Skip to content

Conversation

@dawnseeker8
Copy link
Contributor

Cherry-pick of PR #23903 for issue #23903
No conflicts.

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The connection via QR code on Hardware wallet is not proceeding past
scanning the QR code. Functionality is working in the release version
v11.13.1.

After debuggin the code and discover that the issue is caused by Keyring
Controller upgraded to 13.0.0. and `#addQRKeyring` function have bug to
pass a empty accounts array as parameters to keyring, cause the Keystone
MetamaskKeyring default properties all are undefined during
deserialise() process.

This fix patch the `@metamask/keyring-controller` to remove the empty
array passed to KeyStone MetamaskKeyring so that all default properies
in keyring will remain the same.


<!--
Write a short description of the changes included in this pull request,
also include relevant motivation and context. Have in mind the following
questions:
1. What is the reason for the change?
2. What is the improvement/solution?
-->

[![Open in GitHub
Codespaces](https://github.com/codespaces/badge.svg)](https://codespaces.new/MetaMask/metamask-extension/pull/23903?quickstart=1)

## **Related issues**

Fixes: #23804 

## **Manual testing steps**

1. On your hardware wallet, fetch the QR code for MetaMask
2. Proceed to add hardware wallet from the account drop-down selector
3. Select QR-based and Continue
4. Scan the QR code from the hardware wallet
5. user should be able to select QR code account and imported


## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**

https://private-user-images.githubusercontent.com/120041701/318063954-da648f60-e044-4dd4-8e10-484f68dc4ee4.mov?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTI2MzkzNTQsIm5iZiI6MTcxMjYzOTA1NCwicGF0aCI6Ii8xMjAwNDE3MDEvMzE4MDYzOTU0LWRhNjQ4ZjYwLWUwNDQtNGRkNC04ZTEwLTQ4NGY2OGRjNGVlNC5tb3Y_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNDA5JTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDQwOVQwNTA0MTRaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT1iM2QzMDllNTliMzNhNTc5YjVjMDJiY2M3MjZjYWU2NGExNWQ5OWY1MzI3NjExZDc3OWZmOGJhOTk5ODBhZDJjJlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.visSNnKwa_VELXLKh5PBUgbuMvBqOKMDH-oieICU_UI

<!-- [screenshots/recordings] -->

### **After**


https://github.com/MetaMask/metamask-extension/assets/7315988/d4bd8765-499c-40b2-8429-117b58f61a9c



<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Coding
Standards](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-extension/blob/develop/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.

---------

Co-authored-by: MetaMask Bot <metamaskbot@users.noreply.github.com>
@dawnseeker8 dawnseeker8 added team-hardware-wallets-deprecated DEPRECATED: please use "team-accounts-framework" instead release-11.14.0 Issue or pull request that will be included in release 11.14.0 labels Apr 11, 2024
@dawnseeker8 dawnseeker8 requested a review from a team as a code owner April 11, 2024 16:54
@github-actions
Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the INVALID-PR-TEMPLATE PR's body doesn't match template label Apr 11, 2024
@socket-security
Copy link

socket-security bot commented Apr 11, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@npmcli/fs@2.1.2 filesystem +1 43.1 kB gar
npm/aproba@2.0.0 None 0 8.05 kB iarna
npm/cacache@16.1.3 filesystem +9 310 kB lukekarrys
npm/make-fetch-happen@10.2.1 environment, network +6 142 kB gar
npm/minipass-fetch@2.1.2 environment, network +2 177 kB gar
npm/nopt@6.0.0 environment 0 23.9 kB gar
npm/npmlog@6.0.2 None 0 17.1 kB lukekarrys
npm/socks@2.8.1 network +3 518 kB joshglazebrook
npm/ssri@9.0.1 None 0 37.5 kB nlf
npm/unique-filename@2.0.1 None +2 18 kB lukekarrys

🚮 Removed packages: npm/socks@2.8.3

View full report↗︎

@socket-security
Copy link

socket-security bot commented Apr 11, 2024

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package Note
New author npm/@npmcli/fs@2.1.2
Network access npm/make-fetch-happen@10.2.1
Network access npm/make-fetch-happen@10.2.1
Network access npm/make-fetch-happen@10.2.1
Network access npm/make-fetch-happen@10.2.1
New author npm/nopt@6.0.0
New author npm/npmlog@6.0.2
New author npm/unique-slug@3.0.0

View full report↗︎

Next steps

What is new author?

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/@npmcli/fs@2.1.2
  • @SocketSecurity ignore npm/make-fetch-happen@10.2.1
  • @SocketSecurity ignore npm/nopt@6.0.0
  • @SocketSecurity ignore npm/npmlog@6.0.2
  • @SocketSecurity ignore npm/unique-slug@3.0.0

@danjm danjm merged commit 779280f into Version-v11.14.0 Apr 12, 2024
@danjm danjm deleted the fix/cherry-pick-23804 branch April 12, 2024 09:26
@github-actions github-actions bot locked and limited conversation to collaborators Apr 12, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

INVALID-PR-TEMPLATE PR's body doesn't match template release-11.14.0 Issue or pull request that will be included in release 11.14.0 team-hardware-wallets-deprecated DEPRECATED: please use "team-accounts-framework" instead

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants