Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Intercept requests and add skeleton for malicious site detection #5369

Open
wants to merge 6 commits into
base: develop
Choose a base branch
from

Conversation

CrisBarreiro
Copy link
Contributor

@CrisBarreiro CrisBarreiro commented Dec 9, 2024

Task/Issue URL: https://app.asana.com/0/1205008441501016/1207151848931035/f

Description

Steps to test this PR

Feature 1

  • Load a site and check you get Timber.tag("MaliciousSiteProtection").d("isMalicious $url") for all mainframe and iframe requests (only for internal builds).
  • Check you should never get 2 instances of those logs for the exact same URL

UI changes

Before After
!(Upload before screenshot) (Upload after screenshot)

Copy link
Contributor Author

CrisBarreiro commented Dec 9, 2024

@CrisBarreiro CrisBarreiro marked this pull request as ready for review December 9, 2024 10:36
}

@Test
fun `shouldOverride returns true when feature is enabled, is malicious, and not mainframe nor iframe`() = runTest {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test name appears to be incorrect - it states "returns true" but the test asserts false. Consider renaming to shouldOverride returns false when feature is enabled, is malicious, and not mainframe nor iframe to accurately reflect the expected behavior being tested.

Spotted by Graphite Reviewer

Is this helpful? React 👍 or 👎 to let us know.

@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/intercept-requests branch 2 times, most recently from 13cfb3a to 8d0f3b0 Compare December 10, 2024 10:49
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/intercept-requests branch from 8d0f3b0 to 0b7f33d Compare December 10, 2024 13:37
return WebResourceResponse(null, null, null)
}
processedUrls.add(decodedUrl)
} else if (isForIframe(request) && documentUri?.host == request.requestHeaders["Referer"]?.toUri()?.host) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The toUri() call on the Referer header value needs null-safety and exception handling. A malformed URI in the header could crash the app. Consider wrapping this in a try-catch block and providing a fallback value when the URI is invalid or malformed.

Spotted by Graphite Reviewer

Is this helpful? React 👍 or 👎 to let us know.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants