Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Malware protection 1: rename PhishingDetection to MaliciousSiteProtection #1091

Open
wants to merge 8 commits into
base: main
Choose a base branch
from

Conversation

mallexxx
Copy link
Collaborator

@mallexxx mallexxx commented Nov 22, 2024

Please review the release process for BrowserServicesKit here.

Required:

Task/Issue URL: https://app.asana.com/0/1202406491309510/1208033567421351/f
iOS PR:
macOS PR: duckduckgo/macos-browser#3588
What kind of version bump will this require?: Major

Description:

  • Renamed PhishingDetection to MaliciousSiteProtection
  • Adjusted and cleaned up some code parts

Steps to test this PR:

  1. Activate Feature Flag override for malicious site protections in Debug -> Feature Flag overrides
  2. Visit https://privacy-test-pages.site/security/badware/phishing.html, validate phishing detection works without changes

Copy link
Collaborator

@not-a-rootkit not-a-rootkit left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a few notes for future reference but nothing blocking this PR. Tests seem to be working and end-to-end experience seems unaffected.


extension APIClient {

public struct ChangeSetResponse<T: Codable & Hashable>: Codable, Equatable {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔥

// If nothing found, hit the API to get matches
if await checkApiMatches(canonicalHost: canonicalHost, canonicalUrl: canonicalUrl) {
return true
public func evaluate(_ url: URL) async -> ThreatKind? {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is fine for now, but soon this will result in two API requests when we introduce malware protections. It also doesn't allow for independent feature flagging. We should discuss if/how we want to do this on Monday in our call. Doesn't block this PR though.

@@ -58,8 +58,7 @@ public class PhishingDetectionDataProvider: PhishingDetectionDataProviding {
let filterSetData = try loadData(from: embeddedFilterSetURL, expectedSHA: embeddedFilterSetDataSHA)
return try JSONDecoder().decode(Set<Filter>.self, from: filterSetData)
} catch {
Logger.phishingDetectionDataProvider.error("🔴 Error: SHA mismatch for filterSet JSON file. Expected \(self.embeddedFilterSetDataSHA)")
return []
fatalError("🔴 Error: SHA mismatch for filterSet JSON file. Expected \(self.embeddedFilterSetDataSHA)")
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know we do this for privacy configs, but I'm not a fan of crashing the app in this instance. However, ideally this would never make it past internal testing so I'm okay with it.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reaching the catch block means the app bundle corruption (same is valid for a missing Storyboard), and considering the Let it crash discussion this makes impossible to run the app further and we must crash here.
Plus, it happens early in the app lifetime during smoke testing that makes it easily noticeable and not affecting the production built.

public init() {
let dataStoreDirectory: URL
do {
dataStoreDirectory = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again, doesn't affect this PR but just making notes for myself: in the next PR we should try to align with @alessandroboron's TD for storage locations: https://app.asana.com/0/481882893211075/1207273224076495/f

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this part is not modified from the original implementation: to be update in later PRs to match the config files storage location

@mallexxx mallexxx changed the title rename PhishingDetection to MaliciousSiteProtection Malware protection 1: rename PhishingDetection to MaliciousSiteProtection Nov 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants