feat(mobile): prevent 3rd party access our packages

trezor · Feb 19, 2025 · c851f55 · c851f55
1 parent 8586a18
commit c851f55
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/suite-native/app/metro.config.js b/suite-native/app/metro.config.js
@@ -9,6 +9,8 @@ const defaultSourceExts = jsonExpoConfig.resolver.sourceExts;
 const additionalSOurceExts = process.env.RN_SRC_EXT ? process.env.RN_SRC_EXT.split(',') : [];
 const sourceExts = [...additionalSOurceExts, ...defaultSourceExts];
 
+const TREZOR_PACKAGES_SCOPES = ['@trezor', '@suite-common', '@suite-native'];
+
 /**
  * Metro configuration
  * https://facebook.github.io/metro/docs/configuration
@@ -36,6 +38,14 @@ const config = {
         },
         sourceExts,
         resolveRequest: (context, moduleName, platform) => {
+            if (
+                TREZOR_PACKAGES_SCOPES.some(scope => moduleName.includes(scope)) &&
+                context.originModulePath.includes('node_modules/')
+            ) {
+                throw new Error(
+                    `SECURITY ALERT: Some 3rd party package is using our interal packages or Connect! Please check this file: ${context.originModulePath}`,
+                );
+            }
             // index 0 refers to suite-native/app node_modules directory
             const rootNodeModulesPath = context.nodeModulesPaths[1];