feat: support lavamoat webpack plugin #30134

weizman · 2025-02-05T14:40:32Z

This PR focuses on preparing webpack plugin to work well with MetaMask effort to integrate it (see LavaMoat/LavaMoat#1526).

In order to do that, I had to:

b36e47a - add to the webpack config support in scuttling and unsafe context modules (this includes a new scuttling exception for webpack to avoid clashing with core webpack logic)
6c0201e - update policy json file
60239a4 - fix contentscript and inpage crashes so they don't clash with webpack core logic nor scuttling logic (see more feat: support lavamoat webpack plugin #30134 (comment))

These make it so that when integrated with the MetaMask PR, compilation and execution of the app works well

needs to be brough out of the webpack-processing pipeline in order for ses not to trip up on its own `eval`s

…ry, first steps in resolving who runs lockdown

github-actions · 2025-02-05T14:40:46Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2025-02-05T14:41:46Z

New dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@lavamoat/[email protected]	eval Transitive: environment	`+7`	9.54 MB	lmbot

View full report↗︎

socket-security · 2025-02-05T14:41:48Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
New author	npm/@lavamoat/[email protected]	New Author: lmbot Previous Author: boneskull	`package.json`	🚫
Obfuscated code	npm/@lavamoat/[email protected]	Confidence: 0.75 Location: Package overview	`package.json`	🚫
New author	npm/[email protected]	New Author: lmbot Previous Author: boneskull	`package.json`	🚫
New author	npm/[email protected]	New Author: lmbot Previous Author: boneskull	`package.json`	🚫

View full report↗︎

Next steps

What is new author?

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

What is obfuscated code?

Obfuscated files are intentionally packed to hide their behavior. This could be a sign of malware.

Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/@lavamoat/[email protected]
@SocketSecurity ignore npm/[email protected]
@SocketSecurity ignore npm/[email protected]

development/webpack/webpack.config.ts

+      generatePolicy: true,
+      runChecks: true, // Candidate to disable later for performance. useful in debugging invalid JS errors, but unless the audit proves me wrong this is probably not improving security.
+      readableResourceIds: true,
+      inlineLockdown: /^runtime|contentscript\.js/u,


To fix the problem, we need to ensure that both parts of the regular expression are properly anchored. This can be done by using non-capturing groups and applying the ^ anchor to both alternatives. The corrected regular expression should be /^(runtime|contentscript\.js)/u.

weizman · 2025-02-18T14:43:30Z

Update:

inpage failed because it tried to access chrome which was scuttled by contentscript
I fixed that temporarily by making inpage run before contentscript (instead of the opposite), but also changed inpage to add the textContent script asynchronously instead of synchronously, so that the actual logic runs only after contentscript as it should
- this is probably not the right way to go about it, because it changes order of execution which most likely will cause problems
In addition, I identified this bug in my lavamoat pr feat(webpack): introduce enhancements to support webpack integration LavaMoat/LavaMoat#1526 (comment) which caused another error and prevented inpage from working
Given the temp change above (which should still be properly addressed) and the lavamoat bug fix, inpage now seems to load error-free

weizman · 2025-02-19T10:25:52Z

Update:

13c545d makes inpage work properly without the need for replacing the order of it with contentscript
solved by:
- moving the injection logic to a function that is declared in contentscript instead of inpage, where the scuttled primordials are still accessible
- set the function to a globally accessible object (such as the document)
- reducing inpage to just grabbing that function from the document object and invoking it
This results in the same effect, but without the errors

…lash

legobeat and others added 15 commits February 5, 2025 16:33

wip: allow enabling lavamoat

34f0f71

wip: allow running lavamoat under webpack build

8683ec6

add webpack lavamoat policy

7256344

wip(mv3): move lockdown-install step

24c2bea

revertme: remove lockdown scripts for testing purposes

c33364a

wip: move lockdown injection

d88d837

needs to be brough out of the webpack-processing pipeline in order for ses not to trip up on its own `eval`s

wip(webpack): add @lavamoat/webpack plugin

8e78ca8

fixup submodules

2630fad

wip: add @lavamoat/webpack

b6ddcea

fix: set up LavaMoat webpack plugin for use from neighboring reposito…

67402f2

…ry, first steps in resolving who runs lockdown

fix: inline lockdown instead of using one from the extension

172e57c

fix: policy override for a missing fetch

aa747be

fix: allow setTimeout for lodash - it was not detected in policy gen.

8754a95

chore: more updates to policy

d338164

fix: make lavamoat setup conditional

fe7c561

metamaskbot added the team-lavamoat label Feb 5, 2025

metamaskbot added the INVALID-PR-TEMPLATE PR's body doesn't match template label Feb 5, 2025

github-advanced-security bot found potential problems Feb 5, 2025

View reviewed changes

development/webpack/webpack.config.ts Fixed Show fixed Hide fixed

weizman mentioned this pull request Feb 5, 2025

draft - try handle 2m old diff #30073

Closed

github-advanced-security bot found potential problems Feb 5, 2025

View reviewed changes

weizman mentioned this pull request Feb 5, 2025

feat(webpack): introduce enhancements to support webpack integration LavaMoat/LavaMoat#1526

Draft

weizman force-pushed the webpack-lavamoat-new branch from 79d1b01 to 13c545d Compare February 24, 2025 15:43

chore: configure inpage script to run unlocked

b4347e7

weizman force-pushed the webpack-lavamoat-new branch from 13c545d to cb6fbb0 Compare February 24, 2025 15:52

feat: add scuttling and context modules support

b36e47a

weizman added 2 commits February 24, 2025 17:55

chore: update policy file

6c0201e

feat: reorder inpage and contentscript execution to avoid scuttling c…

60239a4

…lash

weizman force-pushed the webpack-lavamoat-new branch from cb6fbb0 to 60239a4 Compare February 24, 2025 15:55

weizman changed the title ~~draft - try handle 2m old diff~~ feat: support lavamoat webpack plugin Feb 24, 2025

@@ -191,3 +191,3 @@
                   readableResourceIds: true,
-                  inlineLockdown: /^runtime|contentscript\.js/u,
+                  inlineLockdown: /^(runtime|contentscript\.js)/u,
                   unlockedChunksUnsafe: /inpage\.js/u,

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support lavamoat webpack plugin #30134

feat: support lavamoat webpack plugin #30134

weizman commented Feb 5, 2025 •

edited

Loading

github-actions bot commented Feb 5, 2025

socket-security bot commented Feb 5, 2025 •

edited

Loading

socket-security bot commented Feb 5, 2025 •

edited

Loading

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

weizman commented Feb 18, 2025 •

edited

Loading

weizman commented Feb 19, 2025

feat: support lavamoat webpack plugin #30134

Are you sure you want to change the base?

feat: support lavamoat webpack plugin #30134

Conversation

weizman commented Feb 5, 2025 • edited Loading

github-actions bot commented Feb 5, 2025

socket-security bot commented Feb 5, 2025 • edited Loading

socket-security bot commented Feb 5, 2025 • edited Loading

Next steps

weizman commented Feb 18, 2025 • edited Loading

weizman commented Feb 19, 2025

weizman commented Feb 5, 2025 •

edited

Loading

socket-security bot commented Feb 5, 2025 •

edited

Loading

socket-security bot commented Feb 5, 2025 •

edited

Loading

weizman commented Feb 18, 2025 •

edited

Loading