mirror of
https://github.com/pezkuwichain/phishing.git
synced 2026-10-20 18:56:29 +00:00
SatoshiQaziMuhammed
767a92904d
* feat: sync the lists with polkadot-js/phishing daily, and check them before publishing The lists had not moved since January 2026, the site that serves them was copied by hand, and the rebrand had turned five real phishing domains into pezkuwichain.* names, unblocking them. - scripts/syncUpstream.mjs and sync-upstream.yml take upstream's lists every day, lay pezkuwi/overlay.json over them, and commit to master. A day out of bounds (too many sites unblocked or added, scam addresses dropped, one of our domains blocked, one of our entries lost) writes nothing and opens an issue. - pezkuwi/overlay.json holds our own entries with their reasons: the five pezkuwichain.* names stay blocked on purpose, and our domains are protected. - scripts/lists.mjs holds the rules; scripts/lists.test.mjs tests them and the sync end to end; scripts/checkLists.mjs checks the committed files, including that they are what sortAll writes. lists.yml runs all three. - pezkuwi/host/ is what phishing.pezkuwichain.io runs: it pulls master hourly and refuses a rewritten history, a blocked own domain, a shrink over 2%, or shards that disagree, with a sandbox test of each refusal. - sortAll strips a trailing dot. Upstream's 817 "scam.xyz." entries were filed under an empty top-level domain in all/all.json, where checkIfDenied never looks; 816 repeated a listed name, and prenads.xyz was blocked nowhere else. - sortAll uses Node's own directory functions instead of @pezkuwi/dev, so the sync and the checks run without installing the build toolchain. - The auto-approve, auto-merge and crosscheck workflows, and the IPFS job, depended on tokens and secrets this repository does not have; removed. The remaining workflows are pinned to commits, with no default permissions and a timeout on every job. * chore(lists): first sync with polkadot-js/phishing Written by scripts/syncUpstream.mjs from upstream bf5e7c6: 658 sites added; nodelinkapp.xyz, org.in and terra-claim.com unblocked by upstream; the five polkadot-js domains the rebrand had renamed blocked again; 816 duplicate "scam.xyz." entries folded into their names and the stray all/all.json gone. 54,051 blocked sites, 279 scam addresses. * fix(lists): commit the .build shard, and refuse a shard git ignores .gitignore held "build/", which also matched all/build/all.json, the shard of the .build top-level domain. Every sort wrote it and no commit held it, so the eight .build scam sites were never published; upstream has the same gap. The directory is excluded from the ignore rule, the shard is committed, and checkLists.mjs now fails on any shard git would ignore (with the old rule restored it does). Also clears the repository's lint on lists.test.mjs: imports sorted, and node:test's describe and it calls marked void. * test(lists): await describe and it, as the repository's lint requires no-floating-promises requires the promises node:test's describe and it return to be handled, and no-void forbids handling them with void. Awaited, the 25 cases run as before.
97 lines
3.6 KiB
JavaScript
97 lines
3.6 KiB
JavaScript
// Copyright 2020-2026 @pezkuwi/phishing authors & contributors
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
// node scripts/syncUpstream.mjs <upstream git ref>
|
|
//
|
|
// Brings the lists to polkadot-js/phishing at the ref given (the caller fetches it), lays our own
|
|
// entries over them (pezkuwi/overlay.json), and lets sortAll write every derived file. Then it
|
|
// checks the result and compares it with what was committed before:
|
|
//
|
|
// exit 0 publishable; the working tree holds the lists (unchanged if upstream did not move)
|
|
// exit 2 a check or a limit refused them; commit nothing, a person decides
|
|
//
|
|
// The last line is always one of:
|
|
// SYNC upstream=<sha> changed=<yes|no> deny=+<n>/-<n> addresses=+<n>/-<n>
|
|
// SYNC-REFUSED upstream=<sha> problems=<n>
|
|
|
|
import { execFileSync, spawnSync } from 'node:child_process';
|
|
import fs from 'node:fs';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
import { changes, guard, mergeAll, mergeMeta, problems, readLists, readOverlay, writeJson } from './lists.mjs';
|
|
|
|
const ref = process.argv[2];
|
|
|
|
if (!ref) {
|
|
console.error('usage: node scripts/syncUpstream.mjs <upstream git ref>');
|
|
process.exit(64);
|
|
}
|
|
|
|
/** @param {string[]} args */
|
|
function git (...args) {
|
|
return execFileSync('git', args, { encoding: 'utf8', maxBuffer: 512 * 1024 * 1024 });
|
|
}
|
|
|
|
/** @param {string} file */
|
|
function upstream (file) {
|
|
return git('show', `${ref}:${file}`);
|
|
}
|
|
|
|
const upstreamSha = git('rev-parse', '--verify', `${ref}^{commit}`).trim();
|
|
const before = readLists('.');
|
|
const overlay = readOverlay('.');
|
|
|
|
// Upstream's metadata as it is, with our entries added: the months sortAll reads it from.
|
|
/** @type {{ date: string; url: string }[]} */
|
|
const meta = /** @type {string[]} */ (JSON.parse(upstream('meta/index.json')))
|
|
.flatMap((month) => JSON.parse(upstream(`meta/${month}.json`)));
|
|
/** @type {Record<string, { date: string; url: string }[]>} */
|
|
const months = {};
|
|
|
|
for (const item of mergeMeta(meta, overlay)) {
|
|
(months[item.date.slice(0, 7)] ??= []).push(item);
|
|
}
|
|
|
|
fs.rmSync('meta', { force: true, recursive: true });
|
|
fs.mkdirSync('meta');
|
|
|
|
for (const [month, items] of Object.entries(months)) {
|
|
writeJson(`meta/${month}.json`, items);
|
|
}
|
|
|
|
writeJson('meta/index.json', Object.keys(months).sort((a, b) => b.localeCompare(a)));
|
|
writeJson('all.json', mergeAll(JSON.parse(upstream('all.json')), overlay));
|
|
fs.writeFileSync('address.json', upstream('address.json'));
|
|
fs.writeFileSync('known.json', upstream('known.json'));
|
|
|
|
const sortAll = spawnSync(process.execPath, [fileURLToPath(new URL('./sortAll.mjs', import.meta.url))], { stdio: 'inherit' });
|
|
const after = readLists('.');
|
|
const change = changes(before, after);
|
|
const found = sortAll.status === 0
|
|
? [...problems(after, overlay), ...guard(change)]
|
|
: [`sortAll failed with status ${sortAll.status}`];
|
|
|
|
if (found.length) {
|
|
for (const problem of found) {
|
|
console.error(`FAIL ${problem}`);
|
|
}
|
|
|
|
console.log(`SYNC-REFUSED upstream=${upstreamSha} problems=${found.length}`);
|
|
process.exit(2);
|
|
}
|
|
|
|
const changed = git('status', '--porcelain', '--', 'all.json', 'address.json', 'known.json', 'all', 'meta').trim() !== '';
|
|
|
|
// Recorded only when the lists moved: upstream commits that touch only its package would
|
|
// otherwise rewrite this file every day.
|
|
if (changed) {
|
|
fs.mkdirSync('pezkuwi', { recursive: true });
|
|
writeJson('pezkuwi/upstream.json', { commit: upstreamSha });
|
|
}
|
|
|
|
for (const url of change.removed) {
|
|
console.log(`unblocked: ${url}`);
|
|
}
|
|
|
|
console.log(`SYNC upstream=${upstreamSha} changed=${changed ? 'yes' : 'no'} deny=+${change.added.length}/-${change.removed.length} addresses=+${change.addressesAdded.length}/-${change.addressesRemoved.length}`);
|