Fix custom prefixes unduly assigning trust to external lists

gorhill · gorhill · commit b5f74456a443 · 2025-11-01T13:00:05.000-04:00
Related discussion: uBlockOrigin/uBlock-issues#3843 (comment)
diff --git a/src/js/storage.js b/src/js/storage.js
@@ -433,7 +433,10 @@ onBroadcast(msg => {
                 }
             }).filter(prefix => prefix !== undefined);
     }
+    const match = /^[a-z-]+:\/\/[^/]+\//.exec(assetKey);
+    const assetOrigin = match && match[0];
     for ( const prefix of this.parsedTrustedListPrefixes ) {
+        if ( assetOrigin && prefix.length < assetOrigin.length ) { continue; }
         if ( assetKey.startsWith(prefix) ) { return true; }
     }
     return false;

Original file line number	Diff line number	Diff line change
`@@ -433,7 +433,10 @@ onBroadcast(msg => {`
`433`	`433`	`}`
`434`	`434`	`}).filter(prefix => prefix !== undefined);`
`435`	`435`	`}`
	`436`	`+ const match = /^[a-z-]+:\/\/[^/]+\//.exec(assetKey);`
	`437`	`+ const assetOrigin = match && match[0];`
`436`	`438`	`for ( const prefix of this.parsedTrustedListPrefixes ) {`
	`439`	`+ if ( assetOrigin && prefix.length < assetOrigin.length ) { continue; }`
`437`	`440`	`if ( assetKey.startsWith(prefix) ) { return true; }`
`438`	`441`	`}`
`439`	`442`	`return false;`