection } from '../Connection';
 import DevLogger from '../utils/DevLogger';
 import handleSendMessage from './handleSendMessage';
 import { ImageSourcePropType } from 'react-native';
+import { INTERNAL_ORIGINS } from '../../../constants/transaction';
+import { rpcErrors } from '@metamask/rpc-errors';
 
 export const setupBridge = ({
   originatorInfo,
@@ -55,6 +57,16 @@ export const setupBridge = ({
       DevLogger.log(
         `getRpcMethodMiddleware origin=${connection.origin} url=${originatorInfo.url} `,
       );
+      // Prevent external connections from using internal origins
+      // This is an external connection (SDK), so block any internal origin
+      if (
+        INTERNAL_ORIGINS.includes(originatorInfo.url) ||
+        INTERNAL_ORIGINS.includes(originatorInfo.title)
+      ) {
+        throw rpcErrors.invalidParams({
+          message: 'External transactions cannot use internal origins',
+        });
+      }
       return getRpcMethodMiddleware({
         hostname: connection.origin,
         channelId: connection.channelId,

app/core/SDKConnectV2/services/connection-registry.ts

@@ -15,7 +15,8 @@ import logger from './logger';
 import { ACTIONS, PREFIXES } from '../../../constants/deeplinks';
 import { decompressPayloadB64 } from '../utils/compression-utils';
 import { whenStoreReady } from '../utils/when-store-ready';
-import { ORIGIN_METAMASK } from '@metamask/controller-utils';
+import { rpcErrors } from '@metamask/rpc-errors';
+import { INTERNAL_ORIGINS } from '../../../constants/transaction';
 
 /**
  * The ConnectionRegistry is the central service responsible for managing the
@@ -111,15 +112,18 @@ export class ConnectionRegistry {
 
     try {
       const connReq = this.parseConnectionRequest(url);
+      // Prevent external connections from using internal origins
+      // This is an external connection (SDK V2), so block any internal origin
       if (
-        (connReq.metadata.dapp.url &&
-          connReq.metadata.dapp.url === ORIGIN_METAMASK) ||
-        (connReq.metadata.dapp.name &&
-          connReq.metadata.dapp.name === ORIGIN_METAMASK)
+        INTERNAL_ORIGINS.includes(connReq.metadata.dapp.url) ||
+        INTERNAL_ORIGINS.includes(connReq.metadata.dapp.name)
       ) {
-        throw new Error('Connections from metamask origin are not allowed');
+        throw rpcErrors.invalidParams({
+          message: 'External transactions cannot use internal origins',
+        });
       }
       connInfo = this.toConnectionInfo(connReq);
+
       this.hostapp.showConnectionLoading(connInfo);
       conn = await Connection.create(
         connInfo,

app/core/WalletConnect/WalletConnect2Session.ts

@@ -18,6 +18,7 @@ import { addTransaction } from '../../util/transaction-controller';
 import BackgroundBridge from '../BackgroundBridge/BackgroundBridge';
 import { Minimizer } from '../NativeModules';
 import { getPermittedAccounts, getPermittedChains } from '../Permissions';
+import { INTERNAL_ORIGINS } from '../../constants/transaction';
 import getRpcMethodMiddleware, {
   getRpcMethodMiddlewareHooks,
 } from '../RPCMethods/RPCMethodMiddleware';
@@ -754,6 +755,14 @@ class WalletConnect2Session {
     origin: string,
   ) {
     try {
+      // Prevent external transactions from using internal origins
+      // This is an external connection (WalletConnect), so block any internal origin
+      if (INTERNAL_ORIGINS.includes(origin)) {
+        throw rpcErrors.invalidParams({
+          message: 'External transactions cannot use internal origins',
+        });
+      }
+
       const networkClientId = getNetworkClientIdForCaipChainId(caip2ChainId);
       const trx = await addTransaction(methodParams[0], {
         deviceConfirmedOn: WalletDevice.MM_MOBILE,

app/core/WalletConnect/WalletConnectV2.test.ts

@@ -1446,21 +1446,23 @@ describe('WC2Manager', () => {
     });
   });
 
-  describe.skip('Origin Rejection', () => {
+  describe('Origin Rejection', () => {
     let rejectSessionSpy: jest.SpyInstance;
 
     beforeEach(() => {
       const web3Wallet = (manager as unknown as { web3Wallet: IWalletKit })
         .web3Wallet;
-      rejectSessionSpy = jest.spyOn(web3Wallet, 'rejectSession');
+      rejectSessionSpy = jest
+        .spyOn(web3Wallet, 'rejectSession')
+        .mockResolvedValue(undefined);
     });
 
     it('should reject session proposal with "metamask" origin', async () => {
       const proposal = {
         id: 999,
         params: {
           id: 999,
-          pairingTopic: 'test-pairing',
+          pairingTopic: 'test-pairing-999',
           proposer: {
             publicKey: 'test-public-key',
             metadata: {
@@ -1470,16 +1472,16 @@ describe('WC2Manager', () => {
               icons: [],
             },
           },
-          requiredNamespaces: {},
-          optionalNamespaces: {},
           expiryTimestamp: Date.now() + 300000,
           relays: [{ protocol: 'irn' }],
+          requiredNamespaces: {},
+          optionalNamespaces: {},
         },
         verifyContext: {
           verified: {
-            verifyUrl: 'https://example.com',
+            verifyUrl: 'metamask',
             validation: 'VALID' as const,
-            origin: 'https://example.com',
+            origin: 'metamask',
           },
         },
       };
@@ -1502,7 +1504,7 @@ describe('WC2Manager', () => {
         id: 997,
         params: {
           id: 997,
-          pairingTopic: 'test-pairing',
+          pairingTopic: 'test-pairing-997',
           proposer: {
             publicKey: 'test-public-key',
             metadata: {
@@ -1512,6 +1514,8 @@ describe('WC2Manager', () => {
               icons: [],
             },
           },
+          expiryTimestamp: Date.now() + 300000,
+          relays: [{ protocol: 'irn' }],
           requiredNamespaces: {
             eip155: {
               chains: ['eip155:1'],
@@ -1520,14 +1524,12 @@ describe('WC2Manager', () => {
             },
           },
           optionalNamespaces: {},
-          expiryTimestamp: Date.now() + 300000,
-          relays: [{ protocol: 'irn' }],
         },
         verifyContext: {
           verified: {
-            verifyUrl: 'https://example.com',
+            verifyUrl: 'https://metamask.example.com',
             validation: 'VALID' as const,
-            origin: 'https://example.com',
+            origin: 'https://metamask.example.com',
           },
         },
       };
@@ -1550,7 +1552,7 @@ describe('WC2Manager', () => {
         id: 996,
         params: {
           id: 996,
-          pairingTopic: 'test-pairing',
+          pairingTopic: 'test-pairing-996',
           proposer: {
             publicKey: 'test-public-key',
             metadata: {
@@ -1560,6 +1562,8 @@ describe('WC2Manager', () => {
               icons: [],
             },
           },
+          expiryTimestamp: Date.now() + 300000,
+          relays: [{ protocol: 'irn' }],
           requiredNamespaces: {
             eip155: {
               chains: ['eip155:1'],
@@ -1568,8 +1572,6 @@ describe('WC2Manager', () => {
             },
           },
           optionalNamespaces: {},
-          expiryTimestamp: Date.now() + 300000,
-          relays: [{ protocol: 'irn' }],
         },
         verifyContext: {
           verified: {
@@ -1598,7 +1600,7 @@ describe('WC2Manager', () => {
         id: 995,
         params: {
           id: 995,
-          pairingTopic: 'test-pairing',
+          pairingTopic: 'test-pairing-995',
           proposer: {
             publicKey: 'test-public-key',
             metadata: {
@@ -1608,6 +1610,8 @@ describe('WC2Manager', () => {
               icons: [],
             },
           },
+          expiryTimestamp: Date.now() + 300000,
+          relays: [{ protocol: 'irn' }],
           requiredNamespaces: {
             eip155: {
               chains: ['eip155:1'],
@@ -1616,14 +1620,12 @@ describe('WC2Manager', () => {
             },
           },
           optionalNamespaces: {},
-          expiryTimestamp: Date.now() + 300000,
-          relays: [{ protocol: 'irn' }],
         },
         verifyContext: {
           verified: {
-            verifyUrl: 'https://example.com',
+            verifyUrl: 'https://metamask.io',
             validation: 'VALID' as const,
-            origin: 'https://example.com',
+            origin: 'https://metamask.io',
           },
         },
       };

app/core/WalletConnect/WalletConnectV2.ts

@@ -10,6 +10,7 @@ import { IWalletKit, WalletKit, WalletKitTypes } from '@reown/walletkit';
 import { Core } from '@walletconnect/core';
 import { SessionTypes } from '@walletconnect/types';
 import { getSdkError } from '@walletconnect/utils';
+import { rpcErrors } from '@metamask/rpc-errors';
 
 import { updateWC2Metadata } from '../../../app/actions/sdk';
 import { selectEvmChainId } from '../../selectors/networkController';
@@ -23,6 +24,7 @@ import {
   getPermittedAccounts,
   updatePermittedChains,
 } from '../Permissions';
+import { INTERNAL_ORIGINS } from '../../constants/transaction';
 import DevLogger from '../SDKConnect/utils/DevLogger';
 import getAllUrlParams from '../SDKConnect/utils/getAllUrlParams.util';
 import { wait, waitForKeychainUnlocked } from '../SDKConnect/utils/wait.util';
@@ -468,6 +470,18 @@ export class WC2Manager {
     const walletChainIdDecimal = parseInt(walletChainIdHex, 16);
 
     try {
+      // Prevent external connections from using internal origins
+      // This is an external connection (WalletConnect), so block any internal origin
+      if (INTERNAL_ORIGINS.includes(origin)) {
+        await this.web3Wallet.rejectSession({
+          id: proposal.id,
+          reason: getSdkError('USER_REJECTED_METHODS'),
+        });
+        throw rpcErrors.invalidParams({
+          message: 'External transactions cannot use internal origins',
+        });
+      }
+
       // Create a modified CAIP-25 caveat value that includes the current chain
       const caveatValue = getDefaultCaip25CaveatValue();
 

bitrise.yml

@@ -3574,16 +3574,16 @@ app:
       PROJECT_LOCATION_IOS: ios
     - opts:
         is_expand: false
-      VERSION_NAME: 7.61.3
+      VERSION_NAME: 7.61.4
     - opts:
         is_expand: false
-      VERSION_NUMBER: 3327
+      VERSION_NUMBER: 3335
     - opts:
         is_expand: false
-      FLASK_VERSION_NAME: 7.61.3
+      FLASK_VERSION_NAME: 7.61.4
     - opts:
         is_expand: false
-      FLASK_VERSION_NUMBER: 3327
+      FLASK_VERSION_NUMBER: 3335
     - opts:
         is_expand: false
       ANDROID_APK_LINK: ''