Prevent phishing validation bypass via credentialed URLs using tldts (#1560)

* feat: add tldts dependency and update handler to extract hostname from sender URL

* feat: add URL parsing functionality to improve sender URL extraction

packages/extension-base/package.json

@@ -36,6 +36,7 @@
     "@polkadot/util-crypto": "^13.5.2",
     "eventemitter3": "^5.0.1",
     "rxjs": "^7.8.1",
+    "tldts": "^7.0.8",
     "tslib": "^2.8.1"
   },
   "devDependencies": {

packages/extension-base/src/background/handlers/Tabs.ts

@@ -13,6 +13,7 @@ import type { AuthResponse } from './State.js';
 import type State from './State.js';
 
 import { combineLatest, type Subscription } from 'rxjs';
+import { parse } from 'tldts';
 
 import { checkIfDenied } from '@polkadot/phishing';
 import { keyring } from '@polkadot/ui-keyring';
@@ -215,6 +216,22 @@ export default class Tabs {
     });
   }
 
+  private parseUrl (rawUrl: string): string {
+    let from = 'extension';
+
+    if (rawUrl) {
+      try {
+        const { hostname } = parse(rawUrl);
+
+        from = hostname || '<unknown>'; // Only use the hostname
+      } catch {
+        from = '<unknown>';
+      }
+    }
+
+    return from;
+  }
+
   private async redirectIfPhishing (url: string): Promise<boolean> {
     const isInDenyList = await checkIfDenied(url);
 
@@ -229,7 +246,9 @@ export default class Tabs {
 
   public async handle<TMessageType extends MessageTypes> (id: string, type: TMessageType, request: RequestTypes[TMessageType], url: string, port?: chrome.runtime.Port): Promise<ResponseTypes[keyof ResponseTypes]> {
     if (type === 'pub(phishing.redirectIfDenied)') {
-      return this.redirectIfPhishing(url);
+      const parsedUrl = this.parseUrl(url);
+
+      return this.redirectIfPhishing(parsedUrl);
     }
 
     if (type !== 'pub(authorize.tab)') {

packages/extension-base/src/background/handlers/index.ts

@@ -31,6 +31,7 @@ export default function handler<TMessageType extends MessageTypes> ({ id, messag
   const from = isExtension
     ? 'extension'
     : sender?.url || sender?.tab?.url || '<unknown>';
+
   const source = `${from}: ${id}: ${message}`;
 
   console.log(` [in] ${source}`); // :: ${JSON.stringify(request)}`);

yarn.lock

@@ -944,6 +944,7 @@ __metadata:
     "@polkadot/util-crypto": "npm:^13.5.2"
     eventemitter3: "npm:^5.0.1"
     rxjs: "npm:^7.8.1"
+    tldts: "npm:^7.0.8"
     tslib: "npm:^2.8.1"
   languageName: unknown
   linkType: soft