feat(lavamoat/lavadome): update integration to improve security #25653
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Builds ready [4f4ac15]
Page Load Metrics (525 ± 368 ms)
Bundle size diffs
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## develop #25653 +/- ##
========================================
Coverage 70.02% 70.02%
========================================
Files 1443 1443
Lines 50164 50164
Branches 14039 14039
========================================
Hits 35126 35126
Misses 15038 15038 ☔ View full report in Codecov by Sentry. |
weizman
changed the title
weizman
changed the title
weizman
changed the title
Builds ready [a5260d2]
Page Load Metrics (72 ± 10 ms)
Bundle size diffs
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Summary
Updated integration with LavaDome to enhance security by refining CSP and ensuring correct import order.
- Updated
app/manifest/v2/chrome.jsonto restrict font sources to'self'. - Updated
app/manifest/v3/chrome.jsonto align CSP with LavaDome's recommendations, restricting font sources to'self'. - Added import for
@lavamoat/lavadome-reactat the top ofapp/scripts/ui.jsto ensure secure execution order.
3 file(s) reviewed, no comment(s)
Edit PR Review Bot Settings
Builds ready [8c8e360]
Page Load Metrics (632 ± 480 ms)
Bundle size diffs
|
There was a problem hiding this comment.
PR Summary
(updates since last review)
The pull request focuses on enhancing security through improved LavaDome integration and various other updates.
- Removed
test-e2e-swap-playwrightjob in.circleci/config.yml, potentially streamlining CI/CD but removing swap functionality tests. - Added
trim()method todiffOutputin.circleci/scripts/git-diff-develop.tsfor cleaner diff results. - Removed 'sendAToken' message key across multiple localization files, ensure no references remain to avoid runtime errors.
- Updated
background.jsto improve LavaDome integration and add test-specific functionality. - Introduced
FakeKeyringBridgeinapp/scripts/lib/hardware-keyring-builder-factory.tsfor testing purposes, ensure it doesn't affect production code.
75 file(s) reviewed, no comment(s)
Edit PR Review Bot Settings
There was a problem hiding this comment.
PR Summary
(updates since last review)
The pull request focuses on enhancing security through improved LavaDome integration and various TypeScript conversions for better maintainability and type safety.
- Updated
lavamoat/browserify/mmi/policy.json: Modified policy to directly allow@metamask-institutional/typespackage. - Added
@metamask-institutional/typesdependency: Updatedpackage.jsonto include this new dependency. - Converted multiple files to TypeScript: Files under
ui/components/institutionalandui/pages/confirmationswere converted to TypeScript for improved type safety. - Removed
interactive-replacement-token-modal.js: This file was removed, indicating its functionality is no longer needed or has been moved. - Introduced
wrong-network-notificationcomponent: Added new files for this component, including stories and tests, to ensure proper integration and functionality.
46 file(s) reviewed, no comment(s)
Edit PR Review Bot Settings
|
Builds ready [6bdd808]
Page Load Metrics (509 ± 399 ms)
Bundle size diffs
|
|
6bdd808 passed successfully |
|
Builds ready [6338a91]
Page Load Metrics (1744 ± 91 ms)
Bundle size diffs
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Address concerns under Safe Usage: