refactor: Refactor inpage blocklist to avoid usage of regex

[NicholasEllul]

Description

This PR fixes two bugs that occured as the result of using regex to identify URLs in our content script blocklist.

The first issue is that we were only escaping the first . found in a URL when using the inpage blocklist. This meant that entries such as ani.gamer.com.tw would have their first period escaped for regex parsing, but subsequent periods were treated as regex wildcards. This could lead to and unintentionally matching on URLs such as ani.gamerxcom.tw etc.

The second issue is that we were missing a leading anchor ^ in the regex expression. This means that we would block the domain if the matched string occurred anywhere in the URL. For an example, https://google.com?search=uscourts.gov would be a blocked domain since it ended in uscourts.gov. Adding the leading anchor addresses this so we only match the correct domain.

To avoid future regex complexities, this code has been refactored to use built in javascript URL parsing instead.

Related issues

https://github.com/MetaMask/mobile-planning/issues/1571

Manual testing steps

Pre-merge author checklist

• I’ve followed MetaMask Coding Standards.
• I've clearly explained what problem this PR is solving and how it is solved.
• I've linked related issues
• I've included manual testing steps
• I've included screenshots/recordings if applicable
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.
• I’ve properly set the pull request status:
  • In case it's not yet "ready for review", I've set it to "draft".
  • In case it's "ready for review", I've changed it from "draft" to "non-draft".

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note: Issue with testing has been created here: #9009

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[github-actions]

E2E test started on Bitrise: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/63f2cd35-fd45-4f0e-b96d-5bbb17b85e18
You can also kick off another Bitrise E2E smoke test by removing and re-applying the (Run Smoke E2E) label

[tommasini]

LGTM!

[NicholasEllul]

@tommasini also I struggled to mock out window in my jest tests, if you have any suggestions on how I could export this function & test it, please let me know

[davidmurdoch]

Tested by copying the new function from here, visiting websites in the browser, and pasting the function and a call to blockedDomainCheck() into the console.

It seems to work very well!

[NicholasEllul]

I've updated this to match the latest changes found on MetaMask/metamask-extension#23134

[github-actions]

Bitrise

🔄🔄🔄 pr_smoke_e2e_pipeline started on Bitrise...🔄🔄🔄

Commit hash: 659f495
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/0da6d2eb-0b2a-49fd-ae06-68c6d7e2e046

Note

• This comment will auto-update when build completes
• You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

[github-actions]

Bitrise

✅✅✅ pr_smoke_e2e_pipeline passed on Bitrise! ✅✅✅

Commit hash: 19b4d5c
Build link: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/16d196b1-482c-450a-88e4-7094c1bbdb1c

Note

• You can kick off another pr_smoke_e2e_pipeline on Bitrise by removing and re-applying the Run Smoke E2E label on the pull request

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 43.23%. Comparing base (92c9521) to head (19b4d5c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8675   +/-   ##
=======================================
  Coverage   43.23%   43.23%           
=======================================
  Files        1271     1271           
  Lines       30905    30905           
  Branches     3088     3088           
=======================================
  Hits        13361    13361           
  Misses      16769    16769           
  Partials      775      775           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[NicolasMassart]

Could you update the tests?
As you provided an example of dangerous url that could pass with the regex, to confirm the issue is solved, you could add a test case in the unit tests matching against this ani.gamerxcom.tw type of URL.

Same for the second case with https://google.com?search=uscourts.gov

[NicholasEllul]

@NicolasMassart I tried to get some kind of unit test set up and running but struggled trying to figure out how to mock out some of the browser window functions with the current setup. Unlike in extension (https://github.com/MetaMask/metamask-extension/pull/23134/files), the code in this file gets executed the moment it gets imported resulting in difficulties getting a suite of multiple tests running correctly.

[NicolasMassart]

@NicolasMassart I tried to get some kind of unit test set up and running but struggled trying to figure out how to mock out some of the browser window functions with the current setup. Unlike in extension (https://github.com/MetaMask/metamask-extension/pull/23134/files), the code in this file gets executed the moment it gets imported resulting in difficulties getting a suite of multiple tests running correctly.

As discussed, we don't have any ways to test this right now but we are aware it should be.
So creating an issue to investigate testing this injected script is a good start. (please post the link in this PR).

[NicholasEllul]

Related issue has been created here: #9009