Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement Phishing Detection Integration #2791

Closed
wants to merge 75 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
75 commits
Select commit Hold shift + click to select a range
837ca6d
Add phishing error page extension and user script
not-a-rootkit Apr 23, 2024
392f75f
Add error page template and user text
not-a-rootkit Apr 24, 2024
f4442c4
Ensure navigation isn't broken by leaveSite/visitSite handlers.
not-a-rootkit May 3, 2024
b65fa08
Add wrapper around PhishingDetectionService
not-a-rootkit May 15, 2024
319533e
Inject PhishingDetectionManager dependency into TabExtensions
not-a-rootkit May 16, 2024
5bb1c6a
Remove need for error code and always loadAlternateHTML
not-a-rootkit May 17, 2024
26fbe30
Make SpecialErrorPageUserScript generic for PhishingErrorPageTabExten…
not-a-rootkit May 20, 2024
bc9d060
Add isEnabled configuration to phishingErrorPageUserScript
not-a-rootkit May 20, 2024
40a5800
Generalize SSLErrorTabExtension into SpecialErrorPage
not-a-rootkit May 20, 2024
02c1d08
Add Mock for testing phishing detection manager
not-a-rootkit May 20, 2024
43701cd
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit May 21, 2024
0a69ac3
Update references from SSLErrorPage to SpecialErrorPage
not-a-rootkit May 21, 2024
11895eb
Add MockPhishingDetectionManager reference.
not-a-rootkit May 21, 2024
8025500
Add debug function for setting error page type.
not-a-rootkit May 21, 2024
25d3a32
Fix typo in "extension"
not-a-rootkit May 21, 2024
ea7fcc6
Remove unused `startUpdateTasks` function
not-a-rootkit May 21, 2024
64699d1
Split SSL/PhishingErrorPageHTMLTemplate
not-a-rootkit May 21, 2024
3042d8b
loadDataAsync upon init instead of in AppDelegate.
not-a-rootkit May 22, 2024
a0de84d
Move PhishingDetectionManager to BSK
not-a-rootkit May 22, 2024
4872123
Add integration for isPhishing in PrivacyDashboard
not-a-rootkit May 23, 2024
d444027
Implement a PhishingDetectionState on tab object instead of cache
not-a-rootkit May 24, 2024
fee2852
Add integration tests for phishing error page.
not-a-rootkit May 30, 2024
f58a357
Move phishingState update to decidePolicy for PrivacyDashboard
not-a-rootkit May 30, 2024
371d5fe
Remove logs.
not-a-rootkit May 30, 2024
e1cae28
Avoid checking DuckDuckGo + duck:// for phishing.
not-a-rootkit May 30, 2024
402830a
Update header and data type for exemptionsList
not-a-rootkit May 30, 2024
252b9c2
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit Jun 10, 2024
4c10950
Move starting dataset from BSK to client.
not-a-rootkit Jun 12, 2024
70f0149
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit Jun 12, 2024
95f5cb8
Move starter dataset to client-side loading
not-a-rootkit Jun 13, 2024
5dc9795
Add loadData to AppDelegate
not-a-rootkit Jun 20, 2024
5c100b7
Pass PhishingDetecting into TabExtensions and ErrorPage
not-a-rootkit Jun 20, 2024
e66484c
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit Jun 24, 2024
ac2daa8
Add Settings Toggle for Phishing Protection (#2900)
not-a-rootkit Jun 28, 2024
34e8e74
Update error handling so tab.error is set when phishing is detected.
not-a-rootkit Jul 2, 2024
15ac7cc
Add phishing detection error.detected case to error page handling
not-a-rootkit Jul 2, 2024
c9ac440
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit Jul 3, 2024
0d34187
Update + add tests for redirect to error page
not-a-rootkit Jul 4, 2024
c580a86
Add HMAC for unwanted redirects to error page
not-a-rootkit Jul 4, 2024
9c4db74
Remove need for custom initializer for FrameInfo in tests.
not-a-rootkit Jul 4, 2024
9ea104a
Move PhishingRedirectTokenManager to URLTokenValidator
not-a-rootkit Jul 4, 2024
46381b0
Update and cleanup copy + error page HTML
not-a-rootkit Jul 4, 2024
afa4d53
Add URLTokenValidator Tests
not-a-rootkit Jul 4, 2024
d58dba6
Ensure isShieldDotVisible is updated depending on phishing state.
not-a-rootkit Jul 9, 2024
13cae06
Fix update script revision replacement.
not-a-rootkit Jul 9, 2024
5c1bc58
Add feature flagging for phishing detection enabled.
not-a-rootkit Jul 17, 2024
3bef913
Update embedded datasets
not-a-rootkit Jul 17, 2024
b8a24ef
Add feature toggle for phishingDetectionPreferences.
not-a-rootkit Jul 17, 2024
2d68627
Fire pixel for visitSite
not-a-rootkit Jul 17, 2024
6acae3e
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit Jul 23, 2024
fe23eba
Remove unneeded prints.
not-a-rootkit Jul 23, 2024
6772a69
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit Jul 23, 2024
3391fe2
Use isFeature(_ enabledForDomain) in phishing detection.
not-a-rootkit Jul 23, 2024
03064b5
Point to BSK branch for ship review build.
not-a-rootkit Jul 23, 2024
1ba0343
Replace URL exemptions list with domain exemptions list to avoid repe…
not-a-rootkit Jul 23, 2024
72bd673
Pass in URL to error page as base64UrlEncoded string
not-a-rootkit Jul 24, 2024
a544462
Add navigations that follow a "visit site" click to the exemptions list
not-a-rootkit Jul 24, 2024
9428685
Update server-side navigation condition to allow link clicks.
not-a-rootkit Jul 25, 2024
ce80d4d
Add tests for DuckURLScheme handler for error pages.
not-a-rootkit Jul 25, 2024
41d1ab5
Open help pages in new tab.
not-a-rootkit Jul 30, 2024
de8bcc3
Replace privacy dashboard with exclamation mark
not-a-rootkit Jul 30, 2024
5f820b4
Add mouseOverTint to exclamation dashboard icon and move Exclamation …
not-a-rootkit Jul 30, 2024
0b7c930
Add handling for iframe page loads - redirect the parent
not-a-rootkit Jul 30, 2024
65784f4
Clean up iframe handling
not-a-rootkit Aug 1, 2024
e102f0d
Update privacyDashboardEntryPointButton to red exclamation
not-a-rootkit Aug 2, 2024
497253f
Move PhishingDetection Settings Section
not-a-rootkit Aug 5, 2024
15ca27f
Update SpecialErrorPageUserScript to match new messaging format
not-a-rootkit Aug 6, 2024
ed2537d
Handle error page resources loading remotely
not-a-rootkit Aug 6, 2024
70fae30
Fire pixel when malicious iframe is detected
not-a-rootkit Aug 7, 2024
f852646
Remove load time data from error page template
not-a-rootkit Aug 13, 2024
894c9b1
Update protocol usage for phishing detection data store
not-a-rootkit Aug 13, 2024
8945c04
Don't add to history if showing phishing error page.
not-a-rootkit Aug 13, 2024
ccb8474
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit Aug 23, 2024
4cbe24f
Add event mapping to phishingdetection
not-a-rootkit Aug 27, 2024
be60e49
Merge branch 'main' into tespach/phishing-error-page
not-a-rootkit Aug 27, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
193 changes: 169 additions & 24 deletions DuckDuckGo.xcodeproj/project.pbxproj

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
@@ -1,12 +1,176 @@
{
"pins" : [
{
"identity" : "apple-toolbox",
"kind" : "remoteSourceControl",
"location" : "https://github.com/duckduckgo/apple-toolbox.git",
"state" : {
"revision" : "0c13c5f056805f2d403618ccc3bfb833c303c68d",
"version" : "3.1.2"
"object": {
"pins": [
{
"package": "AppleToolbox",
"repositoryURL": "https://github.com/duckduckgo/apple-toolbox.git",
"state": {
"branch": null,
"revision": "0c13c5f056805f2d403618ccc3bfb833c303c68d",
"version": "3.1.2"
}
},
{
"package": "BareBonesBrowserKit",
"repositoryURL": "https://github.com/duckduckgo/BareBonesBrowser.git",
"state": {
"branch": null,
"revision": "31e5bfedc3c2ca005640c4bf2b6959d69b0e18b9",
"version": "0.1.0"
}
},
{
"package": "BloomFilter",
"repositoryURL": "https://github.com/duckduckgo/bloom_cpp.git",
"state": {
"branch": null,
"revision": "8076199456290b61b4544bf2f4caf296759906a0",
"version": "3.0.0"
}
},
{
"package": "Autofill",
"repositoryURL": "https://github.com/duckduckgo/duckduckgo-autofill.git",
"state": {
"branch": null,
"revision": "9fea1c6762db726328b14bb9ebfd6508849eae28",
"version": "12.1.0"
}
},
{
"package": "GRDB",
"repositoryURL": "https://github.com/duckduckgo/GRDB.swift.git",
"state": {
"branch": null,
"revision": "4225b85c9a0c50544e413a1ea1e502c802b44b35",
"version": "2.4.0"
}
},
{
"package": "Gzip",
"repositoryURL": "https://github.com/1024jp/GzipSwift.git",
"state": {
"branch": null,
"revision": "731037f6cc2be2ec01562f6597c1d0aa3fe6fd05",
"version": "6.0.1"
}
},
{
"package": "Lottie",
"repositoryURL": "https://github.com/airbnb/lottie-spm",
"state": {
"branch": null,
"revision": "1d29eccc24cc8b75bff9f6804155112c0ffc9605",
"version": "4.4.3"
}
},
{
"package": "OHHTTPStubs",
"repositoryURL": "https://github.com/AliSoftware/OHHTTPStubs.git",
"state": {
"branch": null,
"revision": "12f19662426d0434d6c330c6974d53e2eb10ecd9",
"version": "9.1.0"
}
},
{
"package": "OpenSSL",
"repositoryURL": "https://github.com/duckduckgo/OpenSSL-XCFramework",
"state": {
"branch": null,
"revision": "b75ab2c0405860bb2616db71b9a456acb118c21a",
"version": "3.1.4000"
}
},
{
"package": "PrivacyDashboardResources",
"repositoryURL": "https://github.com/duckduckgo/privacy-dashboard",
"state": {
"branch": null,
"revision": "36dc07cba4bc1e7e0c1d1fb679c3cd077694a072",
"version": "5.0.0"
}
},
{
"package": "Punycode",
"repositoryURL": "https://github.com/gumob/PunycodeSwift.git",
"state": {
"branch": null,
"revision": "4356ec54e073741449640d3d50a1fd24fd1e1b8b",
"version": "2.1.0"
}
},
{
"package": "Sparkle",
"repositoryURL": "https://github.com/sparkle-project/Sparkle.git",
"state": {
"branch": null,
"revision": "b456fd404954a9e13f55aa0c88cd5a40b8399638",
"version": "2.6.3"
}
},
{
"package": "swift-argument-parser",
"repositoryURL": "https://github.com/apple/swift-argument-parser.git",
"state": {
"branch": null,
"revision": "0fbc8848e389af3bb55c182bc19ca9d5dc2f255b",
"version": "1.4.0"
}
},
{
"package": "swift-snapshot-testing",
"repositoryURL": "https://github.com/pointfreeco/swift-snapshot-testing",
"state": {
"branch": null,
"revision": "5b0c434778f2c1a4c9b5ebdb8682b28e84dd69bd",
"version": "1.15.4"
}
},
{
"package": "swift-syntax",
"repositoryURL": "https://github.com/apple/swift-syntax",
"state": {
"branch": null,
"revision": "64889f0c732f210a935a0ad7cda38f77f876262d",
"version": "509.1.1"
}
},
{
"package": "Swifter",
"repositoryURL": "https://github.com/httpswift/swifter.git",
"state": {
"branch": null,
"revision": "9483a5d459b45c3ffd059f7b55f9638e268632fd",
