@metamask-previews/phishing-controller 11.0.0-preview-02e7ff99 → 12.0.1-preview-473880a1

package/CHANGELOG.md

@@ -7,6 +7,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [12.0.1]
+
+### Added
+
+- Add `getHostnameFromUrl` utility function to standardize hostname extraction from URLs ([#4645](https://github.com/MetaMask/core/pull/4645))
+
+### Fixed
+
+- Update `test`, `isBlockedRequest`, and `bypass` methods to use the hostname for allowlist checks instead of the full origin ([#4645](https://github.com/MetaMask/core/pull/4645))
+  - The previous approach of using the full origin had limitations in dealing with subdomains or variations in the URL structure, which could lead to inconsistent results or false negatives.
+
+## [12.0.0]
+
+### Added
+
+- Add allowlist functionality to the C2 domain detection system ([#4464](https://github.com/MetaMask/core/pull/4644))
+- Add `PhishingController` functionality for blocking client-side C2 requests by managing a hashed C2 request blocklist ([#4526](https://github.com/MetaMask/core/pull/4526))
+  - Add `requestBlocklist` type to `ListTypes`.
+  - Add `isBlockedRequest` method to `PhishingController`.
+  - Add `isMaliciousRequestDomain` method to `PhishingDetector`.
+  - Add handling of `requestBlocklist` in `PhishingDetector` configuration.
+  - Add logic to update and check `requestBlocklist` when updating a stale list.
+  - Add `sha256Hash` function to generate SHA-256 hash of a domain.
+- Define and export new types: `PhishingControllerGetStateAction`, `PhishingControllerStateChangeEvent`, `PhishingControllerEvents` ([#4633](https://github.com/MetaMask/core/pull/4633))
+
+### Changed
+
+- **BREAKING:** Add `@noble/hashes` `^1.4.0` as dependency ([#4526](https://github.com/MetaMask/core/pull/4526))
+- **BREAKING:**: Add `ethereum-cryptography` `^2.1.2` as dependency ([#4526](https://github.com/MetaMask/core/pull/4526))
+- **BREAKING:** `PhishingControllerMessenger` must allow internal events defined in the `PhishingControllerEvents` type ([#4633](https://github.com/MetaMask/core/pull/4633))
+- Widen `PhishingControllerActions` to include the `PhishingController:getState` action ([#4633](https://github.com/MetaMask/core/pull/4633))
+- Bump `@metamask/base-controller` from `^6.0.2` to `^6.0.3` ([#4625](https://github.com/MetaMask/core/pull/4625))
+- Bump `@metamask/controller-utils` from `^11.0.2` to `^11.1.0` ([#4639](https://github.com/MetaMask/core/pull/4639))
+
 ## [11.0.0]
 
 ### Changed
@@ -64,7 +98,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Changed Stalelist and hotlist update intervals ([#4202](https://github.com/MetaMask/core/pull/4202))
   - Updated the Stalelist update interval to 30 days and the hotlist update interval to 5 mins
 - Bump `@metamask/controller-utils` version to `~9.1.0` ([#4153](https://github.com/MetaMask/core/pull/4153))
-- Bump TypeScript version to `~4.9.5` ([#4084](https://github.com/MetaMask/core.git/pull/4084))
+- Bump TypeScript version to `~4.9.5` ([#4084](https://github.com/MetaMask/core/pull/4084))
 - Bump `@metamask/base-controller` to `^5.0.2`
 
 ## [9.0.1]
@@ -228,7 +262,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
     All changes listed after this point were applied to this package following the monorepo conversion.
 
-[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@11.0.0...HEAD
+[Unreleased]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@12.0.1...HEAD
+[12.0.1]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@12.0.0...@metamask/phishing-controller@12.0.1
+[12.0.0]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@11.0.0...@metamask/phishing-controller@12.0.0
 [11.0.0]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@10.1.1...@metamask/phishing-controller@11.0.0
 [10.1.1]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@10.1.0...@metamask/phishing-controller@10.1.1
 [10.1.0]: https://github.com/MetaMask/core/compare/@metamask/phishing-controller@10.0.0...@metamask/phishing-controller@10.1.0

package/dist/PhishingController.js

@@ -11,7 +11,12 @@
 
 
 
-var _chunkDPHXQJ4Ejs = require('./chunk-DPHXQJ4E.js');
+
+
+
+
+var _chunkZAOBCAQTjs = require('./chunk-ZAOBCAQT.js');
+require('./chunk-5NDIXQG5.js');
 require('./chunk-Z4BLTVTB.js');
 
