isPhishingDomain() and hostnameVariants() in src/shared/phishingDomains.js (lines 116-140) hash the hostname as given, lowercased. A hostname written with the trailing dot of a fully qualified name (evil.example.) is the same host to the browser and to DNS, but hashes differently from evil.example, and so do all its parent-domain variants.
What happens
On next (8e52528), release build, Chrome, with a listed domain (myetheywallet.com, the one the Chrome suite uses) mapped to a local test page:
From http://myetheywallet.com:8080/, eth_requestAccounts opens the Connection Request with the red "PHISHING WARNING" banner.
From http://myetheywallet.com.:8080/, the same page opens the same prompt with origin http://myetheywallet.com.:8080 and no banner.
A phishing site only has to link to its own name with a dot at the end to lose the warning on every prompt: connection, transaction, signature and network switch.
What should happen
README, Phishing Domain Protection: "When a dApp on a blocklisted domain requests a wallet connection, transaction approval, or signature, the approval popup displays a prominent red warning banner", and "The domain checker matches exact hostnames and all parent domains". The check should treat name. and name as one host.
Severity: major
Definition of done
A listed domain and its subdomains get the warning when the hostname ends in a dot.
A test covers a trailing-dot hostname, for the domain and a subdomain.
Model: opus-5-5
## Where
`isPhishingDomain()` and `hostnameVariants()` in `src/shared/phishingDomains.js` (lines 116-140) hash the hostname as given, lowercased. A hostname written with the trailing dot of a fully qualified name (`evil.example.`) is the same host to the browser and to DNS, but hashes differently from `evil.example`, and so do all its parent-domain variants.
## What happens
On `next` (8e52528), release build, Chrome, with a listed domain (`myetheywallet.com`, the one the Chrome suite uses) mapped to a local test page:
- From `http://myetheywallet.com:8080/`, `eth_requestAccounts` opens the Connection Request with the red "PHISHING WARNING" banner.
- From `http://myetheywallet.com.:8080/`, the same page opens the same prompt with origin `http://myetheywallet.com.:8080` and no banner.
A phishing site only has to link to its own name with a dot at the end to lose the warning on every prompt: connection, transaction, signature and network switch.
## What should happen
README, Phishing Domain Protection: "When a dApp on a blocklisted domain requests a wallet connection, transaction approval, or signature, the approval popup displays a prominent red warning banner", and "The domain checker matches exact hostnames and all parent domains". The check should treat `name.` and `name` as one host.
Severity: major
## Definition of done
- [ ] A listed domain and its subdomains get the warning when the hostname ends in a dot.
- [ ] A test covers a trailing-dot hostname, for the domain and a subdomain.
Model: opus-5-5
clawbot
self-assigned this 2026-10-14 05:07:17 +02:00
Fix is up for review in #546: the blocklist check drops a trailing dot from the hostname before it matches the hostname and its parent domains.
Model: opus-5-5
Fix is up for review in https://git.eeqj.de/sneak/AutistMask/pulls/546: the blocklist check drops a trailing dot from the hostname before it matches the hostname and its parent domains.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where
isPhishingDomain()andhostnameVariants()insrc/shared/phishingDomains.js(lines 116-140) hash the hostname as given, lowercased. A hostname written with the trailing dot of a fully qualified name (evil.example.) is the same host to the browser and to DNS, but hashes differently fromevil.example, and so do all its parent-domain variants.What happens
On
next(8e52528), release build, Chrome, with a listed domain (myetheywallet.com, the one the Chrome suite uses) mapped to a local test page:http://myetheywallet.com:8080/,eth_requestAccountsopens the Connection Request with the red "PHISHING WARNING" banner.http://myetheywallet.com.:8080/, the same page opens the same prompt with originhttp://myetheywallet.com.:8080and no banner.A phishing site only has to link to its own name with a dot at the end to lose the warning on every prompt: connection, transaction, signature and network switch.
What should happen
README, Phishing Domain Protection: "When a dApp on a blocklisted domain requests a wallet connection, transaction approval, or signature, the approval popup displays a prominent red warning banner", and "The domain checker matches exact hostnames and all parent domains". The check should treat
name.andnameas one host.Severity: major
Definition of done
Model: opus-5-5
Fix is up for review in #546: the blocklist check drops a trailing dot from the hostname before it matches the hostname and its parent domains.
Model: opus-5-5