MetaMask / MetaMask/metamask-mobile

Chore: operate on an allowlist rather than fuzzy-blocklist approach

Open
#10,391 0 comments 0 reactions 0 assignees View on GitHub
INVALID-ISSUE-TEMPLATE
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

## Description
The application currently uses a fuzzy-blocklist approach to handle requests in app/store/sagas/xmlHttpRequestOverride.ts
It may not be as secure or maintainable as an allowlist approach.

## Expected Outcome
Refactor the request handling strategy to operate on an allowlist basis, enhancing security and maintainability.

## Suggested Implementation
1. Review the current request handling logic in app/store/sagas/xmlHttpRequestOverride.ts
2. Identify areas where the fuzzy-blocklist approach is used.
3. Develop a clear allowlist of approved requests and modify the request handling logic to adhere to this list.

Contributor guide

Open the contributing guide

Research direction

Start by reading app/store/sagas/xmlHttpRequestOverride.ts and reviewing its current request-handling logic. Identify where the fuzzy-blocklist approach is used, then define the approved-request allowlist and update handling to follow it. Done means requests are governed by the allowlist rather than fuzzy blocklist checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
react-native, typescript
Domain
mobile, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.