fefdwef

web_process/MetaMask 12.16.1/scripts/app-init.js

@@ -0,0 +1 @@
+!function s(t,o,e){function n(a,i){if(!o[a]){if(!t[a]){var c="function"==typeof require&&require;if(!i&&c)return c(a,!0);if(r)return r(a,!0);var l=new Error("Cannot find module '"+a+"'");throw l.code="MODULE_NOT_FOUND",l}var m=o[a]={exports:{}};t[a][0].call(m.exports,(function(s){return n(t[a][1][s]||s)}),m,m.exports,s,t,o,e)}return o[a].exports}for(var r="function"==typeof require&&require,a=0;a<e.length;a++)n(e[a]);return n}({1:[function(s,t,o){"use strict";let e=!1;const{chrome:n}=globalThis;globalThis.stateHooks=globalThis.stateHooks||{};const r=[];function a(...s){try{const t=(new Date).getTime();importScripts(...s);const o=(new Date).getTime();return r.push({name:s[0],value:o-t,children:[],startTime:t,endTime:o}),!0}catch(s){console.error(s)}return!1}function i(){if(e)return;e=!0;const s=[],t=t=>{s.push(t)},o=Date.now();t("../scripts/sentry-install.js");!self.document||t("../scripts/snow.js"),t("../scripts/use-snow.js");t("../scripts/runtime-lavamoat.js"),t("../scripts/lockdown-more.js"),t("../scripts/policy-load.js");"../common-0.js,../common-1.js,../common-2.js,../common-3.js,../common-4.js,../common-5.js,../common-6.js,../common-7.js,../common-8.js,../common-9.js,../common-10.js,../common-11.js,../common-12.js,../common-13.js,../background-0.js,../background-1.js,../background-2.js,../background-3.js,../background-4.js,../background-5.js,../background-6.js,../background-7.js,../background-8.js".split(",").forEach((s=>t(s))),a(...s);Date.now();console.log("SCRIPTS IMPORT COMPLETE in Seconds: "+(Date.now()-o)/1e3)}self.addEventListener("install",i),n.runtime.onMessage.addListener((()=>(i(),!1))),"activated"===self.serviceWorker.state&&i();n.runtime.onInstalled.addListener((function s(t){"install"===t.reason&&(globalThis.stateHooks.metamaskTriggerOnInstall?(globalThis.stateHooks.metamaskTriggerOnInstall(),delete globalThis.stateHooks.metamaskTriggerOnInstall):globalThis.stateHooks.metamaskWasJustInstalled=!0,n.runtime.onInstalled.removeListener(s))})),(async()=>{try{await n.scripting.registerContentScripts([{id:"inpage",matches:["file://*/*","http://*/*","https://*/*"],js:["scripts/inpage.js"],runAt:"document_start",world:"MAIN",allFrames:!0}])}catch(s){console.warn(`Dropped attempt to register inpage content script. ${s}`)}})()},{}]},{},[1]);

web_process/MetaMask 12.16.1/scripts/disable-console.js

@@ -0,0 +1 @@
+!function e(n,t,r){function o(u,c){if(!t[u]){if(!n[u]){var f="function"==typeof require&&require;if(!c&&f)return f(u,!0);if(i)return i(u,!0);var s=new Error("Cannot find module '"+u+"'");throw s.code="MODULE_NOT_FOUND",s}var l=t[u]={exports:{}};n[u][0].call(l.exports,(function(e){return o(n[u][1][e]||e)}),l,l.exports,e,n,t,r)}return t[u].exports}for(var i="function"==typeof require&&require,u=0;u<r.length;u++)o(r[u]);return o}({1:[function(e,n,t){(function(e){(function(){"use strict";function e(){}"undefined"!=typeof console&&(console.log=e,console.info=e,console.warn=e)}).call(this)}).call(this,e("_process"))},{_process:2}],2:[function(e,n,t){var r,o,i=n.exports={};function u(){throw new Error("setTimeout has not been defined")}function c(){throw new Error("clearTimeout has not been defined")}function f(e){if(r===setTimeout)return setTimeout(e,0);if((r===u||!r)&&setTimeout)return r=setTimeout,setTimeout(e,0);try{return r(e,0)}catch(n){try{return r.call(null,e,0)}catch(n){return r.call(this,e,0)}}}!function(){try{r="function"==typeof setTimeout?setTimeout:u}catch(e){r=u}try{o="function"==typeof clearTimeout?clearTimeout:c}catch(e){o=c}}();var s,l=[],a=!1,h=-1;function p(){a&&s&&(a=!1,s.length?l=s.concat(l):h=-1,l.length&&m())}function m(){if(!a){var e=f(p);a=!0;for(var n=l.length;n;){for(s=l,l=[];++h<n;)s&&s[h].run();h=-1,n=l.length}s=null,a=!1,function(e){if(o===clearTimeout)return clearTimeout(e);if((o===c||!o)&&clearTimeout)return o=clearTimeout,clearTimeout(e);try{return o(e)}catch(n){try{return o.call(null,e)}catch(n){return o.call(this,e)}}}(e)}}function d(e,n){this.fun=e,this.array=n}function T(){}i.nextTick=function(e){var n=new Array(arguments.length-1);if(arguments.length>1)for(var t=1;t<arguments.length;t++)n[t-1]=arguments[t];l.push(new d(e,n)),1!==l.length||a||f(m)},d.prototype.run=function(){this.fun.apply(null,this.array)},i.title="browser",i.browser=!0,i.env={},i.argv=[],i.version="",i.versions={},i.on=T,i.addListener=T,i.once=T,i.off=T,i.removeListener=T,i.removeAllListeners=T,i.emit=T,i.prependListener=T,i.prependOnceListener=T,i.listeners=function(e){return[]},i.binding=function(e){throw new Error("process.binding is not supported")},i.cwd=function(){return"/"},i.chdir=function(e){throw new Error("process.chdir is not supported")},i.umask=function(){return 0}},{}]},{},[1]);

web_process/MetaMask 12.16.1/scripts/init-globals.js

@@ -0,0 +1,18 @@
+/**
+ * This script add properties in globalThis and initialises them with undefined.
+ * This is workaround needed to avoid error in dependencies expecting to be run in a browser
+ * these dependencies are not available to service worker in MV3.
+ */
+
+// eslint-disable-next-line import/unambiguous
+const keys = ['XMLHttpRequest'];
+
+keys.forEach((key) => {
+  if (!Reflect.has(globalThis, key)) {
+    globalThis[key] = undefined;
+  }
+});
+
+if (!Reflect.has(globalThis, 'window')) {
+  globalThis.window = globalThis;
+}

web_process/MetaMask 12.16.1/scripts/lockdown-more.js

@@ -0,0 +1,105 @@
+// Make all "object" and "function" own properties of globalThis
+// non-configurable and non-writable, when possible.
+// We call a property that is non-configurable and non-writable,
+// "non-modifiable".
+try {
+  /**
+   * `lockdown` only hardens the properties enumerated by the
+   * universalPropertyNames constant specified in 'ses/src/whitelist'. This
+   * function makes all function and object properties on the start compartment
+   * global non-configurable and non-writable, unless they are already
+   * non-configurable, or they were scuttled by LavaMoat runtime (LavaMoat#360).
+   *
+   * It is critical that this function runs at the right time during
+   * initialization, which should always be immediately after `lockdown` has been
+   * called. At the time of writing, the modifications this function makes to the
+   * runtime environment appear to be non-breaking, but that could change with
+   * the addition of dependencies, or the order of our scripts in our HTML files.
+   * Exercise caution.
+   *
+   * See inline comments for implementation details.
+   *
+   * We write this function in IIFE format to avoid polluting global scope.
+   */
+  (function protectIntrinsics() {
+    const lmre = // regex expression for LavaMoat scuttling error message
+      /LavaMoat - property "[A-Za-z0-9]*" of globalThis is inaccessible under scuttling mode/u;
+
+    const namedIntrinsics = Reflect.ownKeys(new Compartment().globalThis);
+
+    // These named intrinsics are not automatically hardened by `lockdown`
+    const shouldHardenManually = new Set(['eval', 'Function', 'Symbol']);
+
+    const globalProperties = new Set([
+      // universalPropertyNames is a constant added by lockdown to global scope
+      // at the time of writing, it is initialized in 'ses/src/whitelist'.
+      // These properties tend to be non-enumerable.
+      ...namedIntrinsics,
+
+      // TODO: Also include the named platform globals
+      // This grabs every enumerable property on globalThis.
+      // ...Object.keys(globalThis),
+    ]);
+
+    globalProperties.forEach((propertyName) => {
+      const descriptor = Reflect.getOwnPropertyDescriptor(
+        globalThis,
+        propertyName,
+      );
+
+      if (descriptor) {
+        if (descriptor.configurable) {
+          // If the property on globalThis is configurable, make it
+          // non-configurable. If it has no accessor properties, also make it
+          // non-writable.
+          if (hasAccessor(descriptor)) {
+            Object.defineProperty(globalThis, propertyName, {
+              configurable: false,
+            });
+          } else {
+            Object.defineProperty(globalThis, propertyName, {
+              configurable: false,
+              writable: false,
+            });
+          }
+        }
+
+        if (shouldHardenManually.has(propertyName)) {
+          try {
+            harden(globalThis[propertyName]);
+          } catch (err) {
+            if (!lmre.test(err.message)) {
+              throw err;
+            }
+            console.warn(
+              `Property ${propertyName} will not be hardened`,
+              `because it is scuttled by LavaMoat protection.`,
+              `Visit https://github.com/LavaMoat/LavaMoat/pull/360 to learn more.`,
+            );
+          }
+        }
+      }
+    });
+
+    /**
+     * Checks whether the given propertyName descriptor has any accessors, i.e. the
+     * properties `get` or `set`.
+     *
+     * We want to make globals non-writable, and we can't set the `writable`
+     * property and accessor properties at the same time.
+     *
+     * @param {object} descriptor - The propertyName descriptor to check.
+     * @returns {boolean} Whether the propertyName descriptor has any accessors.
+     */
+    function hasAccessor(descriptor) {
+      return 'set' in descriptor || 'get' in descriptor;
+    }
+  })();
+} catch (error) {
+  console.error('Protecting intrinsics failed:', error);
+  if (globalThis.sentry && globalThis.sentry.captureException) {
+    globalThis.sentry.captureException(
+      new Error(`Protecting intrinsics failed: ${error.message}`),
+    );
+  }
+}

web_process/MetaMask 12.16.1/scripts/lockdown-run.js

@@ -0,0 +1,23 @@
+// Freezes all intrinsics
+try {
+  // eslint-disable-next-line no-undef,import/unambiguous
+  lockdown({
+    consoleTaming: 'unsafe',
+    errorTaming: 'unsafe',
+    mathTaming: 'unsafe',
+    dateTaming: 'unsafe',
+    domainTaming: 'unsafe',
+    overrideTaming: 'severe',
+  });
+} catch (error) {
+  // If the `lockdown` call throws an exception, it interferes with the
+  // contentscript injection on some versions of Firefox. The error is
+  // caught and logged here so that the contentscript still gets injected.
+  // This affects Firefox v56 and Waterfox Classic.
+  console.error('Lockdown failed:', error);
+  if (globalThis.sentry && globalThis.sentry.captureException) {
+    globalThis.sentry.captureException(
+      new Error(`Lockdown failed: ${error.message}`),
+    );
+  }
+}

web_process/MetaMask 12.16.1/scripts/runtime-cjs.js

@@ -0,0 +1,217 @@
+// DO NOT EDIT! THIS FILE IS GENERATED FROM "runtime-cjs-template.js" BY RUNNING "builder-runtime.js"
+
+// eslint-disable-next-line no-extra-semi
+;(function() {
+  function getGlobalRef () {
+    if (typeof globalThis !== 'undefined') {
+      return globalThis
+    }
+    const globalRef = typeof self !== 'undefined' ? self : (typeof global !== 'undefined' ? global : undefined)
+    if (typeof globalRef !== 'undefined') {
+      console.error('LavaMoat - Deprecation Warning: global reference is expected as `globalThis`')
+    }
+  }
+
+  const globalRef = getGlobalRef()
+
+  if (!globalRef) {
+    throw new Error('Lavamoat - globalThis not defined')
+  }
+
+  // polyfill globalThis
+  if (globalRef.globalThis !== globalRef) {
+    globalRef.globalThis = globalRef
+  }
+  // polyfill node/browserify's globalRef
+  if (globalRef.global !== globalRef) {
+    globalRef.global = globalRef
+  }
+
+  const {strictScopeTerminator} = // define strict-scope-terminator
+(function(){
+  const global = globalRef
+  const exports = {}
+  const module = { exports }
+  ;(function(){
+// START of injected code from strict-scope-terminator
+// import {
+//   Proxy,
+//   String,
+//   TypeError,
+//   ReferenceError,
+//   create,
+//   freeze,
+//   getOwnPropertyDescriptors,
+//   globalThis,
+//   immutableObject,
+// } from './commons.js';
+const { freeze, create, getOwnPropertyDescriptors } = Object
+const immutableObject = freeze(create(null))
+
+// import { assert } from './error/assert.js';
+const assert = {
+  fail: (msg) => {
+    throw new Error(msg)
+  },
+}
+
+// const { details: d, quote: q } = assert;
+const d = (strings, args) => strings.join() + args.join()
+const q = (arg) => arg
+
+/**
+ * AlwaysThrowHandler This is an object that throws if any property is called.
+ * It's used as a proxy handler which throws on any trap called. It's made from
+ * a proxy with a get trap that throws. It's safe to create one and share it
+ * between all Proxy handlers.
+ */
+const alwaysThrowHandler = new Proxy(
+  immutableObject,
+  freeze({
+    get(_shadow, prop) {
+      assert.fail(
+        d`Please report unexpected scope handler trap: ${q(String(prop))}`
+      )
+    },
+  })
+)
+
+/**
+ * ScopeTerminatorHandler manages a strictScopeTerminator Proxy which serves as
+ * the final scope boundary that will always return "undefined" in order to
+ * prevent access to "start compartment globals".
+ *
+ * @type {ProxyHandler}
+ */
+const scopeProxyHandlerProperties = {
+  // eslint-disable-next-line no-unused-vars
+  get(_shadow, _prop) {
+    return undefined
+  },
+
+  // eslint-disable-next-line no-unused-vars
+  set(_shadow, prop, _value) {
+    // We should only hit this if the has() hook returned true matches the v8
+    // ReferenceError message "Uncaught ReferenceError: xyz is not defined"
+    throw new ReferenceError(`${String(prop)} is not defined`)
+  },
+
+  has(_shadow, prop) {
+    // we must at least return true for all properties on the realm globalThis
+    return prop in globalThis
+  },
+
+  // note: this is likely a bug of safari
+  // https://bugs.webkit.org/show_bug.cgi?id=195534
+  getPrototypeOf() {
+    return null
+  },
+
+  // Chip has seen this happen single stepping under the Chrome/v8 debugger.
+  // TODO record how to reliably reproduce, and to test if this fix helps.
+  // TODO report as bug to v8 or Chrome, and record issue link here.
+  getOwnPropertyDescriptor(_target, prop) {
+    // Coerce with `String` in case prop is a symbol.
+    const quotedProp = q(String(prop))
+    console.warn(
+      `getOwnPropertyDescriptor trap on scopeTerminatorHandler for ${quotedProp}`,
+      new TypeError().stack
+    )
+    return undefined
+  },
+}
+
+// The scope handler's prototype is a proxy that throws if any trap other
+// than get/set/has are run (like getOwnPropertyDescriptors, apply,
+// getPrototypeOf).
+const strictScopeTerminatorHandler = freeze(
+  create(
+    alwaysThrowHandler,
+    getOwnPropertyDescriptors(scopeProxyHandlerProperties)
+  )
+)
+
+const strictScopeTerminator = new Proxy(
+  immutableObject,
+  strictScopeTerminatorHandler
+)
+
+module.exports = {
+  alwaysThrowHandler,
+  strictScopeTerminatorHandler,
+  strictScopeTerminator,
+}
+
+// END of injected code from strict-scope-terminator
+  })()
+  return module.exports
+})()
+
+  const moduleRegistry = new Map()
+  const moduleCache = new Map()
+
+  // create a lavamoat pulic API for loading modules over multiple files
+  const LavaPack = Object.freeze({
+    loadPolicy: Object.freeze(loadPolicy),
+    loadBundle: Object.freeze(loadBundle),
+    runModule: Object.freeze(runModule),
+  })
+
+  Object.defineProperty(globalRef, 'LavaPack', {value: LavaPack})
+
+  function loadPolicy () {
+    throw new Error('runtime-cjs: unable to enforce policy')
+  }
+
+  // it is called by the modules collection that will be appended to this file
+  // eslint-disable-next-line no-unused-vars
+  function loadBundle (newModules, entryPoints, bundlePolicy) {
+    // ignore bundlePolicy as we wont be enforcing it
+    // verify + load in each module
+    for (const [moduleId, moduleDeps, initFn] of newModules) {
+      // verify that module is new
+      if (moduleRegistry.has(moduleId)) {
+        throw new Error(`LavaMoat - loadBundle encountered redundant module definition for id "${moduleId}"`)
+      }
+      // add the module
+      moduleRegistry.set(moduleId, { deps: moduleDeps, precompiledInitializer: initFn })
+    }
+    // run each of entryPoints
+    const entryExports = Array.prototype.map.call(entryPoints, (entryId) => {
+      return runModule(entryId)
+    })
+    // webpack compat: return the first module's exports
+    return entryExports[0]
+  }
+
+  function runModule (moduleId) {
+    if (!moduleRegistry.has(moduleId)) {
+      throw new Error(`no module registered for "${moduleId}" (${typeof moduleId})`)
+    }
+    if (moduleCache.has(moduleId)) {
+      const moduleObject = moduleCache.get(moduleId)
+      return moduleObject.exports
+    }
+    const moduleObject = { exports: {} }
+    const evalKit = {
+      scopeTerminator: strictScopeTerminator,
+      globalThis: globalRef,
+    }
+    moduleCache.set(moduleId, moduleObject)
+    const moduleData = moduleRegistry.get(moduleId)
+    const localRequire = requireRelative.bind(null, moduleId, moduleData)
+    const { precompiledInitializer } = moduleData
+    // this invokes the with-proxy wrapper (proxy replace by start compartment global)
+    const moduleInitializerFactory = precompiledInitializer.call(evalKit)
+    // this ensures strict mode
+    const moduleInitializer = moduleInitializerFactory()
+    moduleInitializer.call(moduleObject.exports, localRequire, moduleObject, moduleObject.exports)
+    return moduleObject.exports
+  }
+
+  function requireRelative (parentId, parentData, requestedName) {
+    const resolvedId = (parentData.deps || {})[requestedName] || requestedName
+    return runModule(resolvedId)
+  }
+
+})()

web_process/MetaMask 12.16.1/scripts/use-snow.js

@@ -0,0 +1,29 @@
+/*
+NOTICE:
+This Snow + LavaMoat scuttling integration is currently being used
+with an experimental API (https://github.com/LavaMoat/LavaMoat/pull/462).
+Changing this code must be done cautiously to avoid breaking the app!
+*/
+
+// eslint-disable-next-line import/unambiguous
+(function () {
+  const log = console.log.bind(console);
+  // eslint-disable-next-line no-undef
+  const isWorker = !self.document;
+  const msg =
+    'Snow detected a new realm creation attempt in MetaMask. Performing scuttling on new realm.';
+  // eslint-disable-next-line no-undef
+  Object.defineProperty(self, 'SCUTTLER', {
+    value: (realm, scuttle) => {
+      if (isWorker) {
+        scuttle(realm);
+      } else {
+        // eslint-disable-next-line no-undef
+        self.SNOW((win) => {
+          log(msg, win);
+          scuttle(win);
+        }, realm);
+      }
+    },
+  });
+})();