Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(Wallet) Implement mitigation for null password issue #23641

Merged
merged 3 commits into from
May 20, 2024

Conversation

simoarpe
Copy link
Collaborator

@simoarpe simoarpe commented May 14, 2024

Resolves brave/brave-browser#38224

Resolves brave/brave-browser#38220

Resolves brave/brave-browser#35297

Implement a mitigation for an issue that may cause an illegal state exception during Wallet creation.

When brave/brave-browser#35294 will be completed the Wallet restoration (that most likely was causing the issue) will be refactored.

Submitter Checklist:

  • I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
  • There is a ticket for my issue
  • Used Github auto-closing keywords in the PR description above
  • Wrote a good PR/commit description
  • Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
  • Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
  • Checked the PR locally:
    • npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
    • npm run presubmit wiki, npm run gn_check, npm run tslint
  • Ran git rebase master (if needed)

Reviewer Checklist:

  • A security review is not needed, or a link to one is included in the PR description
  • New files have MPL-2.0 license header
  • Adequate test coverage exists to prevent regressions
  • Major classes, functions and non-trivial code blocks are well-commented
  • Changes in component dependencies are properly reflected in gn
  • Code follows the style guide
  • Test plan is specified in PR before merging

After-merge Checklist:

Test Plan:

Account Recovery Steps

  • Clean Wallet data, if any
  • Navigate to Wallet section to trigger onboarding flow
  • Tap on restore Wallet and complete onboarding flow
  • Observe the Wallet is correctly restored

@simoarpe simoarpe added CI/skip-macos-x64 Do not run CI builds for macOS x64 CI/skip-ios Do not run CI builds for iOS feature/web3/wallet CI/skip-windows-x64 Do not run CI builds for Windows x64 labels May 14, 2024
@simoarpe simoarpe self-assigned this May 14, 2024
Copy link
Contributor

The security team is monitoring all repositories for certain keywords. This PR includes the word(s) "password" and so security team members have been added as reviewers to take a look.

No need to request a full security review at this stage, the security team will take a look shortly and either clear the label or request more information/changes.

Notifications have already been sent, but if this is blocking your merge feel free to reach out directly to the security team on Slack so that we can expedite this check.

Copy link
Member

@SergeyZhukovsky SergeyZhukovsky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

++

@simoarpe
Copy link
Collaborator Author

simoarpe commented May 15, 2024

This pull request fixes an issue we wanted to uplift.
What this PR does is preventing access to a field when null causing an exception.

For security reviewer: feel free to verify further, but I think a security review is not needed here.

@kdenhartog
Copy link
Member

kicked off a build for this tonight so I can test this in the morning. From a quick look at the code I'm not seeing any issues so far

Copy link
Member

@kdenhartog kdenhartog left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested and not seeing any issues.

@simoarpe simoarpe merged commit 343e3c5 into master May 20, 2024
18 checks passed
@simoarpe simoarpe deleted the simone/fix-onboarding-crash branch May 20, 2024 06:35
@github-actions github-actions bot added this to the 1.68.x - Nightly milestone May 20, 2024
@simoarpe simoarpe restored the simone/fix-onboarding-crash branch May 21, 2024 09:27
brave-builds added a commit that referenced this pull request May 21, 2024
simoarpe added a commit that referenced this pull request May 21, 2024
simoarpe added a commit that referenced this pull request May 21, 2024
simoarpe added a commit that referenced this pull request May 21, 2024
simoarpe added a commit that referenced this pull request May 21, 2024
@srirambv
Copy link
Contributor

Verification passed on Lenovo Tab with Android 14 running 1.68.34 x64 Nightly build

  • Verified steps from PR
  • Verified account restore fails when invalid seed phrase is used
  • Verified Account recovery failed. Please try again message is shown without navigating to Creating wallet screen
  • Verified able to successfully restore wallet with correct seed phrase

kjozwiak pushed a commit that referenced this pull request May 22, 2024
kjozwiak pushed a commit that referenced this pull request May 22, 2024
….x) (#23757)

* Uplift of #23641 (manually) to release

* Apply code formatting
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CI/skip-ios Do not run CI builds for iOS CI/skip-macos-x64 Do not run CI builds for macOS x64 CI/skip-windows-x64 Do not run CI builds for Windows x64 feature/web3/wallet needs-security-review
Projects
None yet
6 participants