sneak
722f7c86de
The blocklist URL in shipped code named a competitor and pointed at a moving ref, and the extension re-fetched from it every 24 hours, which also meant a third party decided what this wallet warns about. All of that is gone. script/vendor-blocklist fetches upstream at a pinned commit, verifies the sha256 of the bytes that commit serves, and writes src/shared/phishingBlocklist.json. It is build-time tooling, never shipped, and the one place in the repo that names the upstream project; a source reference nobody can verify is not a source reference. The artifact stores truncated sha256 digests rather than domain names. That is what censors it: the previous file contained the competitor's name 6,475 times, as phishing domains impersonating them, and not one of those domains is dropped. It also makes lookups a binary search over a fixed-width string, so nothing is built at module load — which matters on MV3, where the worker re-evaluates the module on every wake — and takes the file from 8.7 MB to 1.7 MB. script/check-censored enforces the rest: it reads the name out of the vendoring script rather than repeating it, and fails on any occurrence in the working tree or under dist/ that is not one of the two literals shipped code cannot avoid. It runs in make check, which inspects dist/ when there is one and says loudly when there is not, and again with --require-dist at the end of every make build. Removing the runtime fetch retires the delta, the extension-storage persistence and the 24-hour alarm from #158. A retired alarm is now cleared rather than left waking the worker forever on installs that already have it. The e2e suite drives the warning end to end from a real blocklisted origin served as a real http(s) site, with a control asserting the banner stays hidden for one that is not listed. Its service-worker interception canary needed a new anchor, since the startup fetch it used to watch for no longer happens: it now wakes the worker with a message and asks it for one throwaway fetch. LICENSE no longer cites a repository that returns 404. eslint.config.js gains one block: script/lib/ holds node programs the shell entrypoints call, and without it they lint with no globals at all.
84 lines
3.3 KiB
Bash
Executable File
84 lines
3.3 KiB
Bash
Executable File
#!/bin/sh
|
|
# script/test-e2e: build the extension and drive the real popup in a real
|
|
# Chromium inside a pinned container. Our own extension to
|
|
# scripts-to-rule-them-all.
|
|
#
|
|
# Deliberately NOT called by script/check or script/test: REPO_POLICIES.md
|
|
# caps make test at 20 seconds and a browser suite does not fit. Run it
|
|
# yourself before touching popup views. ESLint's no-undef now catches a
|
|
# used-but-not-imported identifier in make check, but only this suite sees
|
|
# what a view actually does when it runs.
|
|
# .gitea/workflows/e2e.yml also runs it on every push, in a job separate
|
|
# from check so that cap and the local fast path both stay intact.
|
|
#
|
|
# Docker is the only prerequisite. The repo reaches the container as a
|
|
# build context and the extension is built inside it (see
|
|
# tests/e2e/Dockerfile), so nothing here depends on the node, yarn or make
|
|
# on the machine that starts the run. That is not a convenience: a bind
|
|
# mount cannot work under Gitea Actions, and the runner image's node is too
|
|
# old to install this repo's dependencies.
|
|
set -eu
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
|
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
|
|
|
IMAGE="$("$SCRIPT_DIR/projectname")-e2e-chrome"
|
|
|
|
IIDFILE=""
|
|
|
|
cleanup() {
|
|
if [ -n "$IIDFILE" ]; then
|
|
rm -f "$IIDFILE"
|
|
fi
|
|
}
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
|
|
if ! command -v docker >/dev/null 2>&1; then
|
|
echo "test-e2e: docker is required to run the e2e suite" >&2
|
|
exit 1
|
|
fi
|
|
|
|
IIDFILE="$(mktemp)"
|
|
trap cleanup EXIT
|
|
trap 'cleanup; exit 130' INT TERM
|
|
|
|
echo "Building the Chrome e2e image (extension included)..."
|
|
docker build --iidfile "$IIDFILE" -t "$IMAGE" -f tests/e2e/Dockerfile .
|
|
|
|
echo "Running e2e suite in the pinned Playwright container..."
|
|
# The image is run by ID, not by tag: where two clones of this repo run
|
|
# the suite at once, the other build can move the tag between this
|
|
# build and this run, and the suite would then silently test the other
|
|
# checkout.
|
|
#
|
|
# --ipc=host: Chromium's shared-memory needs more than the default
|
|
# 64MB /dev/shm or renderers crash.
|
|
# HOME=/tmp: the image's root home is not a reliable place for the
|
|
# browser profile.
|
|
# PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1: without it,
|
|
# ctx.route() intercepts page requests only, and every fetch made by
|
|
# the MV3 background service worker — the JSON-RPC calls behind
|
|
# every approval the suite drives among them — goes to the real
|
|
# internet. The flag is experimental and Playwright may drop or
|
|
# rename it. It cannot break silently: the harness asks the worker
|
|
# for one request of its own at launch and aborts the whole suite
|
|
# if it does not reach the route handler (see the interception
|
|
# canary in tests/e2e/harness.js). If a future Playwright removes
|
|
# the flag, that probe is what will fail, and the fix is either a
|
|
# replacement mechanism or an honest downgrade of the isolation
|
|
# claim in tests/e2e/network.js and README.md — not deleting the
|
|
# probe. The image is pinned by digest, so this can only ever bite
|
|
# on a deliberate bump.
|
|
docker run --rm \
|
|
--ipc=host \
|
|
-e HOME=/tmp \
|
|
-e PW_EXPERIMENTAL_SERVICE_WORKER_NETWORK_EVENTS=1 \
|
|
-e "E2E_TRACE_NETWORK=${E2E_TRACE_NETWORK:-0}" \
|
|
"$(cat "$IIDFILE")" \
|
|
node tests/e2e/run.js
|
|
}
|
|
|
|
main "$@"
|