fix: replace legacy eth-json-rpc deps

.iyarc

@@ -1,3 +0,0 @@
-# ReDoS vulnerability, no impact to this application, and fix not backported yet to the versions we use
-
-GHSA-c2qf-rxjj-qqgw

.nvmrc

@@ -1 +1 @@
-20.12.2
+20.18.0

app/components/UI/Stake/Views/StakeInputView/StakeInputView.test.tsx

@@ -58,10 +58,10 @@ jest.mock('../../hooks/useStakeContext.ts', () => ({
     const stakeContext: Stake = {
       setSdkType: jest.fn(),
       sdkService: undefined
-    }
-    return stakeContext
+    };
+    return stakeContext;
   })
-}))
+}));
 
 jest.mock('../../hooks/useBalance', () => ({
   __esModule: true,

app/components/UI/Stake/Views/StakeInputView/StakeInputView.tsx

@@ -46,7 +46,7 @@ const StakeInputView = () => {
 
 
   const { sdkService } = useStakeContext();
-  
+
   const navigateToLearnMoreModal = () => {
     navigation.navigate('StakeModals', {
       screen: Routes.STAKING.MODALS.LEARN_MORE,

app/components/UI/Stake/sdk/stakeSdkProvider.tsx

@@ -68,4 +68,4 @@ export const StakeSDKProvider: React.FC<PropsWithChildren<StakeProviderProps>> =
       {children}
     </StakeContext.Provider>
   );
-};
+};

app/core/BackgroundBridge/BackgroundBridge.js

@@ -1,11 +1,11 @@
 /* eslint-disable import/no-commonjs */
 import URL from 'url-parse';
-import { JsonRpcEngine } from 'json-rpc-engine';
 import {
   createSelectedNetworkMiddleware,
   METAMASK_DOMAIN,
 } from '@metamask/selected-network-controller';
 import EthQuery from '@metamask/eth-query';
+import { JsonRpcEngine } from '@metamask/json-rpc-engine';
 import MobilePortStream from '../MobilePortStream';
 import { setupMultiplex } from '../../util/streams';
 import {
@@ -26,9 +26,9 @@ import snapMethodMiddlewareBuilder from '../Snaps/SnapsMethodMiddleware';
 import { SubjectType } from '@metamask/permission-controller';
 ///: END:ONLY_INCLUDE_IF
 
-const createFilterMiddleware = require('eth-json-rpc-filters');
-const createSubscriptionManager = require('eth-json-rpc-filters/subscriptionManager');
-const providerAsMiddleware = require('eth-json-rpc-middleware/providerAsMiddleware');
+const createFilterMiddleware = require('@metamask/eth-json-rpc-filters');
+const createSubscriptionManager = require('@metamask/eth-json-rpc-filters/subscriptionManager');
+import { providerAsMiddleware } from '@metamask/eth-json-rpc-middleware';
 const pump = require('pump');
 // eslint-disable-next-line import/no-nodejs-modules
 const EventEmitter = require('events').EventEmitter;
@@ -388,11 +388,7 @@ export class BackgroundBridge extends EventEmitter {
 
     pump(outStream, providerStream, outStream, (err) => {
       // handle any middleware cleanup
-      this.engine._middleware.forEach((mid) => {
-        if (mid.destroy && typeof mid.destroy === 'function') {
-          mid.destroy();
-        }
-      });
+      this.engine.destroy();
       if (err) Logger.log('Error with provider stream conn', err);
     });
   }

app/core/RPCMethods/RPCMethodMiddleware.test.ts

@@ -1,13 +1,14 @@
-import {
-  JsonRpcEngine,
+import { JsonRpcEngine, JsonRpcMiddleware } from '@metamask/json-rpc-engine';
+import type {
+  Json,
   JsonRpcFailure,
-  JsonRpcMiddleware,
+  JsonRpcParams,
   JsonRpcRequest,
   JsonRpcResponse,
   JsonRpcSuccess,
-} from 'json-rpc-engine';
+} from '@metamask/utils';
+import { type JsonRpcError, providerErrors, rpcErrors } from '@metamask/rpc-errors';
 import type { TransactionParams } from '@metamask/transaction-controller';
-import { providerErrors, rpcErrors } from '@metamask/rpc-errors';
 import Engine from '../Engine';
 import { store } from '../../store';
 import { getPermittedAccounts } from '../Permissions';
@@ -106,8 +107,8 @@ const jsonrpc = '2.0' as const;
  * @throws If the given value is not a valid {@link JsonRpcSuccess} object.
  */
 function assertIsJsonRpcSuccess(
-  response: JsonRpcResponse<unknown>,
-): asserts response is JsonRpcSuccess<unknown> {
+  response: JsonRpcResponse<Json>,
+): asserts response is JsonRpcSuccess<Json> {
   if ('error' in response) {
     throw new Error(`Response failed with error '${JSON.stringify('error')}'`);
   } else if (!('result' in response)) {
@@ -208,8 +209,8 @@ async function callMiddleware({
   middleware,
   request,
 }: {
-  middleware: JsonRpcMiddleware<unknown, unknown>;
-  request: JsonRpcRequest<unknown>;
+  middleware: JsonRpcMiddleware<JsonRpcParams, Json>;
+  request: JsonRpcRequest<JsonRpcParams>;
 }) {
   const engine = new JsonRpcEngine();
   engine.push(middleware);
@@ -416,7 +417,6 @@ describe('getRpcMethodMiddleware', () => {
       permissionController.createPermissionMiddleware({
         origin: hostMock,
       });
-    // @ts-expect-error JsonRpcId (number | string | void) doesn't match PS middleware's id, which is (string | number | null)
     engine.push(permissionMiddleware);
     const middleware = getRpcMethodMiddleware(getMinimalOptions());
     engine.push(middleware);
@@ -1097,7 +1097,8 @@ describe('getRpcMethodMiddleware', () => {
     it('returns a JSON-RPC error if an error is thrown when adding this transaction', async () => {
       // Omit `from` and `chainId` here to skip validation for simplicity
       // Downcast needed here because `from` is required by this type
-      const mockTransactionParameters = {} as TransactionParams;
+      const mockTransactionParameters = {} as (TransactionParams &
+        JsonRpcParams)[];
       // Transaction fails before returning a result
       mockAddTransaction.mockImplementation(async () => {
         throw new Error('Failed to add transaction');
@@ -1120,12 +1121,17 @@ describe('getRpcMethodMiddleware', () => {
       expect((response as JsonRpcFailure).error.message).toBe(
         expectedError.message,
       );
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      expect(((response as JsonRpcFailure).error as JsonRpcError<any>).data.cause.message).toBe(
+        expectedError.message,
+      );
     });
 
     it('returns a JSON-RPC error if an error is thrown after approval', async () => {
       // Omit `from` and `chainId` here to skip validation for simplicity
       // Downcast needed here because `from` is required by this type
-      const mockTransactionParameters = {} as TransactionParams;
+      const mockTransactionParameters = {} as (TransactionParams &
+        JsonRpcParams)[];
       setupGlobalState({
         addTransactionResult: Promise.reject(
           new Error('Failed to process transaction'),
@@ -1234,7 +1240,7 @@ describe('getRpcMethodMiddleware', () => {
         jsonrpc,
         id: 1,
         method: 'personal_ecRecover',
-        params: [undefined, helloWorldSignature],
+        params: [undefined, helloWorldSignature] as JsonRpcParams,
       };
       const expectedError = rpcErrors.internal('Missing data parameter');
 

app/core/RPCMethods/RPCMethodMiddleware.ts

@@ -1,6 +1,6 @@
 import { Alert } from 'react-native';
 import { getVersion } from 'react-native-device-info';
-import { createAsyncMiddleware } from 'json-rpc-engine';
+import { createAsyncMiddleware } from '@metamask/json-rpc-engine';
 import { providerErrors, rpcErrors } from '@metamask/rpc-errors';
 import {
   EndFlowOptions,
@@ -16,6 +16,7 @@ import {
   permissionRpcMethods,
 } from '@metamask/permission-controller';
 import { blockTagParamIndex, getAllNetworks } from '../../util/networks';
+import type { Hex } from '@metamask/utils';
 import { polyfillGasPrice } from './utils';
 import {
   processOriginThrottlingRejection,
@@ -112,7 +113,7 @@ export const checkActiveAccountAndChainId = async ({
   isWalletConnect,
 }: {
   address?: string;
-  chainId?: number;
+  chainId?: Hex;
   channelId?: string;
   hostname: string;
   isWalletConnect: boolean;
@@ -224,7 +225,7 @@ const generateRawSignature = async ({
   title: { current: string };
   icon: { current: string | undefined };
   analytics: { [key: string]: string | boolean };
-  chainId: number;
+  chainId: Hex;
   isMMSDK: boolean;
   channelId?: string;
   getSource: () => string;
@@ -521,7 +522,7 @@ export const getRpcMethodMiddleware = ({
             chainId,
           }: {
             from?: string;
-            chainId?: number;
+            chainId?: Hex;
           }) => {
             // TODO this needs to be modified for per dapp selected network
             await checkActiveAccountAndChainId({

