Fix memory leak

packages/extension/src/background/actionHandlers.ts

@@ -6,6 +6,7 @@ import {
   ReviewTransactionResult,
   TransactionResult,
 } from "../shared/actionQueue/types"
+import { isDappMessageHasherAllowed } from "../shared/messageHasher"
 import { MessageType } from "../shared/messages"
 import { addNetwork, getNetworks } from "../shared/network"
 import { preAuthorize } from "../shared/preAuthorizations"
@@ -130,6 +131,12 @@ export const handleActionApproval = async (
 
     case "ALPH_SIGN_MESSAGE": {
       try {
+        if (!isDappMessageHasherAllowed(action.payload.messageHasher)) {
+          throw Error(
+            "Unsupported message hasher. Only the 'alephium' message hasher is accepted.",
+          )
+        }
+
         const account = await wallet.getAccount({
           address: action.payload.signerAddress,
           networkId: action.payload.networkId,

packages/extension/src/background/actionMessaging.ts

@@ -1,3 +1,4 @@
+import { isDappMessageHasherAllowed } from "../shared/messageHasher"
 import { ActionMessage } from "../shared/messages/ActionMessage"
 import { handleActionApproval, handleActionRejection } from "./actionHandlers"
 import { sendMessageToUi } from "./activeTabs"
@@ -57,6 +58,24 @@ export const handleActionMessage: HandleMessage<ActionMessage> = async ({
     }
 
     case "ALPH_SIGN_MESSAGE": {
+      if (!isDappMessageHasherAllowed(msg.data.messageHasher)) {
+        const rejectedActionHash = "rejected-unsupported-message-hasher"
+        await respond({
+          type: "ALPH_SIGN_MESSAGE_RES",
+          data: {
+            actionHash: rejectedActionHash,
+          },
+        })
+        return await respond({
+          type: "ALPH_SIGN_MESSAGE_FAILURE",
+          data: {
+            actionHash: rejectedActionHash,
+            error:
+              "Unsupported message hasher. Only the 'alephium' message hasher is accepted.",
+          },
+        })
+      }
+
       const { meta } = await actionQueue.push({
         type: "ALPH_SIGN_MESSAGE",
         payload: msg.data,

packages/extension/src/inpage/messageActions.ts

@@ -20,7 +20,10 @@ export function waitForMessage<
     predicate: (x: T) => boolean = () => true,
 ): Promise<T extends { data: infer S } ? S : undefined> {
   return new Promise((resolve, reject) => {
-    const pid = setTimeout(() => reject(new Error("Timeout")), timeout)
+    const pid = setTimeout(() => {
+      window.removeEventListener("message", handler)
+      reject(new Error("Timeout"))
+    }, timeout)
     const handler = (event: MessageEvent<WindowMessageType>) => {
       if (event.data.type === type && predicate(event.data as any)) {
         clearTimeout(pid)

packages/extension/src/shared/__test__/messageHasher.test.ts

@@ -0,0 +1,15 @@
+import { isDappMessageHasherAllowed, SAFE_DAPP_MESSAGE_HASHERS } from "../messageHasher"
+
+describe("isDappMessageHasherAllowed (dApp signMessage policy)", () => {
+  it("accepts only the domain-separated 'alephium' hasher", () => {
+    expect(SAFE_DAPP_MESSAGE_HASHERS[0]).toBe("alephium")
+    expect(SAFE_DAPP_MESSAGE_HASHERS[1]).toBe("sha256")
+    expect(isDappMessageHasherAllowed("alephium")).toBe(true)
+    expect(isDappMessageHasherAllowed("sha256")).toBe(true)
+  })
+
+  it("rejects every other hasher a dApp could request", () => {
+    expect(isDappMessageHasherAllowed("identity")).toBe(false)
+    expect(isDappMessageHasherAllowed("blake2b")).toBe(false)
+  })
+})

packages/extension/src/shared/messageHasher.ts

@@ -0,0 +1,6 @@
+import { MessageHasher } from "@alephium/web3"
+
+export const SAFE_DAPP_MESSAGE_HASHERS: MessageHasher[] = ["alephium", "sha256"]
+
+export const isDappMessageHasherAllowed = (messageHasher: MessageHasher): boolean =>
+  SAFE_DAPP_MESSAGE_HASHERS.includes(messageHasher)