"version": "1.5.0"
}
},
{
"package": "DDGSyncCrypto",
"repositoryURL": "https://github.com/duckduckgo/sync_crypto",
"state": {
"branch": null,
"revision": "2ab6ab6f0f96b259c14c2de3fc948935fc16ac78",
"version": "0.2.0"
}
},
{
"package": "TrackerRadarKit",
"repositoryURL": "https://github.com/duckduckgo/TrackerRadarKit",
"state": {
"branch": null,
"revision": "1403e17eeeb8493b92fb9d11eb8c846bb9776581",
"version": "2.1.2"
}
},
{
"package": "WireGuardKit",
"repositoryURL": "https://github.com/duckduckgo/wireguard-apple",
"state": {
"branch": null,
"revision": "13fd026384b1af11048451061cc1b21434990668",
"version": "1.1.3"
}
}
},
{
Expand Down
38 changes: 38 additions & 0 deletions DuckDuckGo/Assets.xcassets/Colors/AlertRed.colorset/Contents.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
{
"colors" : [
{
"color" : {
"color-space" : "display-p3",
"components" : {
"alpha" : "1.000",
"blue" : "0.215",
"green" : "0.197",
"red" : "0.846"
}
},
"idiom" : "universal"
},
{
"appearances" : [
{
"appearance" : "luminosity",
"value" : "dark"
}
],
"color" : {
"color-space" : "display-p3",
"components" : {
"alpha" : "1.000",
"blue" : "0.375",
"green" : "0.380",
"red" : "0.924"
}
},
"idiom" : "universal"
}
],
"info" : {
"author" : "xcode",
"version" : 1
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
{
"colors" : [
{
"color" : {
"color-space" : "display-p3",
"components" : {
"alpha" : "1.000",
"blue" : "0.190",
"green" : "0.172",
"red" : "0.743"
}
},
"idiom" : "universal"
},
{
"appearances" : [
{
"appearance" : "luminosity",
"value" : "dark"
}
],
"color" : {
"color-space" : "display-p3",
"components" : {
"alpha" : "1.000",
"blue" : "0.327",
"green" : "0.330",
"red" : "0.810"
}
},
"idiom" : "universal"
}
],
"info" : {
"author" : "xcode",
"version" : 1
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
{
"colors" : [
{
"color" : {
"color-space" : "display-p3",
"components" : {
"alpha" : "1.000",
"blue" : "0.178",
"green" : "0.161",
"red" : "0.696"
}
},
"idiom" : "universal"
},
{
"appearances" : [
{
"appearance" : "luminosity",
"value" : "dark"
}
],
"color" : {
"color-space" : "display-p3",
"components" : {
"alpha" : "1.000",
"blue" : "0.307",
"green" : "0.307",
"red" : "0.759"
}
},
"idiom" : "universal"
}
],
"info" : {
"author" : "xcode",
"version" : 1
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
{
"images" : [
{
"filename" : "Exclamation-FIlled-Recolorable-16.pdf",
"idiom" : "universal"
}
],
"info" : {
"author" : "xcode",
"version" : 1
},
"properties" : {
"preserves-vector-representation" : true,
"template-rendering-intent" : "template"
}
}
Binary file not shown.
17 changes: 17 additions & 0 deletions DuckDuckGo/Common/Localizables/UserText.swift
Original file line number Diff line number Diff line change
Expand Up @@ -262,6 +262,19 @@ struct UserText {
return String(format: localized, domain)
}

// MARK: Phishing Error Page
static let phishingErrorPageHeader = NSLocalizedString("phishing.error.page.header", value: "Warning: This site puts your personal information at risk", comment: "Title shown in an error page that warn users of security risks on a website due to Phishing issues")
static let phishingErrorPageTabTitle = NSLocalizedString("phishing.error.page.tab.title", value: "Warning: Deceptive Site Ahead", comment: "Title shown in an error page tab that warn users of security risks on a website due to Phishing issues")
static let phishingErrorPageBody = NSLocalizedString("phishing.error.page.body",
value: "This website may be impersonating a legitimate site in order to trick you into providing personal information, such as passwords or credit card numbers. <a href=\"https://duckduckgo.com/duckduckgo-help-pages/privacy/phishing-and-malware-protection/\" target=\"_blank\">Learn more</a>",
comment: "Error description shown in an error page that warns users of security risks on a website due to Phishing issues.")
