fix: fix security comment

MetaMask · Dec 5, 2024 · 282122f · 282122f
1 parent 0d2ae6e
commit 282122f
Show file tree

Hide file tree

Showing 2 changed files with 68 additions and 2 deletions.
diff --git a/app/scripts/migrations/135.ts b/app/scripts/migrations/135.ts
@@ -1,6 +1,9 @@
 import { hasProperty, isObject } from '@metamask/utils';
 import { cloneDeep } from 'lodash';
-import { infuraProjectId } from '../../../shared/constants/network';
+import {
+  allowedInfuraHosts,
+  infuraProjectId,
+} from '../../../shared/constants/network';
 import { RpcEndpointType } from '@metamask/network-controller';
 
 export const version = 135;
@@ -53,6 +56,18 @@ function transformState(state: Record<string, unknown>) {
         const defaultRpcEndpoint =
           networkConfig?.rpcEndpoints?.[networkConfig?.defaultRpcEndpointIndex];
 
+        console.log('defaultRpcEndpoint ......', defaultRpcEndpoint);
+
+        console.log(
+          'defaultRpcEndpoint ......',
+          new URL(defaultRpcEndpoint.url).host,
+        );
+
+        console.log(
+          'defaultRpcEndpoint ......',
+          allowedInfuraHosts.includes(new URL(defaultRpcEndpoint.url).host),
+        );
+
         if (
           !isObject(defaultRpcEndpoint) ||
           typeof defaultRpcEndpoint.url !== 'string'
@@ -64,7 +79,7 @@ function transformState(state: Record<string, unknown>) {
           const urlHost = new URL(defaultRpcEndpoint.url).host;
           return (
             defaultRpcEndpoint.type === RpcEndpointType.Infura ||
-            urlHost.endsWith('infura.io')
+            allowedInfuraHosts.includes(urlHost)
           );
         } catch {
           return false;

diff --git a/shared/constants/network.ts b/shared/constants/network.ts
@@ -1077,6 +1077,57 @@ export const FEATURED_RPCS: AddNetworkFields[] = [
   },
 ];
 
+export const allowedInfuraHosts = [
+  // Ethereum
+  'mainnet.infura.io',
+  'holesky.infura.io',
+  'sepolia.infura.io',
+  // Linea
+  'linea-mainnet.infura.io',
+  'linea-sepolia.infura.io',
+  // Polygon
+  'polygon-mainnet.infura.io',
+  'polygon-amoy.infura.io',
+  // Base
+  'base-mainnet.infura.io',
+  'base-sepolia.infura.io',
+  // Blast
+  'blast-mainnet.infura.io',
+  'blast-sepolia.infura.io',
+  // Optimism
+  'optimism-mainnet.infura.io',
+  'optimism-sepolia.infura.io',
+  // Arbitrum
+  'arbitrum-mainnet.infura.io',
+  'arbitrum-sepolia.infura.io',
+  // Palm
+  'palm-mainnet.infura.io',
+  'palm-testnet.infura.io',
+  // Avalanche
+  'avalanche-mainnet.infura.io',
+  'avalanche-fuji.infura.io',
+  // Celo
+  'celo-mainnet.infura.io',
+  'celo-alfajores.infura.io',
+  // ZKSync
+  'zksync-mainnet.infura.io',
+  'zksync-sepolia.infura.io',
+  // BSC
+  'bsc-mainnet.infura.io',
+  'bsc-testnet.infura.io',
+  // Mantle
+  'mantle-mainnet.infura.io',
+  'mantle-sepolia.infura.io',
+  // OPBNB
+  'opbnb-mainnet.infura.io',
+  'opbnb-testnet.infura.io',
+  // Scroll
+  'scroll-mainnet.infura.io',
+  'scroll-sepolia.infura.io',
+  // Unichain
+  'unichain-sepolia.infura.io',
+];
+
 /**
  * Represents the availability state of the currently selected network.
  */