Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Display warning page for malicious sites #5416

Merged
merged 17 commits into from
Jan 31, 2025
Merged

Display warning page for malicious sites #5416

merged 17 commits into from
Jan 31, 2025
+642 −25

Conversation

CrisBarreiro
Copy link
Contributor

@CrisBarreiro CrisBarreiro commented Dec 19, 2024 •
edited
Loading

Task/Issue URL: https://app.asana.com/0/72649045549333/1208836754662807/f

Description

Steps to test this PR

Pre-requisites

  • Enable maliciousSiteProtection and enableMaliciousSiteProtection RC flags

Feature 1

Feature 2

Feature 3

  • Open wikipedia
  • On the same tab, navigate to Standard Phishing Test
  • Wait for the error page to show
  • Tap on the omnibar and load the same page again
  • Check the error is shown again

Feature 4

  • Open Standard Phishing Test
  • Wait for the error page to show
  • Tap on the omnibar and navigate to a different site
  • Check navigation is performed normally

Feature 5

  • Open Standard Phishing Test
  • Wait for the error page to show
  • Tap on "Leave This Site"
  • Check current tab is closed and a new one is opened

Feature 6

  • Open Standard Phishing Test
  • Wait for the error page to show
  • Tap on "Advanced"
  • Tap on "Accept Risk and Visit Site"
  • Check the site is loaded
  • Reload the site
  • Check it's loaded normally, no error page shown
  • Kill the app
  • Open it again and load the same site again
  • Check error page is now shown

UI changes

Before After
!(Upload before screenshot) (Upload after screenshot)

This was referenced Dec 19, 2024
Merged
Merged
Merged
@CrisBarreiro Graphite App
Copy link
Contributor Author

CrisBarreiro commented Dec 19, 2024 •
edited
Loading

This stack of pull requests is managed by Graphite. Learn more about stacking.

@CrisBarreiro CrisBarreiro mentioned this pull request Dec 19, 2024
Closed
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/blocking-algorithm branch from ef6e36e to 75f7e5d Compare December 20, 2024 10:18
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/error-page branch 2 times, most recently from dc04edf to 97e340a Compare December 20, 2024 10:37
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/blocking-algorithm branch from 8cb9ae8 to 08a01f5 Compare January 10, 2025 16:28
Base automatically changed from feature/cris/malicious-site-protection/blocking-algorithm to feature/cris/malicious-site-protection/load-initial-dataset January 10, 2025 16:29
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/load-initial-dataset branch 5 times, most recently from 7e348f0 to 1ca9aeb Compare January 20, 2025 14:33
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/error-page branch 2 times, most recently from 48ba45d to def68f6 Compare January 20, 2025 17:48
@CrisBarreiro CrisBarreiro mentioned this pull request Jan 22, 2025
Open
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/load-initial-dataset branch from 95a99e2 to d77fac9 Compare January 23, 2025 15:12
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/error-page branch from 34176e8 to cae18b1 Compare January 23, 2025 15:12
CrisBarreiro
CrisBarreiro commented Jan 24, 2025
View reviewed changes
app/src/main/java/com/duckduckgo/app/browser/webview/MaliciousSiteBlockerWebViewIntegration.kt Outdated Show resolved Hide resolved
app/src/main/java/com/duckduckgo/app/browser/BrowserTabViewModel.kt Outdated Show resolved Hide resolved
app/src/main/java/com/duckduckgo/app/browser/BrowserTabViewModel.kt Outdated Show resolved Hide resolved
app/src/main/java/com/duckduckgo/app/browser/BrowserTabViewModel.kt Outdated Show resolved Hide resolved
app/src/main/java/com/duckduckgo/app/browser/omnibar/OmnibarLayoutViewModel.kt Outdated Show resolved Hide resolved
app/src/main/java/com/duckduckgo/app/browser/webview/MaliciousSiteBlockedWarningLayout.kt Outdated Show resolved Hide resolved
app/src/main/java/com/duckduckgo/app/browser/webview/MaliciousSiteBlockerWebViewIntegration.kt Outdated Show resolved Hide resolved
app/src/main/res/layout/fragment_browser_tab.xml Show resolved Hide resolved
app/src/main/res/values/strings.xml Show resolved Hide resolved
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/load-initial-dataset branch from d77fac9 to 1c4cd9e Compare January 24, 2025 11:46
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/error-page branch from 1e884da to e7697fe Compare January 24, 2025 11:47
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/load-initial-dataset branch 2 times, most recently from f20c37b to 9622274 Compare January 30, 2025 10:32
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/error-page branch from bbdf911 to 7acab25 Compare January 30, 2025 10:32
CrisBarreiro
CrisBarreiro commented Jan 30, 2025
View reviewed changes
app/src/main/java/com/duckduckgo/app/browser/webview/MaliciousSiteBlockerWebViewIntegration.kt

@SingleInstanceIn(AppScope::class)
class ExemptedUrlsHolder @Inject constructor() {
val exemptedMaliciousUrls = mutableSetOf<String>()
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we shouldn't expose a mutable set, but rather provide a method for exemptions to be added

@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/load-initial-dataset branch from 9622274 to 8770d6e Compare January 30, 2025 10:44
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/error-page branch from 7acab25 to 9142bc0 Compare January 30, 2025 10:44
CrisBarreiro added a commit that referenced this pull request Jan 30, 2025
@CrisBarreiro
Add blocking algorithm (#5370)
5a3aa6e 
Task/Issue URL:
https://app.asana.com/0/72649045549333/1207151848931036/f
Also includes: https://app.asana.com/0/72649045549333/1208870183150418/f

### Description
* Add logic to keep a malicious site dataset up-to-date
* Add blocking algorithm for malicious sites (temporarily show a
snackbar whenever a site is identified as malicious)
* Add algorithm to determine whether a URL is malicious or not. Details
are described
[here](https://app.asana.com/0/481882893211075/1207273224076497/f)
(Approach A, _"Implement MaliciousSiteDetection client library that"_
section). API was discussed
[here](https://app.asana.com/0/1202552961248957/1208934234411796/f)

### Steps to test this PR

_Pre-requisites_
- [x] Enable `enableMaliciousSiteProtection` under
`androidBrowserConfig`

> [!NOTE]  
> Since this implementation only shows a toast, my recommendation is to
do the testing along with #5416

_Feature 1_
- [x] Open https://privacy-test-pages.site/security/badware/, check
snackbar isn't shown
- [x] Check a Snackbar informing of a malicious site is shown for the
following tests
- [ ] [Standard Phishing
Test](https://privacy-test-pages.site/security/badware/phishing.html)
- [ ] [Standard Malware
Test](https://privacy-test-pages.site/security/badware/malware.html)
- [ ] [Phishing iFrame
Loader](https://privacy-test-pages.site/security/badware/phishing-iframe-loader.html)
- [ ] [Phishing JS Redirector
(Direct)](https://privacy-test-pages.site/security/badware/phishing-js-redirector-helper.html)
- [ ] [Phishing JS Redirector
(Indirect)](https://privacy-test-pages.site/security/badware/phishing-js-redirector.html)
- [ ] [Phishing Legit iFrame
Loader](https://privacy-test-pages.site/security/badware/phishing-legit-iframe-loader.html)
- [ ] [Phishing Redirect via Meta Refresh (Not Flagged in
Dataset)](https://privacy-test-pages.site/security/badware/phishing-meta-redirect-clean.html)
- [ ] [Phishing Redirect via Meta Refresh (Flagged in
Dataset)](https://privacy-test-pages.site/security/badware/phishing-meta-redirect.html)
- [ ] [Phishing Open via
Popups](https://privacy-test-pages.site/security/badware/phishing-popups.html)
- [ ] [Phishing Opening with URL
Tampering](https://privacy-test-pages.site/security/badware/phishing-url-tampering.html)
- [ ] [Phishing Form
Submission](https://privacy-test-pages.site/security/badware/phishing-form-submission.html)
-> Submit form
- [ ] [Phishing Service
Worker](https://privacy-test-pages.site/security/badware/phishing-service-worker.html)
- Only navigate, not fetch
- [ ] [HTTP 301 Redirect to Main Phishing Test
Page](https://privacy-test-pages.site/security/badware/phishing-redirect/)
- [ ] [HTTP 302 Redirect to Main Phishing Test
Page](https://privacy-test-pages.site/security/badware/phishing-redirect/302)
- [ ] [HTTP Redirect to Phishing JS Redirector
(Indirect)](https://privacy-test-pages.site/security/badware/phishing-redirect/js)
- [ ] [HTTP Redirect to Phishing JS Redirector
(Direct)](https://privacy-test-pages.site/security/badware/phishing-redirect/js2)
- [ ] [HTTP Redirect to Phishing iFrame
Loader](https://privacy-test-pages.site/security/badware/phishing-redirect/iframe)
- [ ] [HTTP Redirect to Clean Meta Refresh
Redirector](https://privacy-test-pages.site/security/badware/phishing-redirect/meta)
- [ ] [HTTP Redirect to Flagged Meta Refresh
Redirector](https://privacy-test-pages.site/security/badware/phishing-redirect/meta2)

### UI changes
n/a, toast is temporary, an error page will be added in the next PR
Base automatically changed from feature/cris/malicious-site-protection/load-initial-dataset to develop January 30, 2025 14:03
@CrisBarreiro CrisBarreiro force-pushed the feature/cris/malicious-site-protection/error-page branch from 9142bc0 to 6ea4903 Compare January 30, 2025 14:07
@CrisBarreiro CrisBarreiro mentioned this pull request Jan 30, 2025
Open
4 tasks
@CrisBarreiro CrisBarreiro marked this pull request as ready for review January 31, 2025 10:06
cmonfortep
cmonfortep approved these changes Jan 31, 2025
View reviewed changes
Copy link
Contributor

@cmonfortep cmonfortep left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(@CrisBarreiro has reviewed the PR but she can't approve it since she created the PR)

@CrisBarreiro CrisBarreiro enabled auto-merge (squash) January 31, 2025 11:09
@CrisBarreiro CrisBarreiro merged commit 0c0da0e into develop Jan 31, 2025
6 checks passed
@CrisBarreiro CrisBarreiro deleted the feature/cris/malicious-site-protection/error-page branch January 31, 2025 11:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cmonfortep cmonfortep cmonfortep approved these changes

Assignees

@cmonfortep cmonfortep

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@CrisBarreiro @cmonfortep @laghee