feat(connector)_: do not allow override clientId for http connection

Author: friofry

services/connector/api.go

@@ -10,7 +10,8 @@ import (
 )
 
 var (
-	ErrInvalidResponseFromForwardedRpc = errors.New("invalid response from forwarded RPC")
+	ErrInvalidResponseFromForwardedRpc         = errors.New("invalid response from forwarded RPC")
+	ErrCannotOverrideClientIDForHttpConnection = errors.New("cannot override clientId for HTTP connection")
 )
 
 type API struct {
@@ -96,6 +97,11 @@ func (api *API) CallRPC(ctx context.Context, inputJSON string) (interface{}, err
 		return "", err
 	}
 
+	// This prevents external clients from spoofing ClientID to impersonate trusted clients
+	if IsUntrustedConnection(ctx) && request.ClientID != "" {
+		return "", ErrCannotOverrideClientIDForHttpConnection
+	}
+
 	if command, exists := api.r.GetCommand(request.Method); exists {
 		return command.Execute(ctx, request)
 	}

services/connector/api_test.go

@@ -37,9 +37,20 @@ func TestCallRPC(t *testing.T) {
 			request:     "{\"method\": \"wallet_switchEthereumChain\", \"params\": []}",
 			expectError: commands.ErrRequestMissingDAppData,
 		},
+		{
+			request: `{
+				"method": "eth_chainId",
+				"params": [],
+				"url": "https://example.com",
+				"name": "Example DApp",
+				"iconUrl": "https://example.com/icon.png",
+				"clientId": "wallet-connect"
+			}`,
+			expectError: ErrCannotOverrideClientIDForHttpConnection,
+		},
 	}
 
-	ctx := context.Background()
+	ctx := WithConnectionType(context.Background(), ConnectionTypeHTTP)
 	for _, tt := range tests {
 		t.Run(tt.request, func(t *testing.T) {
 			_, err := state.api.CallRPC(ctx, tt.request)

services/connector/commands/client_handler.go

@@ -126,11 +126,6 @@ func (c *ClientSideHandler) RecallDAppPermissions(args RecallDAppPermissionsArgs
 		return ErrEmptyUrl
 	}
 
-	// For backward compatibility with old clients(browser extension) that don't provide clientId
-	if args.ClientID == "" {
-		args.ClientID = DefaultClientID
-	}
-
 	dApp, err := persistence.SelectDApp(c.Db, args.URL, args.ClientID)
 	if err != nil {
 		return err

services/connector/commands/rpc_traits.go

@@ -113,9 +113,5 @@ func (r *RPCRequest) Validate() error {
 		return ErrRequestMissingDAppData
 	}
 
-	// Browser extension doesn't send ClientID
-	if r.ClientID == "" {
-		r.ClientID = DefaultClientID
-	}
 	return nil
 }