neptune/ghost-keychain
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

leverage the phishing list caching - Move phishing check to background script (#561)

Browse Source 
* cache phishing list

* Update packages/extension-base/src/page/index.ts

* remove xml and pdf check

* remove cache

Co-authored-by: Github Actions <action@github.com>
This commit is contained in:
Thibaut Sardan 2020-12-04 05:20:03 -10:00 committed by GitHub
parent 8df2e3472c
commit b3145fc862
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
11 changed files with 38 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
packages/extension-base/package.json
View File

@ -11,6 +11,7 @@
"@polkadot/api": "^2.9.1",
"@polkadot/extension-inject": "^0.35.2-2",
"@polkadot/keyring": "^4.2.1",
"@polkadot/phishing": "^0.2.6",
"@polkadot/ui-keyring": "^0.62.2-17"
}
}

2
packages/extension-base/src/background/handlers/State.ts
View File

@ -5,10 +5,10 @@ import type { ProviderMeta, MetadataDef } from '@polkadot/extension-inject/types
import type { JsonRpcResponse, ProviderInterface, ProviderInterfaceCallback } from '@polkadot/rpc-provider/types';
import type { AccountJson, AuthorizeRequest, MetadataRequest, RequestAuthorizeTab, RequestRpcSend, RequestRpcSubscribe, RequestSign, ResponseRpcListProviders, ResponseSigning, SigningRequest, RequestRpcUnsubscribe } from '../types';
import { BehaviorSubject } from 'rxjs';
import { knownMetadata, addMetadata } from '@polkadot/extension-chains';
import chrome from '@polkadot/extension-inject/chrome';
import { assert } from '@polkadot/util';
import { BehaviorSubject } from 'rxjs';
import { MetadataStore } from '../../stores';

15
packages/extension-base/src/background/handlers/Tabs.ts
View File

@ -9,6 +9,7 @@ import type { SubjectInfo } from '@polkadot/ui-keyring/observable/types';
import type { RequestAuthorizeTab, ResponseSigning, RequestTypes, ResponseTypes, MessageTypes, ResponseRpcListProviders, RequestRpcSend, RequestRpcSubscribe, RequestRpcUnsubscribe, SubscriptionMessageTypes } from '../types';
import { PHISHING_PAGE_REDIRECT } from '@polkadot/extension-base/defaults';
import { checkIfDenied } from '@polkadot/phishing';
import keyring from '@polkadot/ui-keyring';
import accountsObservable from '@polkadot/ui-keyring/observable/accounts';
import { assert } from '@polkadot/util';
@ -143,9 +144,19 @@ export default class Tabs {
return null;
}
private async redirectIfPhishing (url: string): Promise<boolean> {
const isInDenyList = await checkIfDenied(url);
if (isInDenyList) {
this.redirectPhishingLanding();
}
return false;
}
public async handle<TMessageType extends MessageTypes> (id: string, type: TMessageType, request: RequestTypes[TMessageType], url: string, port: chrome.runtime.Port): Promise<ResponseTypes[keyof ResponseTypes]> {
if (type === 'pub(phishing.redirect)') {
return this.redirectPhishingLanding();
if (type === 'pub(phishing.redirectIfDenied)') {
return this.redirectIfPhishing(url);
}
if (type !== 'pub(authorize.tab)') {

2
packages/extension-base/src/background/types.ts
View File

@ -108,7 +108,7 @@ export interface RequestSignatures {
'pub(extrinsic.sign)': [SignerPayloadJSON, ResponseSigning];
'pub(metadata.list)': [null, InjectedMetadataKnown[]];
'pub(metadata.provide)': [MetadataDef, boolean];
'pub(phishing.redirect)': [null, null];
'pub(phishing.redirectIfDenied)': [null, boolean];
'pub(rpc.listProviders)': [void, ResponseRpcListProviders];
'pub(rpc.send)': [RequestRpcSend, JsonRpcResponse];
'pub(rpc.startProvider)': [string, ProviderMeta];

24
packages/extension-base/src/page/index.ts
View File

@ -4,7 +4,6 @@
import type { ResponseTypes, TransportRequestMessage, TransportResponseMessage, MessageTypes, RequestTypes, MessageTypesWithNullRequest, SubscriptionMessageTypes, MessageTypesWithNoSubscriptions, MessageTypesWithSubscriptions } from '../background/types';
import Injected from './Injected';
import { isXmlOrPdf } from '../utils';
// when sending a message from the injector to the extension, we
// - create an event - this we send to the loader
@ -51,25 +50,18 @@ export function sendMessage<TMessageType extends MessageTypes> (message: TMessag
// the enable function, called by the dapp to allow access
export async function enable (origin: string): Promise<Injected> {
const currentPathname = window.location.pathname;
if (isXmlOrPdf(currentPathname)) {
return redirectPhishing();
} else {
await sendMessage('pub(authorize.tab)', { origin });
return new Injected(sendMessage);
}
}
// the redirection function, called by the page in case the host
// is flagged as a phishing site.
export async function redirectPhishing (): Promise<Injected> {
await sendMessage('pub(phishing.redirect)');
await sendMessage('pub(authorize.tab)', { origin });
return new Injected(sendMessage);
}
// redirect users if this page is considered as phishing, otherwise return false
export async function redirectIfPhishing (): Promise<boolean> {
const res = await sendMessage('pub(phishing.redirectIfDenied)');
return res;
}
export function handleResponse<TMessageType extends MessageTypes> (data: TransportResponseMessage<TMessageType> & { subscription?: string }): void {
const handler = handlers[data.id];

