feat: check against urls with path

[imblue-dabadee]

Explanation

There has been an advent of sites such as sites.google.com being used maliciously that bypass the checks as they contain an allowlisted hostname. This PR aims to enable the Phishing Controller to block URL paths so that we can maintain the same allowlist but also block malicious websites that use allowlisted hostnames.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed, highlighting breaking changes as necessary
• I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

[AugmentedMode]

We shouldn't be modifying this file should we ?

[AugmentedMode]

new URL() throws on bad input. Should we wrap this with a try/catch?

[AugmentedMode]

What do you think about a type like this instead for better readability

type PathBlockNode = {
  isBlocked: boolean;          
  blockAllSubpaths: boolean;    
  children: Record<string, PathBlockNode>;  
};

type BlocklistPaths = Record<string, PathBlockNode>;  

[cursor]

Bug: Phishing Detector Ignores C2 Domain Blocklists

Legacy PhishingDetector configurations no longer correctly handle c2DomainBlocklist. The c2DomainBlocklist property is no longer passed to getDefaultPhishingDetectorConfig in the legacy constructor path, causing C2 domain blocklists to be ignored. This is a regression for existing legacy configurations.

packages/phishing-controller/src/PhishingDetector.ts#L76-L92

core/packages/phishing-controller/src/PhishingDetector.ts

Lines 76 to 92 in 9368c52

	constructor(opts: PhishingDetectorOptions) {
	// recommended configuration
	if (Array.isArray(opts)) {
	this.#configs = processConfigs(opts);
	this.#legacyConfig = false;
	// legacy configuration
	} else {
	this.#configs = [
	getDefaultPhishingDetectorConfig({
	allowlist: opts.whitelist,
	blocklist: opts.blacklist,
	fuzzylist: opts.fuzzylist,
	tolerance: opts.tolerance,
	}),
	];
	this.#legacyConfig = true;
	}

 

---