MetaMask / MetaMask/metamask-extension
[Bug]: IPFS ENS - When pasting an ENS domain in the address bar, I'm redirected to that domain without my consent (without pressing the ENTER key)
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
### Describe the bug
When pasting an ENS domain in the address bar, I'm redirected to that domain without pressing ENTER key. This behaviour is different from when you paste a regular address in the browser address bar, where nothing happens until you press ENTER. This seems a security degradation when using ENS domains vs regular browser domains, where you do need to press ENTER after pasting any address.
Note: not sure which team owns the ENS browser resolution, so I've assigned it to the Platform team, but feel free to re-assign
### Expected behavior
We need explicit user consent to resolve the address, so we should wait until the ENTER key is press, instead of resolving right after pasting an ENS domain in the browser navigation bar.
### Screenshots/Recordings
https://github.com/user-attachments/assets/16fc27f0-a9f2-4197-afa6-663ea1efec53
### Steps to reproduce
1. Make sure you have the ENS resolution enabled from settings
2. Select Mainnet
3. Open a new browser tab
4. Paste this `https://metamask.eth`
5. Without pressing enter, see how you are already redirected to the ens page
### Error messages or log output
```shell
```
### Detection stage
In production (default)
### Version
12.9.0
### Build type
None
### Browser
Chrome
### Operating system
Linux
### Hardware wallet
_No response_
### Additional context
_No response_
### Severity
_No response_
Contributor guide
Research direction
Start by tracing the ENS resolution path triggered from the browser navigation bar and compare it with the regular address-paste flow. Reproduce the steps with ENS resolution enabled, then verify that pasting an ENS domain does not navigate until ENTER is pressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100