4
packages/extension-base/src/utils/index.ts
View File

@ -1,4 +0,0 @@
// Copyright 2019-2020 @polkadot/extension-base authors & contributors
// SPDX-License-Identifier: Apache-2.0
export { default as isXmlOrPdf } from './isXmlOrPdf';

23
packages/extension-base/src/utils/isXmlOrPdf.test.tsx
View File

@ -1,23 +0,0 @@
// Copyright 2019-2020 @polkadot/extension-ui authors & contributors
// SPDX-License-Identifier: Apache-2.0
import { isXmlOrPdf } from './';
describe.only('File extension util function', () => {
it('returns true for a xml file', () => {
const res = isXmlOrPdf('/some.xml');
expect(res).toBe(true);
});
it('returns true for a pdf file', () => {
const res = isXmlOrPdf('/some.pdf');
expect(res).toBe(true);
});
it('returns false for any other path', () => {
expect(isXmlOrPdf('/some-pdf')).toBe(false);
expect(isXmlOrPdf('/some-xml')).toBe(false);
});
});

17
packages/extension-base/src/utils/isXmlOrPdf.ts
View File

@ -1,17 +0,0 @@
// Copyright 2019-2020 @polkadot/extension authors & contributors
// SPDX-License-Identifier: Apache-2.0
export default function (pathname: string): boolean {
const prohibitedFiles: RegExp[] = [
/\.xml$/u,
/\.pdf$/u
];
return prohibitedFiles.some((file) => {
if (file.test(pathname)) {
return true;
}
return false;
});
}

3
packages/extension/package.json
View File

@ -8,8 +8,7 @@
"@babel/runtime": "^7.12.5",
"@polkadot/extension-base": "^0.35.2-2",
"@polkadot/extension-inject": "^0.35.2-2",
"@polkadot/extension-ui": "^0.35.2-2",
"@polkadot/phishing": "^0.2.3"
"@polkadot/extension-ui": "^0.35.2-2"
},
"devDependencies": {
"@polkadot/dev": "^0.60.6"

24
packages/extension/src/page.ts
View File

@ -3,9 +3,8 @@
import type { Message } from '@polkadot/extension-base/types';
import { enable, handleResponse, redirectPhishing } from '@polkadot/extension-base/page';
import { enable, handleResponse, redirectIfPhishing } from '@polkadot/extension-base/page';
import { injectExtension } from '@polkadot/extension-inject';
import { checkIfDenied } from '@polkadot/phishing';
// setup a response listener (events created by the loader for extension responses)
window.addEventListener('message', ({ data, source }: Message): void => {
@ -22,21 +21,14 @@ window.addEventListener('message', ({ data, source }: Message): void => {
}
});
const currentUrl = window.location.host;
checkIfDenied(currentUrl)
.then((isOnDeny) => {
if (isOnDeny) {
console.log('Phishing detected, redirecting to phishing info landing page');
redirectPhishing().catch(console.error);
} else {
inject();
}
})
.catch((error): void => {
console.warn(`Unable to retrieve phishing list: ${(error as Error).message}`);
redirectIfPhishing().then((gotRedirected) => {
if (!gotRedirected) {
inject();
});
}
}).catch((e) => {
console.warn(`Unable to determine if the site is in the phishing list: ${(e as Error).message}`);
inject();
});
function inject () {
injectExtension(enable, {

10
yarn.lock
View File

@ -2012,6 +2012,7 @@ __metadata:
"@polkadot/api": ^2.9.1
"@polkadot/extension-inject": ^0.35.2-2
"@polkadot/keyring": ^4.2.1
"@polkadot/phishing": ^0.2.6
"@polkadot/ui-keyring": ^0.62.2-17
languageName: unknown
linkType: soft
@ -2102,7 +2103,6 @@ __metadata:
"@polkadot/extension-base": ^0.35.2-2
"@polkadot/extension-inject": ^0.35.2-2
"@polkadot/extension-ui": ^0.35.2-2
"@polkadot/phishing": ^0.2.3
languageName: unknown
linkType: soft
@ -2171,13 +2171,13 @@ __metadata:
languageName: node
linkType: hard
"@polkadot/phishing@npm:^0.2.3":
version: 0.2.3
resolution: "@polkadot/phishing@npm:0.2.3"
"@polkadot/phishing@npm:^0.2.6":
version: 0.2.6
resolution: "@polkadot/phishing@npm:0.2.6"
dependencies:
"@babel/runtime": ^7.12.5
"@polkadot/x-fetch": ^4.2.1
checksum: a718e78cd1d63e63dfe6284fdc0c3c17a79c1a15bfd54977fdfea00a86003c04c03e629892c041abb4f41dca42d5e89dad32172cae2361302ee9e278d1360c64
checksum: 867171eccda637634929c315cd6f23f43fd88a71c5474802ee313304cd349abcc48882f4ef20e28d8944c272b1e61d5627c5ea1df235944ba05f07e75b3b5bdb
languageName: node
linkType: hard