feat: SES lockdown v1.1.0 on Android (Hermes)

[leotm]

Description

SES running on Hermes, follow-up to

• feat: SES lockdown v0.18.8 (iOS JSC) #6586

Previous async bundling errors (fixed except load) no longer relevant

metamask-mobile/android/app/build/ASSETS/createBundleProdDebugJsAndAssets/index.android.bundle: error: async functions are unsupported
      const loadWithoutErrorAnnotation = async (compartmentPrivateFields, moduleAliases, compartment, moduleSpecifier, pendingJobs, moduleLoads, errors) => {

metamask-mobile/android/app/build/ASSETS/createBundleProdDebugJsAndAssets/index.android.bundle: error: async functions are unsupported
      const memoizedLoadWithErrorAnnotation = async (compartmentPrivateFields, moduleAliases, compartment, moduleSpecifier, pendingJobs, moduleLoads, errors) => {

metamask-mobile/android/app/build/ASSETS/createBundleProdDebugJsAndAssets/index.android.bundle: error: async functions are unsupported
      const load = async (compartmentPrivateFields, moduleAliases, compartment, moduleSpecifier) => {

mobile/android/app/build/ASSETS/createBundleProdDebugJsAndAssets/index.android.bundle:1233 error: async generators are unsupported
        async function* AsyncGeneratorFunctionInstance() {}

• ses bumped to v1.0.0 refactored to Promises w/o async parts (in seperate PR to not ruin clear diff)
  • feat: SES lockdown v1.0.0 (Android Hermes) #8161

Runtime

• // assertDirectEvalAvailable(); // SES TypeError
• // addIntrinsics(tameRegExpConstructor(regExpTaming)); // SES TypeError
• // addIntrinsics(tameSymbolConstructor()); // Metro exception
• // addIntrinsics(getAnonymousIntrinsics()); // SES TypeError
• // completePrototypes(); // SES TypeError
• // whitelistIntrinsics(intrinsics, markVirtualizedNativeFunction); // SES TypeError
• // hardenIntrinsics(); // no error, app hangs loading, under investigation

Testing

• SES enabled on Android/Hermes
• locally: SES enabled in debug-mode
• SES ft toggle enabled (default), UI (exp menu) hidden on Android currently
• Hermes: build from source (custom tarball, new arch) -> bundled Hermes (default)
• RN bumps: 0.71.14-16->.72.10->.73.4->.74.0(0.74.0-rc.0)->nightly
• prototype pollution: Object.defineProperty(Object.prototype, 'test', { value: true });

Related issues

• SES lockdown Hermes compat tracking issue endojs/endo#1891

Manual testing steps

App functions as normal

yarn watch:clean
yarn start:android # react-native run-android --variant=prodDebug

# cd android
# adb uninstall io.metamask
./gradlew clean # after changes to ses
./gradlew :app:createBundleProdDebugJsAndAssets # bundle only
./gradlew :app:installProdDebug -PreactNativeArchitectures=arm64-v8a # bundle & build

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I’ve followed MetaMask Coding Standards.
• I've clearly explained what problem this PR is solving and how it is solved.
• I've linked related issues
• I've included manual testing steps
• I've included screenshots/recordings if applicable
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.
• I’ve properly set the pull request status:
  • In case it's not yet "ready for review", I've set it to "draft".
  • In case it's "ready for review", I've changed it from "draft" to "non-draft".

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[leotm]

prev initial iteration: 9f4d987

current: 6de1055

[sonarcloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 41.47%. Comparing base (667d8c8) to head (b7fd07c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8009   +/-   ##
=======================================
  Coverage   41.47%   41.47%           
=======================================
  Files        1263     1263           
  Lines       30605    30605           
  Branches     3008     3008           
=======================================
  Hits        12694    12694           
  Misses      17157    17157           
  Partials      754      754           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[sonarcloud]

Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity in the last 90 days. It will be closed in 7 days. Thank you for your contributions.

[github-actions]

This PR was closed because there has been no follow up activity in 7 days. Thank you for your contributions.