MetaMask / MetaMask/multichain-api-client

windowPostMessageTransport throws when an unrelated postMessage has null data

Open Beginner friendly
#108 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
1
Forks
4
PR merge metrics
No merged PRs in 30d

Description

### What happened?

`getWindowPostMessageTransport().connect()` installs a global `window.addEventListener('message', ...)` listener. That listener receives every `postMessage` on the page, including messages sent by unrelated scripts or iframes.

The current listener destructures `event.data` before validating it:

```ts
const { target, data } = event.data;
```

If another page script sends a valid postMessage with `null` or `undefined` data, this throws a `TypeError` before the listener can ignore the unrelated message.

### Minimal reproduction

After `connect()` has registered the message listener, dispatching a message shaped like this is enough to trigger the crash:

```ts
messageHandler({
data: null,
origin: location.origin,
} as MessageEvent);
```

Expected: unrelated/non-object message payloads are ignored, the same as wrong target/stream/origin messages.

Actual: the listener throws while destructuring `event.data`.

### Suggested fix

Add a small guard before destructuring:

```ts
if (!event.data || typeof event.data !== 'object') {
return;
}
```

This keeps the existing MetaMask message handling unchanged while preventing unrelated page messages from surfacing avoidable listener errors.

Contributor guide

No contributing guide indexed for this repository

Research direction

Find the getWindowPostMessageTransport implementation and inspect the message listener installed by connect(). Reproduce the issue with a message event whose data is null or undefined, then verify that non-object payloads are ignored while existing target, stream, origin, and MetaMask message handling remain unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
74/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.