fix: handle non-url origins by 0xEdouardEth · Pull Request #623 · MetaMask/snap-solana-wallet

0xEdouardEth · 2026-06-25T13:51:35Z

Explanation

This PR updates the Solana Snap to handle request origins that are not valid URLs, such as the stable wallet-connect origin used by MetaMask Mobile WalletConnect multichain requests.

The Snap still uses valid URL origins for dapp display and Blockaid wallet metadata. Non-URL origins are now treated as in-app metadata at the Security Alerts API boundary, so values such as wallet-connect or internal MetaMask origins are not sent as dapp domains. Unknown invalid origins are hidden from confirmation UI instead of showing meaningless identifiers.

Solana sign-in requests still require a real URL origin, because the sign-in flow relies on the origin as a domain. If the origin is not a valid URL, the sign-in confirmation is rejected instead of building a misleading sign-in message.

Tests were added/updated for origin parsing, Security Alerts API metadata, transaction scan forwarding, confirmation rendering, and background refresh behavior.

References

Related to MetaMask Mobile PR: refactor(walletconnect): use stable origin for Tron snap requests metamask-mobile#32339
Related Tron Snap PR: fix: handle non-url origins snap-tron-wallet#340

Checklist

I've updated the test suite for new or updated code as appropriate
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed
- N/A - no package changelog update needed for this internal behavior fix.
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them
- N/A - this does not introduce a breaking API change.

Validation

yarn eslint <changed files>

Result: passed.

ENVIRONMENT=test ... yarn workspace @metamask/solana-wallet-snap jest \
  packages/snap/src/core/clients/security-alerts-api/SecurityAlertsApiClient.test.ts \
  packages/snap/src/core/services/transaction-scan/TransactionScan.test.ts \
  packages/snap/src/core/utils/parseOrigin.test.ts \
  --runInBand --coverage=false

Result: 3 test suites passed, 32 tests passed.

Note: tests that install the local Snap require a matching generated bundle/manifest shasum. I did not commit generated bundle/manifest artifacts in this PR.

Note

Medium Risk
Touches confirmation and security-scan origin handling on signing paths; sign-in now hard-fails for WalletConnect/MetaMask origins, which is intentional but behavior-changing for those flows.

Overview
Adds first-class support for non-URL request origins such as wallet-connect and internal metamask, aligned with MetaMask Mobile WalletConnect multichain flows.

Origin parsing is centralized via KNOWN_ORIGIN_LABELS (case-insensitive labels for MetaMask and WalletConnect). parseOrigin now only accepts known origins or http(s) URLs; other schemes and malformed values throw clearer errors. New isKnownOrigin helper supports UI and flow guards.

Security scan still maps internal metamask to METAMASK_ORIGIN_URL for Blockaid; wallet-connect is forwarded unchanged to the Security Alerts API (new tests).

Sign-in confirmations reject known non-URL origins because sign-in needs a real dapp domain—WalletConnect/MetaMask metadata origins fail fast instead of building a misleading message.

Skipped Jest cases get jest/no-disabled-tests eslint comments only.

^{Reviewed by Cursor Bugbot for commit 2e14da0. Bugbot is set up for automated code reviews on this repo. Configure here.}

taran-a · 2026-06-29T09:56:50Z

+
+  it('returns false for other origins', () => {
+    expect(isKnownOrigin('https://example.com')).toBe(false);
+    expect(isKnownOrigin('metamask')).toBe(false);


metamask is the known origin according to isKnownOrigin, isn't it ?

yes correct!

Fixed in this commit: d63f072

Copilot

Pull request overview

This PR updates the Solana Snap’s origin handling so that certain stable non-URL origins (e.g., wallet-connect) are treated as known in-app origins rather than being parsed as URLs, and ensures sign-in flows reject known non-URL origins.

Changes:

Centralizes known-origin display handling via KNOWN_ORIGIN_LABELS and updates parseOrigin to only accept http(s) URLs or known-origin tokens.
Adds isKnownOrigin and uses it to hard-reject sign-in requests that come from known non-URL origins.
Updates/extends unit tests around origin parsing and transaction scan origin forwarding.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/snap/src/features/confirmation/views/ConfirmSignIn/render.tsx	Rejects known non-URL origins for sign-in confirmations.
packages/snap/src/core/utils/parseOrigin.ts	Adds known-origin mapping, restricts URL parsing to http(s), and exports `isKnownOrigin`.
packages/snap/src/core/utils/parseOrigin.test.ts	Expands tests for known origins, invalid origins, and `isKnownOrigin`.
packages/snap/src/core/services/transaction-scan/TransactionScan.ts	Clarifies (via comment) what origin shapes may be forwarded to the scan client.
packages/snap/src/core/services/transaction-scan/TransactionScan.test.ts	Adds coverage for MetaMask-origin mapping and WalletConnect origin forwarding.
packages/snap/src/core/constants/solana.ts	Introduces `WALLET_CONNECT_ORIGIN` and `KNOWN_ORIGIN_LABELS`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+import {
+  KNOWN_ORIGIN_LABELS,
+  WALLET_CONNECT_ORIGIN,
+} from '../constants/solana';


+describe('isKnownOrigin', () => {
+  it('returns true for the WalletConnect origin', () => {
+    expect(isKnownOrigin('wallet-connect')).toBe(true);
+  });
+
+  it('returns false for other origins', () => {
+    expect(isKnownOrigin('https://example.com')).toBe(false);
+    expect(isKnownOrigin('metamask')).toBe(false);
+    expect(isKnownOrigin(undefined)).toBe(false);
+  });
+});


    options?: string[];
    account?: SolanaKeyringAccount;
  }): Promise<TransactionScanResult | null> {
+    // The origin could be METAMASK_ORIGIN_URL, WALLET_CONNECT_ORIGIN or any valid URL.


sonarqubecloud · 2026-07-02T07:35:57Z

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

0xEdouardEth force-pushed the fix/validate-origin-url branch 2 times, most recently from f742c84 to 42b2163 Compare June 26, 2026 12:59

0xEdouardEth mentioned this pull request Jun 26, 2026

fix: handle non-url origins MetaMask/snap-tron-wallet#340

Open

4 tasks

0xEdouardEth force-pushed the fix/validate-origin-url branch from 42b2163 to dfb3939 Compare June 26, 2026 13:45

0xEdouardEth marked this pull request as ready for review June 26, 2026 13:45

0xEdouardEth requested a review from a team as a code owner June 26, 2026 13:45

cursor Bot reviewed Jun 26, 2026

View reviewed changes

Comment thread packages/snap/src/features/confirmation/views/ConfirmSignIn/render.tsx

Comment thread packages/snap/src/core/services/transaction-scan/TransactionScan.ts

0xEdouardEth force-pushed the fix/validate-origin-url branch 2 times, most recently from 7d7ad1d to 1cb7163 Compare June 26, 2026 13:54

fix: handle non-url origins

03982a5

0xEdouardEth force-pushed the fix/validate-origin-url branch from 1cb7163 to 03982a5 Compare June 26, 2026 13:56

taran-a reviewed Jun 29, 2026

View reviewed changes

Battambang requested a review from Copilot June 30, 2026 09:45

Copilot started reviewing on behalf of Battambang June 30, 2026 09:45 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

0xEdouardEth and others added 3 commits June 30, 2026 12:30

fix: tests

d63f072

fix: lint

09db026

Merge branch 'main' into fix/validate-origin-url

2e14da0

adonesky1 mentioned this pull request Aug 4, 2026

fix(walletconnect): restore per-session channel id as the Snap request origin MetaMask/metamask-mobile#34284

Open

7 tasks

Navigation Menu

Uh oh!

Uh oh!

fix: handle non-url origins - #623

fix: handle non-url origins#623
0xEdouardEth wants to merge 4 commits into
mainfrom
fix/validate-origin-url

0xEdouardEth commented Jun 25, 2026 •

edited by cursor Bot

Loading

Uh oh!

Uh oh!

Uh oh!

taran-a Jun 29, 2026

Uh oh!

adaOctopus Jul 6, 2026

Uh oh!

0xEdouardEth Jul 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

sonarqubecloud Bot commented Jul 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Uh oh!

Conversation

0xEdouardEth commented Jun 25, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

References

Checklist

Validation

Uh oh!

Uh oh!

Uh oh!

taran-a Jun 29, 2026

Choose a reason for hiding this comment

Uh oh!

adaOctopus Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

0xEdouardEth Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

sonarqubecloud Bot commented Jul 2, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

0xEdouardEth commented Jun 25, 2026 •

edited by cursor Bot

Loading