This is a proposal to do refactoring of the @metamask/providers StreamProvider and make its private methods and properties use #hash approach if possible. That way it would not be exposing methods and properties within its prototype chain which can be a security concern.
It is discovered that harden function from Secure EcmaScript which is used in Snaps and LavaMoat, is freezing some parts of the stream which makes it impossible to work. Because of that, a special way of using Proxy was introduced. By having a real private methods and properties it might be easier to secure this type of issues in the future.
This is a proposal to do refactoring of the
@metamask/providersStreamProviderand make its private methods and properties use#hashapproach if possible. That way it would not be exposing methods and properties within its prototype chain which can be a security concern.It is discovered that
hardenfunction from Secure EcmaScript which is used in Snaps and LavaMoat, is freezing some parts of the stream which makes it impossible to work. Because of that, a special way of using Proxy was introduced. By having a real private methods and properties it might be easier to secure this type of issues in the future.