app/core/RPCMethods/createLegacyMethodMiddleware/index.test.ts

@@ -2,7 +2,7 @@ import {
   JsonRpcEngine,
   JsonRpcEngineEndCallback,
   JsonRpcEngineNextCallback,
-} from 'json-rpc-engine';
+} from '@metamask/json-rpc-engine';
 import {
   Json,
   JsonRpcParams,
@@ -150,6 +150,10 @@ describe('createLegacyMethodMiddleware', () => {
     });
     assertIsJsonRpcFailure(response);
 
+    // Type assertion for the error not having cause object
+    const errorData = response.error.data as { cause?: Error };
+
+    expect(errorData.cause?.message).toBe('test error');
     expect(response.error.message).toBe('test error');
   });
 
@@ -166,6 +170,10 @@ describe('createLegacyMethodMiddleware', () => {
     });
     assertIsJsonRpcFailure(response);
 
+    // Type assertion for the error not having cause object
+    const errorData = response.error.data as { cause?: Error };
+
+    expect(errorData.cause?.message).toBe('test error');
     expect(response.error.message).toBe('test error');
   });
 

app/core/RPCMethods/createUnsupportedMethodMiddleware/index.ts

@@ -1,14 +1,16 @@
 import { rpcErrors } from '@metamask/rpc-errors';
-import type { JsonRpcMiddleware } from 'json-rpc-engine';
+import type { JsonRpcMiddleware } from '@metamask/json-rpc-engine';
+
 import { UNSUPPORTED_RPC_METHODS } from '../utils';
+import { Json, JsonRpcParams } from '@metamask/utils';
 
 /**
  * Creates a middleware that rejects explicitly unsupported RPC methods with the
  * appropriate error.
  */
 const createUnsupportedMethodMiddleware = (): JsonRpcMiddleware<
-  unknown,
-  void
+  JsonRpcParams,
+  Json
 > =>
   async function unsupportedMethodMiddleware(req, _res, next, end) {
     if ((UNSUPPORTED_RPC_METHODS as Set<string>).has(req.method)) {

app/core/RPCMethods/eth_sendTransaction.test.ts

@@ -1,6 +1,11 @@
 // eslint-disable-next-line import/no-nodejs-modules
 import { inspect } from 'util';
-import type { JsonRpcRequest, PendingJsonRpcResponse } from 'json-rpc-engine';
+import type {
+  Json,
+  JsonRpcParams,
+  JsonRpcRequest,
+  PendingJsonRpcResponse,
+} from '@metamask/utils';
 import type {
   TransactionParams,
   TransactionController,
@@ -48,8 +53,10 @@ jest.mock('../../util/transaction-controller', () => ({
  * @returns The JSON-RPC request.
  */
 function constructSendTransactionRequest(
-  params: unknown,
-): JsonRpcRequest<unknown> & { method: 'eth_sendTransaction' } {
+  params: [TransactionParams & JsonRpcParams],
+): JsonRpcRequest<[TransactionParams & JsonRpcParams]> & {
+  method: 'eth_sendTransaction';
+} {
   return {
     jsonrpc: '2.0',
     id: 1,
@@ -63,7 +70,7 @@ function constructSendTransactionRequest(
  *
  * @returns A pending JSON-RPC response.
  */
-function constructPendingJsonRpcResponse(): PendingJsonRpcResponse<unknown> {
+function constructPendingJsonRpcResponse(): PendingJsonRpcResponse<Json> {
   return {
     jsonrpc: '2.0',
     id: 1,
@@ -144,7 +151,9 @@ function getMockAddTransaction({
 describe('eth_sendTransaction', () => {
   it('sends the transaction and returns the resulting hash', async () => {
     const mockAddress = '0x0000000000000000000000000000000000000001';
-    const mockTransactionParameters = { from: mockAddress };
+    const mockTransactionParameters = {
+      from: mockAddress,
+    };
     const expectedResult = 'fake-hash';
     const pendingResult = constructPendingJsonRpcResponse();
 
