Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: update phishing controller version #28131

Merged
merged 5 commits into from
Oct 28, 2024

Conversation

AugmentedMode
Copy link
Contributor

@AugmentedMode AugmentedMode commented Oct 28, 2024

Description

Please view the attached issue within MetaMask planning for details regarding this PR

Open in GitHub Codespaces

Related issues

Fixes: Please view the attached issue within MetaMask planning for details regarding this PR

Manual testing steps

  1. Go to a website known to be on the C2 domain blocklist. For now we made our test website https://develop.d3bkcslj57l47p.amplifyapp.com/ have a malicious C2 Request that is on our blocklist.
  2. Attempt to interact with the site.
  3. Verify that on visiting the website you get redirected to the Metamask phishing page.
  4. Repeat with a site that is not on the blocklist to confirm normal operation.

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@AugmentedMode AugmentedMode requested a review from a team as a code owner October 28, 2024 17:35
Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@github-actions github-actions bot added the team-product-safety Push issues to Product Safety team label Oct 28, 2024
@AugmentedMode AugmentedMode self-assigned this Oct 28, 2024
Copy link

socket-security bot commented Oct 28, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@metamask/phishing-controller@12.3.0 network +1 583 kB metamaskbot

🚮 Removed packages: npm/@metamask/phishing-controller@12.0.2

View full report↗︎

Copy link

socket-security bot commented Oct 28, 2024

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/@metamask/phishing-controller@12.3.0

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

@AugmentedMode
Copy link
Contributor Author

@metamaskbot update-policies

@AugmentedMode
Copy link
Contributor Author

@SocketSecurity ignore npm/@metamask/phishing-controller@12.3.0

cryptotavares
cryptotavares previously approved these changes Oct 28, 2024
@metamaskbot
Copy link
Collaborator

Policies updated.
👀 Please review the diff for suspicious new powers.

🧠 Learn how: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

@AugmentedMode AugmentedMode added this pull request to the merge queue Oct 28, 2024
Copy link
Member

@weizman weizman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

approving lavamoat policies specifically

@metamaskbot
Copy link
Collaborator

Builds ready [e983246]
Page Load Metrics (2042 ± 203 ms)
PlatformPageMetricMin (ms)Max (ms)Average (ms)StandardDeviation (ms)MarginOfError (ms)
ChromeHomefirstPaint180037502047419201
domContentLoaded178737222010421202
load179837622042424203
domInteractive19126552512
backgroundConnect8107293115
firstReactRender522101013215
getState468272311
initialActions01000
loadScripts129329241495355170
setupStore1179352311
uiStartup200542142277477229
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 3.09 KiB (0.07%)
  • ui: 0 Bytes (0.00%)
  • common: 284 Bytes (0.00%)

Merged via the queue into develop with commit 42e2aa4 Oct 28, 2024
76 checks passed
@AugmentedMode AugmentedMode deleted the feat/c2-domain-detection branch October 28, 2024 18:56
@github-actions github-actions bot locked and limited conversation to collaborators Oct 28, 2024
@metamaskbot metamaskbot added the release-12.7.0 Issue or pull request that will be included in release 12.7.0 label Oct 28, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
release-12.7.0 Issue or pull request that will be included in release 12.7.0 team-product-safety Push issues to Product Safety team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants