feat: add SES to wallet-mobile #420

andreabadesso · 2024-01-22T17:20:59Z

Motivation

We want to defend against supply chain attacks as those kind of attacks have already hit the cryptocurrency ecosystem and present a significant risk for our developers and users of our wallets and apps.

This PR is part of a series of PRs using a set of tools called LavaMoat to improve security on our Javascript projects with a set of good defaults, preventing us from having to rewrite them from scratch

Important: SES is not yet fully compatible with react-native, there is a compatibility tracker issue here

What is not yet supported (that affect us)?

Also, to prevent multiple patches in react-native, we had to inject SES in a patch to react-native's initializeCore method, so it gets loaded before anything else in our bundle

Acceptance Criteria

We should be able to defend agains't prototype pollution and poisoning attacks coming from the installed libs and their dependencies by using SES
We should have control over which dependencies are able to run postinstall scripts, blocking all the rest by using LavaMoat allow-scripts
We should use the hathor-unleash-client instead of the official unleash javascript client, which is a watered-down version of it, with only the features we use
We should inject SES as soon as possible, so we should patch react-native to inject it before react-native initialization

Security Checklist

Make sure you do not include new dependencies in the project unless strictly necessary and do not include dev-dependencies as production ones. More dependencies increase the possibility of one of them being hijacked and affecting us.

package.json

README.md

tuliomir

question: It looks good to me, but I feel there's something missing on the documentation on how to maintain the code from now on.

When we add new dependencies, should we change anything on the lavamoat files, or only on the "lavamoat" config inside the package.json?

thought: Since this will be a primary concern for any modifications on our dependencies, I think it's important to document it better on the readme file. Both for Hathor Labs devs and for the community members that wish to contribute.

package.json

README.md

lockdown.umd.js

naugtur · 2024-02-06T09:54:30Z

Hi. I think we could chat about what we're working on in LavaMoat. Get in touch if you think so too :)

andreabadesso · 2024-02-06T14:51:11Z

Hi. I think we could chat about what we're working on in LavaMoat. Get in touch if you think so too :)

Hey @naugtur, thanks for reaching out!

I've just sent you a DM on twitter, please tell me if this is the best way to contact you

naugtur · 2024-04-12T21:11:40Z

Update on our progress:

we're making changes to SES lockdown that will let it work under Hermes. (Currently only async support is problematic)
of you want runtime protections and can switch away from Hermes, any other engine can work. Current release of the webpack plugin is working for web targets. If you use the webpack based build tool from Callstack you could try out lavamoat plugin for webpack. We're planning to test.it ourselves after the work on SES above.

BTW
Consider just switching to socketsupply.co

src/sagas/ses.js

tuliomir · 2024-04-22T15:38:02Z

src/sagas/ses.js

+    // SES was enabled, we should disable it in storage which gets read in the
+    // react-native initialization (more on this in patches/react-native+0.72.5.patch)
+    // and restart the react-native bundle.
+    disableSes();


question: If there is a problem with the Unleash connection or with the MMKV storage, is there a chance of the application entering an infinite loop of self restarting?

If there is a problem with the Unleash connection, we would default to false (we could also default to true, not sure if we want to do this in the first release though), which would cause this method to be called

If there is a problem with the MMKV storage it would indeed cause a infinite restart loop, but I don't see how this could happen without us catching it in QA or internal tests...

I would suggest adding a comment or opening an issue/KTLO to address this in the future.

I agree that the QA would get this situation, but our QA is pretty big already and there is a possibility of human error.

In my opinion, this is not critical enough to demand a fix right now, but it's a nice to have for future improvements as a KTLO.

src/sagas/ses.js

tuliomir · 2024-04-24T16:22:43Z

src/sagas/ses.js

+    // SES was enabled, we should disable it in storage which gets read in the
+    // react-native initialization (more on this in patches/react-native+0.72.5.patch)
+    // and restart the react-native bundle.
+    disableSes();


I would suggest adding a comment or opening an issue/KTLO to address this in the future.

I agree that the QA would get this situation, but our QA is pretty big already and there is a possibility of human error.

In my opinion, this is not critical enough to demand a fix right now, but it's a nice to have for future improvements as a KTLO.

tuliomir · 2024-04-24T16:23:13Z

src/sagas/ses.js

+const storage = new MMKV();
+
+function disableSes(restart = true) {
+  logger.debug('Disabling SAS');


Suggested change

logger.debug('Disabling SAS');

logger.debug('Disabling SES');

Fixed! Thanks

package.json

src/sagas/ses.js

SES_AND_LAVAMOAT.md

patches/react-native+0.72.5.patch

package.json

patches/intl+1.2.5.patch

package.json

Reviewed all threads

andreabadesso requested a review from pedroferreira1 as a code owner January 22, 2024 17:20

andreabadesso self-assigned this Jan 22, 2024

andreabadesso added the enhancement New feature or request label Jan 22, 2024

andreabadesso force-pushed the feat/lavamoat-integration branch 2 times, most recently from 2479ce2 to 4b42122 Compare January 29, 2024 16:53

andreabadesso changed the base branch from dev to refactor/using-hathor-unleash-client January 29, 2024 18:27

andreabadesso force-pushed the feat/lavamoat-integration branch 2 times, most recently from e7261a1 to 752c1db Compare January 30, 2024 14:52

andreabadesso requested review from r4mmer and tuliomir and removed request for r4mmer January 30, 2024 16:10

msbrogli previously requested changes Jan 30, 2024

View reviewed changes

package.json Outdated Show resolved Hide resolved

README.md Show resolved Hide resolved

tuliomir reviewed Jan 31, 2024

View reviewed changes

package.json Show resolved Hide resolved

README.md Show resolved Hide resolved

lockdown.umd.js Outdated Show resolved Hide resolved

Base automatically changed from refactor/using-hathor-unleash-client to master February 8, 2024 15:34

andreabadesso force-pushed the feat/lavamoat-integration branch from 8ecb435 to 0628d10 Compare February 15, 2024 14:00

andreabadesso force-pushed the feat/lavamoat-integration branch from 0628d10 to a54da44 Compare March 25, 2024 18:02

andreabadesso requested review from msbrogli and tuliomir April 12, 2024 16:23

andreabadesso force-pushed the feat/lavamoat-integration branch from d3f602a to 98b3ac1 Compare April 15, 2024 16:18

tuliomir reviewed Apr 22, 2024

View reviewed changes

tuliomir mentioned this pull request Apr 22, 2024

feat: enable walletconnect #450

Open

1 task

tuliomir approved these changes Apr 24, 2024

View reviewed changes

pedroferreira1 reviewed Oct 24, 2024

View reviewed changes

andreabadesso changed the title ~~feat: lavamoat integration~~ feat: add SES to wallet-mobile Oct 28, 2024

pedroferreira1 reviewed Nov 4, 2024

View reviewed changes

patches/intl+1.2.5.patch Outdated Show resolved Hide resolved

package.json Outdated Show resolved Hide resolved

pedroferreira1 approved these changes Nov 5, 2024

View reviewed changes

refactor: feature toggle using hathor unleash client

e9c110e

andreabadesso added 21 commits November 6, 2024 22:41

chore: added postinstall to setup script and updated packages

76effcc

chore: fixed allow-scripts version

b7dae59

chore: added patch-package to postinstall

c65da15

chore: added MKMV to podfile.lock

b04fd0b

chore: reading ses enabled from constant

f84d24d

feat: yield fatal error when SES should be enabled but is not

c1540f0

refactor: improved verifySesEnabled method

41b35f9

feat: update SES to 1.5.0

b95b273

feat: patched intl to work in SES

0ae27ef

refactor: updated react-native patch import order

fc4c613

feat: improved logging and updated podfile with sentry update and mmkv

7c8b645

fix: typo

64b89bd

docs: improved comment on unleash disabled

1e301c6

refactor: use isSESEnabled

fdcd8e3

chore: updated sha256sums

4ff93b0

docs: updated SES_AND_LAVAMOAT document with better explanation on SES

aed3d0c

refactor: disabled hermes on android

045e9e9

refactor: updated react-native patch, removed unused changes

aa85a21

refactor: updated intl patch to remove unused implementation

9b51b60

chore: added comment on react-native patch

8e8af18

chore: removed exit 1 from preinstall on root

bb4f43a

andreabadesso force-pushed the feat/lavamoat-integration branch from 6084586 to 4c95a93 Compare November 7, 2024 01:42

chore: updated intl patch to add a comment

e9a0644

andreabadesso force-pushed the feat/lavamoat-integration branch from 4c95a93 to e9a0644 Compare November 7, 2024 01:43

pedroferreira1 removed the request for review from msbrogli November 7, 2024 01:46

andreabadesso and others added 2 commits November 7, 2024 07:50

fix: updated translation files

c691226

chore: remove unused actions, reducer and saga effect

0e8cdc4

andreabadesso merged commit 2a65bf2 into master Nov 7, 2024
1 check passed

andreabadesso deleted the feat/lavamoat-integration branch November 7, 2024 10:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add SES to wallet-mobile #420

feat: add SES to wallet-mobile #420

andreabadesso commented Jan 22, 2024 •

edited

Loading

tuliomir left a comment

naugtur commented Feb 6, 2024

andreabadesso commented Feb 6, 2024

naugtur commented Apr 12, 2024

tuliomir Apr 22, 2024

andreabadesso Apr 24, 2024

tuliomir Apr 24, 2024

tuliomir Apr 24, 2024

tuliomir Apr 24, 2024

andreabadesso Nov 4, 2024

	logger.debug('Disabling SAS');
	logger.debug('Disabling SES');

feat: add SES to wallet-mobile #420

feat: add SES to wallet-mobile #420

Conversation

andreabadesso commented Jan 22, 2024 • edited Loading

Motivation

Acceptance Criteria

Security Checklist

tuliomir left a comment

Choose a reason for hiding this comment

naugtur commented Feb 6, 2024

andreabadesso commented Feb 6, 2024

naugtur commented Apr 12, 2024

tuliomir Apr 22, 2024

Choose a reason for hiding this comment

andreabadesso Apr 24, 2024

Choose a reason for hiding this comment

tuliomir Apr 24, 2024

Choose a reason for hiding this comment

tuliomir Apr 24, 2024

Choose a reason for hiding this comment

tuliomir Apr 24, 2024

Choose a reason for hiding this comment

andreabadesso Nov 4, 2024

Choose a reason for hiding this comment

andreabadesso commented Jan 22, 2024 •

edited

Loading