Blocking the "www" website with any TLD will block almost every websites with that TLD

[agadiffe]

Hi.

If we block ||www.com^, it will block almost every .com websites (this bug applies with any TLD).

blocked:
https://example.com
https://github.com
https://youtube.com
https://google.com
https://chatgpt.com
https://copilot.microsoft.com
... etc (almost everything)

some very few websites seems to be immune (there are probably other exceptions):
https://brave.com
https://news.ycombinator.com

Didn't find a pattern about why these 2 above websites are not blocked.

The rule works as expected in uBlock Origin.

example of an affected adblock list:
The "multi ultimate" list from @hagezi has ||www.be^ (malware website) in it, and therefore, every .be websites are blocked.

I didn't find any opened issue reporting this problem. Neither here or on brave/brave-browser.

[R0h1tAnand]

Hi.

If we block ||www.com^, it will block almost every .com websites (this bug applies with any TLD).

blocked: https://example.com https://github.com https://youtube.com https://google.com https://chatgpt.com https://copilot.microsoft.com ... etc (almost everything)

some very few websites seems to be immune (there are probably other exceptions): https://brave.com https://news.ycombinator.com

Didn't find a pattern about why these 2 above websites are not blocked.

The rule works as expected in uBlock Origin.

example of an affected adblock list: The "multi ultimate" list from @hagezi has ||www.be^ (malware website) in it, and therefore, every .be websites are blocked.

I didn't find any opened issue reporting this problem. Neither here or on brave/brave-browser.

I've identified and fixed this bug. The root cause was in line 757 of src/filters/network.rs where www. was being unconditionally stripped from hostname anchor filters, causing ||www.com^ to be parsed as ||com^, which then matched all .com domains as a suffix.

The fix implements smart www-stripping that:

• Preserves www. when it's the actual domain (e.g., ||www.com^ → hostname stays "www.com")
• Strips www. when it's just a subdomain prefix (e.g., ||www.youjizz.com^ → hostname becomes "youjizz.com")

All tests pass and the fix correctly handles both cases. Pull request: #584

---

Note to Maintainers

This fix addresses a critical bug where hostname anchor filters with TLD-only domains (like ||www.com^, ||www.be^) were incorrectly blocking all websites with that TLD due to overly aggressive www-stripping during filter parsing.

Review Focus Areas:

• The smart www-stripping logic in src/filters/network.rs (lines ~755-775)
• Serialization hash update is intentional due to changed filter parsing
• All 212 existing tests pass, including hostname matching edge cases

Backwards Compatibility:

• Filter lists using ||www.[tld]^ patterns will now work correctly instead of over-blocking
• Existing ||www.example.com^ filters continue to work as before (www. is still stripped when it's a subdomain)

Happy to make any adjustments based on your feedback!

[atuchin-m]

@antonok-edm Do we actually need the special logic for www.? www.domain.com is a different domain.
I've checked https://www.example.com/favicon.ico rule for AdBlock and AdGuard. Both of them apply it only for www.example.com, but not for example.com

cc @boocmp @ShivanKaul

[ShivanKaul]

Do we actually need the special logic for www.?

I have the same question.