 
@@ -26,5 +31,9 @@ require('./chunk-Z4BLTVTB.js');
 
 
 
-exports.HOTLIST_REFRESH_INTERVAL = _chunkDPHXQJ4Ejs.HOTLIST_REFRESH_INTERVAL; exports.ListKeys = _chunkDPHXQJ4Ejs.ListKeys; exports.ListNames = _chunkDPHXQJ4Ejs.ListNames; exports.METAMASK_HOTLIST_DIFF_FILE = _chunkDPHXQJ4Ejs.METAMASK_HOTLIST_DIFF_FILE; exports.METAMASK_HOTLIST_DIFF_URL = _chunkDPHXQJ4Ejs.METAMASK_HOTLIST_DIFF_URL; exports.METAMASK_STALELIST_FILE = _chunkDPHXQJ4Ejs.METAMASK_STALELIST_FILE; exports.METAMASK_STALELIST_URL = _chunkDPHXQJ4Ejs.METAMASK_STALELIST_URL; exports.PHISHING_CONFIG_BASE_URL = _chunkDPHXQJ4Ejs.PHISHING_CONFIG_BASE_URL; exports.PhishingController = _chunkDPHXQJ4Ejs.PhishingController; exports.STALELIST_REFRESH_INTERVAL = _chunkDPHXQJ4Ejs.STALELIST_REFRESH_INTERVAL; exports.default = _chunkDPHXQJ4Ejs.PhishingController_default; exports.phishingListKeyNameMap = _chunkDPHXQJ4Ejs.phishingListKeyNameMap;
+
+
+
+
+exports.C2_DOMAIN_BLOCKLIST_ENDPOINT = _chunkZAOBCAQTjs.C2_DOMAIN_BLOCKLIST_ENDPOINT; exports.C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL = _chunkZAOBCAQTjs.C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL; exports.C2_DOMAIN_BLOCKLIST_URL = _chunkZAOBCAQTjs.C2_DOMAIN_BLOCKLIST_URL; exports.CLIENT_SIDE_DETECION_BASE_URL = _chunkZAOBCAQTjs.CLIENT_SIDE_DETECION_BASE_URL; exports.HOTLIST_REFRESH_INTERVAL = _chunkZAOBCAQTjs.HOTLIST_REFRESH_INTERVAL; exports.ListKeys = _chunkZAOBCAQTjs.ListKeys; exports.ListNames = _chunkZAOBCAQTjs.ListNames; exports.METAMASK_HOTLIST_DIFF_FILE = _chunkZAOBCAQTjs.METAMASK_HOTLIST_DIFF_FILE; exports.METAMASK_HOTLIST_DIFF_URL = _chunkZAOBCAQTjs.METAMASK_HOTLIST_DIFF_URL; exports.METAMASK_STALELIST_FILE = _chunkZAOBCAQTjs.METAMASK_STALELIST_FILE; exports.METAMASK_STALELIST_URL = _chunkZAOBCAQTjs.METAMASK_STALELIST_URL; exports.PHISHING_CONFIG_BASE_URL = _chunkZAOBCAQTjs.PHISHING_CONFIG_BASE_URL; exports.PhishingController = _chunkZAOBCAQTjs.PhishingController; exports.STALELIST_REFRESH_INTERVAL = _chunkZAOBCAQTjs.STALELIST_REFRESH_INTERVAL; exports.default = _chunkZAOBCAQTjs.PhishingController_default; exports.phishingListKeyNameMap = _chunkZAOBCAQTjs.phishingListKeyNameMap;
 //# sourceMappingURL=PhishingController.js.map

package/dist/PhishingController.mjs

@@ -1,4 +1,8 @@
 import {
+  C2_DOMAIN_BLOCKLIST_ENDPOINT,
+  C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL,
+  C2_DOMAIN_BLOCKLIST_URL,
+  CLIENT_SIDE_DETECION_BASE_URL,
   HOTLIST_REFRESH_INTERVAL,
   ListKeys,
   ListNames,
@@ -11,9 +15,14 @@ import {
   PhishingController_default,
   STALELIST_REFRESH_INTERVAL,
   phishingListKeyNameMap
-} from "./chunk-Q42CM6EP.mjs";
+} from "./chunk-I3U4U3MW.mjs";
+import "./chunk-G2RL74NS.mjs";
 import "./chunk-XUI43LEZ.mjs";
 export {
+  C2_DOMAIN_BLOCKLIST_ENDPOINT,
+  C2_DOMAIN_BLOCKLIST_REFRESH_INTERVAL,
+  C2_DOMAIN_BLOCKLIST_URL,
+  CLIENT_SIDE_DETECION_BASE_URL,
   HOTLIST_REFRESH_INTERVAL,
   ListKeys,
   ListNames,

package/dist/PhishingDetector.js

@@ -1,8 +1,9 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-var _chunkDPHXQJ4Ejs = require('./chunk-DPHXQJ4E.js');
+var _chunkZAOBCAQTjs = require('./chunk-ZAOBCAQT.js');
+require('./chunk-5NDIXQG5.js');
 require('./chunk-Z4BLTVTB.js');
 
