[pull] dev from CyberDrain:dev - #51
Merged
Merged
Conversation
Dev to release
Dev to release
Add azurestaticapps.net to typo allow list
Clear protected_domains in detection rules
Update lastUpdated date in detection rules
The domain squatting result handler in scripts/content.js collapsed the block | warn | log action enum into block vs. everything-else. Because only the 'block' case was checked, the 'log' action fell through to the warning branch: it showed the orange warning banner and recorded every telemetry line (protection event, CIPP report, webhook) as 'warned'. The 'log' action was therefore functionally identical to 'warn'. Resolve the effective action as a real three-state value (block | warn | log) and derive a matching telemetry outcome (blocked | warned | logged). Preserve the semantics that warn logs telemetry and shows a banner, while log logs telemetry only and shows nothing to the user. Warn logs, log does not warn. The detector side (getActionForSeverity in domain-squatting-detector.js) already passed 'log' through intact and is unchanged. Fixes: #161
urlPatternToRegex appended a hard end-anchor to any non-wildcard pattern, so an allowlisted host or root URL only matched the bare root URL and never a real navigated deep link. An admin who allowlisted the exact host of a page (including the protocol-qualified form) still saw that page scanned or blocked, because the actual URL carries a path and the trailing anchor rejected it. Relax only the trailing anchoring: normalize a single trailing slash and tolerate an optional trailing path, query, or fragment. The tolerated remainder must begin with /, ?, or # so suffix tricks such as https://host.evil.com/ still do not match an entry for https://host/. Leading protocol and subdomain tolerance is intentionally out of scope, so bare-domain entries still require the documented https://.../ * form. The change is applied to both copies of urlPatternToRegex (scripts/content.js and options/options.js), which must stay in sync. Fixes: #162
…terns The deep-link matching added for the URL allowlist applied its tolerant trailing matcher to every non-wildcard pattern, which turned path-specific entries into prefix matches. For example an entry for https://host/safe also matched https://host/safe/anything, over-broadening a bypass allowlist entry beyond what the admin intended. Gate the tolerant trailing matcher on host or root URL patterns only (no path segment beyond an optional single trailing slash). A pattern that includes an explicit path now stays an exact match. Host and root URL patterns still match deep links, and suffix or prefix tricks such as https://host.evil.com/ still do not match. Applied to both copies of urlPatternToRegex in scripts/content.js and options/options.js, which must stay in sync. Addresses PR review feedback on BezaluLLC#2 (review comments on the urlPatternToRegex suffix handling).
Reflect the three-state detection action shipped in this branch. The log action is now documented as a distinct outcome: the detection is recorded in Activity Logs and sent to reporting and webhooks, but no warning banner and no block are shown to the user. This also corrects the earlier statement that a warning banner is shown regardless of the action setting when page blocking is disabled, which is no longer true for the log action, and updates the inline action comments from 'block or warn' to include 'log'. Refs: #161
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Logan Cook <2997336+MWG-Logan@users.noreply.github.com>
Introduce .github/workflows/validate-pr.yml to run automated PR checks on dev and main. The workflow includes jobs for linting (ESLint if config present), CodeQL security analysis, JSON manifest and config validation, Conventional Commits PR title validation, and verification reminders when key files (config/ or manifest) change. This centralizes PR gating and developer guidance for releases and security checks.
…nt of Check extension
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Brian Simpson <50429915+bmsimp@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Brian Simpson <50429915+bmsimp@users.noreply.github.com>
…main-deployment.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Brian Simpson <50429915+bmsimp@users.noreply.github.com>
…main-deployment.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Brian Simpson <50429915+bmsimp@users.noreply.github.com>
…main-deployment.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Brian Simpson <50429915+bmsimp@users.noreply.github.com>
…une Step 2 - Setup script: mirror the Format-ArrayLiteral change for scalar replacements by adding Format-SingleQuoted and switching all string-valued scalar replacements to single-quoted output. Prevents \$ / backtick interpolation in user-provided URLs and branding fields when generated scripts run. - Docs: add the missing "Step 2: Create the Win32 App in Intune" between packaging and configuration, fixing the 1 -> 3 jump.
Deploy script previously only wrote the toolbar property when $forceToolbarPin = 1. Flipping the setting from 1 to 0 left a stale toolbar_pin=force_pinned / toolbar_state=force_shown on devices, which Detect couldn't reliably catch without causing an infinite redeploy loop. Deploy: always write the toolbar property -- pinned values when =1, default_unpinned / hidden when =0. Matches the CIPP Intune standard. Detect: add ToolbarPinnedValue / ToolbarUnpinnedValue to the $browsers array and always verify the toolbar property against the expected value based on $forceToolbarPin. Addresses Copilot review comment on toolbar pin drift.
Setup: Apply-Replacements now tracks which patterns were found and throws a detailed error listing any missing patterns. Previously a silent miss (e.g., upstream comment reworded) would produce an output script stuck on defaults. Callers now pass -TemplateName so the error identifies which template failed. Detect: convert all remaining bare Test-RegValue calls and bare exit 1 paths to use Test-RegValueWithDetails / Write-DetectionFailure so every failure mode emits a specific reason on stdout. Affects customBranding, genericWebhook, genericWebhook/events (incl. count mismatch and "unexpected events" branches), urlAllowlist (same), and ExtensionSettings. Admins running the script manually now see exactly which check failed. Addresses Copilot review comments on silent replacement failures and missing diagnostic output.
An example of some deployment methods. If more screenshots or more official language is needed I'd be happy to assist in any way I can! Signed-off-by: josh-ricketts-enable <91432846+josh-ricketts-enable@users.noreply.github.com>
Signed-off-by: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Signed-off-by: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Signed-off-by: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Signed-off-by: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
Signed-off-by: Zacgoose <107489668+Zacgoose@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )