MetaMask / MetaMask/metamask-extension
Should Ignore Sandboxed iFrames
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
**What problem are you trying to solve?**
Some dapps use sandboxed iframes to execute arbitrary code in a sandbox, (see https://www.w3schools.com/tags/att_iframe_sandbox.asp). MetaMask should not allow code in the sandbox to request transaction signing under any circumstances as users might believe the parent dapp is requesting it.
**Describe the solution you'd like**
MetaMask should block transactions originating from an iframe that has the `sandbox` attribute.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by locating MetaMask's transaction-signing request path for dapps and determine how the requesting iframe's sandbox attribute can be identified. Done means transaction-signing requests from sandboxed iframes are blocked under all circumstances, with coverage for that behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100