Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Phishing Detection Feature #981

Merged
merged 21 commits into from
Sep 10, 2024
Merged

Conversation

not-a-rootkit
Copy link
Collaborator

@not-a-rootkit not-a-rootkit commented Sep 10, 2024

Please review the release process for BrowserServicesKit here.

Required:

Task/Issue URL: https://app.asana.com/0/1204023833050360/1207976613228509/f
iOS PR: duckduckgo/iOS#3336
macOS PR: duckduckgo/macos-browser#3206
What kind of version bump will this require?: Major

Optional:

Tech Design URL: https://app.asana.com/0/481882893211075/1207156899292810/f
CC: https://app.asana.com/0/481882893211075/1207220724600204/f

Description:
Implement Phishing Detection library to facilitate end-to-end phishing detection feature. Including:

  1. Background data updates
  2. API client for updating data
  3. Embedded datasets
  4. Detection logic
  5. Event firing

Steps to test this PR:

  1. Build on macOS
  2. Ensure signed in via use-login.duckduckgo.com (only available internally)
  3. Quit the app
  4. Visit https://privacy-test-pages.site/security/badware/phishing.html
  5. Ensure error page is thrown
  6. Click advanced
  7. Click "Accept Risk"
  8. Ensure page loads
  9. Play around with navigations (back/forward, etc.)
  10. Disable the feature in Settings>General
  11. Try edge-case test pages:

The last two failing test cases are to be addressed in follow-up work. Currently this feature is hidden behind a feature-flag for internal-only builds.

OS Testing:

  • iOS 14
  • iOS 15
  • iOS 16
  • macOS 10.15
  • macOS 11
  • macOS 12

Internal references:

Software Engineering Expectations
Technical Design Template

not-a-rootkit and others added 20 commits August 8, 2024 10:09
<!--
Note: This checklist is a reminder of our shared engineering
expectations.
-->

Please review the release process for BrowserServicesKit
[here](https://app.asana.com/0/1200194497630846/1200837094583426).

**Required**:

Task/Issue URL:
https://app.asana.com/0/1204023833050360/1207976613228504/f
iOS PR: -
macOS PR: -
What kind of version bump will this require?: Major/Minor/Patch

**Description**:
Introduces data related classes for the phishing detection feature,
specifically:
1. Embedded data set provider
2. Background activity scheduler
3. Data types and data store 

Note: dataUpdater and API client is implemented in a separate PR. 

<!--
Tagging instructions
If this PR isn't ready to be merged for whatever reason it should be
marked with the `DO NOT MERGE` label (particularly if it's a draft)
If it's pending Product Review/PFR, please add the `Pending Product
Review` label.

If at any point it isn't actively being worked on/ready for
review/otherwise moving forward (besides the above PR/PFR exception)
strongly consider closing it (or not opening it in the first place). If
you decide not to close it, make sure it's labelled to make it clear the
PRs state and comment with more information.
-->

**Steps to test this PR**:
1. Run BackgroundActivityScheduler tests 

<!--
Before submitting a PR, please ensure you have tested the combinations
you expect the reviewer to test, then delete configurations you *know*
do not need explicit testing.

Using a simulator where a physical device is unavailable is acceptable.
-->

**OS Testing**:

* [ ] iOS 14
* [ ] iOS 15
* [ ] iOS 16
* [ ] macOS 10.15
* [ ] macOS 11
* [ ] macOS 12

---
###### Internal references:
[Software Engineering
Expectations](https://app.asana.com/0/59792373528535/199064865822552)
[Technical Design
Template](https://app.asana.com/0/59792373528535/184709971311943)

---------

Co-authored-by: Sabrina Tardio <[email protected]>
<!--
Note: This checklist is a reminder of our shared engineering
expectations.
-->

Please review the release process for BrowserServicesKit
[here](https://app.asana.com/0/1200194497630846/1200837094583426).

**Required**:

Task/Issue URL:
https://app.asana.com/0/1204023833050360/1207976613228506/f
iOS PR: -
macOS PR: -
What kind of version bump will this require?: Major/Minor/Patch

**Description**:
Implements the service wrapper for phishing detection, including the
backend API client, and data update manager.
1. PhishingDetectionUpdateManager - uses the client and data store to
implement the data update logic
2. PhishingDetectionClient - makes web requests to the backend service
3. PhishingDetector - exposes isMalicious to client app

<!--
Tagging instructions
If this PR isn't ready to be merged for whatever reason it should be
marked with the `DO NOT MERGE` label (particularly if it's a draft)
If it's pending Product Review/PFR, please add the `Pending Product
Review` label.

If at any point it isn't actively being worked on/ready for
review/otherwise moving forward (besides the above PR/PFR exception)
strongly consider closing it (or not opening it in the first place). If
you decide not to close it, make sure it's labelled to make it clear the
PRs state and comment with more information.
-->

**Steps to test this PR**:
1. 

<!--
Before submitting a PR, please ensure you have tested the combinations
you expect the reviewer to test, then delete configurations you *know*
do not need explicit testing.

