diff --git a/packages/extension-base/package.json b/packages/extension-base/package.json index f38bf220..6828f952 100644 --- a/packages/extension-base/package.json +++ b/packages/extension-base/package.json @@ -11,6 +11,7 @@ "@polkadot/api": "^2.9.1", "@polkadot/extension-inject": "^0.35.2-2", "@polkadot/keyring": "^4.2.1", + "@polkadot/phishing": "^0.2.6", "@polkadot/ui-keyring": "^0.62.2-17" } } diff --git a/packages/extension-base/src/background/handlers/State.ts b/packages/extension-base/src/background/handlers/State.ts index 319aeb68..37650757 100644 --- a/packages/extension-base/src/background/handlers/State.ts +++ b/packages/extension-base/src/background/handlers/State.ts @@ -5,10 +5,10 @@ import type { ProviderMeta, MetadataDef } from '@polkadot/extension-inject/types import type { JsonRpcResponse, ProviderInterface, ProviderInterfaceCallback } from '@polkadot/rpc-provider/types'; import type { AccountJson, AuthorizeRequest, MetadataRequest, RequestAuthorizeTab, RequestRpcSend, RequestRpcSubscribe, RequestSign, ResponseRpcListProviders, ResponseSigning, SigningRequest, RequestRpcUnsubscribe } from '../types'; -import { BehaviorSubject } from 'rxjs'; import { knownMetadata, addMetadata } from '@polkadot/extension-chains'; import chrome from '@polkadot/extension-inject/chrome'; import { assert } from '@polkadot/util'; +import { BehaviorSubject } from 'rxjs'; import { MetadataStore } from '../../stores'; diff --git a/packages/extension-base/src/background/handlers/Tabs.ts b/packages/extension-base/src/background/handlers/Tabs.ts index 3f69f086..9326a1fe 100644 --- a/packages/extension-base/src/background/handlers/Tabs.ts +++ b/packages/extension-base/src/background/handlers/Tabs.ts @@ -9,6 +9,7 @@ import type { SubjectInfo } from '@polkadot/ui-keyring/observable/types'; import type { RequestAuthorizeTab, ResponseSigning, RequestTypes, ResponseTypes, MessageTypes, ResponseRpcListProviders, RequestRpcSend, RequestRpcSubscribe, RequestRpcUnsubscribe, SubscriptionMessageTypes } from '../types'; import { PHISHING_PAGE_REDIRECT } from '@polkadot/extension-base/defaults'; +import { checkIfDenied } from '@polkadot/phishing'; import keyring from '@polkadot/ui-keyring'; import accountsObservable from '@polkadot/ui-keyring/observable/accounts'; import { assert } from '@polkadot/util'; @@ -143,9 +144,19 @@ export default class Tabs { return null; } + private async redirectIfPhishing (url: string): Promise { + const isInDenyList = await checkIfDenied(url); + + if (isInDenyList) { + this.redirectPhishingLanding(); + } + + return false; + } + public async handle (id: string, type: TMessageType, request: RequestTypes[TMessageType], url: string, port: chrome.runtime.Port): Promise { - if (type === 'pub(phishing.redirect)') { - return this.redirectPhishingLanding(); + if (type === 'pub(phishing.redirectIfDenied)') { + return this.redirectIfPhishing(url); } if (type !== 'pub(authorize.tab)') { diff --git a/packages/extension-base/src/background/types.ts b/packages/extension-base/src/background/types.ts index e95079d1..a2720ebc 100644 --- a/packages/extension-base/src/background/types.ts +++ b/packages/extension-base/src/background/types.ts @@ -108,7 +108,7 @@ export interface RequestSignatures { 'pub(extrinsic.sign)': [SignerPayloadJSON, ResponseSigning]; 'pub(metadata.list)': [null, InjectedMetadataKnown[]]; 'pub(metadata.provide)': [MetadataDef, boolean]; - 'pub(phishing.redirect)': [null, null]; + 