TheDude
/
ciphermask
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
A Metamask fork with Infura removed and default networks editable
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
15042 Commits
2 Branches
1 Tag
200 MiB
Tag: Branch: Tree: dcfe80c255
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from 'dcfe80c255'
${ noResults }
ciphermask/test/e2e/mock-page-with-disallowed-i.../index.html

21 lines
636 B
Raw Normal View History Unescape

Use externally hosted phishing warning page An externally hosted phishing warning page is now used rather than the built-in phishing warning page.The phishing page warning URL is set via configuration file or environment variable. The default URL is either the expected production URL or `http://localhost:9999/` for e2e testing environments. The new external phishing page includes a design change when it is loaded within an iframe. In that case it now shows a condensed message, and prompts the user to open the full warning page in a new tab to see more details or bypass the warning. This is to prevent a clickjacking attack from safelisting a site without user consent. The new external phishing page also includes a simple caching service worker to ensure it continues to work offline (or if our hosting goes offline), as long as the user has successfully loaded the page at least once. We also load the page temporarily during the extension startup process to trigger the service worker installation. The old phishing page and all related lines have been removed. The property `web_accessible_resources` has also been removed from the manifest. The only entry apart from the phishing page was `inpage.js`, and we don't need that to be web accessible anymore because we inject the script inline into each page rather than loading the file directly. New e2e tests have been added to cover more phishing warning page functionality, including the "safelist" action and the "iframe" case.
3 years ago
<!doctype html>
<html lang="en">
<head>
<title>Mock E2E Phishing Page</title>
</head>
<script type="text/javascript">
function setIframeSource() {
const urlSearchParams = new URLSearchParams(window.location.search);
const params = Object.fromEntries(urlSearchParams.entries());
Fix e2e tests The e2e tests have been updated for `@metamask/phishing-warning@1.1.0`. The iframe case was updated with a new design, which required test changes. The third test that was meant to ensure the phishing page can't redirect to an extension page has been updated to navigate directly to the phishing warning page and setting the URL manually via query parameters, as that was the only way to test that redirect.
3 years ago
const extensionUrl = new URL(params.extensionUrl);
document.getElementById('frame').src = `http://localhost:9999/#hostname=${encodeURIComponent(extensionUrl.hostname)}&href=${encodeURIComponent(extensionUrl.href)}`;
Use externally hosted phishing warning page An externally hosted phishing warning page is now used rather than the built-in phishing warning page.The phishing page warning URL is set via configuration file or environment variable. The default URL is either the expected production URL or `http://localhost:9999/` for e2e testing environments. The new external phishing page includes a design change when it is loaded within an iframe. In that case it now shows a condensed message, and prompts the user to open the full warning page in a new tab to see more details or bypass the warning. This is to prevent a clickjacking attack from safelisting a site without user consent. The new external phishing page also includes a simple caching service worker to ensure it continues to work offline (or if our hosting goes offline), as long as the user has successfully loaded the page at least once. We also load the page temporarily during the extension startup process to trigger the service worker installation. The old phishing page and all related lines have been removed. The property `web_accessible_resources` has also been removed from the manifest. The only entry apart from the phishing page was `inpage.js`, and we don't need that to be web accessible anymore because we inject the script inline into each page rather than loading the file directly. New e2e tests have been added to cover more phishing warning page functionality, including the "safelist" action and the "iframe" case.
3 years ago
}
window.onload = setIframeSource;
</script>
<body>
<div>Hello</div>
<iframe id="frame" width=900 height=900>
</body>
Fix e2e tests The e2e tests have been updated for `@metamask/phishing-warning@1.1.0`. The iframe case was updated with a new design, which required test changes. The third test that was meant to ensure the phishing page can't redirect to an extension page has been updated to navigate directly to the phishing warning page and setting the URL manually via query parameters, as that was the only way to test that redirect.
3 years ago
</html>