Using a simulator where a physical device is unavailable is acceptable.
-->

**OS Testing**:

* [ ] iOS 14
* [ ] iOS 15
* [ ] iOS 16
* [ ] macOS 10.15
* [ ] macOS 11
* [ ] macOS 12

---
###### Internal references:
[Software Engineering
Expectations](https://app.asana.com/0/59792373528535/199064865822552)
[Technical Design
Template](https://app.asana.com/0/59792373528535/184709971311943)
<!--
Note: This checklist is a reminder of our shared engineering
expectations.
-->

Please review the release process for BrowserServicesKit
[here](https://app.asana.com/0/1200194497630846/1200837094583426).

**Required**:

Task/Issue URL: https://app.asana.com/0/0/1207976613228512/f
iOS PR: -
macOS PR: -
What kind of version bump will this require?: Minor

**Description**:
Functions for PrivacyInfo and PrivacyDashboard
- Enable the isPhishing flag to trigger the phishing detected view on
the privacy dashboard.
- When isPhishing is set, it should raise the phishing detected view on
the privacy dashboard.
- Add custom case where subfeatures are enabled only for internal users
(currently it would return disabled for internal)


<!--
Tagging instructions
If this PR isn't ready to be merged for whatever reason it should be
marked with the `DO NOT MERGE` label (particularly if it's a draft)
If it's pending Product Review/PFR, please add the `Pending Product
Review` label.

If at any point it isn't actively being worked on/ready for
review/otherwise moving forward (besides the above PR/PFR exception)
strongly consider closing it (or not opening it in the first place). If
you decide not to close it, make sure it's labelled to make it clear the
PRs state and comment with more information.
-->

**Steps to test this PR**:
1.

<!--
Before submitting a PR, please ensure you have tested the combinations
you expect the reviewer to test, then delete configurations you *know*
do not need explicit testing.

Using a simulator where a physical device is unavailable is acceptable.
-->

**OS Testing**:

* [ ] iOS 14
* [ ] iOS 15
* [ ] iOS 16
* [ ] macOS 10.15
* [ ] macOS 11
* [ ] macOS 12

---
###### Internal references:
[Software Engineering
Expectations](https://app.asana.com/0/59792373528535/199064865822552)
[Technical Design
Template](https://app.asana.com/0/59792373528535/184709971311943)

---------

Co-authored-by: Sabrina Tardio <[email protected]>
<!--
Note: This checklist is a reminder of our shared engineering
expectations.
-->

Please review the release process for BrowserServicesKit
[here](https://app.asana.com/0/1200194497630846/1200837094583426).

**Required**:

Task/Issue URL:
https://app.asana.com/0/1204023833050360/1207976613228507/f
iOS PR: -
macOS PR: -
What kind of version bump will this require?: Major/Minor/Patch

**Description**:
Implements phishing detection pixels as per [✓ Map out pixels and create
privacy triage: 0.5
days](https://app.asana.com/0/1204023833050360/1207699541075655/f) and
[✓ Privacy Triage: Phishing Detection Pixels on
macOS](https://app.asana.com/0/69071770703008/1207738252568650/f)

<!--
Tagging instructions
If this PR isn't ready to be merged for whatever reason it should be
marked with the `DO NOT MERGE` label (particularly if it's a draft)
If it's pending Product Review/PFR, please add the `Pending Product
Review` label.

If at any point it isn't actively being worked on/ready for
review/otherwise moving forward (besides the above PR/PFR exception)
strongly consider closing it (or not opening it in the first place). If
you decide not to close it, make sure it's labelled to make it clear the
PRs state and comment with more information.
-->

**Steps to test this PR**:
1. None :/ 

<!--
Before submitting a PR, please ensure you have tested the combinations
you expect the reviewer to test, then delete configurations you *know*
do not need explicit testing.

Using a simulator where a physical device is unavailable is acceptable.
-->

**OS Testing**:

* [ ] iOS 14
* [ ] iOS 15
* [ ] iOS 16
* [ ] macOS 10.15
* [ ] macOS 11
* [ ] macOS 12

---
###### Internal references:
[Software Engineering
Expectations](https://app.asana.com/0/59792373528535/199064865822552)
[Technical Design
Template](https://app.asana.com/0/59792373528535/184709971311943)
Copy link
Contributor

@SabrinaTardio SabrinaTardio left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@not-a-rootkit not-a-rootkit merged commit 3dc2650 into main Sep 10, 2024
7 checks passed
@not-a-rootkit not-a-rootkit deleted the tespach/phishing-detection-feature branch September 10, 2024 10:07
samsymons added a commit that referenced this pull request Sep 13, 2024
* main:
  Revert "C.S.S Patch Privacy Config on C.S.S for "internal" support in… (#995)
  C.S.S Patch Privacy Config on C.S.S for "internal" support in DuckPlayer  (#994)
  return urls on burn domains (#992)
  Update survey builder OS version (#984)
  Add feature flag for SKAN API (#993)
  [DuckPlayer] Add feature flag and update C.S.S (#983)
  Update Onboarding gradients (#985)
  Fix WKDownload cancellation under Xcode 16 (#986)
  Add shouldCheckServerTrust flag (#982)
  Promote password import in autofill menu (#976)
  Add Phishing Detection Feature (#981)
  Revert "Add Phishing Detection Package" (#980)
  Add Phishing Detection Package (#935)
  Update VPN user agent (#971)
  New feature flag for autofillSurveys (#974)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants