Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address security concern etld dapps #13385

Closed

Conversation

qamarngr
Copy link
Contributor

@qamarngr qamarngr commented May 18, 2022

Resolves brave/brave-browser#21798

Submitter Checklist:

  • I confirm that no security/privacy review is needed, or that I have requested one
  • There is a ticket for my issue
  • Used Github auto-closing keywords in the PR description above
  • Wrote a good PR/commit description
  • Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
  • Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
  • Checked the PR locally: npm run test -- brave_browser_tests, npm run test -- brave_unit_tests, npm run lint, npm run gn_check, npm run tslint
  • Ran git rebase master (if needed)

Reviewer Checklist:

  • A security review is not needed, or a link to one is included in the PR description
  • New files have MPL-2.0 license header
  • Adequate test coverage exists to prevent regressions
  • Major classes, functions and non-trivial code blocks are well-commented
  • Changes in component dependencies are properly reflected in gn
  • Code follows the style guide
  • Test plan is specified in PR before merging

After-merge Checklist:

Test Plan:

Same as
#12701

@qamarngr qamarngr requested a review from a team as a code owner May 18, 2022 23:35
@qamarngr qamarngr self-assigned this May 18, 2022
@qamarngr qamarngr added the QA/No label May 18, 2022
@qamarngr qamarngr requested a review from SergeyZhukovsky May 18, 2022 23:38
@qamarngr qamarngr added this to the 1.41.x - Nightly milestone May 18, 2022
@qamarngr qamarngr removed the QA/No label May 18, 2022
@qamarngr qamarngr requested a review from Pavneet-Sing May 18, 2022 23:45
Copy link

@Pavneet-Sing Pavneet-Sing left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would encourage to start using the domain layer (any possible implementation) with MVVM style to enhance the code quality, classes like Utils is doing too much, yet not efficient. Feel free to use your architectural skills to enhance domain or other areas.

getWalletService().geteTldPlusOneFromOrigin(Utils.getCurrentMojomOrigin(), origin -> {
siteTv.setText(Utils.geteTLDFromGRUL(origin.eTldPlusOne));
});
getFavIcon(siteUrl.getOrigin());

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: rename to showFavIcon or something as getFavIcon returns void

if (activity != null) {

FaviconImageCallback imageCallback = (bitmap,
iconUrl) -> AddSwitchChainNetworkFragment.this.onFaviconAvailable(url, bitmap);

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: is it required AddSwitchChainNetworkFragment.this.?

}
}

private void onFaviconAvailable(GURL pageUrl, Bitmap iconBitmap) {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: since it's not a callback method so would be better to rename to showFavIcon or similar for convention and per title case use Icon in FavIcon

</message>
<message name="IDS_BRAVE_WALLET_PROVIDE_ENCRYPTION_KEY_DESCRIPTION" desc="Provide Encryption Key Panel Details">is requesting your wallets public encryption key. If you consent to providing this key, the site will be able to compose encrypted messages to you.</message>
Copy link

@Pavneet-Sing Pavneet-Sing May 19, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: description doesn't have to be in title case, seems like we have done this before so kindly ignore some existing examples or fix them to avoid the influence.

Comment on lines +157 to +160
private BraveWalletService getWalletService() {
assert getActivity() instanceof BraveWalletBaseActivity;
return ((BraveWalletBaseActivity) getActivity()).getBraveWalletService();
}

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

redundant, remove this, BaseDAppsFragment already has the getBraveWalletService.

This is one of the side effect of this approach, better start using the domain layer or anything better to improve code quality.

@SergeyZhukovsky
Copy link
Member

@qamarngr I don't think CI is running btw if you work off your fork. As I see lint format isn't applied as well. Could you please work directly from brave-core repository?

@@ -112,7 +112,9 @@ public void onClick(View v) {
mRecyclerView = view.findViewById(R.id.accounts_list);
mFavicon = view.findViewById(R.id.favicon);

mWebSite.setText(getCurrentHostHttpAddress().getSpec());
getBraveWalletService().geteTldPlusOneFromOrigin(Utils.getCurrentMojomOrigin(), origin -> {
mWebSite.setText(Utils.geteTLDFromGRUL(origin.eTldPlusOne));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GURL?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh sorry, I refactored it, I was previously passing GURL, later on I removed it.

if (mBraveWalletService != null) {
return;
}
mBraveWalletService = BraveWalletServiceFactory.getInstance().getBraveWalletService(this);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to close the service in DisconnectMojoServices

@Pavneet-Sing
Copy link

Duplicate of #13398

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants