Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Feature/confusables #2464

Merged
merged 28 commits into from
Apr 29, 2021
Merged

Feature/confusables #2464

merged 28 commits into from
Apr 29, 2021

Conversation

rickycodes
Copy link
Member

@rickycodes rickycodes commented Mar 31, 2021 •
edited
Loading

Description

re: #2067

Notes

good confusables to test:

vita‍lik.eth vs vitalik.eth
faceboоk.eth

image
image
image
image

Checklist

  • There is a related GitHub issue
  • Tests are included if applicable
  • Any added code is fully documented

Issue

Resolves #2067

@rickycodes rickycodes added needs-qa Any New Features that needs a full manual QA prior to being added to a release. needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) labels Mar 31, 2021
@rickycodes rickycodes requested a review from a team as a code owner March 31, 2021 20:30
@rickycodes rickycodes force-pushed the feature/confusables branch 3 times, most recently from 0ae809a to 5facd1f Compare April 1, 2021 16:23
@omnat
Copy link
Contributor

omnat commented Apr 7, 2021

jfyi @rickycodes - extension found this bug on their confusables error implementation MetaMask/metamask-extension#10691

@rickycodes
Copy link
Member Author

@omnat doesn't look like we have any such issue in our case that address resolves fine:
image

estebanmino
estebanmino approved these changes Apr 9, 2021
View reviewed changes
Copy link
Contributor

@estebanmino estebanmino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👌

@estebanmino estebanmino removed the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Apr 9, 2021
@rickycodes rickycodes added the DO-NOT-MERGE Pull requests that should not be merged label Apr 10, 2021
@rickycodes rickycodes removed the DO-NOT-MERGE Pull requests that should not be merged label Apr 14, 2021
@ibrahimtaveras00 ibrahimtaveras00 added QA in Progress QA has started on the feature. and removed needs-qa Any New Features that needs a full manual QA prior to being added to a release. labels Apr 14, 2021
@ibrahimtaveras00
Copy link
Contributor

ibrahimtaveras00 commented Apr 14, 2021 •
edited
Loading

My normal ENS name for my test account, ibrahimtester.eth, is getting flagged as a confusable

Are we fine with showing this warning on normal ENS names?

Saw it on a few other ones as well:

Screen Shot 2021-04-14 at 4 08 18 PM

This seems similar to what the Extension Team was seeing cc: @omnat @cjeria

@cjeria
Copy link

cjeria commented Apr 14, 2021

@ibrahimtaveras00 looks like it's flagging the letter "m" from your screenshots. @rickycodes does this seem like a bug to you?

@rickycodes
Copy link
Member Author

rickycodes commented Apr 14, 2021 •
edited
Loading

@cjeria it's not a bug. looking at the json I see a pairing "m": "rn",... i guess m is similar to rn so it gets flagged.

@cjeria
Copy link

cjeria commented Apr 14, 2021

@rickycodes ah, I see. Should either of those be in the json though? There are English words that use that pair - "morning.eth", "burning.eth". I wouldn't want to alarm the user in those cases. Can that be omitted from the JSON?

@rickycodes
Copy link
Member Author

@cjeria the .json that I am referring to is part of the library we're using. that said, they could be omitted if we wanted to filter them out on our end. alternatively, we could look at flagging the more obvious ones (ens names that container zero width white space or unicode chars).

@ibrahimtaveras00 ibrahimtaveras00 removed the QA in Progress QA has started on the feature. label Apr 14, 2021
@rickycodes rickycodes added needs-qa Any New Features that needs a full manual QA prior to being added to a release. and removed QA'd but questions A QA run through has been done but you need clarification on minor issues you found labels Apr 27, 2021
@ibrahimtaveras00 ibrahimtaveras00 added next release QA in Progress QA has started on the feature. and removed needs-qa Any New Features that needs a full manual QA prior to being added to a release. labels Apr 29, 2021
ibrahimtaveras00
ibrahimtaveras00 approved these changes Apr 29, 2021
View reviewed changes
Copy link
Contributor

@ibrahimtaveras00 ibrahimtaveras00 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixes look good, QA Passed 👍🏽

