mirror of
https://github.com/pezkuwichain/pezkuwi-wallet-android.git
synced 2026-10-20 18:56:25 +00:00
The polkadot.js responder forwarded Throwable.message of any rejection error to the page and both responders interpolated the message into JavaScript without escaping. Map polkadot.js rejections to a fixed public message (unknown errors become "Request failed"), give MetamaskError an explicit publicMessage, and quote both with JSONObject.quote so a message can no longer break out of the string literal.