Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: safeguard utill/address functions for undefined arguments #7056

Merged
merged 13 commits into from
Sep 12, 2023

Conversation

jpcloureiro
Copy link
Contributor

@jpcloureiro jpcloureiro commented Aug 24, 2023

Development & PR Process

  1. Follow MetaMask Mobile Coding Standards
  2. Add release-xx label to identify the PR slated for a upcoming release (will be used in release discussion)
  3. Add needs-dev-review label when work is completed
  4. Add the appropiate QA label when dev review is completed
    • needs-qa: PR requires manual QA.
    • No QA/E2E only: PR does not require any manual QA effort. Prior to merging, ensure that you have successful end-to-end test runs in Bitrise.
    • Spot check on release build: PR does not require feature QA but needs non-automated verification. In the description section, provide test scenarios. Add screenshots, and or recordings of what was tested.
  5. Add QA Passed label when QA has signed off (Only required if the PR was labeled with needs-qa)
  6. Add your team's label, i.e. label starting with team- (or external-contributor label if your not a MetaMask employee)

Description

This PR aims at preventing the appearance of the ErrorBoundary screen on a specific user flow that seems to be the most affected by this bug

The user flow we're touching is the navigation to the Transaction screen while the wallet has a non-empty list of transactions to be displayed.

`TypeError: undefined is not an object(evaluating e.toLowerCase)`  (Under the error boundary screen "ActivityView"). 

is the error we've been seeing the most.

This fix only implements an access check on a couple of util functions inside app/util/address that are being used in the Transaction screen components

Issue

fixes #6771

Checklist

  • There is a related GitHub issue
  • Tests are included if applicable
  • Any added code is fully documented

@github-actions
Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@jpcloureiro jpcloureiro changed the title utils/adress: safeguard functions for undefined argument fix: safeguard utill/address functions for undefined arguments Aug 24, 2023
@jpcloureiro jpcloureiro marked this pull request as ready for review August 25, 2023 13:50
@jpcloureiro jpcloureiro requested a review from a team as a code owner August 25, 2023 13:50
@gauthierpetetin gauthierpetetin added the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Aug 25, 2023
@codecov-commenter
Copy link

codecov-commenter commented Aug 25, 2023

Codecov Report

Patch coverage: 36.36% and project coverage change: +0.06% 🎉

Comparison is base (df4b055) 33.08% compared to head (b0d2e6c) 33.15%.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7056      +/-   ##
==========================================
+ Coverage   33.08%   33.15%   +0.06%     
==========================================
  Files        1005     1005              
  Lines       32649    32654       +5     
  Branches     8395     8398       +3     
==========================================
+ Hits        10803    10827      +24     
+ Misses      21846    21827      -19     
Files Changed Coverage Δ
...mponents/Views/EditAccountName/EditAccountName.tsx 80.00% <0.00%> (-4.22%) ⬇️
app/util/address/index.js 52.17% <100.00%> (+12.39%) ⬆️

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@tommasini
Copy link
Contributor

tommasini commented Aug 25, 2023

The getAddressAccountType is used only for analytics purposes, just want to do the reference that the property account_type will be false when the address is undefined on the following events:

  • Sign Request Started
  • Sign Request Completed
  • Sign Request Cancelled
  • Send Transaction Started
  • Account Renamed
  • Contract Address Copied
  • Connect Request Started

Do you confirm @jpcloureiro ?

tommasini
tommasini previously approved these changes Aug 25, 2023
Copy link
Contributor

@tommasini tommasini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@jpcloureiro
Copy link
Contributor Author

The getAddressAccountType is used only for analytics purposes, just want to do the reference that the property account_type will be false when the address is undefined on the following events:

  • Sign Request Started
  • Sign Request Completed
  • Sign Request Cancelled
  • Send Transaction Started
  • Account Renamed
  • Contract Address Copied
  • Connect Request Started

Do you confirm @jpcloureiro ?

Good catch.

That function shouldn't return a boolean.

I'll make the function throw an error if all calls happen to be wrapped inside a try / catch block

@jpcloureiro
Copy link
Contributor Author

getAddressAccountType throws an error when address is undefined in 24308d6

jpcloureiro and others added 2 commits August 28, 2023 16:45
Co-authored-by: Nico MASSART <NicolasMassart@users.noreply.github.com>
Copy link
Contributor

@NicolasMassart NicolasMassart left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Q: not sure why you don't cascade the checks in the functions.

Right now, each address check function has to do similar checks (defined, length, valid hex, regex,...).

Why not just one that checks the definition, then the format?
In the end, all of the functions that use an address seems to require a fully valid hex ethereum address. So I feel that one "isValidEthAddress" that does a definition check and a regex match would be enough to be called from all other places.
It would also reduce the number of places where you do checks and make code stronger and easier to understand to me.