'pub(phishing.redirectIfDenied)': [null, boolean]; 'pub(rpc.listProviders)': [void, ResponseRpcListProviders]; 'pub(rpc.send)': [RequestRpcSend, JsonRpcResponse]; 'pub(rpc.startProvider)': [string, ProviderMeta]; diff --git a/packages/extension-base/src/page/index.ts b/packages/extension-base/src/page/index.ts index 83232f75..04a91c7f 100644 --- a/packages/extension-base/src/page/index.ts +++ b/packages/extension-base/src/page/index.ts @@ -4,7 +4,6 @@ import type { ResponseTypes, TransportRequestMessage, TransportResponseMessage, MessageTypes, RequestTypes, MessageTypesWithNullRequest, SubscriptionMessageTypes, MessageTypesWithNoSubscriptions, MessageTypesWithSubscriptions } from '../background/types'; import Injected from './Injected'; -import { isXmlOrPdf } from '../utils'; // when sending a message from the injector to the extension, we // - create an event - this we send to the loader @@ -51,25 +50,18 @@ export function sendMessage (message: TMessag // the enable function, called by the dapp to allow access export async function enable (origin: string): Promise { - const currentPathname = window.location.pathname; - - if (isXmlOrPdf(currentPathname)) { - return redirectPhishing(); - } else { - await sendMessage('pub(authorize.tab)', { origin }); - - return new Injected(sendMessage); - } -} - -// the redirection function, called by the page in case the host -// is flagged as a phishing site. -export async function redirectPhishing (): Promise { - await sendMessage('pub(phishing.redirect)'); + await sendMessage('pub(authorize.tab)', { origin }); return new Injected(sendMessage); } +// redirect users if this page is considered as phishing, otherwise return false +export async function redirectIfPhishing (): Promise { + const res = await sendMessage('pub(phishing.redirectIfDenied)'); + + return res; +} + export function handleResponse (data: TransportResponseMessage & { subscription?: string }): void { const handler = handlers[data.id]; diff --git a/packages/extension-base/src/utils/index.ts b/packages/extension-base/src/utils/index.ts deleted file mode 100644 index 738dd209..00000000 --- a/packages/extension-base/src/utils/index.ts +++ /dev/null @@ -1,4 +0,0 @@ -// Copyright 2019-2020 @polkadot/extension-base authors & contributors -// SPDX-License-Identifier: Apache-2.0 - -export { default as isXmlOrPdf } from './isXmlOrPdf'; diff --git a/packages/extension-base/src/utils/isXmlOrPdf.test.tsx b/packages/extension-base/src/utils/isXmlOrPdf.test.tsx deleted file mode 100644 index bd7876c7..00000000 --- a/packages/extension-base/src/utils/isXmlOrPdf.test.tsx +++ /dev/null @@ -1,23 +0,0 @@ -// Copyright 2019-2020 @polkadot/extension-ui authors & contributors -// SPDX-License-Identifier: Apache-2.0 - -import { isXmlOrPdf } from './'; - -describe.only('File extension util function', () => { - it('returns true for a xml file', () => { - const res = isXmlOrPdf('/some.xml'); - - expect(res).toBe(true); - }); - - it('returns true for a pdf file', () => { - const res = isXmlOrPdf('/some.pdf'); - - expect(res).toBe(true); - }); - - it('returns false for any other path', () => { - expect(isXmlOrPdf('/some-pdf')).toBe(false); - expect(isXmlOrPdf('/some-xml')).toBe(false); - }); -}); diff --git a/packages/extension-base/src/utils/isXmlOrPdf.ts b/packages/extension-base/src/utils/isXmlOrPdf.ts deleted file mode 100644 index a00d79e9..00000000 --- a/packages/extension-base/src/utils/isXmlOrPdf.ts +++ /dev/null @@ -1,17 +0,0 @@ -// Copyright 2019-2020 @polkadot/extension authors & contributors -// SPDX-License-Identifier: Apache-2.0 - -export default function (pathname: string): boolean { - const prohibitedFiles: RegExp[] = [ - /\.xml$/u, - /\.pdf$/u - ]; - - return prohibitedFiles.some((file) => { - if (file.test(pathname)) { - return true; - } - - return false; - }); -} diff --git a/packages/extension/package.json b/packages/extension/package.json index 35283ea9..2a99e3a8 100644 --- a/packages/extension/package.json +++ b/packages/extension/package.json @@ -8,8 +8,7 @@ "@babel/runtime": "^7.12.5", "@polkadot/extension-base": "^0.35.2-2", "@polkadot/extension-inject": "^0.35.2-2", - "@polkadot/extension-ui": "^0.35.2-2", - "@polkadot/phishing": "^0.2.3" + "@polkadot/extension-ui": "^0.35.2-2" }, "devDependencies": { "@polkadot/dev": "^0.60.6" diff --git a/packages/extension/src/page.ts b/packages/extension/src/page.ts index 0e78dfd6..c0444888 100644 --- a/packages/extension/src/page.ts +++ b/packages/extension/src/page.ts @@ -3,9 +3,8 @@ import type { Message } from '@polkadot/extension-base/types'; -import { enable, handleResponse, redirectPhishing } from '@polkadot/extension-base/page'; +import { enable, handleResponse, redirectIfPhishing } from '@polkadot/extension-base/page'; import { injectExtension } from '@polkadot/extension-inject'; -import { checkIfDenied } from '@polkadot/phishing'; // setup a response listener (events created by the loader for extension responses) window.addEventListener('message', ({ data, source }: Message): void => { @@ -22,21 +21,14 @@ window.addEventListener('message', ({ data, source }: Message): void => { } }); -const currentUrl = window.location.host; - -checkIfDenied(currentUrl) - .then((isOnDeny) => { - if (isOnDeny) { - console.log('Phishing detected, redirecting to phishing info landing page'); - redirectPhishing().catch(console.error); - } else { - inject(); - } - }) - .catch((error): void => { - console.warn(`Unable to retrieve phishing list: ${(error as Error).message}`); +redirectIfPhishing().then((gotRedirected) => { + if (!gotRedirected) { inject(); - }); + } +}).catch((e) => { + console.warn(`Unable to determine if the site is in the phishing list: ${(e as Error).message}`); + inject(); +}); function inject () { injectExtension(enable, { diff --git a/yarn.lock b/yarn.lock index 904bf947..0048b4c7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2012,6 +2012,7 @@ __metadata: "@polkadot/api": ^2.9.1 "@polkadot/extension-inject": ^0.35.2-2 "@polkadot/keyring": ^4.2.1 + "@polkadot/phishing": ^0.2.6 "@polkadot/ui-keyring": ^0.62.2-17 languageName: unknown linkType: soft @@ -2102,7 +2103,6 @@ __metadata: "@polkadot/extension-base": ^0.35.2-2 "@polkadot/extension-inject": ^0.35.2-2 "@polkadot/extension-ui": ^0.35.2-2 - "@polkadot/phishing": ^0.2.3 languageName: unknown linkType: soft @@ -2171,13 +2171,13 @@ __metadata: languageName: node linkType: hard -"@polkadot/phishing@npm:^0.2.3": - version: 0.2.3 - resolution: "@polkadot/phishing@npm:0.2.3" +"@polkadot/phishing@npm:^0.2.6": + version: 0.2.6 + resolution: "@polkadot/phishing@npm:0.2.6" dependencies: "@babel/runtime": ^7.12.5 "@polkadot/x-fetch": ^4.2.1 - checksum: a718e78cd1d63e63dfe6284fdc0c3c17a79c1a15bfd54977fdfea00a86003c04c03e629892c041abb4f41dca42d5e89dad32172cae2361302ee9e278d1360c64 + checksum: 867171eccda637634929c315cd6f23f43fd88a71c5474802ee313304cd349abcc48882f4ef20e28d8944c272b1e61d5627c5ea1df235944ba05f07e75b3b5bdb languageName: node linkType: hard