diff --git a/packages/snap/snap.manifest.json b/packages/snap/snap.manifest.json index e018fb9..9bd910c 100644 --- a/packages/snap/snap.manifest.json +++ b/packages/snap/snap.manifest.json @@ -7,7 +7,7 @@ "url": "https://github.com/@greymass/antelope-snap.git" }, "source": { - "shasum": "ZRXhKVwCKT0RTuBwE7IcYbge2YkMkQ5ogyteqFnmuwc=", + "shasum": "+FP/f5IPNs8hzqU0H0eO767Pjdip+9AKgZnaM5kXcUo=", "location": { "npm": { "filePath": "dist/bundle.js", diff --git a/packages/snap/src/rpc.ts b/packages/snap/src/rpc.ts index bcf5a10..8bb9e76 100644 --- a/packages/snap/src/rpc.ts +++ b/packages/snap/src/rpc.ts @@ -29,6 +29,8 @@ export async function getPublicKey(request: AntelopeRequest): Promise { return String(await derivePublicKey(chain)); } +const MAX_TRANSACTION_LENGTH = 10000; + export async function signTransaction( request: AntelopeSignatureRequest, ): Promise { @@ -36,7 +38,27 @@ export async function signTransaction( if (!request.params?.transaction) { throw new Error('Missing transaction in request params'); } - const transaction = Transaction.from(JSON.parse(request.params.transaction)); + + // Check the length of the transaction string + if (request.params.transaction.length > MAX_TRANSACTION_LENGTH) { + throw new Error('Transaction data is too large'); + } + + let transactionData; + try { + // Attempt to parse the transaction data + transactionData = JSON.parse(request.params.transaction); + } catch (error) { + throw new Error(`Invalid JSON transaction data: ${(error as Error).stack}`); + } + + let transaction; + try { + // Attempt to create a Transaction object from the parsed data + transaction = Transaction.from(transactionData); + } catch (error) { + throw new Error(`Invalid transaction format: ${(error as Error).stack}`); + } // Load the appropriate chain definition if (!request.params?.chainId) {