Production Builds Allow Development and Localhost Origins; Snap Does Not Enforce Transport Security  Partially Addressed
The snaps RPC access is restricted to certain origins only. However, there is no logic that disables development/test domains from origin checks in production builds.\\nSolflare Snap\\n../solflare-snap/src/index.js:L7-L17\\n```\\nmodule.exports.onRpcRequest = async ({ origin, request }) => {\\n if (\\n !origin ||\\n (\\n !origin.match(/^https?:\\/\\/localhost:[0-9]{1,4}$/) &&\\n !origin.match(/^https?:\\/\\/(?:\\S+\\.)?solflare\\.com$/) &&\\n !origin.match(/^https?:\\/\\/(?:\\S+\\.)?solflare\\.dev$/)\\n )\\n ) {\\n throw new Error('Invalid origin');\\n }\\n```\\n\\nAptos Snap\\n../aptos-snap/src/index.js:L6-L15\\n```\\nmodule.exports.onRpcRequest = async ({ origin, request }) => {\\n if (\\n !origin ||\\n (\\n !origin.match(/^https?:\\/\\/localhost:[0-9]{1,4}$/) &&\\n !origin.match(/^https?:\\/\\/(?:\\S+\\.)?risewallet\\.dev$/)\\n )\\n ) {\\n throw new Error('Invalid origin');\\n }\\n```\\n\\nSui Snap\\n../sui-snap/src/index.js:L8-L17\\n```\\nmodule.exports.onRpcRequest = async ({ origin, request }) => {\\n if (\\n !origin ||\\n (\\n !origin.match(/^https?:\\/\\/localhost:[0-9]{1,4}$/) &&\\n !origin.match(/^https?:\\/\\/(?:\\S+\\.)?elliwallet\\.dev$/)\\n )\\n ) {\\n throw new Error('Invalid origin');\\n }\\n```\\n
Resolution\\nThe client has issued the following statement:\\nChangesets:\\nsolflare-wallet/solflare-snap@749d2b0\\nsolflare-wallet/aptos-snap@eef10b5\\nsolflare-wallet/sui-snap@898295f\\nStatement from the Assessment Team:\\nImplement logic that removes development/localhost origin from the allow list for production builds. Employ strict checks on the format of provided origin. Do not by default allow all subdomains.
```\\nmodule.exports.onRpcRequest = async ({ origin, request }) => {\\n if (\\n !origin ||\\n (\\n !origin.match(/^https?:\\/\\/localhost:[0-9]{1,4}$/) &&\\n !origin.match(/^https?:\\/\\/(?:\\S+\\.)?solflare\\.com$/) &&\\n !origin.match(/^https?:\\/\\/(?:\\S+\\.)?solflare\\.dev$/)\\n )\\n ) {\\n throw new Error('Invalid origin');\\n }\\n```\\n