MetaMask / MetaMask/multichain-api-client
windowPostMessageTransport throws when an unrelated postMessage has null data
- Dominant language
- TypeScript
- Stars
- 1
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
### What happened?
`getWindowPostMessageTransport().connect()` installs a global `window.addEventListener('message', ...)` listener. That listener receives every `postMessage` on the page, including messages sent by unrelated scripts or iframes.
The current listener destructures `event.data` before validating it:
```ts
const { target, data } = event.data;
```
If another page script sends a valid postMessage with `null` or `undefined` data, this throws a `TypeError` before the listener can ignore the unrelated message.
### Minimal reproduction
After `connect()` has registered the message listener, dispatching a message shaped like this is enough to trigger the crash:
```ts
messageHandler({
data: null,
origin: location.origin,
} as MessageEvent);
```
Expected: unrelated/non-object message payloads are ignored, the same as wrong target/stream/origin messages.
Actual: the listener throws while destructuring `event.data`.
### Suggested fix
Add a small guard before destructuring:
```ts
if (!event.data || typeof event.data !== 'object') {
return;
}
```
This keeps the existing MetaMask message handling unchanged while preventing unrelated page messages from surfacing avoidable listener errors.
Contributor guide
No contributing guide indexed for this repository
Research direction
Find the getWindowPostMessageTransport implementation and inspect the message listener installed by connect(). Reproduce the issue with a message event whose data is null or undefined, then verify that non-object payloads are ignored while existing target, stream, origin, and MetaMask message handling remain unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, frontend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 74/100