@ibrahimtaveras00 ibrahimtaveras00 added QA Passed A successful QA run through has been done and removed QA in Progress QA has started on the feature. labels Apr 29, 2021
@rickycodes rickycodes merged commit 2b571c5 into develop Apr 29, 2021
@rickycodes rickycodes deleted the feature/confusables branch April 29, 2021 23:45
rickycodes added a commit to ScreamingHawk/metamask-mobile that referenced this pull request Apr 30, 2021
@rickycodes
Merge branch 'develop' of github.com:MetaMask/metamask-mobile into pa…
5242665 
…tch-1

* 'develop' of github.com:MetaMask/metamask-mobile: (51 commits)
  Feature/confusables (MetaMask#2464)
  fix typeface on login text field (MetaMask#2610)
  Replace controller context (MetaMask#2416)
  Fix adding custom token in custom network (MetaMask#2590)
  only add custom tokens if not in mainnet (MetaMask#2470)
  Address yarn lints (MetaMask#2524)
  Upgrade .nvmrc to node v14 (MetaMask#2588)
  Swaps: Add cache thresholds configuration (MetaMask#2514)
  Swaps: BSC Support (MetaMask#2468)
  Use node 14 (MetaMask#2539)
  resolve isENS without case sensitivity (MetaMask#2545) (MetaMask#2568)
  Revert "resolve isENS without case sensitivity (MetaMask#2545)" (MetaMask#2566)
  resolve isENS without case sensitivity (MetaMask#2545)
  Bump versioncode (MetaMask#2558)
  v2.2.0 (MetaMask#2555)
  Include decimalsToShow in balanceToFiatNumber (MetaMask#2547)
  Bug fix/sync import time (MetaMask#2554)
  bundle update (MetaMask#2549)
  Fix analytics try catch (MetaMask#2546)
  Only get nonce from the network if the feature is enabled (MetaMask#2543)
  ...
sethkfman added a commit that referenced this pull request May 12, 2021
@sethkfman @rickycodes
@Pixeladed @wachunei @estebanmino @Gudahtt @andrepimenta @ScreamingHawk @ibrahimtaveras00 @darkwing @dependabot
Release/v2.3.0 (#2677)
867369e 
* resolve isENS without case sensitivity (#2545) (#2568)

Co-authored-by: ricky <ricky.miller@gmail.com>

Co-authored-by: Minh <minhle@canva.com>

* Use node 14 (#2539)

* Swaps: BSC Support (#2468)

* Swaps: Add cache thresholds configuration (#2514)

* Upgrade .nvmrc to node v14 (#2588)

* Address yarn lints (#2524)

* address yarn lints

* add eslint-disable

* Update isENS method

* fix rn-fetch-blob.js mock

* Add tests for isENS

* useRef instead of useMemo

* Update eslint

* Use lastIndexOf and add test

* Add test case for ricky.metamask.eth

* Add offset

* Fix AppConstants import

* only add custom tokens if not in mainnet (#2470)

* checkchainid

* tests

* Fix adding custom token in custom network (#2590)

* Replace controller context (#2416)

* Replace controller context

The `context` object previously constructed by the
`ComposableController` is no more. Instead each controller now accepts
its dependencies directly as constructor parameters, in a similar
manner to the extension controllers.

This was done in preparation for migrating to BaseControllerV2 and the
new controller messaging system - this is just a temporary solution
that will let us migrate controllers one at a time.

The style of dependency injection here matches the extension (at least
with newer controllers anyway). Specific methods and state snapshots
are injected rather than entire controllers, to help simplify unit
tests and make it easier to understand how controllers interact.

The `Engine.context` property was used throughout mobile, so it has
been preserved. It is now constructed explicitly, rather than being a
re-export of the `ComposableController` context.

This PR depends upon MetaMask/core#387

* Pass in function for `getOpenSeaApiKey` rather than string

The API key was passed in directly by accident, instead of a function get returned the key. This has been fixed.

Co-authored-by: Esteban Miño <efmino@uc.cl>

* Update `AccountTrackerController` options

The `AccountTrackerController` option `initialIdentities` was replaced
with `getIdentities`. The initial identities passed in here were
incorrect anyway due to a typo (`initialState.preferencesController`
was used instead of `initialState.PreferencesController`).

* Fix `getIdentities` handler for `AccountTrackerController`

* Set initial controller state

The `controllers` setter on `ComposedController` used to be responsible
for setting initial state. Since that setter has been removed, the
initial state is now set after the controllers have been constructed.

This should be functionally equivalent to what it was before. We're
setting the initial state by calling `update` on each controller, just
as the `controller` setter used to.

