From 9ac4932ddeac558aee1cf7ebe44705ff7a82adb7 Mon Sep 17 00:00:00 2001
From: Kheops <26880866+0xKheops@users.noreply.github.com>
Date: Thu, 6 Jul 2023 08:36:24 +0700
Subject: [PATCH] fix: improved network & erc20 validation (#911)

---
 apps/extension/src/core/domains/ethereum/helpers.ts | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/apps/extension/src/core/domains/ethereum/helpers.ts b/apps/extension/src/core/domains/ethereum/helpers.ts
index dcbe35138..9abc22526 100644
--- a/apps/extension/src/core/domains/ethereum/helpers.ts
+++ b/apps/extension/src/core/domains/ethereum/helpers.ts
@@ -237,14 +237,16 @@ export const prepareTransaction = (
   return result
 }
 
+const testNoScriptTag = (text?: string) => !text?.toLowerCase().includes("<script")
+
 const schemaAddEthereumRequest = yup.object().shape({
   chainId: yup.string().required(),
-  chainName: yup.string().required(),
+  chainName: yup.string().required().max(100).test("noScriptTag", testNoScriptTag),
   nativeCurrency: yup
     .object()
     .shape({
-      name: yup.string().required(),
-      symbol: yup.string().min(2).max(6).required(),
+      name: yup.string().required().max(50).test("noScriptTag", testNoScriptTag),
+      symbol: yup.string().required().min(2).max(11).test("noScriptTag", testNoScriptTag),
       decimals: yup.number().required().integer(),
     })
     .required(),
@@ -281,8 +283,8 @@ const schemaWatchAssetRequest = yup.object().shape({
   options: yup
     .object()
     .shape({
-      address: yup.string().required(),
-      symbol: yup.string().min(2).max(11),
+      address: yup.string().required().test("ethAddress", isEthereumAddress),
+      symbol: yup.string().min(2).max(11).test("noScriptTag", testNoScriptTag),
       decimals: yup.number(),
       // ignore image if it doesn't pass security checks
       image: yup.string().transform((value) => (isSafeImageUrl(value) ? value : undefined)),