Add allowed origins check while signining messages

src/hooks/useGetOrCreateAccounts.ts

@@ -6,7 +6,7 @@ import useAccountsData from "./useAccountsData";
 import { useNetworks } from "../context/NetworksContext";
 import { useAccounts } from "../context/AccountsContext";
 
-const REACT_APP_ALLOWED_URLS = process.env.REACT_APP_ALLOWED_URLS
+const REACT_APP_ALLOWED_URLS = process.env.REACT_APP_ALLOWED_URLS;
 
 const useGetOrCreateAccounts = () => {
   const { networksData } = useNetworks();

src/screens/AutoSignIn.tsx

@@ -7,7 +7,7 @@ import { sendMessage } from '../utils/misc';
 import useAccountsData from '../hooks/useAccountsData';
 import useGetOrCreateAccounts from '../hooks/useGetOrCreateAccounts';
 
-const REACT_APP_ALLOWED_URLS = process.env.REACT_APP_ALLOWED_URLS
+const REACT_APP_ALLOWED_URLS = process.env.REACT_APP_ALLOWED_URLS;
 
 export const AutoSignIn = () => {
   const { networksData } = useNetworks();

src/screens/SignMessageEmbed.tsx

@@ -16,6 +16,8 @@ import { getCosmosAccounts, retrieveSingleAccount } from '../utils/accounts';
 import { getMnemonic, getPathKey, sendMessage } from '../utils/misc';
 import { COSMOS } from '../utils/constants';
 
+const REACT_APP_ALLOWED_URLS = process.env.REACT_APP_ALLOWED_URLS;
+
 type SignRequestProps = NativeStackScreenProps<StackParamsList, 'sign-request-embed'>;
 
 const SignMessageEmbed = ({ route }: SignRequestProps) => {
@@ -70,7 +72,6 @@ const SignMessageEmbed = ({ route }: SignRequestProps) => {
     }
   };
 
-
   const rejectRequestHandler = async () => {
     if (sourceWindow && origin) {
       sendMessage(
@@ -87,6 +88,19 @@ const SignMessageEmbed = ({ route }: SignRequestProps) => {
     const handleCosmosSignMessage = async (event: MessageEvent) => {
       if (event.data.type !== 'SIGN_ZENITH_MESSAGE') return;
 
+
+      if (!REACT_APP_ALLOWED_URLS) {
+        console.log('allowed URLs are not set.');
+        return;
+      }
+
+      const allowedUrls = REACT_APP_ALLOWED_URLS.split(',').map(url => url.trim());
+
+      if (!allowedUrls.includes(event.origin)) {
+        console.log('Unauthorized app.');
+        return;
+      }
+
       try {
         const { signerAddress, signDoc } = event.data.params;
 
@@ -102,7 +116,7 @@ const SignMessageEmbed = ({ route }: SignRequestProps) => {
           event.data.chainId,
           signerAddress,
         );
-        
+
         setDisplayAccount(requestAccount);
         setIsLoading(false);
       } catch (err) {

stack/stack-orchestrator/stack/laconic-wallet-web/README.md

@@ -49,6 +49,9 @@ Instructions for running the `laconic-wallet-web` using [laconic-so](https://git
   # WalletConnect project ID, same should be used in the laconic-wallet
   WALLET_CONNECT_ID=
 
+  # Allowed urls is a comma separated list of allowed urls
+  CERC_ALLOWED_URLS=
+
   # Optional
 
   # WalletConnect code for hostname verification
@@ -63,9 +66,6 @@ Instructions for running the `laconic-wallet-web` using [laconic-so](https://git
 
   # RPC endpoint of laconicd node (default: https://laconicd.laconic.com)
   CERC_LACONICD_RPC_URL=
-
-  # Allowed urls is a comma separated list of allowed urls for auto-sign-in route
-  CERC_ALLOWED_URLS=
   ```
 
 ## Start the deployment