MetaMask / MetaMask/metamask-extension

[Bug]: IPFS ENS - When pasting an ENS domain in the address bar, I'm redirected to that domain without my consent (without pressing the ENTER key)

Open
#29,183 1 comment 0 reactions 0 assignees View on GitHub
needs-reproduction regression-prod-12.9.0 Sev2-normal team-extension-platform type-bug type-security
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

### Describe the bug

When pasting an ENS domain in the address bar, I'm redirected to that domain without pressing ENTER key. This behaviour is different from when you paste a regular address in the browser address bar, where nothing happens until you press ENTER. This seems a security degradation when using ENS domains vs regular browser domains, where you do need to press ENTER after pasting any address.

Note: not sure which team owns the ENS browser resolution, so I've assigned it to the Platform team, but feel free to re-assign

### Expected behavior

We need explicit user consent to resolve the address, so we should wait until the ENTER key is press, instead of resolving right after pasting an ENS domain in the browser navigation bar.

### Screenshots/Recordings

https://github.com/user-attachments/assets/16fc27f0-a9f2-4197-afa6-663ea1efec53

### Steps to reproduce

1. Make sure you have the ENS resolution enabled from settings
2. Select Mainnet
3. Open a new browser tab
4. Paste this `https://metamask.eth`
5. Without pressing enter, see how you are already redirected to the ens page

### Error messages or log output

```shell

```

### Detection stage

In production (default)

### Version

12.9.0

### Build type

None

### Browser

Chrome

### Operating system

Linux

### Hardware wallet

_No response_

### Additional context

_No response_

### Severity

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing the ENS resolution path triggered from the browser navigation bar and compare it with the regular address-paste flow. Reproduce the steps with ENS resolution enabled, then verify that pasting an ENS domain does not navigate until ENTER is pressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.