MetaMask / MetaMask/metamask-mobile
Chore: operate on an allowlist rather than fuzzy-blocklist approach
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 1.7k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 669
Description
## Description
The application currently uses a fuzzy-blocklist approach to handle requests in app/store/sagas/xmlHttpRequestOverride.ts
It may not be as secure or maintainable as an allowlist approach.
## Expected Outcome
Refactor the request handling strategy to operate on an allowlist basis, enhancing security and maintainability.
## Suggested Implementation
1. Review the current request handling logic in app/store/sagas/xmlHttpRequestOverride.ts
2. Identify areas where the fuzzy-blocklist approach is used.
3. Develop a clear allowlist of approved requests and modify the request handling logic to adhere to this list.
Contributor guide
Research direction
Start by reading app/store/sagas/xmlHttpRequestOverride.ts and reviewing its current request-handling logic. Identify where the fuzzy-blocklist approach is used, then define the approved-request allowlist and update handling to follow it. Done means requests are governed by the allowlist rather than fuzzy blocklist checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native, typescript
- Domain
- mobile, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100