* Fix initial state variable reference

Co-authored-by: Esteban Miño <efmino@uc.cl>

* fix typeface on login text field (#2610)

* Feature/confusables (#2464)

* Add confusable warning to SendTo

* Highlight confusable characters

* Replace zeroWidthPoints characters with ?

* Add some notes

* Add confusable highlight to confirm screen

* Update checkZeroWidth function

* Add exclamation mark to Confirm

* Add handleConfusables method

* Move this into one spot

* Add hasZeroWidthPoints

* Rename T to Texts

* Use reduce

* Add homoglyphic tests

* Add Modal for confusable on confirm screen

* Update snapshot

* Use Swaps InfoModal

* Increase lineheight on modals

* Only display warning if address is not in addressBook

* Update snapshot

* Make texts lowercase

* Remove unused state

* Add patch

* Display as warning in yelllow when not zero width

* Only display confusables warnings if the user is not in addressbook

* Add optional chaining for addressBook

Co-authored-by: andrepimenta <andrepimenta7@gmail.com>

* Add New Zealand Dollar to currency options (#2446)

* Add New Zealand Dollar to currency options

* Update snapshot to include nzd

Co-authored-by: Ricky Miller <ricky.miller@gmail.com>

* Move some errors to analytics instead of sentry (#2529)

* Move some errors to analytics instead of sentry

* Add swaps errors

* Change to log just as 1 error

* Fix typos

* Log can't reach branch servers as analytics

* Browser: Failed to resolve ENS name for chainId - log as analytics

* Update tests

Co-authored-by: Pedro Pablo Aste Kompen <wachunei@gmail.com>

* Don't hide url modal on emulator (#2604)

* Detox/Fix failing tests (#2607)

* fixed all failing tests

* remove a

Co-authored-by: Ibrahim Taveras <ibrahimtaveras@ibrahims-mbp.myfiosgateway.com>

* Upgrade wallet connect (#2552)

* This will fix sentry errors with no title by using the extra info as a title (#2565)

* Bugfix/android anr (#2603)

* updated Sentry SDK and increase the default timeout for ANR to be thrown  from 4 to 10 seconds #2498

* updated ANR reporting time to 8 seconds

* removed increased timeout and correct sentry integrations vesion

* updated pod dependencies

* remove typo (#2613)

* Upgrade swaps-controller v4 (#2586)

* updated lock files (#2614)

* Fix/respect custom spend limit on dapp approve modal (#2556)

* Add better initial state reset for permission edit modal

* Use spendLimitCustomValue for allowance

* minimumSpendLimit 1

* Remove minimumSpendLimit prop

* Get minimumSpendLimit from EditPermission component

* Add MINIMUM_VALUE const

* use export const

* Coerce minimumSpendLimit to number

* Log error

* Remove callback from initialState

Co-authored-by: Pedro Pablo Aste Kompen <wachunei@gmail.com>

* Improve rpc errors logging and removing user rejected errors (#2564)

* Improve rpc errors logging and removing user rejected errors

* Update for even more cases

* Add comments to code

* Add trackErrorAsAnalytics

* Use typeof

* Feature/update seed phrase wording (#2605)

* Move login strings to translation file

* replace seed phrase with Secret Recovery phrase

* Get an video working

* get video working off disk

* Add SeedPhraseVideo component

* Add TODO:

* Add SeedPhraseVideo to onboarding

* Update snapshots

* Add borderRadius

* cleanup

* Remove placeholder video and add recovery-phrase

* Add video-controls

* Add cover to video

* Add play button to cover

* adjust opacity to closer match design

* Add marginTop to video on settings page

* Remove subtitles for now

* Update few remaining instances

* Account for single word instances

* update snapshots

* Update snapshots

* RC v2.3.0 (#2621)

* bump version numbers

* update change log

* Implement 'hide zero balance token' setting for token balances on home screen (#2444)

* Implement 'hide zero balance token' setting for token balances on home screen

* Add localizations

* Refactor how balances are detected, add tests

* Fix lint, add spacing, create jest snapshots

* Fix test, lint

* Remove unnecessary proop from test

* Remove 'paymentChannelsEnabled' prop that doesn't belong in this patch

Co-authored-by: ricky <ricky.miller@gmail.com>

* Fix isZero is undefined (#2625)

* Fix isZero is undefined

* Update app/components/UI/Tokens/index.js

Co-authored-by: Esteban Miño <efmino@uc.cl>

* add optional chaining

Co-authored-by: Esteban Miño <efmino@uc.cl>

* Address yarn audit (#2633)

* updated change log (#2631)

* updated change log

* updated change log

* updated change log

* Exclude native asset from hiding when balance is zero (#2639)

* Fix undefined is not an object identities[selectedAddress].importTime (#2643)

* Fix undefined is not an object (evaluating 'identities[selectedAddress].importTime

* Use accountImportTime for consistency

* Safe navbar for iphone 12 (#2645)

* safenavbar

* Update app/util/Device.js

Co-authored-by: ricky <ricky.miller@gmail.com>

* mocks

* lint

* finally

Co-authored-by: ricky <ricky.miller@gmail.com>

* Fix missing seed phrase updates (#2657)

* Fix Balance undefined for deeplink payment requests (#2656)

* Check for transactionToName

* Account for own accounts

* Remove console.log

* Use account names from identities

* Remove async

* Add some safety

* Load video over the network (#2663)

* updated version code and change logs (#2664)

* updated version code and change logs

* update change log

* added export of iOS artifacts (#2667)

* added export of iOS artifacts

* updated destination directory

* Bump hosted-git-info from 2.8.8 to 2.8.9 (#2670)

Bumps [hosted-git-info](https://github.com/npm/hosted-git-info) from 2.8.8 to 2.8.9.
- [Release notes](https://github.com/npm/hosted-git-info/releases)
- [Changelog](https://github.com/npm/hosted-git-info/blob/v2.8.9/CHANGELOG.md)
- [Commits](npm/hosted-git-info@v2.8.8...v2.8.9)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Key off accounts (#2669)

* Key off accounts

* Key off accounts in ChoosePassword as well

* Fix deploy contract and create token testnets (#2674)

* updated change logs

* upated version codes and change logs (#2675)

Co-authored-by: ricky <ricky.miller@gmail.com>
Co-authored-by: Minh <minhle@canva.com>
Co-authored-by: Pedro Pablo Aste Kompen <wachunei@gmail.com>
Co-authored-by: Esteban Miño <efmino@uc.cl>
Co-authored-by: Mark Stacey <markjstacey@gmail.com>
Co-authored-by: andrepimenta <andrepimenta7@gmail.com>
Co-authored-by: Michael Standen <screaminghawk@gmail.com>
Co-authored-by: Ibrahim Taveras <ibrahimtaveras00@gmail.com>
Co-authored-by: Ibrahim Taveras <ibrahimtaveras@ibrahims-mbp.myfiosgateway.com>
Co-authored-by: David Walsh <davidwalsh83@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@rickycodes rickycodes mentioned this pull request May 14, 2021
Closed
rickycodes added a commit that referenced this pull request Jan 31, 2022
@rickycodes @andrepimenta
Feature/confusables (#2464)
752f4cb 
* Add confusable warning to SendTo

* Highlight confusable characters

* Replace zeroWidthPoints characters with ?

* Add some notes

* Add confusable highlight to confirm screen

* Update checkZeroWidth function

* Add exclamation mark to Confirm

* Add handleConfusables method

* Move this into one spot

* Add hasZeroWidthPoints

* Rename T to Texts

* Use reduce

* Add homoglyphic tests

* Add Modal for confusable on confirm screen

* Update snapshot

* Use Swaps InfoModal

* Increase lineheight on modals

* Only display warning if address is not in addressBook

* Update snapshot

* Make texts lowercase

* Remove unused state

* Add patch

* Display as warning in yelllow when not zero width

* Only display confusables warnings if the user is not in addressbook

* Add optional chaining for addressBook

Co-authored-by: andrepimenta <andrepimenta7@gmail.com>
@serenae-fansubs serenae-fansubs mentioned this pull request Feb 23, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@estebanmino estebanmino estebanmino approved these changes

@ibrahimtaveras00 ibrahimtaveras00 ibrahimtaveras00 approved these changes

@sethkfman sethkfman Awaiting requested review from sethkfman

Assignees
No one assigned
Labels
next release QA Passed A successful QA run through has been done
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Warn users whenever an ENS name contains a homoglyph vulnerability
7 participants
@rickycodes @omnat @ibrahimtaveras00 @cjeria @andrepimenta @sethkfman @estebanmino