A page on a blocklisted domain lost the phishing warning on every approval prompt when its hostname was written with a trailing dot (myetheywallet.com.), which the browser and DNS treat as the same host as myetheywallet.com.
hostnameVariants() in src/shared/phishingDomains.js now drops one trailing dot before it builds the hostname and its parent domains, so isPhishingDomain() hashes the name the list holds. That function is the only place a hostname is checked, so the connection, transaction, signature and network-switch prompts are all covered by the one change.
tests/phishingDomains.test.js checks a listed domain and a subdomain of it written with a trailing dot, and a clean domain with one, which is still not flagged. The Phishing Domain Protection section of the README now says the checker treats name. as name.
Judgement call: only one trailing dot is dropped. A name ending in two dots has an empty label, which I expect no browser to resolve; not checked in a browser.
No browser-suite case for a trailing-dot page was added; the unit tests cover the check.
A page on a blocklisted domain lost the phishing warning on every approval prompt when its hostname was written with a trailing dot (`myetheywallet.com.`), which the browser and DNS treat as the same host as `myetheywallet.com`.
`hostnameVariants()` in `src/shared/phishingDomains.js` now drops one trailing dot before it builds the hostname and its parent domains, so `isPhishingDomain()` hashes the name the list holds. That function is the only place a hostname is checked, so the connection, transaction, signature and network-switch prompts are all covered by the one change.
`tests/phishingDomains.test.js` checks a listed domain and a subdomain of it written with a trailing dot, and a clean domain with one, which is still not flagged. The Phishing Domain Protection section of the README now says the checker treats `name.` as `name`.
Judgement call: only one trailing dot is dropped. A name ending in two dots has an empty label, which I expect no browser to resolve; not checked in a browser.
No browser-suite case for a trailing-dot page was added; the unit tests cover the check.
Closes https://git.eeqj.de/sneak/AutistMask/issues/534
Model: opus-5-5
The blocklist check hashed the hostname as the page gave it, so
"myetheywallet.com." and every subdomain written that way hashed
differently from the listed "myetheywallet.com" and opened approval
prompts with no warning. The browser and DNS treat both spellings as
one host. hostnameVariants() now drops one trailing dot before
building the hostname and its parent domains, so the check sees the
name the list holds.
Model: opus-5-5
PASS: a blocklisted domain, or a subdomain of one, written with a trailing dot now gets the phishing warning on the connection, transaction, signature and network switch prompts, as #534 asks.
Model: opus-5-5
PASS: a blocklisted domain, or a subdomain of one, written with a trailing dot now gets the phishing warning on the connection, transaction, signature and network switch prompts, as https://git.eeqj.de/sneak/AutistMask/issues/534 asks.
Model: opus-5-5
clawbot
merged commit b4059af827 into next2026-10-14 10:48:41 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
A page on a blocklisted domain lost the phishing warning on every approval prompt when its hostname was written with a trailing dot (
myetheywallet.com.), which the browser and DNS treat as the same host asmyetheywallet.com.hostnameVariants()insrc/shared/phishingDomains.jsnow drops one trailing dot before it builds the hostname and its parent domains, soisPhishingDomain()hashes the name the list holds. That function is the only place a hostname is checked, so the connection, transaction, signature and network-switch prompts are all covered by the one change.tests/phishingDomains.test.jschecks a listed domain and a subdomain of it written with a trailing dot, and a clean domain with one, which is still not flagged. The Phishing Domain Protection section of the README now says the checker treatsname.asname.Judgement call: only one trailing dot is dropped. A name ending in two dots has an empty label, which I expect no browser to resolve; not checked in a browser.
No browser-suite case for a trailing-dot page was added; the unit tests cover the check.
Closes #534
Model: opus-5-5
PASS: a blocklisted domain, or a subdomain of one, written with a trailing dot now gets the phishing warning on the connection, transaction, signature and network switch prompts, as #534 asks.
Model: opus-5-5