Missing Line Terminator on allowedOrigins enables origin spoofing

Summary

@pkkr identified a vulnerability in our Snaps allowedOrigins functionality, a functionality which allows a Snap developers to control which origins could interact with certain Snaps APIs. Due to a missing regex terminator, this origin control could be bypassed, allowing a malicious domain to access restricted parts of the Snaps API. At its worst, this would enable malicious dApps to call the Keyring API’s exportAccount method, potentially accessing sensitive account information from Snaps who choose to implement it.

Not only did @pkkr identify this impactful vulnerability, but did so with incredible timing. His prompt report allowed us to address the issue before it reached production.

We would like to thank @pkkr for his continued efforts to demonstrate the impact of this vulnerability and for consistently helping to make MetaMask more secure.

‎