MetaMask / MetaMask/api-playground
Prevent addresses from being added to the URLs
- Dominant language
- TypeScript
- Stars
- 7
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
Though the playground isn't intended for use with sensitive information, we should still avoid including addresses in URLs to avoid any privacy risks.
The recent addition of analytics that are including URLs in the event parameters exacerbates this risk so it should be prioritized.
Here's an example of what's being passed when there are params included in the URL (there is some masking but that is from a third-party UI and doesn't mean they don't have the full address in their system):
```
analytics.page({
path: '/wallet/reference/wallet_requestpermissions/',
referrer: '',
search: '?requestPermissionsObject[eth_accounts][account]=0***',
title: 'MetaMask developer documentation',
url: 'https://docs.metamask.io/wallet/reference/wallet_requestpermissions/?requestPermissionsObject[eth_accounts][account]=0***'
});
```
At the same time, we want to balance privacy against the developer experience.
@BelfordZ recommends adding a "Copy" button to allow developers to save their input data from the playground in case they need it again later.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the analytics.page payload shown in the issue from the playground, then trace how input parameters become URL search data. Review the privacy concern alongside the proposed Copy button and define the desired behavior before implementation. Done means addresses are not exposed through URLs or analytics while developers can still preserve their input.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100