@@ -172,6 +181,7 @@ describe('eth_sendTransaction', () => {
         async () =>
           await eth_sendTransaction({
             hostname: 'example.metamask.io',
+            //@ts-expect-error - invalid parameters forced
             req: constructSendTransactionRequest(invalidParameter),
             res: constructPendingJsonRpcResponse(),
             sendTransaction: getMockAddTransaction({
@@ -194,6 +204,7 @@ describe('eth_sendTransaction', () => {
         async () =>
           await eth_sendTransaction({
             hostname: 'example.metamask.io',
+            //@ts-expect-error - invalid parameters forced
             req: constructSendTransactionRequest(invalidParameter),
             res: constructPendingJsonRpcResponse(),
             sendTransaction: getMockAddTransaction({

app/core/RPCMethods/eth_sendTransaction.ts

@@ -1,6 +1,13 @@
-import type { JsonRpcRequest, PendingJsonRpcResponse } from 'json-rpc-engine';
+import type {
+  Hex,
+  Json,
+  JsonRpcParams,
+  JsonRpcRequest,
+  PendingJsonRpcResponse,
+} from '@metamask/utils';
 import {
   TransactionController,
+  TransactionParams,
   WalletDevice,
 } from '@metamask/transaction-controller';
 import { rpcErrors } from '@metamask/rpc-errors';
@@ -46,6 +53,11 @@ const hasProperty = <
 ): objectToCheck is ObjectToCheck & Record<Property, unknown> =>
   Object.hasOwnProperty.call(objectToCheck, name);
 
+interface SendArgs {
+  from: string;
+  chainId?: Hex;
+}
+
 /**
  * Handle a `eth_sendTransaction` request.
  *
@@ -66,13 +78,12 @@ async function eth_sendTransaction({
   validateAccountAndChainId,
 }: {
   hostname: string;
-  req: JsonRpcRequest<unknown> & { method: 'eth_sendTransaction' };
-  res: PendingJsonRpcResponse<unknown>;
+  req: JsonRpcRequest<[TransactionParams & JsonRpcParams]> & {
+    method: 'eth_sendTransaction';
+  };
+  res: PendingJsonRpcResponse<Json>;
   sendTransaction: TransactionController['addTransaction'];
-  validateAccountAndChainId: (args: {
-    from: string;
-    chainId?: number;
-  }) => Promise<void>;
+  validateAccountAndChainId: (args: SendArgs) => Promise<void>;
 }) {
   if (
     !Array.isArray(req.params) &&

app/core/RPCMethods/utils.ts

@@ -2,7 +2,8 @@ import { query } from '@metamask/controller-utils';
 import Engine from '../Engine';
 import { selectHooks } from '@metamask/snaps-rpc-methods';
 import { OptionalDataWithOptionalCause, rpcErrors } from '@metamask/rpc-errors';
-import { JsonRpcMiddleware } from 'json-rpc-engine';
+import { JsonRpcMiddleware } from '@metamask/json-rpc-engine';
+
 import { PermittedHandlerExport } from '@metamask/permission-controller';
 import { Json, JsonRpcParams, hasProperty } from '@metamask/utils';
 import EthQuery from '@metamask/eth-query';
@@ -76,7 +77,7 @@ export function makeMethodMiddlewareMaker<U>(
   const makeMethodMiddleware = (hooks: Record<string, unknown>) => {
     assertExpectedHook(hooks, expectedHookNames);
 
-    const methodMiddleware: JsonRpcMiddleware<JsonRpcParams, unknown> = async (
+    const methodMiddleware: JsonRpcMiddleware<JsonRpcParams, Json> = async (
       req,
       res,
       next,
@@ -88,12 +89,11 @@ export function makeMethodMiddlewareMaker<U>(
         try {
           // Implementations may or may not be async, so we must await them.
           return await implementation(
-            // @ts-expect-error JsonRpcId (number | string | void) doesn't match the permission middleware's id, which is (string | number | null)
             req,
             res,
             next,
             end,
-            selectHooks(hooks, hookNames),
+            selectHooks(hooks, hookNames) as U,
           );
         } catch (error) {
           if (process.env.METAMASK_DEBUG) {