core icon indicating copy to clipboard operation
core copied to clipboard

fix: add logic to properly rate limit snap install requests

Open hmalik88 opened this issue 9 months ago • 0 comments

Explanation

  • What is the current state of things and why does it need to change? The approval controller doesn't properly block multiple snap install requests from the same origin. One can technically open up to 3 install flows at once (connect to snap A, proceed to install step, connect to snap B, proceed to install-result step for snap A, proceed to install for snap B, connect to snap C).
  • What is the solution your changes offer and how does it work? Add logic to treat wallet_installSnap, wallet_updateSnap, wallet_installSnapResult as one.
  • Are there any changes whose purpose might not obvious to those unfamiliar with the domain? The snap installation flow is comprised of multiple requests, hence why this probably slipped through the cracks.
  • If your primary goal was to update one package but you found you had to update another one along the way, why did you do so? Added snap approval types to controller-utils (for use in the client).

References

Are there any issues that this pull request is tied to? No Are there other links that reviewers should consult to understand these changes better? These changes are necessary to complete this PR: https://github.com/MetaMask/metamask-extension/pull/33040

Checklist

  • [ ] I've updated the test suite for new or updated code as appropriate
  • [ ] I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • [ ] I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
  • [ ] I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

hmalik88 avatar May 17 '25 06:05 hmalik88