 
-exports.PhishingDetector = _chunkDPHXQJ4Ejs.PhishingDetector;
+exports.PhishingDetector = _chunkZAOBCAQTjs.PhishingDetector;
 //# sourceMappingURL=PhishingDetector.js.map

package/dist/PhishingDetector.mjs

@@ -1,6 +1,7 @@
 import {
   PhishingDetector
-} from "./chunk-Q42CM6EP.mjs";
+} from "./chunk-I3U4U3MW.mjs";
+import "./chunk-G2RL74NS.mjs";
 import "./chunk-XUI43LEZ.mjs";
 export {
   PhishingDetector

package/dist/chunk-5NDIXQG5.js

@@ -0,0 +1,16 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});// src/types.ts
+var PhishingDetectorResultType = /* @__PURE__ */ ((PhishingDetectorResultType2) => {
+  PhishingDetectorResultType2["All"] = "all";
+  PhishingDetectorResultType2["Fuzzy"] = "fuzzy";
+  PhishingDetectorResultType2["Blocklist"] = "blocklist";
+  PhishingDetectorResultType2["Allowlist"] = "allowlist";
+  PhishingDetectorResultType2["Blacklist"] = "blacklist";
+  PhishingDetectorResultType2["Whitelist"] = "whitelist";
+  PhishingDetectorResultType2["C2DomainBlocklist"] = "c2DomainBlocklist";
+  return PhishingDetectorResultType2;
+})(PhishingDetectorResultType || {});
+
+
+
+exports.PhishingDetectorResultType = PhishingDetectorResultType;
+//# sourceMappingURL=chunk-5NDIXQG5.js.map

package/dist/chunk-5NDIXQG5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"names":["PhishingDetectorResultType"],"mappings":";AAyCO,IAAK,6BAAL,kBAAKA,gCAAL;AAIL,EAAAA,4BAAA,SAAM;AAIN,EAAAA,4BAAA,WAAQ;AAIR,EAAAA,4BAAA,eAAY;AAIZ,EAAAA,4BAAA,eAAY;AAKZ,EAAAA,4BAAA,eAAY;AAKZ,EAAAA,4BAAA,eAAY;AAIZ,EAAAA,4BAAA,uBAAoB;AA9BV,SAAAA;AAAA,GAAA","sourcesContent":["/**\n * Represents the result of checking a domain.\n */\nexport type PhishingDetectorResult = {\n  /**\n   * The name of the configuration object in which the domain was found within\n   * an allowlist, blocklist, or fuzzylist.\n   */\n  name?: string;\n  /**\n   * The version associated with the configuration object in which the domain\n   * was found within an allowlist, blocklist, or fuzzylist.\n   */\n  version?: string;\n  /**\n   * Whether the domain is regarded as allowed (true) or not (false).\n   */\n  result: boolean;\n  /**\n   * A normalized version of the domain, which is only constructed if the domain\n   * is found within a list.\n   */\n  match?: string;\n  /**\n   * Which type of list in which the domain was found.\n   *\n   * - \"allowlist\" means that the domain was found in the allowlist.\n   * - \"blocklist\" means that the domain was found in the blocklist.\n   * - \"fuzzy\" means that the domain was found in the fuzzylist.\n   * - \"blacklist\" means that the domain was found in a blacklist of a legacy\n   * configuration object.\n   * - \"whitelist\" means that the domain was found in a whitelist of a legacy\n   * configuration object.\n   * - \"all\" means that the domain was not found in any list.\n   */\n  type: PhishingDetectorResultType;\n};\n\n/**\n * The type of list in which the domain was found.\n */\nexport enum PhishingDetectorResultType {\n  /*\n   * \"all\" means that the domain was not found in any list.\n   */\n  All = 'all',\n  /*\n   * \"fuzzy\" means that the domain was found in the fuzzylist.\n   */\n  Fuzzy = 'fuzzy',\n  /*\n   * \"blocklist\" means that the domain was found in the blocklist.\n   */\n  Blocklist = 'blocklist',\n  /*\n   * \"allowlist\" means that the domain was found in the allowlist.\n   */\n  Allowlist = 'allowlist',\n  /*\n   * \"blacklist\" means that the domain was found in a blacklist of a legacy\n   * configuration object.\n   */\n  Blacklist = 'blacklist',\n  /*\n   * \"whitelist\" means that the domain was found in a whitelist of a legacy\n   * configuration object.\n   */\n  Whitelist = 'whitelist',\n  /*\n   * \"c2DomainBlocklist\" means that the domain was found in the C2 domain blocklist.\n   */\n  C2DomainBlocklist = 'c2DomainBlocklist',\n}\n"]}

