release(runway): cherry-pick feat: path based blocking #36824
Merged
+1,034
−61
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![runway-github[bot]](https://avatars.githubusercontent.com/in/86225?s=80&v=4){kind=small}
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
metamaskbot
added
the
team-runway-bot-deprecated
✨ Files requiring CODEOWNER review ✨🔑 @MetaMask/accounts-engineers (1 files, +1 -0)
🧩 @MetaMask/extension-devs (4 files, +8 -0)
📜 @MetaMask/policy-reviewers (4 files, +8 -0)
Tip Follow the policy review process outlined in the LavaMoat Policy Review Process doc before expecting an approval from Policy Reviewers. 🔗 @MetaMask/supply-chain (4 files, +8 -0)
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
…ask/metamask-extension into cherry-pick-13-4-3-8bdd1e1
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Results generated automatically by MetaMask CI |
Builds ready [ecbd824]
UI Startup Metrics (1258 ± 73 ms)
|
…ask/metamask-extension into cherry-pick-13-4-3-8bdd1e1
…ask/metamask-extension into cherry-pick-13-4-3-8bdd1e1
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Results generated automatically by MetaMask CI |
Builds ready [5b54350]
UI Startup Metrics (1239 ± 72 ms)
|
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Results generated automatically by MetaMask CI |
Builds ready [cc97556]
UI Startup Metrics (1253 ± 86 ms)
|
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Results generated automatically by MetaMask CI |
Builds ready [d5da20f]
UI Startup Metrics (1215 ± 69 ms)
|
📊 Page Load Benchmark ResultsCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Results generated automatically by MetaMask CI |
Builds ready [5b70d32]
UI Startup Metrics (1235 ± 75 ms)
|
| }, | ||
| "@metamask/base-controller": { | ||
| "globals": { | ||
| "console.error": true, |
There was a problem hiding this comment.
Note to facilitate future stable-sync PR creation: All lavamoat file updates come from the upgrade of "@metamask/base-controller" from v8.3.0 to v8.4.0 in this PR, which is included in release 13.5.0.
| ); | ||
| assert.equal( | ||
| METAMASK_HOTLIST_DIFF_URL, | ||
| 'https://phishing-detection.api.cx.metamask.io/v1/diffsSince', |
There was a problem hiding this comment.
Note to facilitate future stable-sync PR creation: Some changes in this e2e test file have been omitted here on purpose (while there were on the original PR) because important refactoring has taken place in e2e test files on main which makes it too difficult to import the changes here.
Instead, we'll rely on manual testing for the phishing detection e2e test cases on this release branch.
Then we'll need to ensure that these changes don't get merged back to main.
gauthierpetetin
approved these changes
Oct 14, 2025
metamaskbot
added
the
release-13.4.3
|
No release label on PR. Adding release label release-13.4.3 on PR, as PR was cherry-picked in branch 13.4.3. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Introduces URL path based blocking within the extension. This allows
websites like
example.com/pathto be blocked rather than blocking allof
example.com.Changelog
CHANGELOG entry: Added path-based blocking for URLs
Related issues
Fixes:
Manual testing steps
sites.google.com/view/aoooop/aave-comand make sure that ityou are redirected to the Phishing Warning Page
sites.google.com/view/aoooop/and make sure that it does notredirect you.
sites.google.com/view/aoooop/aave-com/pathand make sure thatyou are redirected to the Phishing Warning Page.
sites.google.com/view/aoooop/aave-comshould also nolonger redirect to the Phishing Warning Page.
sites.google.com/view/aoooop/aave-com/pathshould also nolonger redirect to the Phishing Warning Page (implicit in step 4).
Screenshots/Recordings
Before
After
Pre-merge author checklist
Docs and MetaMask
Extension Coding
Standards.
if applicable
guidelines).
Not required for external contributors.
Pre-merge reviewer checklist
app, test code being changed).
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.
Note
Introduce trie-based path matching for phishing detection, add path whitelisting, migrate hotlist diffs to v2, and update tests/mocks and dependencies.
PathTrie(insert/delete/match, list->trie, deep copy) used to matchhostname+path.PhishingController): newstate.whitelistPaths;test/bypasshonor path matches; parse stalelistblocklistPathsviaconvertListToTrie; hotlist diffs endpoint tov2.PhishingDetector): checkblocklistPathswithmatchedPathPrefix; exposeblockingPath(url).getHostnameAndPathComponents/getPathnameFromUrl;applyDiffssupportsblocklistPathswith trie ops; minor config cleanup.diffsSince v2; metrics masks includewhitelistPaths.whitelistPathsfrom UI state and snapshots.@metamask/phishing-controller(adds new dist files); bump@metamask/phishing-warning; lockfile/attributions updates; LavaMoat policies allowconsole.errorfor base-controller.Written by Cursor Bugbot for commit 5b70d32. This will update automatically on new commits. Configure here.
Co-authored-by: augmentedmode [email protected] 8bdd1e1