mirror of
https://github.com/pezkuwichain/pezkuwi-wallet-android.git
synced 2026-10-26 21:49:56 +00:00
The polkadot.js responder forwarded Throwable.message of any rejection error to the page and both responders interpolated the message into JavaScript without escaping. Map polkadot.js rejections to a fixed public message (unknown errors become "Request failed"), give MetamaskError an explicit publicMessage, and quote both with JSONObject.quote so a message can no longer break out of the string literal.