package/dist/chunk-G2RL74NS.mjs

@@ -0,0 +1,16 @@
+// src/types.ts
+var PhishingDetectorResultType = /* @__PURE__ */ ((PhishingDetectorResultType2) => {
+  PhishingDetectorResultType2["All"] = "all";
+  PhishingDetectorResultType2["Fuzzy"] = "fuzzy";
+  PhishingDetectorResultType2["Blocklist"] = "blocklist";
+  PhishingDetectorResultType2["Allowlist"] = "allowlist";
+  PhishingDetectorResultType2["Blacklist"] = "blacklist";
+  PhishingDetectorResultType2["Whitelist"] = "whitelist";
+  PhishingDetectorResultType2["C2DomainBlocklist"] = "c2DomainBlocklist";
+  return PhishingDetectorResultType2;
+})(PhishingDetectorResultType || {});
+
+export {
+  PhishingDetectorResultType
+};
+//# sourceMappingURL=chunk-G2RL74NS.mjs.map

package/dist/chunk-G2RL74NS.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["/**\n * Represents the result of checking a domain.\n */\nexport type PhishingDetectorResult = {\n  /**\n   * The name of the configuration object in which the domain was found within\n   * an allowlist, blocklist, or fuzzylist.\n   */\n  name?: string;\n  /**\n   * The version associated with the configuration object in which the domain\n   * was found within an allowlist, blocklist, or fuzzylist.\n   */\n  version?: string;\n  /**\n   * Whether the domain is regarded as allowed (true) or not (false).\n   */\n  result: boolean;\n  /**\n   * A normalized version of the domain, which is only constructed if the domain\n   * is found within a list.\n   */\n  match?: string;\n  /**\n   * Which type of list in which the domain was found.\n   *\n   * - \"allowlist\" means that the domain was found in the allowlist.\n   * - \"blocklist\" means that the domain was found in the blocklist.\n   * - \"fuzzy\" means that the domain was found in the fuzzylist.\n   * - \"blacklist\" means that the domain was found in a blacklist of a legacy\n   * configuration object.\n   * - \"whitelist\" means that the domain was found in a whitelist of a legacy\n   * configuration object.\n   * - \"all\" means that the domain was not found in any list.\n   */\n  type: PhishingDetectorResultType;\n};\n\n/**\n * The type of list in which the domain was found.\n */\nexport enum PhishingDetectorResultType {\n  /*\n   * \"all\" means that the domain was not found in any list.\n   */\n  All = 'all',\n  /*\n   * \"fuzzy\" means that the domain was found in the fuzzylist.\n   */\n  Fuzzy = 'fuzzy',\n  /*\n   * \"blocklist\" means that the domain was found in the blocklist.\n   */\n  Blocklist = 'blocklist',\n  /*\n   * \"allowlist\" means that the domain was found in the allowlist.\n   */\n  Allowlist = 'allowlist',\n  /*\n   * \"blacklist\" means that the domain was found in a blacklist of a legacy\n   * configuration object.\n   */\n  Blacklist = 'blacklist',\n  /*\n   * \"whitelist\" means that the domain was found in a whitelist of a legacy\n   * configuration object.\n   */\n  Whitelist = 'whitelist',\n  /*\n   * \"c2DomainBlocklist\" means that the domain was found in the C2 domain blocklist.\n   */\n  C2DomainBlocklist = 'c2DomainBlocklist',\n}\n"],"mappings":";AAyCO,IAAK,6BAAL,kBAAKA,gCAAL;AAIL,EAAAA,4BAAA,SAAM;AAIN,EAAAA,4BAAA,WAAQ;AAIR,EAAAA,4BAAA,eAAY;AAIZ,EAAAA,4BAAA,eAAY;AAKZ,EAAAA,4BAAA,eAAY;AAKZ,EAAAA,4BAAA,eAAY;AAIZ,EAAAA,4BAAA,uBAAoB;AA9BV,SAAAA;AAAA,GAAA;","names":["PhishingDetectorResultType"]}