@metamask/inpage-provider - npm Package Compare versions

Comparing version 5.0.0 to 5.0.1

package.json

 {
   "name": "@metamask/inpage-provider",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "A JavaScript Ethereum provider that connects over a WebExtension port.",
@@ -5,0 +5,0 @@ "main": "index.js",

README.md

@@ -29,1 +29,6 @@ # MetaMask Inpage Provider
 ```
+
+### Do Not Modify the Provider
+
+The Provider object should not be mutated by consumers under any circumstances.
+The maintainers of this package will neither fix nor take responsbility for bugs caused by third parties mutating the provider object.

src/initProvider.js

@@ -9,3 +9,4 @@ const MetamaskInpageProvider = require('./MetamaskInpageProvider')
    * @param {number} opts.maxEventListeners - The maximum number of event listeners.
-   * @param {boolean} opts.preventPropertyDeletion - Whether to wrap the provider in a proxy that prevents property deletion.
+   * @param {boolean} opts.protectProperties - Whether to wrap the provider
+   * in a proxy that prevents property deletion and some property overwrites.
    * @param {boolean} opts.shouldSendMetadata - Whether the provider should send page metadata.
@@ -18,7 +19,14 @@ * @param {boolean} opts.shouldSetOnWindow - Whether the provider should be set as window.ethereum
   maxEventListeners = 100,
-  preventPropertyDeletion = true,
+  protectProperties = true,
   shouldSendMetadata = true,
   shouldSetOnWindow = true,
-}) {
+} = {}) {
 
+  // public, non-deprecated properties
+  const PROTECTED_PROPERTIES = new Set([
+    '_metamask',
+    'isMetaMask',
+    'request',
+  ])
+
   if (!connectionStream) {
@@ -32,7 +40,13 @@ throw new Error('Must provide a connection stream.')
 
-  if (preventPropertyDeletion) {
-    // Workaround for web3@1.0 deleting the bound `sendAsync` but not the unbound
-    // `sendAsync` method on the prototype, causing `this` reference issues
+  if (protectProperties) {
+    // Some libraries, e.g. web3@1.x, mess with our API.
     provider = new Proxy(provider, {
       deleteProperty: () => true,
+      set: (target, prop, value, receiver) => {
+        if (PROTECTED_PROPERTIES.has(prop)) {
+          throw new Error(`MetaMask: Overwriting 'ethereum.${prop}' is forbidden.`)
+        } else {
+          return Reflect.set(target, prop, value, receiver)
+        }
+      },
     })
@@ -39,0 +53,0 @@ }

No alert changes

Improved metrics

Total package byte prevSize

32942

increased by1.79%

Lines of code

795

increased by1.66%

Number of lines in readme file

34

increased by17.24%

No dependency changes