Skip to content

Commit

Permalink
Disallow methods calls prefixed with 'personal_' from running with Al…
Browse files Browse the repository at this point in the history
…chemy Provider (#111)
  • Loading branch information
thebrianchen authored Mar 16, 2022
1 parent 8c8598f commit 21d823c
Showing 1 changed file with 12 additions and 3 deletions.
15 changes: 12 additions & 3 deletions src/web3-adapter/sendJsonRpcPayload.ts
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,10 @@ const ALCHEMY_DISALLOWED_METHODS: string[] = [
"eth_sign",
"eth_signTypedData_v3",
"eth_signTypedData",
"personal_sign",
];

const ALCHEMY_DISALLOWED_PREFIXES: string[] = ["personal"];

export interface JsonRpcPayloadSender {
sendJsonRpcPayload: SendJsonRpcPayloadFunction;
setWriteProvider(writeProvider: Provider | null | undefined): void;
Expand Down Expand Up @@ -89,9 +90,17 @@ function getDisallowedMethod(
payload: SingleOrBatchRequest,
): string | undefined {
const payloads = Array.isArray(payload) ? payload : [payload];

// Check if the payload method is a disallowed method or starts with a
// disallowed prefix.
const disallowedRequest =
payloads.find((p) => ALCHEMY_DISALLOWED_METHODS.indexOf(p.method) >= 0) ||
undefined;
payloads.find(
(p) =>
ALCHEMY_DISALLOWED_METHODS.indexOf(p.method) >= 0 ||
ALCHEMY_DISALLOWED_PREFIXES.some((prefix) =>
p.method.startsWith(prefix),
),
) || undefined;
return disallowedRequest && disallowedRequest.method;
}

Expand Down

0 comments on commit 21d823c

Please sign in to comment.