MetaMask / MetaMask/metamask-extension
[Bug]: Announcements - Wallet crashes with invalid API response from API `https://cdn.contentful.com`
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
### Describe the bug
The wallet doesn't validate the API response from cdn.contentful causing the wallet to break if non string is passed in headline (ie object)
### Expected behavior
Ensure wallet handles properly an unexpected response without crashing
### Screenshots/Recordings
https://github.com/user-attachments/assets/fce94d51-48fb-4580-b4d0-c01bcbdcd524
### Steps to reproduce
1. Setup a proxy
2. Setup a rule to intercep this request:
` https://cdn.contentful.com/spaces/{SPACE_ID}/environments/master/entries?access_token=...&content_type=promotionalBanner&fields.showInExtension=true` -- you can check your id and access token in the network inspector
Send this response back
```
{
"items": [
{
"sys": { "id": "evilbanner1" },
"fields": {
"headline": { "x": "not-a-string" },
"teaser": "Check out this feature",
"image": { "sys": { "id": "img1" } },
"linkUrl": "https://metamask.io",
"undismissable": false,
"showInExtension": true
}
}
],
"includes": {
"Asset": [
{
"sys": { "id": "img1" },
"fields": { "file": { "url": "//images.ctfassets.net/x/banner.png" } }
}
]
}
}
```
3. Open the wallet
4. See wallet breaks
### Error messages or log output
```shell
```
### Where was this bug found?
Live version (from official store)
### Version
13.37.0
### Build type
None
### Browser
Chrome
### Operating system
MacOS
### Hardware wallet
_No response_
### Additional context
_No response_
### Severity
_No response_
Contributor guide
Research direction
Start by tracing the announcements request to cdn.contentful.com and the wallet code that renders promotional banners. Reproduce the issue with the provided malformed headline response, then ensure the wallet handles that unexpected response without crashing and verify the normal announcement flow still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 62/100