@jpcloureiro
Copy link
Contributor Author

Q: not sure why you don't cascade the checks in the functions.

Right now, each address check function has to do similar checks (defined, length, valid hex, regex,...).

Why not just one that checks the definition, then the format? In the end, all of the functions that use an address seems to require a fully valid hex ethereum address. So I feel that one "isValidEthAddress" that does a definition check and a regex match would be enough to be called from all other places. It would also reduce the number of places where you do checks and make code stronger and easier to understand to me.

We should be using isValidAddress from @ethereumjs/util to validate the selectedAddress value.

This validation should occur at a root level rather than in the multiple places where it is being used.
We should also be controlling more user flows based on the validity of selectedAddress value.

With that in mind, I prefer to leave those changes outside this PR for the sake of keeping the scope close to the issue

NicolasMassart
NicolasMassart previously approved these changes Aug 29, 2023
Copy link
Contributor

@NicolasMassart NicolasMassart left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@jpcloureiro jpcloureiro added the No QA Needed/E2E Only Apply this label when your PR does not need any QA effort. label Aug 29, 2023
@jpcloureiro jpcloureiro removed the No QA Needed/E2E Only Apply this label when your PR does not need any QA effort. label Aug 29, 2023
tommasini
tommasini previously approved these changes Aug 29, 2023
Copy link
Contributor

@tommasini tommasini left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@jpcloureiro jpcloureiro added needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) and removed blocked labels Sep 4, 2023
jpcloureiro and others added 2 commits September 4, 2023 13:19
Co-authored-by: LeoTM <1881059+leotm@users.noreply.github.com>
Copy link
Contributor

@MarioAslau MarioAslau left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!

@sethkfman
Copy link
Contributor

@MarioAslau MarioAslau added needs-qa Any New Features that needs a full manual QA prior to being added to a release. and removed needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) labels Sep 5, 2023
@sethkfman sethkfman added the release-7.7.0 Issue or pull request that will be included in release 7.7.0 label Sep 6, 2023
Copy link
Contributor

@Cal-L Cal-L left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some comments - Do we know the root of why selectedAddress would be undefined?

app/util/address/index.js Show resolved Hide resolved
app/util/address/index.js Show resolved Hide resolved
@hesterbruikman
Copy link
Contributor

Test recording as shared on Slack Sep 4

@jpcloureiro
Copy link
Contributor Author

jpcloureiro commented Sep 11, 2023

Left some comments - Do we know the root of why selectedAddress would be undefined?

Bad redux hydration is one of them

@Cal-L
Copy link
Contributor

Cal-L commented Sep 11, 2023

Left some comments - Do we know the root of why selectedAddress would be undefined?

Bad redux hydration is one of them

Is there a solution for fixing the root cause (fixing the bad rehydration condition)? Currently, the patch still results in the app showing potentially incorrect states since selectedAddress can still be undefined.

@jpcloureiro
Copy link
Contributor Author

jpcloureiro commented Sep 12, 2023

Hey, I've updated the PR description to provide more context around this approach.

The motivation for this PR relies on preventing a specific error that has been reported multiple times. All of them appear to occur on the transaction screen.

The approach is to allow specific functions to not throw errors when their arguments are undefined rather than preventing the selectedAddress from becoming undefined.

Efforts on preventing selectedAddress from becoming undefined could be tracked on this issue

@sonarcloud
Copy link

sonarcloud bot commented Sep 12, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 1 Code Smell

0.0% 0.0% Coverage
0.0% 0.0% Duplication

@cortisiko cortisiko added QA Passed A successful QA run through has been done and removed needs-qa Any New Features that needs a full manual QA prior to being added to a release. labels Sep 12, 2023
Copy link
Member

@cortisiko cortisiko left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not see anything out of the ordinary to report here. ✅

@cortisiko cortisiko merged commit 80eab2d into main Sep 12, 2023
25 of 26 checks passed
@cortisiko cortisiko deleted the fix/tolowercase-error branch September 12, 2023 19:55
@github-actions github-actions bot locked and limited conversation to collaborators Sep 12, 2023
@metamaskbot metamaskbot added the release-7.8.0 Issue or pull request that will be included in release 7.8.0 label Sep 12, 2023
@xinnanyemm xinnanyemm removed the release-7.8.0 Issue or pull request that will be included in release 7.8.0 label Sep 19, 2023
@gauthierpetetin gauthierpetetin added team-mobile-platform team-mobile-ux DEPRECATED: please use "team-wallet-ux" label instead labels Feb 2, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
QA Passed A successful QA run through has been done release-7.7.0 Issue or pull request that will be included in release 7.7.0 team-mobile-platform team-mobile-ux DEPRECATED: please use "team-wallet-ux" label instead
Projects
None yet