MetaMask / MetaMask/metamask-extension
[Bug]: Onramps - Wallet crashes with invalid API response `https://on-ramp-content.api.cx.metamask.io/`
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
### Describe the bug
The API response from `https://on-ramp-content.api.cx.metamask.io/regions/networks` is not sanitized/validated, meaning it can break the wallet if we get an unexpected response (ie not array).
### Expected behavior
Validate API response so the wallet doesn't break
### Screenshots/Recordings
https://github.com/user-attachments/assets/0bc38004-90dc-4348-a3d1-63a2496e98f1
### Steps to reproduce
1. Setup a proxy
2. Intercept this GET request and subpaths `https://on-ramp-content.api.cx.metamask.io/regions/networks`
3. Add this payload response
```
{
"networks": "not-an-array"
}
```
4. Reload wallet and go to Assets page
5. See wallet breaks
### Error messages or log output
```shell
```
### Where was this bug found?
Live version (from official store)
### Version
13.37.0
### Build type
None
### Browser
Chrome
### Operating system
MacOS
### Hardware wallet
_No response_
### Additional context
_No response_
### Severity
_No response_
Contributor guide
Research direction
Start by locating the code that requests https://on-ramp-content.api.cx.metamask.io/regions/networks and feeds its response to the Assets page. Reproduce the issue with {"networks":"not-an-array"}, then validate the response so unexpected data does not break the wallet. Done means the wallet remains usable with the malformed response and the normal response still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, frontend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 66/100