MetaMask / MetaMask/metamask-extension

[Bug]: Announcements - Wallet crashes with invalid API response from API `https://cdn.contentful.com`

Open
#43,953 0 comments 0 reactions 0 assignees View on GitHub
needs-triage regression-prod-13.37.0 Sev2-normal type-bug
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

### Describe the bug

The wallet doesn't validate the API response from cdn.contentful causing the wallet to break if non string is passed in headline (ie object)

### Expected behavior

Ensure wallet handles properly an unexpected response without crashing

### Screenshots/Recordings

https://github.com/user-attachments/assets/fce94d51-48fb-4580-b4d0-c01bcbdcd524

### Steps to reproduce

1. Setup a proxy
2. Setup a rule to intercep this request:
` https://cdn.contentful.com/spaces/{SPACE_ID}/environments/master/entries?access_token=...&content_type=promotionalBanner&fields.showInExtension=true` -- you can check your id and access token in the network inspector

Send this response back

```
{
"items": [
{
"sys": { "id": "evilbanner1" },
"fields": {
"headline": { "x": "not-a-string" },
"teaser": "Check out this feature",
"image": { "sys": { "id": "img1" } },
"linkUrl": "https://metamask.io",
"undismissable": false,
"showInExtension": true
}
}
],
"includes": {
"Asset": [
{
"sys": { "id": "img1" },
"fields": { "file": { "url": "//images.ctfassets.net/x/banner.png" } }
}
]
}
}
```

3. Open the wallet
4. See wallet breaks

### Error messages or log output

```shell

```

### Where was this bug found?

Live version (from official store)

### Version

13.37.0

### Build type

None

### Browser

Chrome

### Operating system

MacOS

### Hardware wallet

_No response_

### Additional context

_No response_

### Severity

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by tracing the announcements request to cdn.contentful.com and the wallet code that renders promotional banners. Reproduce the issue with the provided malformed headline response, then ensure the wallet handles that unexpected response without crashing and verify the normal announcement flow still works.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.