fix: enforce widget token list restrictions#7834
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
WalkthroughToken list selection now applies widget and field-scoped restrictions to visible and favorite tokens, filters persisted recent tokens through allowed token keys, exposes restriction state via context, and preserves virtual widget lists in curated-only mode. ChangesToken list availability and selection
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Widget
participant useTokensToSelect
participant TokenListContext
participant useRecentTokens
participant useHydratedRecentTokens
participant TokenSearchResults
Widget->>useTokensToSelect: provide field and scoped list parameters
useTokensToSelect->>TokenListContext: return visible tokens, allowed recent tokens, and restriction state
TokenListContext->>useRecentTokens: pass allowed recent tokens
useRecentTokens->>useHydratedRecentTokens: pass allowed token keys
useHydratedRecentTokens->>useHydratedRecentTokens: filter persisted recent tokens
TokenListContext->>TokenSearchResults: expose scoped restriction state
TokenSearchResults->>TokenSearchResults: apply search result scoping
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying explorer-dev with
|
| Latest commit: |
440ce99
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://b645cd73.explorer-dev-dxz.pages.dev |
| Branch Preview URL: | https://deepsec-widget-token-list-re.explorer-dev-dxz.pages.dev |
Deploying swap-dev with
|
| Latest commit: |
440ce99
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://7484a1a3.swap-dev-5u6.pages.dev |
| Branch Preview URL: | https://deepsec-widget-token-list-re.swap-dev-5u6.pages.dev |
fairlighteth
left a comment
fairlighteth
left a comment
There was a problem hiding this comment.
✅ AI Review (Codex GPT-5, worked 9m): latest follow-up is fixed; no new PR-scope findings
Review completed. I found no new non-duplicate comments worth posting.
Rechecked
- Favorites are restricted to the current
sellTokenLists/buyTokenLists; bridge favorites must also be provider-supported. - Persisted recents outside the field scope are removed before hydration and before applying the item limit.
- Unrestricted custom recents remain available, while unsupported bridge recents remain visible but disabled.
- Curated-only mode retains virtual widget lists such as
customTokens.
Result: Fixed. The previous favorite and persisted-recent bypasses are no longer reproducible on head b5e97d550.
Review scope and related context
- Reviewed all 13 changed files; there are no review threads, inline comments, or human reviews to deduplicate.
- Targeted verification passed: 42/42 frontend tests and 8/8 token-library tests.
- Test, lint, typecheck, agent harness, deployment, and security checks pass.
- Cypress fails the same four
#do-trade-buttontimeouts on this head and exact basec03a2d33f, so it is not attributable to this PR. - DeepSec PR mode used GitHub’s exact 13-file set. Helper exit:
0; underlying scan exit:1; artifact:/tmp/deepsec-comment-pr-7834-review-2018074.md. - DeepSec’s only finding is the raw bridge-search restriction already documented and explicitly deferred in the PR body, so it is not repeated.
Generated using the pr-review skill from the CoW Protocol skills repo.
Generated using the security-review skill from the CoW Protocol skills repo.
✅ Browser QA passed: scoped favorites, persisted recents, and unrestricted fallbackOutcome
Run details
Artifacts
Sell scope: Gemini retains 
Buy scope: Optimism favorites remain; out-of-list 
Bridge intersection: 
Unrestricted control: persisted 
Bridge transport caveatThe PR preview's barn BFF bridge proxy returned Generated using the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
apps/cowswap-frontend/src/modules/tokensList/hooks/useRecentTokens.ts (1)
38-41: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider renaming
buildFavoriteTokenKeysfor reuse with allowed tokens.
buildFavoriteTokenKeysis now called for both favorite tokens (line 37) and allowed tokens (line 39). The function name implies it's specific to favorites, but it's a generic token-key Set builder. A more descriptive name likebuildTokenKeySetwould improve clarity at both call sites.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/cowswap-frontend/src/modules/tokensList/hooks/useRecentTokens.ts` around lines 38 - 41, Rename buildFavoriteTokenKeys to a generic name such as buildTokenKeySet, update its definition and all call sites for both favorite and allowed tokens, and preserve the existing behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@apps/cowswap-frontend/src/modules/tokensList/hooks/useRecentTokens.ts`:
- Around line 38-41: Rename buildFavoriteTokenKeys to a generic name such as
buildTokenKeySet, update its definition and all call sites for both favorite and
allowed tokens, and preserve the existing behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 260de7d7-da8e-4dc0-9342-dfd9702561ed
📒 Files selected for processing (13)
apps/cowswap-frontend/src/modules/tokensList/containers/SelectTokenWidget/hooks/useRecentTokenSection.tsapps/cowswap-frontend/src/modules/tokensList/containers/TokenSearchResults/index.tsxapps/cowswap-frontend/src/modules/tokensList/hooks/useHydratedRecentTokens.tsapps/cowswap-frontend/src/modules/tokensList/hooks/useRecentTokens.test.tsxapps/cowswap-frontend/src/modules/tokensList/hooks/useRecentTokens.tsapps/cowswap-frontend/src/modules/tokensList/hooks/useTokenListContext.test.tsapps/cowswap-frontend/src/modules/tokensList/hooks/useTokenListContext.tsapps/cowswap-frontend/src/modules/tokensList/hooks/useTokensToSelect.test.tsapps/cowswap-frontend/src/modules/tokensList/hooks/useTokensToSelect.tsapps/cowswap-frontend/src/modules/tokensList/state/tokensToSelectAtom.test.tsapps/cowswap-frontend/src/modules/tokensList/state/tokensToSelectAtom.tslibs/tokens/src/state/tokenLists/tokenListsStateAtom.test.tslibs/tokens/src/state/tokenLists/tokenListsStateAtom.ts
|
Addressed CodeRabbit's naming nit in |
| return acc | ||
| }, new Set()) | ||
|
|
||
| const favoriteTokenAddresses = hideFavoriteTokens |
There was a problem hiding this comment.
This was done on purpose in #7254, won't it add the bug again?
There was a problem hiding this comment.
Thanks for checking, I dug into this to find out.
#7254 intentionally made favorites an exception to sell/buy list filtering so they matched Active token-list behavior.
This PR deliberately supersedes that part: following the DeepSec finding, field-specific sell/buy lists are treated as integrator allowlists, so favorites cannot bypass them. The separate #7254 raw-search fix remains intact: scoped search still uses only the field-scoped
allTokensand removes inactive, blockchain, and external results.hideFavoriteTokensalso remains enforced upstream, and we have targeted coverage for an out-of-scope favorite being excluded.
So answering your question, my understanding is that this PR intentionally removes the exception for favorites. This means favorites outside the active token list will be hidden again, like before #7254. But search is still limited to the allowed tokens, so the separate search bug fixed in #7254 does not come back.
2 participants
What changed
sellTokenListsandbuyTokenListsfor favorite and persisted recent tokens.customTokens, while curated-only mode is active.Why
Favorite tokens bypass widget sell/buy token-list restrictionsand the review follow-up for persisted Recent tokens.Bridge token search ignores widget-scoped token list restrictions; raw bridge search still needs its own field-specific intersection.QA Testing
Preview URL QA:
buyTokenListsstays hidden. A permitted Recent token without route support remains visible but disabled.Developer verification:
useRecentTokens.test.tsxcovers unrestricted fallback hydration, scoped filtering, and filtering before the recent-item limit.useTokensToSelect.test.tscovers sell, buy, shared, wrong-side, and cross-chain scope selection.useTokenListContext.test.tscovers forwarding restricted and unrestricted recent-token policy.tokensVirtualListUtils.test.tscovers disabled bridge recents while provider support is loading or unavailable.tokensToSelectAtom.test.tsandtokenListsStateAtom.test.tscover field-scoped selection and retaining virtual widget lists in curated-only mode.Reviewer note:
Preview URLs
Summary by CodeRabbit