static let phishingErrorPageAdvancedButton = NSLocalizedString("phishing.error.page.advanced.button", value: "Advanced…", comment: "Button shown in an error page that warns users of security risks on a website due to Phishing issues. The buttons allows the user to see advanced options on click.")
static let phishingErrorPageLeaveSiteButton = NSLocalizedString("phishing.error.page.leave.site.button", value: "Leave This Site", comment: "Button shown in an error page that warns users of security risks on a website due to Phishing issues. The buttons allows the user to leave the website and navigate to previous page.")
static let phishingErrorPageVisitSiteButton = NSLocalizedString("phishing.error.page.visit.site.button", value: "Accept Risk and Visit Site", comment: "Button shown in an error page that warns users of security risks on a website due to Phishing issues. The buttons allows the user to visit the website anyway despite the risks.")
static let phishingErrorAdvancedInfoTitle = NSLocalizedString("phishing.error.page.advanced.info.title", value: "DuckDuckGo warns you when a website has been flagged as malicious.", comment: "Title of the Advanced info section shown in an error page that warns users of security risks on a website due to Phishing issues.")
static let phishingErrorAdvancedInfoBodyPhishing = NSLocalizedString("phishing.error.page.advanced.info.body.credential.phishing", value: "Warnings are shown for websites that have been reported to be deceptive. Deceptive websites try to trick you into believing they are legitimate websites you trust. If you understand the risks involved, you can continue anyway.", comment: "Body of the text of the Advanced info shown in an error page that warns users of security risks on a website due to Phishing issues.")
static let phishingErrorPageReadMore = NSLocalizedString("phishing.error.page.read.more", value: "See our <a href=\"https://duckduckgo.com/duckduckgo-help-pages/privacy/phishing-and-malware-protection/\" target=\"_blank\">Phishing and Malware Protection help page</a> for more information.", comment: "A call-to-action to read more on our help pages for phishing and malware protection.")



static let openSystemPreferences = NSLocalizedString("open.preferences", value: "Open System Preferences", comment: "Open System Preferences (to re-enable permission for the App) (up to and including macOS 12")
Expand Down Expand Up @@ -432,6 +445,10 @@ struct UserText {

static let downloadsOpenPopupOnCompletion = NSLocalizedString("downloads.open.on.completion", value: "Automatically open the Downloads panel when downloads complete", comment: "Checkbox to open a Download Manager popover when downloads are completed")

static let phishingDetectionHeader = NSLocalizedString("phishing-detection.enabled.header", value: "Malicious Site Protection", comment: "Header for phishing site protection section in the settings page")
static let phishingDetectionIsEnabled = NSLocalizedString("phishing-detection.enabled.checkbox", value: "Allow DuckDuckGo to warn you before loading a webpage that has been flagged as malicious or fraudulent.", comment: "Checkbox that enables or disables the phishing detection feature in the browser")
static let phishingDetectionEnabledWarning = NSLocalizedString("phishing-detection.enabled.warning", value: "Disabling this feature can put your personal information at risk. Only do so if you fully understand the risk involved.", comment: "A description box to warn users away from disabling phishing protection")

// MARK: Password Manager
static let passwordManagementAllItems = NSLocalizedString("passsword.management.all-items", value: "All Items", comment: "Used as title for the Autofill All Items option")
static let passwordManagementLogins = NSLocalizedString("passsword.management.logins", value: "Passwords", comment: "Used as title for the Autofill Logins option")
Expand Down
Loading
Loading